Merge upstream v3.56.0 into local/daily-driver

Brings in:
- chore: prepare v3.56.0 release (Zoo-Code-Org#398)
- fix: API requests hang indefinitely on VS Code 1.122.0+ (Zoo-Code-Org#383)
- feat: add Claude Opus 4.8 support across Anthropic, Bedrock, and Vertex (Zoo-Code-Org#386)
- Show Zoo Code in outbound provider activity logs (Zoo-Code-Org#219)

Conflict resolutions and adjustments below.

Anthropic Opus 4.8 (packages/types/src/providers/anthropic.ts)
--------------------------------------------------------------
Kept our effort-array shape from 64fc5fc (supportsReasoningEffort:
[low, medium, high, xhigh, max], default "high", requiredReasoningEffort:
true). Discarded upstream's binary supportsReasoningBudget +
supportsReasoningBinary shape -- the local fork uses effort-based
reasoning across all Anthropic Opus 4.x models (foundation: fd93c5b).

Vertex Opus 4.8 (packages/types/src/providers/vertex.ts)
--------------------------------------------------------
Upstream's verbatim Vertex 4.8 entry would emit a 400 in our codebase:
unlike Bedrock, Vertex has no provider-side adaptive-thinking guard, so
the registry shape alone decides the request payload. With
supportsReasoningBudget: true, our getAnthropicReasoning() would emit
{ thinking: { type: "enabled", budget_tokens } } -- which Opus 4.8
rejects.

Converted Vertex 4.8 to the same effort-array shape as our Anthropic 4.8
so the helper hits the adaptive/effort branch and emits
{ thinking: { type: "adaptive" }, output_config: { effort: "high" } }.

The pre-existing Vertex Opus 4.7 entry still uses the legacy budget
shape (also broken on the API). That's a known follow-up from fd93c5b
and intentionally out of scope for this merge.

Vertex provider (src/api/providers/anthropic-vertex.ts)
-------------------------------------------------------
Dropped upstream's explicit getAnthropicProviderReasoning() call in
getModel() and the associated import. Our getModelParams({format:
"anthropic"}) already returns params.reasoning via the unified
getAnthropicReasoning helper (post-fd93c5bde), so the explicit call
would duplicate the wiring and lose user-chosen efforts (upstream's
call site omits reasoningEffort).

Bedrock (src/api/providers/bedrock.ts, packages/types/src/providers/bedrock.ts)
------------------------------------------------------------------------------
Took upstream verbatim. The Bedrock provider has its own
isAdaptiveThinkingModel guard that overrides the request payload
regardless of registry shape, so the budget-shape registry entries are
fine here.

Tests (src/api/providers/__tests__/anthropic.spec.ts)
-----------------------------------------------------
Rewrote four upstream-added Opus 4.8 tests that asserted the
budget/binary shape to mirror our existing 4.7 effort-shape tests:
- "should use adaptive thinking ..." -> assert output_config.effort: "high"
- "should omit thinking when reasoning disabled" -> replaced with
  "should always emit adaptive thinking (reasoning is required)"
- "should preserve custom maxTokens" -> replaced with
  "should honor user-chosen effort" (matching our 4.7 pattern)
- "should handle Claude Opus 4.8 model correctly" -> assert
  supportsReasoningEffort array, default "high", requiredReasoningEffort

Verification
------------
- pnpm -w check-types: 11/11 packages clean
- pnpm -w test: 22 failures, all pre-existing in reasoning.spec.ts and
  model-params.spec.ts (matches MEMORY baseline from fd93c5b fixture
  drift). Zero new failures.

Author: Zeph Gillen

.changeset/terminate-process-on-cancel.md

@@ -53,29 +53,20 @@ mode: code
     - Order the list from most important to least important.
     - Include every PR in the release window. Count the PRs and cross-reference the list before continuing.
 
-7. If an image generation tool is available, create a release image at `releases/[version]-release.png`.
-
-    - The image should relate to the main release highlight and fit the existing release-image style.
-    - Add the generated image to `.changeset/v[version].md` before the list of changes:
-
-        ```md
-        ![X.Y.Z Release - Description](/releases/X.Y.Z-release.png)
-        ```
-
-8. For a major or minor release:
+7. For a major or minor release:
 
     - Ask the user what three areas should be highlighted.
     - Update relevant announcement files and documentation, including `webview-ui/src/components/chat/Announcement.tsx`, `README.md`, and the `latestAnnouncementId` in `src/core/webview/ClineProvider.ts`.
     - Ask the user to confirm the English announcement before proceeding.
     - Arrange translation updates for all supported locales affected by README, announcement, or package localization changes.
 
