Commit Copilot v1.9.0

Release Notes: Commit Copilot v1.9.0

We are pleased to announce the release of Commit Copilot v1.9.0. This release delivers full internationalization support across 20 languages, a custom OpenAI-compatible provider system, a complete migration of the side panel to a React bundle, a configurable agent step limit, and a wide set of agentic reliability, security, and UI state improvements.

Key Features

Settings Panel

A Settings screen is now accessible via the gear icon in the top-right corner of the side panel, consolidating extension-level preferences in one place.

Language ??The extension ships with full internationalization support across 20 locales. All user-facing strings?otifications, output channel messages, progress indicators, SCM commands, and the entire side panel UI?re driven by a locale-aware string system. Users can switch the display language at any time from the Settings screen, and the selection is persisted across sessions. Supported locales: 塈?媢堭堥?堜, ?e禳tina, Deutsch, English, Espa簽ol, Fran癟ais, 鄐嫩凶鄐兒?鄐舟?, Magyar, Bahasa Indonesia, Italiano, ?交隤? ?筏?? Nederlands, Polski, Portugu礙s (Brasil), ????郕邽邿, T羹rk癟e, Ti廕積g Vi廙, 蝞�雿葉?? 蝜?銝剜?. Locale strings are organized into dedicated per-language files and a shared types module. Extension manifest display strings are also localized and bundled into the VSIX via the i18n-manifest build step.

Max Agent Steps ??Users can cap the number of tool calls the agent may execute during a single generation run. The limit is enforced uniformly across the OpenAI, Anthropic, and Gemini agent loops and is persisted in global extension state. Setting the value to zero or leaving it empty lifts the cap entirely. This gives users direct control over generation cost and prevents runaway loops on complex repositories.

Custom OpenAI-Compatible Providers

Users can now register, edit, and delete custom OpenAI API-compatible endpoints directly from the side panel. A dedicated Add Custom Provider option appears at the bottom of the provider selector, opening a configuration screen where the provider name, base URL, and API key can be entered and validated before saving. Model names are entered manually rather than fetched from the endpoint, giving full control over which model identifier is sent to the API. Saved providers can be edited at any time?ame, base URL, API key, and model name are all individually modifiable. Each custom provider is persisted in extension state and appears alongside built-in providers in the selector. Custom provider base URLs are threaded through the full generation and agentic flows so they behave identically to built-in providers. All configuration screens and actions carry localized labels for all supported languages.

React-Based Side Panel

The side panel has been fully migrated from a large inline HTML script to a bundled React webview application. A shared bootstrap payload is serialized by the extension host and consumed by the React entry point, replacing ad-hoc string interpolation for initial state. The build and typecheck configurations are updated to compile TSX assets via esbuild, and the generated webview output is packaged and excluded from irrelevant artifacts. Tests are updated to verify the new HTML shell structure, asset URI injection, CSP nonce handling, and bootstrap data serialization.

Reliability and Security Improvements

Agentic Cancellation and Tool Robustness

The retry utility and all agent loops are refactored to support immediate cancellation via polling, so generation halts promptly at the next retry boundary rather than waiting for an in-flight request to complete. Tool call argument parsing in the OpenAI loop is hardened with safer JSON handling to avoid crashes on malformed model output, and the Anthropic loop now explicitly detects and reports truncated responses so users receive a meaningful error rather than a silently incomplete message.

Security: Cryptographically Secure Nonce Generation

The side panel's Content Security Policy nonce is now generated using a cryptographically secure random source, replacing the previous Math.random-based approach. This closes a theoretical nonce-prediction vector in the webview's script execution policy.

Webview State Consistency

Several state synchronization bugs in the side panel are resolved. The model selector is no longer reset after a successful API key validation when the validation response does not carry model data, preserving the current list and selection. The active generation mode is now correctly synchronized from the extension host on panel load. Screen state and settings input values are also kept consistent across navigation transitions, eliminating cases where stale values could appear after returning to the main screen.

Agent Resource Cleanup

The find-references tool now reliably removes its staged workspace directory on failure paths, closing a resource leak that could accumulate temporary directories across multiple failed generations. LLM clients are simplified to rethrow explicit error types without deep wrapping, ensuring error classification is preserved through the call stack.

SCM Action Priority

The SCM title bar Generate and Cancel commands are assigned a higher navigation group priority (navigation@10), ensuring they appear before other extension contributions and are consistently reachable from the Source Control view header.