Sync: upstream v3.74.0 (Opus 5 effort-shape, GPT-5.6, canonical-id, Node 22)

.changeset/itchy-moles-thank.md

@@ -0,0 +1,5 @@
+---
+"zoo-code": patch
+---
+
+Fix bedrock DNS resolution when behind corporate proxy

.github/actions/setup-node-pnpm/action.yml

@@ -6,7 +6,7 @@ inputs:
     node-version:
         description: "Node.js version to use"
         required: false
-        default: "20.20.2"
+        default: "22.23.1"
     pnpm-version:
         description: "pnpm version to use"
         required: false

.github/pull_request_template.md

@@ -38,14 +38,35 @@ Detail the steps to test your changes. This helps reviewers verify your work.
 - [ ] **Scope**: My changes are focused on the linked issue (one major feature/fix per PR).
 - [ ] **Self-Review**: I have performed a thorough self-review of my code.
 - [ ] **Testing**: New and/or updated tests have been added to cover my changes (if applicable).
+- [ ] **Visual Snapshot** (UI changes only): If a user would notice this change at a glance (layout, theme tokens, brand elements, empty/error states), I've added or updated a `*.visual.tsx` snapshot in `webview-ui/`. See `webview-ui/AGENTS.md` → "When a UI change needs a snapshot".
 - [ ] **Documentation Impact**: I have considered if my changes require documentation updates (see "Documentation Updates" section below).
 - [ ] **Contribution Guidelines**: I have read and agree to the [Contributor Guidelines](/CONTRIBUTING.md).
 
-### Screenshots / Videos
+### Visual Snapshots
 
 <!--
-For UI changes, please provide before-and-after screenshots or a short video of the *actual results*.
-This greatly helps in understanding the visual impact of your changes.
+For UI changes to static rendered state, the primary artifact is a committed
+Playwright CT snapshot (`*.visual.tsx` in `webview-ui/`) — that baseline
+becomes durable regression coverage for the surface. See
+`webview-ui/AGENTS.md` for what deserves a snapshot.
+
+Before/after screenshots pasted here are welcome as a review aid but are not a
+substitute for the committed baseline. If a snapshot is possible, prefer the
+snapshot.
+-->
+
+### Videos (interaction / animation only)
+
+<!--
+Snapshots cannot capture motion or multi-step flows. Attach a short screen
+recording here when reviewers need to see:
+  - A new interactive flow (dropdown, form, dialog progression)
+  - Animation, transition, or timing behavior
+  - A regression that only manifests during interaction
+
+Videos are a review aid, not regression coverage. If the *result* of the
+interaction has a distinct rendered state worth protecting, still commit a
+`*.visual.tsx` snapshot of that end-state alongside the video.
 -->
 
 ### Documentation Updates

.github/workflows/code-qa.yml

@@ -135,25 +135,32 @@ jobs:
             # lanes for behavioral confidence, but duplicating coverage uploads
             # there mostly adds Codecov overhead without changing pass/fail
             # behavior.
-            # Coverage is uploaded in three separate steps so each LCOV gets the
+            # Coverage is uploaded in separate steps so each LCOV gets the
             # correct flag set. Codecov double-counts overlapping lines when a
             # single upload carries multiple flags whose paths overlap, so the
-            # two core lanes (which both cover packages/core/src/**) must be
-            # uploaded individually with their own lane flag.
+            # core lanes and webview lane must be uploaded individually with
+            # their own flag.
             # See https://docs.codecov.com/docs/flags
             - name: Upload non-core coverage to Codecov
               if: matrix.upload-coverage
               uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
               with:
                   files: >-
                       src/coverage/lcov.info,
-                      webview-ui/coverage/lcov.info,
                       packages/cloud/coverage/lcov.info,
                       packages/telemetry/coverage/lcov.info,
                       apps/cli/coverage/lcov.info
                   disable_search: true
                   flags: ${{ matrix.codecov-flag }}
                   token: ${{ secrets.CODECOV_TOKEN }}
+            - name: Upload webview JSDOM coverage to Codecov
+              if: matrix.upload-coverage
+              uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
+              with:
+                  files: webview-ui/coverage/lcov.info
+                  disable_search: true
+                  flags: webview-ui
+                  token: ${{ secrets.CODECOV_TOKEN }}
             - name: Upload core unit coverage to Codecov
               if: matrix.upload-coverage
               uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
@@ -170,3 +177,17 @@ jobs:
                   disable_search: true
                   flags: ${{ matrix.codecov-flag }},core-integration
                   token: ${{ secrets.CODECOV_TOKEN }}
+            - name: Upload coverage reports to GitHub
+              if: matrix.upload-coverage
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+              with:
+                  name: coverage-reports-${{ matrix.name }}
+                  path: |
+                      src/coverage/lcov.info
+                      webview-ui/coverage/lcov.info
+                      packages/cloud/coverage/lcov.info
+                      packages/telemetry/coverage/lcov.info
+                      apps/cli/coverage/lcov.info
+                      packages/core/coverage/unit/lcov.info
+                      packages/core/coverage/integration/lcov.info
+                  retention-days: 7

