Configure linter + prettier. - #5

…ini#5)

…maintainer feedback

# This is the 1st commit message:

feat: Create BYOID auth client when detecting BYOID credentials

This change introduces a BYOID auth client that is created when
BYOID credentials are detected. It also refactors the code assist
server and setup to use the new AuthClient type.

# This is the commit message google-gemini#2:

resolve comments

# This is the commit message google-gemini#3:

load credentials only once and lazy load the client

# This is the commit message google-gemini#4:

use original method names

# This is the commit message google-gemini#5:

use original method names for getOauthClient

# This is the commit message google-gemini#6:

remove redundant test mock

**Changes:**
- Make ollamaModel visible in /settings dialog (showInDialog: true)
- Set default value to 'llama3.2:1b' for better UX
- Update description with all 3 model options and their specs
- Add Tip google-gemini#5: Guide users to use /settings to configure Ollama models

**What Users Will See:**
Tips for getting started:
1. Ask questions, edit files, or run commands.
2. Be specific for the best results.
3. Create HIVECODE.md files to customize your interactions with HiveCode.
4. /help for more information.
5. Use /settings to configure Ollama models (llama3.2:1b, qwen3:4b, qwen2.5-coder).

**Settings Dialog:**
Users can now find "Ollama Model" in Security settings with description:
"Select Ollama model: llama3.2:1b (1.3GB, fast), qwen3:4b (2.5GB, balanced),
qwen2.5-coder (4.7GB, best quality). Requires Ollama to be installed and running."

Generated with Claude Code (https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

- Created new /ollamaModelSelector slash command for easy model access
- Integrated OllamaModelSelector component with full dialog support
- Added state management (isOllamaModelDialogOpen) throughout UI contexts
- Updated UIState and UIActions interfaces to support new dialog
- Added dialog rendering to DialogManager component
- Updated Tip google-gemini#5 to guide users to /ollamaModelSelector command
- Provides interactive model selection and download capabilities
- Simplifies Ollama model configuration compared to /settings approach

Users can now type /ollamaModelSelector to see and select from available
Ollama models (llama3.2:1b, qwen3:4b, qwen2.5-coder) with automatic downloads.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

…n and export

- PerformanceCollector: latency P50/P90/P99 percentiles, token efficiency,
  v8 heap utilization, startup phase analysis, optimization suggestions
- CostEstimator: per-model token cost tracking for Gemini 2.0/2.5/3,
  cache savings calculation, cheapest-model recommendations
- PerformanceExporter: JSON export (CI pipelines) and Markdown export
  (human-readable reports) with configurable sections
- 42 tests across 3 test files, all passing
- Exported from telemetry/index.ts

GSoC 2026 Idea google-gemini#5 proof-of-concept

…n and export

- PerformanceCollector: latency P50/P90/P99 percentiles, token efficiency,
  v8 heap utilization, startup phase analysis, optimization suggestions
- CostEstimator: per-model token cost tracking for Gemini 2.0/2.5/3,
  cache savings calculation, cheapest-model recommendations
- PerformanceExporter: JSON export (CI pipelines) and Markdown export
  (human-readable reports) with configurable sections
- 42 tests across 3 test files, all passing
- Exported from telemetry/index.ts

GSoC 2026 Idea google-gemini#5 proof-of-concept

…n and export

- PerformanceCollector: latency P50/P90/P99 percentiles, token efficiency,
  v8 heap utilization, startup phase analysis, optimization suggestions
- CostEstimator: per-model token cost tracking for Gemini 2.0/2.5/3,
  cache savings calculation, cheapest-model recommendations
- PerformanceExporter: JSON export (CI pipelines) and Markdown export
  (human-readable reports) with configurable sections
- 42 tests across 3 test files, all passing
- Exported from telemetry/index.ts

GSoC 2026 Idea google-gemini#5 proof-of-concept

Resolves all 7 review comments from gemini-code-assist[bot]:

google-gemini#1 [CRITICAL] write-todos.ts - Replaced clear+recreate with reconciliation
   strategy that matches existing tasks by title, preserving IDs, types,
   parent-child relationships, and dependencies. Only status is updated
   for matched tasks. New items are created, absent items removed. Epics
   and parent tasks created by dedicated tracker tools are never deleted.

google-gemini#2 [SECURITY-HIGH] trackerService.ts - Added path traversal guard:
   deleteTask() now validates ID matches /^[0-9a-f]{6}$/i before any
   filesystem operation.

google-gemini#3 [HIGH] trackerService.ts - Moved child-task deletion guard from tool
   layer into TrackerService.deleteTask() so all callers (tools, SDK,
   tests) get the same referential integrity protection.

