Feature/zoo 691 delegation atomic update

ai_plans/2026-06-27_zoo-225-knip-dead-code.md

@@ -0,0 +1,77 @@
+# Port Zoo PR #225 — configure knip + remove dead dependencies
+
+## §0 Credit & provenance
+
+- Upstream: Zoo-Code-Org/Zoo-Code PR #225, commit `8ea077942`, merged 2026-06-08.
+- Original author: Elliott de Launay (roomote[bot] / renovate[bot] dropped as bots).
+- Commit trailer:
+    ```
+    Co-authored-by: Elliott de Launay <edelauna@gmail.com>
+    ```
+
+## §1 What & why
+
+Upgrade the knip config (schema v5, per-workspace `ignoreDependencies`, rules,
+`ignoreExportsUsedInFile`) and remove dependencies knip flagged as dead.
+
+**Divergence guard (critical):** "dead in Zoo" ≠ "dead in our fork." Every removed
+dependency was independently verified UNUSED in _our_ code before removal (grep
+for imports + a scripts/config audit). The knip `ignoreDependencies` lists were
+checked against our actual dep set (src 16/16, webview 10/11 — we lack `vscode`,
+so it was dropped from our webview list).
+
+## §2 Edits (exact, verified)
+
+### Dead deps removed from `src/package.json` (all verified zero-usage here)
+
+- `@openrouter/ai-sdk-provider` — zero refs repo-wide; our `openrouter.ts` uses
+  `@anthropic-ai/sdk`, not this package.
+- `@vscode/test-electron` — `apps/vscode-e2e` declares its own; src's is unused.
+- `npm-run-all2` — no script uses `run-p`/`run-s`/`npm-run-all`.
+- `tsup` — src builds via esbuild; only `apps/cli` uses tsup (has its own).
+- `tsx` — only `apps/cli` scripts use it (was hoisted from src) → moved to cli.
+- `zod-to-ts` — zero imports.
+
+### `apps/cli/package.json`
+
+- Add `"tsx": "^4.19.3"` (cli scripts `dev`/`test:integration` use it; previously
+  resolved via hoist from src).
+
+### `webview-ui/package.json` + delete `webview-ui/src/types.d.ts`
+
+- Remove `knuth-shuffle-seeded` (only referenced by the now-deleted `types.d.ts`
+  module declaration; no real import) and `identity-obj-proxy` (no config uses it).
+- Delete `webview-ui/src/types.d.ts` (contained only the knuth-shuffle declaration).
+
+### `package.json`
+
+- `"knip": "knip --include files"` → `"knip": "knip"`.
+
+### `knip.json` (adapted to our fork)
+
+- Port Zoo's new structure verbatim where deps match; **dropped** `vscode` from the
+  webview `ignoreDependencies` (we don't declare it); **added** `self-hosted-cloudapi/**`
+  to top-level `ignore` (our fork has that extra Docker/Python sub-project Zoo lacks).
+
+## §3 Scope cuts (YAGNI / divergence)
+
+- Did NOT add `@vitest/coverage-v8` to src or cli (neither runs coverage here; Zoo
+  already had it — we don't, and don't need it).
+- Did NOT re-order posthog-js/lucide-react in webview (cosmetic).
+- Did NOT add `packages/evals` to knip workspaces (faithful to upstream's new config).
+- Did NOT re-add Roo branding / TTS / router / cloud.
+
+## §4 Verify (binary acceptance)
+
+- `pnpm install` succeeds after removals. ✓
+- `pnpm --filter tumble-code check-types` / `@roo-code/vscode-webview` /
+  `@roo-code/cli` → all pass (tsc resolves every import; a removed-but-used dep
+  would error "cannot find module"). ✓
+- `tsx` bin resolves for `apps/cli`. ✓
+- Note: `pnpm knip` cannot complete on this machine — it crashes traversing the
+  root-owned (uid 70, mode 700) `self-hosted-cloudapi/.vol/postgres` Docker volume
+  with EACCES. Confirmed this happens with the OLD config too → pre-existing local
+  environment issue, independent of this change. The knip config itself parses
+  (knip reaches file traversal past config validation).
+
+## §5 Co-author — see §0.