.github/workflows/e2e.yml

@@ -45,9 +45,100 @@ jobs:
                   VERSION=$(node -p 'require("./apps/vscode-e2e/package.json").devDependencies["@types/vscode"]')
                   echo "version=$VERSION" >> $GITHUB_OUTPUT
 
-            - name: Cache VS Code test binary
+            - name: Restore VS Code test binary cache
               if: github.event_name != 'pull_request' || steps.e2e-marker.outputs.cache-hit != 'true'
-              uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+              id: vscode-cache
+              uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+              with:
+                  path: |
+                      apps/vscode-e2e/.vscode-test/
+                  key: vscode-test-${{ runner.os }}-${{ steps.vscode-ver.outputs.version }}-v1
+                  # Fall back to the most recent stale binary so a version bump or cache
+                  # eviction doesn't force a download when the VS Code CDN is unreachable.
+                  restore-keys: |
+                      vscode-test-${{ runner.os }}-
+
+            - name: Probe VS Code download endpoints
+              if: (github.event_name != 'pull_request' || steps.e2e-marker.outputs.cache-hit != 'true') && steps.vscode-cache.outputs.cache-hit != 'true'
+              id: vscode-probe
+              # The version-resolution API and the archive CDN are different hosts. The
+              # archive URL 302-redirects to the CDN, so a HEAD probe that follows the
+              # redirect covers both. The fallback engages when either is unreachable.
+              run: |
+                  API_OK=false
+                  CDN_OK=false
+                  if curl -sf --max-time 10 https://update.code.visualstudio.com/api/releases/stable > /dev/null; then
+                      API_OK=true
+                  fi
+                  if curl -sfIL --max-time 20 -o /dev/null "https://update.code.visualstudio.com/${{ steps.vscode-ver.outputs.version }}/linux-x64/stable"; then
+                      CDN_OK=true
+                  fi
+                  if [ "$API_OK" = "true" ] && [ "$CDN_OK" = "true" ]; then
+                      echo "reachable=true" >> "$GITHUB_OUTPUT"
+                  else
+                      echo "reachable=false" >> "$GITHUB_OUTPUT"
+                      echo "::warning::VS Code download endpoints unreachable (api=$API_OK, cdn=$CDN_OK); will try the stale cached binary"
+                  fi
+
+            # @vscode/test-electron only skips its live version-resolution request when the
+            # requested version already exists in .vscode-test/. On an exact-key miss it calls
+            # the update API before its download retry loop, so an unreachable CDN fails the
+            # job before any test runs. When the endpoints are down, point the runner at the
+            # stale binary restored above (runTest.ts honors VSCODE_VERSION) so the suite
+            # still runs.
+            - name: Fall back to stale VS Code binary when CDN is unreachable
+              if: (github.event_name != 'pull_request' || steps.e2e-marker.outputs.cache-hit != 'true') && steps.vscode-cache.outputs.cache-hit != 'true' && steps.vscode-probe.outputs.reachable == 'false'
+              id: vscode-fallback
+              run: |
+                  STALE=$(ls -d apps/vscode-e2e/.vscode-test/vscode-linux-x64-* 2>/dev/null | sort -V | tail -n 1 || true)
+                  if [ -n "$STALE" ]; then
+                      echo "VSCODE_VERSION=${STALE##*-}" >> "$GITHUB_ENV"
+                      echo "used=true" >> "$GITHUB_OUTPUT"
+                      echo "VS Code download endpoints are unreachable; falling back to cached VS Code ${STALE##*-}"
+                  else
+                      echo "::warning::VS Code download endpoints are unreachable and no cached binary is available; the download step will retry but may fail"
+                  fi
+
+            # Retry only the binary download: version resolution and the archive fetch are
+            # the network-fragile parts. Genuine test failures should fail fast, so the
+            # test step itself is deliberately not retried.
+            - name: Download VS Code test binary
+              if: github.event_name != 'pull_request' || steps.e2e-marker.outputs.cache-hit != 'true'
+              id: vscode-download
+              run: |
+                  cd apps/vscode-e2e
+                  for attempt in 1 2 3; do
+                      if node -e "const { downloadAndUnzipVSCode } = require('@vscode/test-electron'); const version = process.env.VSCODE_VERSION || require('./package.json').devDependencies['@types/vscode']; downloadAndUnzipVSCode(version).catch((err) => { console.error(err); process.exit(1); });"; then
+                          exit 0
+                      fi
+                      echo "VS Code download attempt ${attempt} failed"
+                      if [ "$attempt" -lt 3 ]; then
+                          sleep 15
+                      fi
+                  done
+                  exit 1
+
+            # restore-keys can bring back older binaries alongside the one just
+            # downloaded; keep only the effective version so each saved cache entry
+            # stays at one binary instead of growing with every version bump.
+            - name: Prune stale VS Code binaries
+              if: github.event_name != 'pull_request' || steps.e2e-marker.outputs.cache-hit != 'true'
+              run: |
+                  EFFECTIVE="${VSCODE_VERSION:-${{ steps.vscode-ver.outputs.version }}}"
+                  for dir in apps/vscode-e2e/.vscode-test/vscode-linux-x64-*; do
+                      [ -e "$dir" ] || continue
+                      if [ "$(basename "$dir")" != "vscode-linux-x64-$EFFECTIVE" ]; then
+                          echo "Pruning stale VS Code binary $(basename "$dir")"
+                          rm -rf "$dir"
+                      fi
+                  done
+
+            # Skip the save when the stale-binary fallback ran: the pinned-version key
+            # must not be populated with an older binary.
+            - name: Save VS Code test binary cache
+              if: (github.event_name != 'pull_request' || steps.e2e-marker.outputs.cache-hit != 'true') && steps.vscode-cache.outputs.cache-hit != 'true' && steps.vscode-fallback.outputs.used != 'true'
+              continue-on-error: true
+              uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
               with:
                   path: |
                       apps/vscode-e2e/.vscode-test/
@@ -59,12 +150,18 @@ jobs:
               if: github.event_name != 'pull_request' || steps.e2e-marker.outputs.cache-hit != 'true'
               run: xvfb-run -a pnpm --filter @roo-code/vscode-e2e test:ci:mock
 
