Merge branch 'main' into renovate/npm-modelcontextprotocol-sdk-vulnerability

Author: edelauna

.github/workflows/marketplace-publish.yml

@@ -9,6 +9,7 @@ on:
 jobs:
   publish-stable:
     runs-on: ubuntu-latest
+    environment: marketplace-production
     permissions:
       contents: write
 
@@ -29,6 +30,13 @@ jobs:
           test "$package_name" = "zoo-code"
           test "$publisher" = "ZooCodeOrganization"
 
+      - name: Validate publish ref
+        run: |
+          if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ] && [ "$GITHUB_REF_NAME" != "main" ]; then
+            echo "Manual stable publishes must run from main, not ${GITHUB_REF_NAME}."
+            exit 1
+          fi
+
       - name: Validate release tag
         if: github.event_name == 'push'
         run: |

.github/workflows/nightly-publish.yml

@@ -15,6 +15,7 @@ concurrency:
 jobs:
   publish-prerelease:
     runs-on: ubuntu-latest
+    environment: marketplace-prerelease
 
     steps:
       - name: Checkout code
@@ -33,6 +34,13 @@ jobs:
           test "$package_name" = "zoo-code"
           test "$publisher" = "ZooCodeOrganization"
 
+      - name: Validate publish ref
+        run: |
+          if [ "$GITHUB_REF_NAME" != "main" ]; then
+            echo "Pre-release publishes must run from main, not ${GITHUB_REF_NAME}."
+            exit 1
+          fi
+
       - name: Set pre-release version
         id: version
         env:

.roo/commands/release.md

@@ -58,7 +58,8 @@ mode: code
     - Ask the user what three areas should be highlighted.
     - Update relevant announcement files and documentation, including `webview-ui/src/components/chat/Announcement.tsx`, `README.md`, and the `latestAnnouncementId` in `src/core/webview/ClineProvider.ts`.
     - Ask the user to confirm the English announcement before proceeding.
-    - Arrange translation updates for all supported locales affected by README, announcement, or package localization changes.
+    - Arrange translation updates for all supported locales affected by README, announcement, or package localization changes. Use the `/roo-translate` skill to propagate the updated `chat.json` announcement highlight keys and the "What's New" section to all supported locales.
+    - All 17 locale READMEs should contain a translated "What's New" section. Check each one and add a translated section where missing.
 
 8. Create the release branch:
 

CHANGELOG.md

@@ -1,5 +1,31 @@
 # Zoo Code Changelog
 
+## 3.58.0
+
+### Minor Changes
+
+- Add Zoo Gateway provider with auth callback and multi-profile token sync (PR #344 by @JamesRobert20, PR #345 by @JamesRobert20, PR #347 by @JamesRobert20)
+- Add Gemini 3.5 Flash support (PR #331 by @jeanbispo)
+- Add Semble as a local on-the-fly embedding provider for code indexing (PR #399 by @navedmerchant)
+- Remove extension-side LLM telemetry; server logs only through gateway (PR #346 by @JamesRobert20)
+- Add VS Code integrated terminal shell override (PR #277 by @proyectoauraorg)
+- Add configurable chat font size (#157 by @duvw, PR #276 by @proyectoauraorg)
+- Render GitHub-style alerts in the webview (#258 by @melck, PR #275 by @proyectoauraorg)
+- Add configurable max output tokens for GLM models (#161 by @app/roomote, PR #274 by @proyectoauraorg)
+- Introduce WorkspacePathResolver for async symlink-aware path canonicalization (#389 by @edelauna, PR #428 by @proyectoauraorg)
+- Better secure release workflows and GitHub Actions (PR #482 by @edelauna)
+- Fix React crash from malformed follow-up suggestion mode (PR #414 by @edelauna)
+- Fix OpenAI temperature omitted when no custom value is set (#242 by @brunocasado, PR #247 by @proyectoauraorg)
+- Handle per-key failures during settings import (PR #401 by @taltas)
+- Add comprehensive test coverage for ReadFileTool (PR #222 by @proyectoauraorg)
+- Unskip VS Code e2e replay for subtasks (PR #94 by @app/roomote)
+- Fix e2e cache: replace paths filter with content-hash cache skip (PR #268 by @app/roomote)
+- Remove deprecated requestRooCreditBalance handler (PR #385 by @JamesRobert20)
+- Update mermaid to v11.15.0 for a security fix (PR #235 by @app/renovate)
+- Update axios to v1.16.0 for a security fix (PR #400 by @app/renovate)
+- Pin dependencies (PR #353 by @app/renovate)
+- Remove unused tmp dependency and other unused packages (PR #341 by @app/renovate)
+
 ## 3.56.0
 