ai_plans/2026-06-27_zoo-324-gemma4-thought-tags.md

@@ -0,0 +1,48 @@
+# Port Zoo PR #324 — parse Gemma 4 `<thought>` reasoning tags alongside `<think>`
+
+## §0 Credit & provenance
+
+- Upstream: Zoo-Code-Org/Zoo-Code PR #324, commit `0084cc899`, merged 2026-06-26.
+- Authors: Sagid M / Sagid Magomedov, Elliott de Launay (edelauna).
+- Commit trailers:
+    ```
+    Co-authored-by: Sagid M <kofon95@mail.ru>
+    Co-authored-by: Sagid Magomedov <sagidsmagomedov@gmail.com>
+    Co-authored-by: Elliott de Launay <edelauna@gmail.com>
+    ```
+
+## §1 What & why (weak-model robustness)
+
+Gemma 4 emits reasoning inside `<thought>…</thought>` rather than `<think>…</think>`.
+This generalizes `TagMatcher` to accept multiple tag names so reasoning extraction
+works for both, without a closing `</thought>` wrongly terminating a `<think>` block.
+Aligns with [[feedback_design_for_weak_models]].
+
+Our `src/utils/tag-matcher.ts` matched Zoo's pre-PR exactly; clean port.
+
+## §2 Edits
+
+- `src/utils/tag-matcher.ts`: constructor accepts `string | [string, ...string[]]`;
+  tracks `tagNames` / `activeTagNames` / `candidates` so any of the names opens a
+  block and only the matching name closes it. (Replaced wholesale with the upstream
+  post-PR version — our file was byte-identical to Zoo's pre-PR.)
+- `base-openai-compatible-provider.ts`, `lm-studio.ts`, `native-ollama.ts`,
+  `openai.ts`: `new TagMatcher("think", …)` → `new TagMatcher(["think", "thought"], …)`.
+- Tests: add `src/utils/__tests__/tag-matcher.spec.ts` (new upstream file, 18 cases);
+  add two `<thought>` integration tests + tighten one flush assertion in
+  `base-openai-compatible-provider.spec.ts`.
+
+## §3 Scope cuts (divergence)
+
+- **Skipped the `openai.spec.ts` +169-line additions** — our `openai.spec.ts` has
+  diverged ~495 lines from Zoo's (timeout work in #567 + other), so the additions
+  don't anchor cleanly. The behavior is already covered by `tag-matcher.spec.ts`
+  (the matcher unit) and the `base-openai-compatible-provider.spec.ts` `<thought>`
+  integration tests (the shared streaming path).
+
+## §4 Verify (binary acceptance) — all ✓
+
+- `pnpm --filter tumble-code check-types` passes.
+- `npx vitest run utils/__tests__/tag-matcher api/providers/__tests__/base-openai-compatible-provider`
+  → 38 pass (incl. the 2 new `<thought>` tests).
+- 4 affected provider suites still green (121 tests).

ai_plans/2026-06-27_zoo-351-mcp-sdk-1-26-0-security.md

@@ -0,0 +1,62 @@
+# Port Zoo PR #351 — update @modelcontextprotocol/sdk to v1.26.0 [security] + MCP resource_link support
+
+## §0 Credit & provenance
+
+- Upstream: Zoo-Code-Org/Zoo-Code PR #351, commit `09fedd62c`, merged 2026-06-06.
+- Original author(s): Elliott de Launay, edelauna (renovate[bot] dropped as a bot).
+- Commit trailers to add:
+    ```
+    Co-authored-by: Elliott de Launay <edelauna@gmail.com>
+    Co-authored-by: edelauna <54631123+edelauna@users.noreply.github.com>
+    ```
+
+## §1 What & why
+
+Two coupled changes:
+
+1. **Security bump** of `@modelcontextprotocol/sdk` `1.12.0 → 1.26.0` in `src/package.json` (+ lockfile).
+2. **MCP `resource_link` content type** (MCP spec 2025-06-18): add the `McpResourceLink`
+   type to `packages/types/src/mcp.ts` and render it in `UseMcpToolTool`.
+
+Our fork is at the exact pre-PR state (sdk 1.12.0; no `McpResourceLink`; no `resource_link`
+branch in `UseMcpToolTool.processToolContent`). MCP code paths exist here (McpHub, UseMcpToolTool),
+so this is in-scope. No Roo/TTS/router/cloud entanglement.
+
+## §2 Edits (exact, adapted to our code)
+
+### 2a. `packages/types/src/mcp.ts` — add types before `McpToolCallResponse`, add to union
+
+Insert the `McpResourceLinkAnnotations` + `McpResourceLink` types and add `| McpResourceLink`
+to the `McpToolCallResponse.content` union. (Keep our existing multi-line union formatting;
+only add the new arm — do NOT reflow the existing arms to one-liners like upstream did; that's
+churn with no behavior change.)
+
+### 2b. `src/core/tools/UseMcpToolTool.ts`
+
+- Add `McpResourceLink` to the type import from `@roo-code/types`.
+- In `processToolContent`'s `.map`, after the `image` branch and before the trailing `return ""`,
+  add a `resource_link` branch rendering a markdown link.
+
+### 2c. `src/package.json`
+
+- `"@modelcontextprotocol/sdk": "1.12.0"` → `"1.26.0"`.
+
+### 2d. Lockfile
+
+- `pnpm install --lockfile-only` (or filtered install) to refresh `pnpm-lock.yaml`.
+
+## §3 Scope cuts (YAGNI)
+
+- Do NOT reflow the existing `McpToolCallResponse` union arms (upstream cosmetic change).
+- Do NOT re-add TTS / router / cloud / Roo branding.
+- No new tests required by upstream; add a focused type/render check only if cheap.
+
+## §4 Verify (binary acceptance)
+
+- `pnpm --filter @roo-code/types check-types` → passes.
+- `cd src && npx tsc --noEmit` (or repo typecheck) → passes; `McpResourceLink` resolves.
+- `grep '@modelcontextprotocol/sdk' src/package.json` shows `1.26.0`.
+- `grep '@modelcontextprotocol/sdk@1.26.0' pnpm-lock.yaml` present; no `@1.12.0` left.
+- Existing MCP tests (`UseMcpToolTool`, `McpHub`) still pass.
+
+## §5 Co-authors — see §0.