+            - name: Explain skipped mocked E2E pass marker
+              if: steps.e2e-marker.outputs.cache-hit != 'true' && steps.run-e2e.outcome == 'success' && steps.vscode-fallback.outputs.used == 'true'
+              run: echo "Skipping mocked E2E pass marker because tests ran against a stale cached VS Code binary (VS Code download endpoints unreachable)."
+
             - name: Write mocked E2E pass marker
-              if: steps.e2e-marker.outputs.cache-hit != 'true' && steps.run-e2e.outcome == 'success'
+              # Skip when the stale-binary fallback ran: a pass against an older VS Code
+              # must not mint a marker for the intended-version source hash.
+              if: steps.e2e-marker.outputs.cache-hit != 'true' && steps.run-e2e.outcome == 'success' && steps.vscode-fallback.outputs.used != 'true'
               run: mkdir -p .cache/e2e-pass && date -u > .cache/e2e-pass/passed
 
             - name: Save mocked E2E pass marker
-              if: steps.e2e-marker.outputs.cache-hit != 'true' && steps.run-e2e.outcome == 'success'
+              if: steps.e2e-marker.outputs.cache-hit != 'true' && steps.run-e2e.outcome == 'success' && steps.vscode-fallback.outputs.used != 'true'
               continue-on-error: true
               uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
               with:

.github/workflows/label-pr-review-state.yml

@@ -153,9 +153,28 @@ jobs:
                   }),
                 ]);
 