-9. Create the release branch:
+8. Create the release branch:
 
     ```bash
     git checkout -b release/v[version]
     ```
 
-10. Generate the final release state on that branch:
+9. Generate the final release state on that branch:
 
     ```bash
     pnpm changeset:version
@@ -84,23 +75,23 @@ mode: code
     - This should update `src/package.json`, `CHANGELOG.md`, and `src/CHANGELOG.md`, then consume the `.changeset` file.
     - Review the generated version and changelog before opening the PR.
 
-11. Open a single release PR with the fully generated release state.
+10. Open a single release PR with the fully generated release state.
 
     ```bash
     git add CHANGELOG.md src/CHANGELOG.md src/package.json README.md locales/*/README.md src/package.nls*.json
     # If generated or updated:
-    git add releases/[version]-release.png webview-ui/src/components/chat/Announcement.tsx src/core/webview/ClineProvider.ts
+    git add webview-ui/src/components/chat/Announcement.tsx src/core/webview/ClineProvider.ts
     git commit -m "chore: prepare v[version] release"
     git push origin release/v[version]
-    gh pr create --title "Release v[version]" --body "Release preparation for v[version]. This PR includes the final version bump, changelog updates, Marketplace README updates, and any release assets or announcement changes." --base main --head release/v[version]
+    gh pr create --title "Release v[version]" --body "Release preparation for v[version]. This PR includes the final version bump, changelog updates, Marketplace README updates, and any announcement changes." --base main --head release/v[version]
     ```
 
     - There is no separate version-bump PR in this flow.
     - The release PR should already contain the final version number and generated changelog updates.
     - If the release includes translated README or package-localization updates, include those files in the same PR.
     - Let the release validation workflow and normal PR checks run before merge.
 
-12. After the release PR is merged, stop for a release review on the resulting `main` commit.
+11. After the release PR is merged, stop for a release review on the resulting `main` commit.
 
     ```bash
     git switch main
@@ -115,7 +106,7 @@ mode: code
     - Share that review summary, including `REVIEWED_SHA`, with the user and wait for explicit confirmation before creating the tag.
     - Do not create the tag or trigger publishing until the user says to proceed.
 
-13. Only after explicit confirmation, create the release tag on that reviewed `main` commit:
+12. Only after explicit confirmation, create the release tag on that reviewed `main` commit:
 
     ```bash
     git tag v[version] "$REVIEWED_SHA"
@@ -124,7 +115,7 @@ mode: code
 
     - If `main` advances after the review pause, keep using the pinned `REVIEWED_SHA` for the tag instead of silently tagging a newer commit.
 
-14. The stable publish workflow runs from the `v[version]` tag.
+13. The stable publish workflow runs from the `v[version]` tag.
 
     - Do not create the tag before the release PR is merged.
     - The publish workflow validates that the tag version matches `src/package.json`.