ai_plans/2026-06-27_zoo-423-pin-dependencies.md

@@ -0,0 +1,51 @@
+# Port Zoo PR #423 — pin React type dependencies
+
+## §0 Credit & provenance
+
+- Upstream: Zoo-Code-Org/Zoo-Code PR #423, commit `5ad7aab6b`, merged 2026-06-07.
+- Original author: Elliott de Launay (renovate[bot] dropped as a bot).
+- Commit trailer:
+    ```
+    Co-authored-by: Elliott de Launay <edelauna@gmail.com>
+    ```
+
+## §1 What & why
+
+Renovate "pin dependencies" chore: replace caret ranges on `@types/react` /
+`@types/react-dom` with exact versions across the three manifests that declare
+them, and align `apps/cli` (which declared React **19** types while the root
+override forces **18**) to the pinned v18.
+
+Pinning removes silent caret drift (reproducible installs) and fixes the
+declared-vs-resolved React-types mismatch in the CLI. The lockfile already
+resolves `@types/react@18.3.23` and `@types/react-dom@18.3.7`, so resolution is
+unchanged — only the declared ranges tighten.
+
+Our fork is at the exact pre-PR state for these lines.
+
+## §2 Edits (exact)
+
+- `apps/cli/package.json`: `"@types/react": "^19.1.6"` → `"18.3.23"`.
+- `package.json` (pnpm.overrides): `"@types/react": "^18.3.23"` → `"18.3.23"`;
+  `"@types/react-dom": "^18.3.5"` → `"18.3.7"`.
+- `webview-ui/package.json`: `"@types/react": "^18.3.23"` → `"18.3.23"`;
+  `"@types/react-dom": "^18.3.5"` → `"18.3.7"`.
+- Refresh `pnpm-lock.yaml` via `pnpm install --lockfile-only`.
+
+## §3 Scope cuts (YAGNI / divergence)
+
+- Do NOT touch `@types/node`, `glob`, or any other line the PR only showed as
+  diff context — our fork has its own values there (`glob: ">=11.1.0"`,
+  cli `@types/node: "^24.1.0"`). Only the React-type lines change.
+- Do NOT re-add Roo branding / TTS / router / cloud.
+
+## §4 Verify (binary acceptance)
+
+- `grep '@types/react' apps/cli/package.json package.json webview-ui/package.json`
+  shows no caret on the react type lines; cli shows `18.3.23`.
+- `pnpm install --lockfile-only` succeeds; lockfile still resolves
+  `@types/react@18.3.23` and `@types/react-dom@18.3.7`.
+- `pnpm --filter @roo-code/vscode-webview check-types` → passes.
+- `pnpm --filter @roo-code/cli check-types` → passes.
+
+## §5 Co-author — see §0.