+                // listForRef returns every check run ever recorded on the ref, including
+                // stale superseded ones (e.g. a failed run later re-run green). Branch
+                // protection and the PR UI only consider the latest run per check name, so
+                // reduce to that before evaluating — otherwise a single stale failure makes
+                // ciFailed true forever and state labels never come back. See issue #884.
+                //
+                // Unlike listReviews (which documents oldest-first order), listForRef's
+                // ordering is unspecified, so we pick the latest by run.id — GitHub assigns
+                // monotonically increasing IDs, and id is never null (a freshly re-queued
+                // run can have started_at: null, which would lose a string comparison
+                // against an older completed run's timestamp).
+                const latestByName = new Map();
+                for (const run of checkRuns) {
+                  const prev = latestByName.get(run.name);
+                  if (!prev || run.id > prev.id) {
+                    latestByName.set(run.name, run);
+                  }
+                }
+
                 // Filter to required checks only (or all checks if rules unavailable).
                 // Always exclude this workflow's own run to avoid self-referential loops.
-                const relevantRuns = checkRuns.filter(run => {
+                const relevantRuns = [...latestByName.values()].filter(run => {
                   if (run.name === 'Reconcile PR review state labels') return false;
                   return requiredCheckNames ? requiredCheckNames.has(run.name) : true;
                 });

.github/workflows/release-reminder.yml

@@ -0,0 +1,68 @@
+name: Post weekly release reminder
+
+# Requires repo secret DISCORD_RELEASE_WEBHOOK_URL — Discord webhook for the
+# release-reminders channel. The reminder job fails (noisily) if it is unset.
+
+on:
+    schedule:
+        # Friday at 09:00 UTC
+        - cron: "0 9 * * 5"
+    workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+    group: release-reminder
+    # A re-run produces an identical message, so cancel a stale/duplicate run
+    # rather than risk posting twice.
+    cancel-in-progress: true
+
+jobs:
+    remind:
+        runs-on: ubuntu-latest
+        steps:
+            - name: Post release reminder to Discord
+              env:
+                  DISCORD_RELEASE_WEBHOOK_URL: ${{ secrets.DISCORD_RELEASE_WEBHOOK_URL }}
+              run: |
+                  set -euo pipefail
+                  owners=("Elliott" "Navad" "Toray")
+                  anchor_date="2026-07-17"
+                  seconds_since_anchor=$(($(date -u +%s) - $(date -u -d "$anchor_date" +%s)))
+                  weeks_since_anchor=$((seconds_since_anchor / 604800))
+                  owner="${owners[$((weeks_since_anchor % ${#owners[@]}))]}"
+
+                  message=$(cat <<EOF
+                  **Weekly release reminder**
+
+                  **${owner}** is on deck for this week's Zoo Code release.
+
+                  1. Create the release branch and prepare the release with \`.roo/commands/release.md\`.
+                  2. Get the release PR approved.
+                  3. Tag the release branch to trigger the Marketplace publish workflow.
+                  4. Approve the deployment when the \`marketplace-production\` environment requests it.
+                  5. After publishing succeeds, add the release PR to the merge queue.
+
+                  Avoid merging or rebasing the release branch before publishing, so the approved tag keeps the intended commit SHA.
+
+                  More detail: https://discord.com/channels/1497384592494297201/1498024845945081999/1512914847124291667
+                  EOF
+                  )
+
+                  payload=$(jq -n --arg content "$message" '{content: $content}')
+                  curl --fail-with-body --silent --show-error \
+                    --header 'Content-Type: application/json' \
+                    --data "$payload" \
+                    "$DISCORD_RELEASE_WEBHOOK_URL"
+
+            - name: Notify on failure
+              if: failure()
+              env:
+                  DISCORD_RELEASE_WEBHOOK_URL: ${{ secrets.DISCORD_RELEASE_WEBHOOK_URL }}
+              run: |
+                  set -euo pipefail
+                  payload=$(jq -nc --arg content "⚠️ release-reminder workflow failed — see the Actions runs." '{content: $content}')
+                  curl --fail-with-body --silent --show-error \
+                    --header 'Content-Type: application/json' \
+                    --data "$payload" \
+                    "$DISCORD_RELEASE_WEBHOOK_URL" || true