 ### Minor Changes

PRIVACY.md

@@ -40,13 +40,6 @@ go—and, importantly, where they don't.
   We retain telemetry only as long as needed for product analytics and debugging.
   Telemetry does **not** collect your code or AI prompts, and you can opt out at
   any time through the settings.
-- **Zoo Code Observability (Authenticated Subscribers Only):** If you sign in to
-  Zoo Code and have an active subscription, Zoo Code will send LLM usage
-  telemetry to the Zoo Code backend (zoocode.dev). This includes task ID, AI
-  provider name, model name, token counts (input/output/cache), and estimated
-  cost. This data is linked to your authenticated Zoo Code account. You can stop
-  this collection at any time by signing out via the Zoo Code badge in the chat
-  area.
 - **Marketplace Requests**: When you browse or search the Marketplace for Model
   Configuration Profiles (MCPs) or Custom Modes, Zoo Code makes a secure API
   call to Zoo Code's backend servers to retrieve listing information. These

README.md

@@ -53,17 +53,19 @@
 You can find a quick guide for migrating from Roo Code to Zoo Code in the [Roo→Zoo migration guide](https://docs.zoocode.dev/roo-to-zoo-migration). We plan to try and help users as they transition over, we have our [Reddit](https://www.reddit.com/r/ZooCode) and [Discord](https://discord.gg/VxfP4Vx3gX)
 for this exact support, so if you are having problems or if you have question, jump on and ask.
 
-## What's New in v3.56.0
-
-- **Claude Opus 4.8** support across Anthropic, Bedrock, and Vertex providers
-- **Opencode Go** added as a new first-class API provider
-- **Reliable task cancellation** — cancelling a task now terminates the running process, with automatic Ctrl+C retry for stubborn processes
-- Fix Gemini custom model IDs being ignored and falling back to the default
-- Fix truncated Grok diffs caused by missing diff markers
-- Fix PowerShell detection on Windows when no shell profile is configured
-- Fix VS Code code actions still showing Roo Code branding; localized into all supported languages
-- Fix Vertex AI warning when the Google Cloud Credentials field receives a file path
-- Six security dependency updates (diff, i18next-http-backend, fast-xml-parser, simple-git, uuid, turbo)
+## What's New in v3.58.0
+
+- **Zoo Gateway** — connect through a managed gateway with multi-profile auth support
+- **Gemini 3.5 Flash** — a fast, capable Google model now available from your provider settings
+- **Semble embedding** — index your codebase locally with on-the-fly embeddings, no external API key required
+- **Configurable chat font size** and **VS Code integrated terminal shell override**
+- **GitHub-style alerts** rendered in the webview
+- **Configurable max output tokens** for GLM models
+- **WorkspacePathResolver** — reliable path handling across symlinked workspaces
+- Fix React crash from malformed follow-up suggestion mode
+- Fix OpenAI temperature being omitted when no custom value is set
+- Handle per-key failures during settings import
+- Security updates: mermaid v11.15.0, axios v1.16.0
 
 <details>
   <summary>🌐 Available languages</summary>
@@ -87,7 +89,7 @@ for this exact support, so if you are having problems or if you have question, j
 - [简体中文](locales/zh-CN/README.md)
 - [繁體中文](locales/zh-TW/README.md)
 - ...
-    </details>
+  </details>
 
