Release v1.4.0: the notes, and the Welcome page says what the site says

RELEASE-NOTES.md

@@ -1,107 +1,75 @@
-# LevelCode v1.3.0
+# LevelCode v1.4.0
 
-When a LevelCode Cloud session ended, v1.2.0 said so with `API 401: Signature has expired` in red — beside an account popover that still claimed you were signed in. This release replaces that with one card and a **Sign in** button, shown before you send anything. Mostly you will not see even the card: the session is renewed ahead of time, a lapsed token is renewed wherever a request is sent rather than only in the chat, and thirty days of sign-in now run from the last time you used the editor. GPT-6 Astra and Claude Fable 5 / 5.1 are sized as the models they are, and the agent's browser preview can open for the first time.
+Extensions from Open VSX install again, and the editor checks them before installing. Up to v1.3.1, LevelCode could not check any signed extension, so every install from Open VSX stopped at **Install Anyway**, and installed extensions never updated. This release checks what Open VSX serves against the registry's own signing key. The agent can also draw now: when structure is the point, it puts a diagram in the chat, in your theme, with boxes that open the code they name. And Gemini 4 Argon, Google's new reasoning model, gets its real context window and room to think.
 
 ## Highlights
 
-### An ended session is a Sign in button, not a red error
+### Extensions install verified, without Install Anyway
 
-The card is headed **Your session has expired**, greets you by name, and says: *Sign in again to keep using LevelCode Cloud — your chat and files here are untouched.* It has two buttons: **Sign in**, and **Use my own key instead**, which opens the provider-mode setting.
+The editor checks every extension it downloads before installing it. In every LevelCode build until now, the module that does that check was missing: it is Microsoft's, and no open-source build includes it. So every check failed with *Signature verification was not executed*. The editor asked you to install anyway, and quietly never updated what you had.
 
-- **It is found before your first message.** The session is checked when the chat opens and every time the window comes back to the front. The check reads the token's own expiry, so a session with hours left costs no request.
-- **The popover and the footer stop saying you are signed in** at the same moment. That was the worst part of the old failure: two parts of the same window disagreeing about whether you were signed in.
-- **The card stays with the conversation.** New Chat, a resumed session and a checkpoint restore each rewrite the transcript, and each puts the card back while the expiry is unanswered. Signing in, or choosing your own key, takes it away.
-- **Inline edit and Agent Sketch say it too.** An ended session reads *Your LevelCode Cloud session has expired. Sign in again to continue.* there — with a **Sign in** button on the inline-edit toast — where v1.2.0 showed the gateway's 401.
+v1.4.0 ships LevelCode's own checker in that place. It confirms that the package is exactly what Open VSX published, using the registry's signing key.
 
-**Only the server saying no ends a session.** Being offline, a 5xx or a malformed reply means nothing is known yet: you stay signed in, and the request shows its own error. A renewal that hangs is given ten seconds and then treated the same way. Clearing credentials on a network blip would sign you out for closing your laptop on a train.
+- **If you turned checking off to get past the old prompt, turn it back on.** Setting `extensions.verifySignature` to `false` stops all checking, and an upgrade leaves the setting as you set it. Remove it, or set it to `true`.
+- **The key is built into the app and never downloaded.** If Open VSX ever changes it, extensions signed with the new key are refused until a LevelCode update carries that key. Extensions already installed keep working. A daily check against the registry looks for exactly that, so a change shows up first as a failed check on our side, not only as your failed installs.
+- **A package that does not match is refused, with the reason.** A package that was changed after publishing, or signed with another key, is refused as untrusted, and the editor says so.
+- **It confirms the package came from Open VSX, not that the code is safe.** It says nothing about what an extension does, any more than an app store's signature does.
+- **An extension installed from a `.vsix` file is not checked.** It comes without a signature to check it against, as in VS Code.
+- **Every build is tested on a real extension.** The build installs one through the app's own command line and stops if it is refused, the test that would have caught this.
 
-If you use LevelCode on your own key with no account, none of this reaches you — no card, no prompt. Gateway mode with no token is what a fresh install is, and it still falls back to your key.
+### The agent can draw
 
-### Thirty days now run from the last time you used it
+Ask how something works and the agent can answer with a picture. Flows, architectures, decision trees and state machines come out as a diagram in the chat. They are laid out, labelled and drawn in your editor's theme.
 
