LineLoom v1.3.0 — Stable · Explicit Private Context

LineLoom v1.3.0 — GitHub Stable Release

Channel: GitHub stable (genuine VS Code stable-channel VSIX, not pre-release).
Extension: SanskarCodes.lineloom · License: MIT · Requires: VS Code 1.96+.

This GitHub-only stable update includes the selected related-file context feature, expanded privacy/regression coverage and the v1.2.1–v1.2.5 source improvements since the v1.2.0 stable GitHub release. Version 1.2.5 was a development candidate, not a separately published GitHub release. Versions 1.2.1–1.2.4 remain separately available as historical GitHub previews.

Main new feature: explicitly selected related-file context

• Opt in by enabling lineloom.crossFileContext and then invoking LineLoom: Select Related Files for Context from the Command Palette. Simply enabling the setting never discovers or reads additional files.
• Select up to two explicit supported source files in the current workspace folder, each no larger than 2,048 bytes. The active file, duplicates, symlinks to leaf files, sensitive paths, exclusions, malformed/non-UTF-8 files, and unsafe or changed workspace policies are rejected.
• A modal requires confirmation before selected snippets can be used by Ollama. The additional context is session-only and never stored in extension settings, analytics or persistent indexes. LineLoom: Clear Selected Related Files revokes this consent and invalidates in-flight completions.
• All selected source remains subject to canonical-path and nested ignore checks before inference and after each response. If anything changes, reject the completion rather than sending a partial reference context.
• This feature is disabled by default. There is no workspace scan, dependency indexing or automatic file selection.
• With references enabled, Qwen 2.5 Coder falls back from the single-file FIM prompt format to a bounded generic completion prompt; this can affect model quality and needs real-model evaluation.

Privacy limitation: This is path/ignore-based access control, not comprehensive content-level secret detection. Review source files before giving extra-context consent; an explicitly approved remote HTTPS Ollama endpoint may receive selected snippets. A model server may itself log prompts.

Additional changes since the last stable GitHub release

• Native manual Stop Current Generation command without disabling automatic completion.
• Robust detection of invalid model/endpoint configuration; improved ignored/private path and corrupted ignore policy safety.
• Active-editor Check Active File Privacy command and opt-in aggregate privacy timing statistics with immediate reset, without recording code or file names.
• Hash-based policy revalidation across root/nested ignore rules, even when a file watcher is late; expanded stale-request cancellation, editor integration and source-tree test coverage.
• VSIX publishing dependency mitigation: pinned compatibility of @vscode/vsce@3.9.2, @azure/identity@4.2.1 and its associated older MSAL Node to clear the high-severity advisory gate without an incompatible MSAL 7 forced override.

Automated verification and outstanding QA

The guarded v1.3.0 GitHub publisher workflow is required to rerun the TypeScript/lint/unit/source/site checks, mocked Ollama integration in an actual Linux VS Code extension host, full dependency high-severity audit, runtime moderate-severity audit, genuine stable-channel VSIX archive/identity checks, checksum verification, clean VS Code CLI installation, and synthetic preference-preserving upgrades from the independently SHA-256-pinned public v1.2.0, v1.2.3 and v1.2.4 packages.

Hands-on manual QA: NOT RUN / NOT VERIFIED. This includes genuine Ollama model quality/latency (especially selected-context Qwen prompt fallback), GPU/CPU resource behavior, screen-reader/keyboard/high-contrast operation, physical Windows/macOS/Linux editor acceptance, remote endpoint consent in a real UI, and user-profile upgrades on personal workstations. The owner requested GitHub stable publication with this limitation explicitly disclosed, not represented as passed. See v1.3.0 manual acceptance, issue #60 and issue #66.

Dependency warning: The complete dev toolchain audit may report four moderate findings inherited through the older VSIX packager -> Azure Identity -> MSAL Node -> uuid dependency path. The release pipeline fails on high or critical full-dependency findings and on moderate-or-higher production dependency findings. The remaining moderate dev-tool findings are documented in security remediation notes and must be reassessed when a compatible patched upstream VSIX publishing stack is available. This is not a zero-vulnerability claim.

Download, verify and install

From GitHub release v1.3.0, download both LineLoom-1.3.0.vsix and LineLoom-1.3.0.sha256.

Verify the checksum (sha256sum -c LineLoom-1.3.0.sha256 on systems with sha256sum), then install in VS Code → Extensions → … → Install from VSIX…, or use code --install-extension LineLoom-1.3.0.vsix. Do not use the unrelated Visual Studio IDE VSIX installer.

The GitHub release does not automatically update either Visual Studio Marketplace or Open VSX; their versions and publisher authentication are not automatically updated and must be separately verified/authorized. The npm installer is also not published by this release.

Support and reports: https://github.com/sanskarIN/LineLoom/issues