ai_plans/2026-06-27_zoo-470-diff-fuzzy-threshold-DEFERRED.md

@@ -0,0 +1,45 @@
+# Zoo PR #470 — configurable diffFuzzyThreshold — DEFERRED (needs dedicated session)
+
+Upstream: Zoo-Code-Org/Zoo-Code PR #470, commit `518bae479`, merged 2026-06-23.
+Author: edelauna (+ coderabbitai bot, dropped). Fixes "Edit Unsuccessful" friction.
+
+## Why deferred (not unsafe, but too large + diverged for an autonomous loop tick)
+
+- **32 files / 588 insertions**: a new opt-in `diffFuzzyThreshold` setting threaded
+  through types → ClineProvider → Task → the multi-search-replace diff strategy,
+  plus a webview slider, SettingsView/ExtensionStateContext wiring, **18 locales**,
+  and **4 test files**.
+- **Plumbing anchors diverge**: Zoo threads the setting next to `rateLimitClock` in
+  `Task` (TaskOptions + constructor) and at ClineProvider Task-creation sites — **our
+  fork has no `rateLimitClock`**, so each of ~10 sites needs individual re-anchoring.
+- The core diff-strategy change itself is **low risk** (our `multi-search-replace.ts`
+  matches Zoo's pre-PR except trivial const→let; the `startLine !== undefined` →
+  `startLine` change is benign with 1-based line numbers).
+
+## Groundwork for the focused session (all diffs already analyzed)
+
+1. `packages/types/src/global-settings.ts`: add `export const DEFAULT_DIFF_FUZZY_THRESHOLD = 1.0`
+   and `diffFuzzyThreshold: z.number().min(0.5).max(1).optional()` to `globalSettingsSchema`.
+   **Skip** Zoo's unrelated import-reorder at the top of that file.
+2. `packages/types/src/vscode-extension-host.ts`: add `diffFuzzyThreshold: number` to `ExtensionState`.
+3. `src/core/diff/strategies/multi-search-replace.ts`: import `DEFAULT_DIFF_FUZZY_THRESHOLD`;
+   constructor clamps `Math.max(0.5, Math.min(1.0, fuzzyThreshold ?? DEFAULT_DIFF_FUZZY_THRESHOLD))`;
+   add Levenshtein-distance / search-length diagnostics to the no-match error; new
+   "Original Content" slice for the range branch.
+4. `src/core/task/Task.ts`: add `diffFuzzyThreshold?: number` to `TaskOptions` and the
+   constructor destructuring (anchor on `initialStatus`, NOT `rateLimitClock`), then
+   `new MultiSearchReplaceDiffStrategy(diffFuzzyThreshold)`.
+5. `src/core/webview/ClineProvider.ts`: destructure `diffFuzzyThreshold` from `getState()`
+   at the two `createTask`/rehydrate sites and pass to `new Task({...})`; add
+   `diffFuzzyThreshold: … ?? DEFAULT_DIFF_FUZZY_THRESHOLD` to getStateToPostToWebview and
+   getState return objects. Re-anchor away from `rateLimitClock` lines.
+6. webview: `ContextManagementSettings.tsx` (Slider 0.5–1.0 step 0.01 under a new
+   `fileEdits.diffFuzzyThreshold` SearchableSetting), `SettingsView.tsx` (destructure +
+   pass prop + include in save payload), `ExtensionStateContext.tsx` (default).
+7. i18n: add `contextManagement.fileEdits.diffFuzzyThreshold.{label,description}` to all
+   18 `settings.json` locales (en text in the PR).
+8. Tests: `multi-search-replace.spec.ts` (+218, diagnostics/clamp), `ClineProvider.spec.ts`
+   (+54, passthrough), `single-open-invariant.spec.ts` (+40), `ContextManagementSettings.spec.tsx`
+   (+21), `SettingsView.spec.tsx` (+38), `ExtensionStateContext.spec.tsx` (+3).
+
+Credit on port: `Co-authored-by: Elliott de Launay <edelauna@gmail.com>`.