-A cloud sign-in is two credentials: an access token good for 8 hours, and a refresh token good for 30 days that buys the next access token. Through v1.2.0 the editor kept the refresh token it was handed at sign-in for that token's whole life, so the thirty days ran from the day you signed in. Someone who used LevelCode every day was signed out on day thirty all the same.
+- **Boxes link to code.** A box that names a function or a file opens it at the right line when clicked.
+- **Full size and export.** **Full size** opens a zoomable view; **Esc** closes it. The toolbar copies the source, saves SVG or PNG, opens the diagram as Mermaid, or inserts it into a Markdown file.
+- **Diagrams stay in the session.** A resumed session shows them again. After **Compact**, the agent can still fetch an old diagram by its id.
+- **Screen readers get a text outline** of every diagram, and linked boxes open with Enter or Space.
+- **It costs about 970 tokens a request** while it is on: the tool and its rules travel with every request. Turn it off with `levelcode.ai.diagrams.enabled`.
 
-The cloud now issues a new refresh token with every renewal, and the editor stores it. The thirty days slide: keep using the editor and you do not reach the wall; leave it for a month and you sign in again.
+### Gemini 4 Argon, and room for reasoning models to think
 
-| What | Value |
-| --- | --- |
-| Access token | 8 hours |
-| Sign-in | 30 days, counted from the last renewal |
-| Renewed ahead of expiry | when under 5 minutes remain — checked at chat open, and on window focus at most every 10 minutes |
-| A renewal that hangs | given up on after 10 seconds — you stay signed in |
+Gemini 4 Argon is in the model picker on Pro plans, at about 100 turns a month at Google's introductory price. That part is on our side, so it does not wait for this release. v1.4.0 makes the editor handle it properly:
 
-### A lapsed token is renewed wherever a request is sent
+- **Its real window.** It gets its full 1,048,576 tokens of context, image input and the reasoning label in the picker. Before, a generic Gemini rule gave it 1,000,000.
+- **A medium reasoning effort for chat and the agent**, and a low one for Compact, so it does not think at length about a summary.
+- **Room to answer.** A reasoning model's thinking comes out of the same budget as its answer, so the agent now gives every reasoning model 32,768 tokens a turn instead of the 8,192 default. That covers Argon, Kimi K3 and the OpenAI o-series. Compact gives them 8,192 tokens instead of 1,500, which their thinking alone could use up, leaving an empty summary.
 
-The chat and the agent already renewed a lapsed access token and sent the request again. Nothing else did. Once the eight hours were up, everything around the chat failed until a chat message happened to renew the token — for a session that was perfectly renewable.
+## New settings
 
-| Where | v1.2.0 | Now |
-| --- | --- | --- |
-| Inline edit | *LevelCode AI edit failed: … API 401: Signature has expired* | renewed, and the edit asked once more |
-| Agent Sketch — Run, the board command, Generate flow | the gateway's 401 on the nodes that ran | renewed; nodes that fail together share one renewal |
-| Inline completion | silently nothing, on every pause in typing | renewed quietly |
-| Compact and the session-memory summary | failed | renewed |
+- `levelcode.ai.diagrams.enabled` (default **on**): let the agent draw diagrams in the chat.
 