.changeset/vertex-credentials-field-validation.md

@@ -1,5 +1,37 @@
 # Zoo Code Changelog
 
+## 3.56.0
+
+### Minor Changes
+
+- Add Claude Opus 4.8 support across Anthropic, Bedrock, and Vertex providers (PR #386 by @vandre-sales)
+- Add Opencode Go as a first-class provider (#172 by @vijay-0001, PR #319 by @proyectoauraorg)
+- Add glm-5.1, kimi-k2.6, and deepseek-v4-pro models to the Fireworks provider (#198 by @DeCodeTheWeb, PR #231 by @proyectoauraorg)
+- Show Zoo Code identity in outbound provider activity logs (#203 by @yfdyh000, PR #219 by @app/roomote)
+- Fix API requests hanging indefinitely on VS Code 1.122.0+ (#381 by @greatgradz-svg, #382 by @abcxlab, PR #383 by @app/roomote)
+- Fix terminal task cancellation so the running process is terminated when a task is cancelled (#245 by @proyectoauraorg, PR #261 by @proyectoauraorg)
+- Fix terminal Ctrl+C retry so processes that need multiple SIGINT signals are properly stopped (#266 by @edelauna, PR #272 by @proyectoauraorg)
+- Fix Gemini provider to honor custom model IDs instead of falling back to the default (#227 by @notoccupy2023-design, PR #317 by @proyectoauraorg)
+- Fix truncated Grok diffs caused by missing diff markers (#186 by @jcalfee, PR #230 by @proyectoauraorg)
+- Fix PowerShell detection on Windows when no shell profile is configured (#82 by @rossdonald, PR #239 by @proyectoauraorg)
+- Fix Vertex AI warning when the Google Cloud Credentials field receives a file path instead of JSON (PR #294 by @0xMink)
+- Rename Zoo Code in VS Code code actions (#328 by @rrewll, PR #329 by @rrewll)
+- Localize VS Code code action commands (#334 by @edelauna, PR #339 by @rrewll)
+- Migrate webview build to Vite 8 (PR #214 by @maxdewald)
+- Add comprehensive unit tests for AskFollowupQuestionTool and ListFilesTool (#206 by @app/roomote, PR #212, #213 by @proyectoauraorg)
+- Update `diff` to v5.2.2 for a security fix (PR #173 by @app/renovate)
+- Update `i18next-http-backend` to v3.0.5 for a security fix (PR #174 by @app/renovate)
+- Update `fast-xml-parser` to v5.7.0 for a security fix (PR #179 by @app/renovate)
+- Update `simple-git` to v3.36.0 for a security fix (PR #182 by @app/renovate)
+- Update `uuid` and pin esbuild/rollup/vite for a security fix (PR #205 by @app/renovate)
+- Update `turbo` to v2.9.14 for a security fix (PR #236 by @app/renovate)
+
+## 3.55.1
+
+### Patch Changes
+
+- Fix API requests hanging indefinitely on VS Code 1.122.0+ when Zoo Code could not find the bundled ripgrep binary after the `@vscode/ripgrep-universal` rename (#381 by @greatgradz-svg, PR #248 by @0xMink).
+
 All notable changes to Zoo Code will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and Zoo Code uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

.roo/commands/release.md

@@ -53,18 +53,17 @@
 You can find a quick guide for migrating from Roo Code to Zoo Code in the [Roo→Zoo migration guide](https://docs.zoocode.dev/roo-to-zoo-migration). We plan to try and help users as they transition over, we have our [Reddit](https://www.reddit.com/r/ZooCode) and [Discord](https://discord.gg/VxfP4Vx3gX)
 for this exact support, so if you are having problems or if you have question, jump on and ask.
 
-## What's New in v3.55.0
-
-**Zoo Code's first feature release** builds on the marketplace handoff with a
-new provider, the upstream sunset merge, and a round of user-facing fixes
-across chat, provider settings, and rendering.
-
-- Add Xiaomi MiMo as a first-class API provider
-- Pull in the upstream Roo Code sunset merge and related platform updates
-- Fix MCP sign-in copy, Gemini full-tool requests, and OpenAI temperature
-  handling for unsupported models
-- Fix Markdown single-tilde rendering and diagnostics temp-file naming
-- Improve provider defaults and region coverage for Z.AI, GLM, and Vertex AI
+## What's New in v3.56.0
+
+- **Claude Opus 4.8** support across Anthropic, Bedrock, and Vertex providers
+- **Opencode Go** added as a new first-class API provider
+- **Reliable task cancellation** — cancelling a task now terminates the running process, with automatic Ctrl+C retry for stubborn processes
+- Fix Gemini custom model IDs being ignored and falling back to the default
+- Fix truncated Grok diffs caused by missing diff markers
+- Fix PowerShell detection on Windows when no shell profile is configured
+- Fix VS Code code actions still showing Roo Code branding; localized into all supported languages
+- Fix Vertex AI warning when the Google Cloud Credentials field receives a file path
+- Six security dependency updates (diff, i18next-http-backend, fast-xml-parser, simple-git, uuid, turbo)
 
 <details>
   <summary>🌐 Available languages</summary>

CHANGELOG.md

@@ -0,0 +1,18 @@
+{
+	"fixtures": [
+		{
+			"match": {
+				"userMessage": "bedrock-identity-smoke"
+			},
+			"response": {
+				"toolCalls": [
+					{
+						"name": "attempt_completion",
+						"arguments": "{\"result\":\"4\"}",
+						"id": "call_bedrock_identity_001"
+					}
+				]
+			}
+		}
+	]
+}