ai_plans/2026-06-27_zoo-567-apirequesttimeout-providers.md

@@ -0,0 +1,60 @@
+# Port Zoo PR #567 — apply apiRequestTimeout consistently across providers
+
+## §0 Credit & provenance
+
+- Upstream: Zoo-Code-Org/Zoo-Code PR #567, commit `b747d56ba`, merged 2026-06-19.
+- Authors: dw (Oh Daewoong), Naved Merchant.
+- Commit trailers:
+    ```
+    Co-authored-by: Oh Daewoong <dw.oh@samsung.com>
+    Co-authored-by: Naved  Merchant <naved.merchant@gmail.com>
+    ```
+
+## §1 What & why
+
+Previously only `openai`/`lm-studio` and `BaseOpenAiCompatibleProvider` honored the
+user's `apiRequestTimeout`. This wires it into **every** provider that builds an
+OpenAI or Anthropic SDK client, via a single `timeoutMs` field on `BaseProvider`.
+
+## §2 Edits
+
+- `base-provider.ts`: add `protected readonly timeoutMs: number = getApiRequestTimeout()`.
+- `timeout-config.ts`: refactor — `getApiRequestTimeout()` now returns `number`
+  (never `undefined`), clamps to the valid 1–3600s range (out-of-range/NaN/non-number
+  → 600s default), and `Math.round()`s the ms (avoids Anthropic SDK float-validation throw).
+- `base-openai-compatible-provider.ts` + `openai.ts`: use `this.timeoutMs` instead of
+  calling `getApiRequestTimeout()` directly; drop the now-unused import.
+- Add `timeout: this.timeoutMs` to client construction in: `anthropic`, `minimax`,
+  `anthropic-vertex` (3 sites), `openai-native`, `openai-codex`, `openrouter`,
+  `router-provider` (covers `lite-llm`/`vercel-ai-gateway` via inheritance), `requesty`,
+  `unbound`, `xai`, `qwen-code`.
+- `src/package.json`: `tumble-code.apiRequestTimeout` → `type: integer`, `minimum: 1`.
+- `package.nls*.json` (18 locales): updated description (drops the now-invalid
+  "0 = no timeout", lists unsupported providers).
+
+## §3 Divergence handled
+
+- **Skipped Zoo-only providers** `zoo-gateway` and `opencode-go` — they don't exist here.
+- Kept our `roo-code`-branded request headers (`originator`, X-Unbound-Metadata) — out of
+  scope for this PR; only `timeout` was added.
+- No changeset (our fork doesn't ship Zoo's changeset flow).
+
+## §4 Tests
+
+- Provider tests that mock `vscode` as `{}` (or via a global mock lacking
+  `getConfiguration`) threw once `BaseProvider`'s field initializer started calling
+  `getApiRequestTimeout()` at construction. Fixed by mocking `../utils/timeout-config`
+  to return a constant `600_000` in the 8 affected specs (anthropic-vertex, lite-llm,
+  openrouter, requesty, vercel-ai-gateway, vertex, vertex-credentials, vscode-lm).
+- Added `timeout: 600_000` to the exact-args client-construction assertions in
+  anthropic-vertex, openrouter, requesty (×2), vercel-ai-gateway.
+- `timeout-config.spec.ts`: replaced the obsolete "0/negative → undefined" tests with
+  out-of-range → default, plus min/max boundary and ms-rounding cases.
+
+## §5 Verify (binary acceptance) — all ✓
+
+- `pnpm --filter tumble-code check-types` passes.
+- `npx vitest run api/providers/__tests__ api/providers/utils/__tests__/timeout-config`
+  → 46 files, 904 pass, 1 skipped.
+
+## §6 Co-authors — see §0.

ai_plans/2026-06-27_zoo-599-fireworks-kimi-k2p7-code.md

@@ -0,0 +1,27 @@
+# Port Zoo PR #599 — add Fireworks kimi-k2p7-code model
+
+## §0 Credit & provenance
+
+- Upstream: Zoo-Code-Org/Zoo-Code PR #599, commit `74583b55e`, merged 2026-06-20.
+- Author: Povilas Kanapickas.
+
+## §1 What & why
+
+New model support: Fireworks `kimi-k2p7-code` (Moonshot AI coding model). Pure
+additive change — no divergence concerns; our `fireworks.ts` matches the pre-PR
+structure (type union, model map, neighboring deepseek-v4-pro / glm-5p1 anchors).
+
+## §2 Edits
+
+- `packages/types/src/providers/fireworks.ts`:
+    - add `"accounts/fireworks/models/kimi-k2p7-code"` to the `FireworksModelId` union
+      (after `kimi-k2p6`).
+    - add its entry to `fireworksModels` (maxTokens 16384, ctx 262144, images+cache+
+      reasoning+temperature, in 0.95 / out 4.0 / cacheReads 0.19), inserted after
+      `deepseek-v4-pro`, before `glm-5p1` — matching upstream placement.
+- `src/api/providers/__tests__/fireworks.spec.ts`: add the model-config test.
+
+## §3 Verify (binary acceptance) — all ✓
+
+- `pnpm --filter @roo-code/types check-types` passes.
+- `npx vitest run api/providers/__tests__/fireworks` → 32 pass.