Added
- Vision Fallback Pass-through (ADR 0004): when primary model cannot handle vision and user enables ollamaCloud.visionFallback, extension swaps to a user-configured vision-capable model for that turn. Settings: visionFallback.enabled, visionFallback.model, visionFallback.connection (all scope:application). Commands: Ollama Cloud: Set Vision Fallback Model, Ollama Cloud: Set Vision Fallback Connection.
- CancellationToken race fix in ollamaClient.streamChat (synchronous isCancellationRequested check before first await).
Fixed
- redactSensitive now masks data:image/*;base64,... payloads (defense-in-depth, v0.4.0 security audit finding #1).
- Stale visionFallback.connection now logs a warning and falls back to primary (M2).
- QuickPick "Set Vision Fallback Connection" now offers a "Clear — use primary connection" option (M3).
Security
- v0.4.0 security audit: PASS WITH NOTES, no regression vs v0.3.0. All 8 invariants hold on new code (multi-connection + vision).
- Vision Fallback code review: APPROVE WITH NOTES, all 10 ADR 0004 constraints verified.
Note on release assets
The GitHub Actions release workflow (.github/workflows/release.yml) was triggered by the v0.5.0 tag push but did not run: the job was blocked because the GitHub account is locked due to a billing issue. No VSIX, SBOM, or signature artefacts were published by the workflow. This release is therefore notes-only. Once billing is restored, re-run the release workflow to attach the signed VSIX, SBOM, and signatures, or build locally and upload.
Full changelog: see CHANGELOG.md