README.md

@@ -0,0 +1,18 @@
+{
+	"fixtures": [
+		{
+			"match": {
+				"userMessage": "openrouter-identity-smoke"
+			},
+			"response": {
+				"toolCalls": [
+					{
+						"name": "attempt_completion",
+						"arguments": "{\"result\":\"4\"}",
+						"id": "call_openrouter_identity_001"
+					}
+				]
+			}
+		}
+	]
+}

apps/vscode-e2e/fixtures/bedrock.json

@@ -0,0 +1,152 @@
+import * as http2 from "http2"
+import * as net from "net"
+import { crc32 } from "zlib"
+
+export interface BedrockMockServer {
+	url: string
+	/** Headers from the most recent converse-stream request (populated after first call). */
+	lastRequestHeaders: http2.IncomingHttpHeaders | undefined
+	close(): Promise<void>
+}
+
+// AWS binary event stream encoder — matches the real Bedrock wire format.
+// Derived from the live converse-stream capture:
+//   { contentBlockDelta: { contentBlockIndex: 0, delta: { toolUse: { input: "..." } } } }
+// aimock's builder nests the payload one level too deep (contentBlockDelta inside contentBlockDelta),
+// causing the AWS SDK deserializer's take() to miss the delta field entirely.
+function encodeHeaders(headers: Record<string, string>): Buffer {
+	const parts: Buffer[] = []
+	for (const [name, value] of Object.entries(headers)) {
+		const nameBytes = Buffer.from(name, "utf8")
+		const valueBytes = Buffer.from(value, "utf8")
+		const buf = Buffer.alloc(1 + nameBytes.length + 1 + 2 + valueBytes.length)
+		let off = 0
+		buf.writeUInt8(nameBytes.length, off)
+		off += 1
+		nameBytes.copy(buf, off)
+		off += nameBytes.length
+		buf.writeUInt8(7, off)
+		off += 1 // type 7 = string
+		buf.writeUInt16BE(valueBytes.length, off)
+		off += 2
+		valueBytes.copy(buf, off)
+		parts.push(buf)
+	}
+	return Buffer.concat(parts)
+}
+
+function encodeFrame(eventType: string, payload: object): Buffer {
+	const hdrs = encodeHeaders({
+		":content-type": "application/json",
+		":event-type": eventType,
+		":message-type": "event",
+	})
+	const body = Buffer.from(JSON.stringify(payload), "utf8")
+	const total = 12 + hdrs.length + body.length + 4
+	const frame = Buffer.alloc(total)
+	let off = 0
+	frame.writeUInt32BE(total, off)
+	off += 4
+	frame.writeUInt32BE(hdrs.length, off)
+	off += 4
+	frame.writeUInt32BE(crc32(frame.subarray(0, 8)) >>> 0, off)
+	off += 4
+	hdrs.copy(frame, off)
+	off += hdrs.length
+	body.copy(frame, off)
+	off += body.length
+	frame.writeUInt32BE(crc32(frame.subarray(0, total - 4)) >>> 0, off)
+	return frame
+}
+
+function buildToolCallFrames(toolName: string, toolUseId: string, argsJson: string): Buffer[] {
+	const frames: Buffer[] = []
+	frames.push(encodeFrame("messageStart", { role: "assistant" }))
+	frames.push(
+		encodeFrame("contentBlockStart", {
+			contentBlockIndex: 0,
+			start: { toolUse: { name: toolName, toolUseId } },
+		}),
+	)
+	const CHUNK = 20
+	for (let i = 0; i < argsJson.length; i += CHUNK) {
+		frames.push(
+			encodeFrame("contentBlockDelta", {
+				contentBlockIndex: 0,
+				delta: { toolUse: { input: argsJson.slice(i, i + CHUNK) } },
+			}),
+		)
+	}
+	frames.push(encodeFrame("contentBlockStop", { contentBlockIndex: 0 }))
+	frames.push(encodeFrame("messageStop", { stopReason: "tool_use" }))
+	frames.push(
+		encodeFrame("metadata", {
+			metrics: { latencyMs: 1 },
+			usage: { inputTokens: 100, outputTokens: 10, totalTokens: 110, serverToolUsage: {} },
+		}),
+	)
+	return frames
+}
+
+export async function startBedrockMockServer(): Promise<BedrockMockServer> {
+	// HTTP/2 cleartext (h2c) — matches what @aws-sdk/client-bedrock-runtime uses by default.
+	const server = http2.createServer()
+	let lastRequestHeaders: http2.IncomingHttpHeaders | undefined
+	const sessions = new Set<http2.ServerHttp2Session>()
+
+	server.on("session", (session) => {
+		sessions.add(session)
+		session.on("close", () => sessions.delete(session))
+	})
+
+	server.on("stream", (stream, headers) => {
+		const path = headers[":path"] as string
+		const method = headers[":method"] as string
+
+		if (!path?.includes("converse-stream") || method !== "POST") {
+			stream.respond({ ":status": 404 })
+			stream.end(JSON.stringify({ error: { message: "Not found", type: "not_found" } }))
+			return
+		}
+
+		lastRequestHeaders = headers
+
+		// Drain the request body before responding (AWS SDK sends the full request before reading).
+		stream.resume()
+		stream.on("end", () => {
+			stream.respond({
+				":status": 200,
+				"content-type": "application/vnd.amazon.eventstream",
+			})
+			const frames = buildToolCallFrames(
+				"attempt_completion",
+				"tooluse_bedrock_mock_001",
+				JSON.stringify({ result: "4" }),
+			)
+			for (const frame of frames) {
+				stream.write(frame)
+			}
+			stream.end()
+		})
+	})
+
+	await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve))
+	const addr = server.address() as net.AddressInfo
+	const url = `http://127.0.0.1:${addr.port}`
+
+	return {
+		url,
+		get lastRequestHeaders() {
+			return lastRequestHeaders
+		},
+		close: () => {
+			// Destroy all open HTTP/2 sessions first so server.close() resolves immediately
+			// instead of waiting for the extension's retry loop to exhaust itself.
+			for (const session of sessions) {
+				session.destroy()
+			}
+			sessions.clear()
+			return new Promise<void>((resolve, reject) => server.close((err) => (err ? reject(err) : resolve())))
+		},
+	}
+}