google-gemini#4 [HIGH] trackerService.ts - Cascade dependency cleanup now sets
   updatedAt on affected tasks so disk metadata stays consistent.

google-gemini#5 [HIGH] trackerService.ts - createTask() now retries up to 10 times
   if the generated 6-char hex ID collides with an existing task.

google-gemini#6 [HIGH] trackerService.ts - deleteTask() now clears parentId on any
   task that referenced the deleted task as parent, preventing orphaned
   invisible tasks in the UI.

google-gemini#7 [HIGH] trackerTools.ts - TrackerDeleteTaskInvocation.execute() now
   trims and validates the ID parameter with the same regex before
   calling the service, catching bad input at the tool boundary.

Tests: 49 passed (added 4 new: path traversal guard, child-task block
at service layer, updatedAt cascade, ID reconciliation preservation).

Addresses all 11 review comments from gemini-code-assist[bot]:

Security (CRITICAL + HIGH):
- Add validateToolParamValues to ASTSearchTool with path validation
  using resolveDefensiveToolPath + resolveToRealPath + validatePathAccess,
  preventing path traversal attacks (comments google-gemini#1, google-gemini#2, google-gemini#8, google-gemini#9)

Parsing correctness (HIGH):
- findClosingBrace: track parenthesis depth to ignore braces inside
  inline object types in function params (comment google-gemini#3)
- findClosingBrace: return lines.length-1 instead of startLine+50
  when brace matching fails, for honest boundary reporting (comment google-gemini#7)
- extractSymbols: track block comment state (/* ... */) to skip
  commented-out code declarations (comment google-gemini#4)
- findIndentEnd: track Python triple-quoted strings to avoid
  early termination on docstrings with low indentation (comment google-gemini#5)
- extractSymbols: fix enum body skipping, enums now advance the
  line pointer past their body like classes/functions (comment google-gemini#10)

Documentation:
- collectSourceFiles: document .gitignore/.geminiignore limitation
  and plan for FileDiscoveryService integration (comment google-gemini#6)
- findClosingBrace: document escaped-quote limitation in the
  string-literal stripping regex (comment google-gemini#11)

Fixes 5 comments from third review round:

CRITICAL/HIGH (google-gemini#1,google-gemini#2): Map scope path traversal - file_path for "map"
  scope now goes through resolveDefensiveToolPath + validatePathAccess
  before reaching getCodebaseMap. handleMapScope accepts safePath param.

HIGH (google-gemini#3): Block comment stripping rewritten from state-tracking to
  character-level replacement. New stripBlockComments() replaces comment
  content with spaces, preserving line numbers. Handles mid-line comments
  and multi-line blocks correctly.

HIGH (google-gemini#4): validateToolParamValues now trims symbol_name and file_path
  at the top before any checks, preventing whitespace-only values.

HIGH (google-gemini#5): handleSymbolScope accepts trimmed symbolName as a parameter
  instead of reading raw this.params.symbol_name, so LLM-injected
  whitespace does not cause lookup mismatches.

Resolves all 7 review comments from gemini-code-assist[bot]:

google-gemini#1 [CRITICAL] write-todos.ts - Replaced clear+recreate with reconciliation
   strategy that matches existing tasks by title, preserving IDs, types,
   parent-child relationships, and dependencies. Only status is updated
   for matched tasks. New items are created, absent items removed. Epics
   and parent tasks created by dedicated tracker tools are never deleted.

google-gemini#2 [SECURITY-HIGH] trackerService.ts - Added path traversal guard:
   deleteTask() now validates ID matches /^[0-9a-f]{6}$/i before any
   filesystem operation.

google-gemini#3 [HIGH] trackerService.ts - Moved child-task deletion guard from tool
   layer into TrackerService.deleteTask() so all callers (tools, SDK,
   tests) get the same referential integrity protection.

google-gemini#4 [HIGH] trackerService.ts - Cascade dependency cleanup now sets
   updatedAt on affected tasks so disk metadata stays consistent.

google-gemini#5 [HIGH] trackerService.ts - createTask() now retries up to 10 times
   if the generated 6-char hex ID collides with an existing task.

google-gemini#6 [HIGH] trackerService.ts - deleteTask() now clears parentId on any
   task that referenced the deleted task as parent, preventing orphaned
   invisible tasks in the UI.

google-gemini#7 [HIGH] trackerTools.ts - TrackerDeleteTaskInvocation.execute() now
   trims and validates the ID parameter with the same regex before
   calling the service, catching bad input at the tool boundary.

Tests: 49 passed (added 4 new: path traversal guard, child-task block
at service layer, updatedAt cascade, ID reconciliation preservation).