-What it deliberately will not do:
+## New commands
 
-- **Send anything twice.** One retry, and none once part of an answer has arrived — a second send would repeat it.
-- **Outlive a Cancel.** Stop, Cancel or the next keystroke ends the wait at once, and a request nobody is waiting for starts no renewal.
-- **Cross accounts or hosts.** A request stays with the account and the cloud host it was sent on. Sign in as someone else while it is out — in this window or another — or point the editor at a different host, and it is not sent again on the new credentials.
-- **Turn typing into refreshes.** Ghost text is sent on every pause in typing. It may start one renewal a minute, and waits on one that is already out.
-
-### One session, every window
-
-The session is stored once and every window shares it, but a window only heard about the changes it made itself. One left open in the background kept showing "signed in" after another window had signed out.
-
-Each window now compares what is stored with what it is showing whenever it comes to the front, and catches up: the card and a signed-out popover if the session ended elsewhere, the popover alone if you signed out there, and the card taken down if you signed back in there.
-
-### GPT-6 Astra and Claude Fable 5 / 5.1, sized as they are
-
-v1.2.0 had no entry for any of them and fell back to a guess: a 200k-token window for all three, and no images for Astra. In gateway mode that meant the model picker offered Astra while the composer refused your screenshot, and the context meter was sized for a fifth of the real window.
-
-| Model | Context window | Images |
-| --- | --- | --- |
-| GPT-6 Astra | 1,050,000 tokens | yes |
-| Claude Fable 5 and 5.1 | 1,000,000 tokens | yes |
-
-The rows hold under every id the models arrive as: `openai/gpt-6-astra` and `anthropic/claude-fable-5.1` from the gateway and OpenRouter, and Anthropic's own `claude-fable-5-1`.
-
-On LevelCode Cloud, Fable 5 and 5.1 are included from **Pro** and GPT-6 Astra from **Pro+**. They are expensive models, and the pricing page says so in turns rather than leaving you to find out: Pro's 2,000 credits are about 260 turns on Kimi K2.7 and about 20 on Fable 5.1.
-
-### The agent's browser preview opens
-
-When the agent starts a web server in the background and it prints a local address, LevelCode opens it in the built-in browser beside the chat — without taking focus, and once per address, so closing the tab is final. That is what `levelcode.ai.preview.autoOpen` has promised since v0.9.2.
-
-It never happened. A logging call on that path referred to a name that was out of scope, and threw before the browser was asked for. Every release from v0.9.2 to v1.2.0 carries it; this is the first that can open the tab.
-
-**What is proven, and what is not.** A test now runs the real chain — the agent, the tool, the command's output — up to the call that opens the browser. The tab itself appearing in a packaged build is the one step no test covers.
-
-Only local addresses are ever opened: `localhost`, `127.0.0.1` and `[::1]`.
+- **AI: Diagram Statistics**: how the agent's diagrams have gone on this machine (drawn, repaired, fallen back, exported). Kept in the editor's own storage; nothing is sent anywhere.
 
 ## Also fixed
 
-- **Three icons were printed as words.** Opening the chat in an editor tab showed a banner reading *layout MOVED TO THE EDITOR*; the preview chip and the recall and project-memory chips showed `globe` and `history` as text on ungrouped timeline rows. The glyphs are in, and a test now runs every icon name written down on either side through the real renderer.
-- **A sign-in replaces the whole session.** One that arrived without a refresh token kept the previous session's, and the next renewal was made with it: refused, it ended the session you had just started; still valid, it renewed the *previous* account under the new one's name. Latent — the cloud sends a refresh token with every sign-in — and closed.
-- **A background command that failed to start** raised an unhandled rejection instead of being logged. Same out-of-scope name as the preview.
+- **A finished answer is no longer nudged to continue.** An answer whose last line was a Markdown-formatted **Done:** did not end the run, and the agent was asked to keep going.
+- **Three backticks inside a sentence** no longer break the paragraph into one line per streamed fragment.
+- **A command that prints a lot tells the agent how it ended.** Output over 8,000 characters used to be cut from the end, which is where the failure and the exit code are. Now the agent sees the start and the end, with the gap stated.
+- **Output over 256 KiB** is shown from its real start, and the count of what was left out is true.
+- **A server that logs more than 100,000 characters before "listening on…"** is still seen as listening. Its port and its preview no longer go missing once the command's card is full.
+- **The Welcome page and the Customize panel use the site's words.** The Welcome page now opens with the site's own line, and the customization extension is now called **LevelCode Customization**. Its settings and commands are unchanged.
 
 ## Not in this release
 
-**The Sessions panel still does not search.** It was the stated gap in v1.0.5, in v1.1.0 and in v1.2.0, and it is the stated gap again. This cycle went to sign-in.
+**LevelCode in a browser tab is not something you can use yet.** Its source is part of this release (`web/`, with a simulated shell for the agent), but it is not hosted anywhere. The Mac app is unchanged by it apart from the shared code it reorganized. That code was run in the real editor, against a stand-in model, before tagging: file writes, review, Undo, commands and diagrams.
 
-**A session with no refresh token cannot be renewed, and is not ended either.** When its access token lapses, the request still shows the gateway's 401. The cloud issues a refresh token with every sign-in, so reaching this takes a sign-in that arrives without one — but it is the one path left where that error can appear.
+**Diagrams have not yet been drawn by every model.** They were tested with scripted models, in the chat page and in the real editor. If a model draws badly, `levelcode.ai.diagrams.enabled` turns them off. Tell us which model it was.
 