 ---
 

apps/cli/package.json

@@ -41,12 +41,12 @@
 	"devDependencies": {
 		"@roo-code/config-eslint": "workspace:^",
 		"@roo-code/config-typescript": "workspace:^",
-		"@types/node": "^24.1.0",
+		"@types/node": "24.2.1",
 		"@types/react": "^19.1.6",
-		"ink-testing-library": "^4.0.0",
-		"rimraf": "^6.0.1",
-		"tsup": "^8.4.0",
-		"@vitest/coverage-v8": "^3.2.3",
-		"vitest": "^3.2.3"
+		"ink-testing-library": "4.0.0",
+		"rimraf": "6.0.1",
+		"tsup": "8.5.0",
+		"@vitest/coverage-v8": "3.2.6",
+		"vitest": "3.2.6"
 	}
 }

apps/vscode-e2e/fixtures/terminal-profile.json

@@ -0,0 +1,32 @@
+{
+	"fixtures": [
+		{
+			"match": {
+				"userMessage": "TERMINAL_PROFILE_E2E_OVERRIDE"
+			},
+			"response": {
+				"toolCalls": [
+					{
+						"name": "execute_command",
+						"arguments": "{\"command\":\"printf 'zoo-profile-override-ok\\\\n' > terminal-profile-e2e/terminal-profile-override.txt\"}",
+						"id": "call_terminal_profile_override_001"
+					}
+				]
+			}
+		},
+		{
+			"match": {
+				"userMessage": "TERMINAL_PROFILE_E2E_DEFAULT"
+			},
+			"response": {
+				"toolCalls": [
+					{
+						"name": "execute_command",
+						"arguments": "{\"command\":\"printf 'zoo-profile-default-ok\\\\n' > terminal-profile-e2e/terminal-profile-default.txt\"}",
+						"id": "call_terminal_profile_default_001"
+					}
+				]
+			}
+		}
+	]
+}

apps/vscode-e2e/package.json

@@ -16,13 +16,13 @@
 		"@roo-code/config-typescript": "workspace:^",
 		"@roo-code/types": "workspace:^",
 		"@copilotkit/aimock": "1.15.1",
-		"@types/mocha": "^10.0.10",
-		"@types/node": "^20.19.25",
-		"@types/vscode": "^1.95.0",
-		"@vscode/test-cli": "^0.0.11",
-		"@vscode/test-electron": "^2.4.0",
-		"glob": "^11.1.0",
-		"mocha": "^11.1.0",
-		"rimraf": "^6.0.1"
+		"@types/mocha": "10.0.10",
+		"@types/node": "20.19.41",
+		"@types/vscode": "1.100.0",
+		"@vscode/test-cli": "0.0.11",
+		"@vscode/test-electron": "2.5.2",
+		"glob": "11.1.0",
+		"mocha": "11.2.2",
+		"rimraf": "6.0.1"
 	}
 }

apps/vscode-e2e/src/fixtures/terminal-profile.ts

@@ -0,0 +1,58 @@
+import { LLMock } from "@copilotkit/aimock"
+
+import { toolResultContains } from "./tool-result"
+
+type TerminalProfileToolCall = {
+	name: "execute_command" | "attempt_completion"
+	params: Record<string, unknown>
+	id: string
+}
+
+type TerminalProfileFixture = {
+	toolCallId: string
+	expected: string[]
+	toolCalls: TerminalProfileToolCall[]
+}
+
+export function addTerminalProfileResultFixtures(mock: InstanceType<typeof LLMock>) {
+	const fixtures: TerminalProfileFixture[] = [
+		{
+			toolCallId: "call_terminal_profile_override_001",
+			expected: ["Exit code: 0"],
+			toolCalls: [
+				{
+					name: "attempt_completion",
+					params: { result: "Ran the command using the Zoo E2E Bash profile override." },
+					id: "call_terminal_profile_override_002",
+				},
+			],
+		},
+		{
+			toolCallId: "call_terminal_profile_default_001",
+			expected: ["Exit code: 0"],
+			toolCalls: [
+				{
+					name: "attempt_completion",
+					params: { result: "Ran the command using the default terminal profile." },
+					id: "call_terminal_profile_default_002",
+				},
+			],
+		},
+	]
+
+	for (const fixture of fixtures) {
+		mock.addFixture({
+			match: {
+				toolCallId: fixture.toolCallId,
+				predicate: (req) => toolResultContains(req, fixture.toolCallId, fixture.expected),
+			},
+			response: {
+				toolCalls: fixture.toolCalls.map((toolCall) => ({
+					name: toolCall.name,
+					arguments: JSON.stringify(toolCall.params),
+					id: toolCall.id,
+				})),
+			},
+		})
+	}
+}