apps/vscode-e2e/fixtures/openrouter.json

@@ -26,12 +26,21 @@ function isDeepSeekTargetedRun(testFile?: string, testGrep?: string) {
 	return testGrep?.toLowerCase().includes("deepseek") ?? false
 }
 
+function isBedrockTargetedRun(testFile?: string, testGrep?: string) {
+	if (testFile?.toLowerCase().includes("bedrock.test")) {
+		return true
+	}
+
+	return testGrep?.toLowerCase().includes("bedrock") ?? false
+}
+
 async function main() {
 	const isRecord = process.env.AIMOCK_RECORD === "true"
 	const testGrep = getCliFlagValue("--grep") || process.env.TEST_GREP
 	const testFile = getCliFlagValue("--file") || process.env.TEST_FILE
 	const isDeepSeekTest = isDeepSeekTargetedRun(testFile, testGrep)
 	const isGeminiTest = testFile?.toLowerCase().includes("gemini.test") ?? false
+	const isBedrockTest = isBedrockTargetedRun(testFile, testGrep)
 
 	if (isRecord && isDeepSeekTest && !process.env.DEEPSEEK_API_KEY) {
 		throw new Error("AIMOCK_RECORD=true requires DEEPSEEK_API_KEY to record DeepSeek fixtures")
@@ -49,7 +58,9 @@ async function main() {
 	// Replay mode starts aimock when no real API key is present or USE_MOCK is forced.
 	const hasRealApiKey = isDeepSeekTest
 		? !!process.env.DEEPSEEK_API_KEY
-		: !!(process.env.OPENROUTER_API_KEY || process.env.ANTHROPIC_API_KEY)
+		: isBedrockTest
+			? true // Bedrock test starts its own binary-event-stream mock server when no real token
+			: !!(process.env.OPENROUTER_API_KEY || process.env.ANTHROPIC_API_KEY)
 	const useMock = isRecord || !hasRealApiKey || process.env.USE_MOCK === "true"
 
 	let mock: InstanceType<typeof LLMock> | undefined