LineLoom v1.3.1 — Sidebar Reliability Preview

LineLoom v1.3.1 — GitHub pre-release candidate

Status: release candidate until an official GitHub pre-release and both assets are verified. This is not a stable release. The latest verified stable is v1.3.0. Visual Studio Marketplace, Open VSX and npm/GitHub Packages versions are entirely separate; this workflow does not publish or update them.

What's new since v1.3.0

• Native Control Center: contextual guidance — one Next: action directs users to enable autocomplete, open a supported local file, adjust languages or endpoint, retry Ollama, cancel an active generation or inspect diagnostics. Restricted workspace or file-exclusion issues remain explicit, non-bypassing guidance.
• Default model readiness — user-invoked Check Ollama Connection records only ephemeral not checked / checking / default model found / missing / connection failed. No passive sidebar polling, no model downloads.
• Effective active-editor model verification — new LineLoom: Check Active Editor Model command checks the configured per-language override if one is active, instead of relying on the default-model health result. Missing default vs missing override leads to the right model-selection command.
• Active-file privacy status — user-invoked local Check Active File Privacy shows a temporary pass/blocked status for the active editor without exposing filenames, paths or source, with invalidation on editor/policy changes.
• Completion hardening — reject additional invisible Unicode formatting/control characters in generated suggestions without silently changing the model output; preserve legitimate multilingual identifier joiners.

These checks are not ongoing surveillance. They are based on explicit user actions; results are in-memory only, safe against overlapping async responses and never override real privacy checks before inference. The extension remains local-first with no implicit workspace indexing, telemetry, hosted account, or automatically enabled related-file context. Remote HTTPS inference still requires separate origin approval.

Verification and limitations

Automated release gates (must be green before publishing): locked npm ci, TypeScript/lint/unit/security/source-tree/website checks, Linux VS Code extension-host with mocked Ollama, a genuine pre-release-channel VSIX, SHA-256 checksum verification, isolated clean installation, and synthetic upgrade from the independently digest-verified public v1.3.0 stable VSIX. The publisher also checks the exact manifest, package-lock version, full audit, duplicate tag and pre-release asset classification.

Manual QA outstanding / NOT RUN as part of this publishing automation: actual Ollama generation quality, p50/p95 latency across physical Windows/macOS/Linux devices, keyboard-only navigation, high-contrast/screen-reader acceptance, and real hosted remote-endpoint behavior. These items remain in manual QA tracking and v1.3.1 plan and the v1.3.1 physical acceptance record; a passing mocked Linux host test is not proof of them.

Known dependency note: the packaging chain has a reviewed high-severity MSAL compatibility mitigation and a security audit gate. Four moderate development-only transitive advisories have been documented for review in issue #79. This preview requires npm audit --audit-level=high and npm audit --omit=dev --audit-level=moderate, but it does not claim the development dependency tree has zero moderate findings.

Install only after GitHub assets are publicly verified

Download LineLoom-1.3.1.vsix and LineLoom-1.3.1.sha256 from the future GitHub v1.3.1 pre-release page. Confirm it is explicitly tagged Pre-release, verify the downloaded VSIX against the accompanying SHA-256 digest, and use VS Code → Extensions → ... → Install from VSIX or code --install-extension LineLoom-1.3.1.vsix. Do not attempt to download an unpublished asset; stay on v1.3.0 stable until preview publication is confirmed.

Rollback: install the published v1.3.0 stable VSIX after verifying its independent checksum. Preview settings remain local and the package does not automatically upload your repository.

Channel and support boundaries

The owner-gated GitHub publisher can produce only an official GitHub pre-release (with exactly a VSIX and .sha256 asset). It must not tag/overwrite an existing release, mark v1.3.1 as stable/latest, or publish to VS Code Marketplace, Open VSX, npmjs.com, or GitHub Packages. The current package-manager CLI remains a separate versioned product.

For problems, file a sanitized GitHub issue without code, paths, prompts or credentials. See sidebar documentation, security policy, and release evidence protocol.