From f4eb1e1ed35ddc4356ad52b1849f333d2cf8502b Mon Sep 17 00:00:00 2001
From: Roo Code <roomote@roocode.com>
Date: Thu, 8 Jan 2026 01:54:39 +0000
Subject: [PATCH] fix: prevent TypeError in TTS useEffect by capturing text in
 local variable

Fixes #10468

The error "Q.text.startsWith is not a function" occurred because
lastMessage.text could potentially change between the type check
(typeof lastMessage.text === "string") and the startsWith call.

This fix captures lastMessage.text in a local variable before
performing any operations on it, preventing the TOCTOU
(time-of-check-time-of-use) vulnerability.
---
 webview-ui/src/components/chat/ChatView.tsx | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/webview-ui/src/components/chat/ChatView.tsx b/webview-ui/src/components/chat/ChatView.tsx
index 6f3ee16ec12..a1068093a49 100644
--- a/webview-ui/src/components/chat/ChatView.tsx
+++ b/webview-ui/src/components/chat/ChatView.tsx
@@ -1015,13 +1015,16 @@ const ChatViewComponent: React.ForwardRefRenderFunction<ChatViewRef, ChatViewPro
 		// This ensures the first message is not read, future user messages are
 		// labeled as `user_feedback`.
 		if (lastMessage && messages.length > 1) {
+			// Capture text in a local variable to prevent TOCTOU (time-of-check-time-of-use) issues
+			// where lastMessage.text could change between the type check and startsWith call
+			const messageText = lastMessage.text
 			if (
-				typeof lastMessage.text === "string" && // has text (must be string for startsWith)
+				typeof messageText === "string" && // has text (must be string for startsWith)
 				(lastMessage.say === "text" || lastMessage.say === "completion_result") && // is a text message
 				!lastMessage.partial && // not a partial message
-				!lastMessage.text.startsWith("{") // not a json object
+				!messageText.startsWith("{") // not a json object
 			) {
-				let text = lastMessage?.text || ""
+				let text = messageText || ""
 				const mermaidRegex = /```mermaid[\s\S]*?```/g
 				// remove mermaid diagrams from text
 				text = text.replace(mermaidRegex, "")