-**Nothing renews the token in a window that simply stays in front.** The check runs when the chat opens and when the window regains focus. A window you never leave finds a lapsed token on its next request, which is renewed and sent again — a moment's delay rather than an error, but not the same as never lapsing.
+**Gemini 4 Argon's reasoning is not carried from one agent step to the next.** The editor does not send it back, and Argon was checked to work without it, but a long task may be less consistent than it would be with it. Carrying it is real adapter work, planned separately.
 
-**"Use my own key instead" is only on the chat's card.** The inline-edit toast offers **Sign in** alone, and Agent Sketch shows the sentence with no button at all.
+**The Sessions panel still does not search.** It has been the stated gap since v1.0.5, and it still is.
 
-## Test coverage
+**There is still no Windows or Linux build.**
 
-- **48 suites**, **854 cases** across the bundled extensions — all green. v1.2.0 measured the same way was 40 suites and 599 cases.
-- `test/sessionExpiredHost.test.js` (70 cases) — the host's own functions, sliced out of `extension.js` and run against stores that answer a turn late: the expiry found at open and on focus, late answers that must not touch a newer session, a sign-out in the middle of a request, and what other windows do to the store.
-- `test/authRetryCallers.test.js` (76 cases) — the real inline edit, Agent Sketch and completion modules, driven as the editor drives them against a gateway that answers 401 to a lapsed token.
-- `test/authRetry.test.js` (45 cases) — the renew-and-retry rules on their own: one retry, one renewal at a time, and a request that stays with its account and host.
-- `test/session.test.js` (19 cases), `test/sessionExpiredUi.test.js` (17) and `test/sessionExpiredCallers.test.js` (16) — the token arithmetic, the card's routing in the webview, and what inline edit and Agent Sketch say.
-- `test/chatIcons.test.js` (6 cases) and `test/agentRunCommand.test.js` (4) — the icon guard, and the preview chain.
+## Test coverage
 
-**The suites now run on every pull request.** Until this release they ran in CI at one moment only — when a tag was pushed — so a new suite's first run on Linux was the release gate, after the merge. The first v1.3.0 tag failed its gate that way: a new test counted turns of the event loop across a real timer, which holds on a Mac and not on the runner. The test waits by the clock now, and the gate is one script, `scripts/test-extensions.sh`, shared by the release workflow and a pull-request check.
+- **126 test files** run in the gate: the bundled extensions, the signature checker and the browser edition.
+- **The bundled extensions' 70 suites hold 1,252 counted cases**, up from 49 suites and 892 cases in v1.3.1. Six suites print `N passing` and are not counted.
+- `extensionSignature` (59 cases): the checker against real Open VSX packages and signatures, every way a signature can fail to verify, and a sweep showing a changed byte of the signature is always refused.
+- The diagram suites (12): the schema and validator, the repair ladder, the layout, the painter, the text forms, the session replay and the host's export checks.
+- `agentReasoningBudget` and `compactReasoningHost`: run the real agent loop and the real Compact, and read what each request asked for.
 
-**Full changelog:** https://github.com/levelcodeai/levelcode/compare/v1.2.0...v1.3.0
+**Full changelog:** https://github.com/levelcodeai/levelcode/compare/v1.3.1...v1.4.0

extensions/levelcode-ai/customize.js

@@ -97,7 +97,7 @@ function htmlFor(nonce, s) {
 		row('Auto-check', s.updates ? 'on' : 'off', s.updates) +
 		'<div class="btns">' + btn('Check for updates', 'levelcode.update.check') + '</div>');
 
-	const hack = section('🛠️', 'Hackability',
+	const hack = section('🛠️', 'Customization',
 		'<p class="muted">Make it yours — a user init script and your own packages, hot-reloaded.</p>' +
 		'<div class="btns">' + btn('Open init script', 'levelcode.init.edit') + btn('Generate a package', 'levelcode.package.generate') + '</div>');
 

extensions/levelcode-ai/package.json

@@ -26,7 +26,7 @@
       {
         "id": "welcome",
         "title": "Welcome to LevelCode",
-        "description": "Your AI-native, hackable, Notepad++-powered editor — set it up in a couple of minutes.",
+        "description": "The AI code editor that keeps you in control — set it up in a couple of minutes.",
         "steps": [
           {
             "id": "ai",

extensions/levelcode-hackability/package.json

@@ -1,7 +1,7 @@
 {
   "name": "levelcode-hackability",
-  "displayName": "LevelCode Hackability",
-  "description": "Atom-style hackability for LevelCode — a user init script that runs your own code at startup.",
+  "displayName": "LevelCode Customization",
+  "description": "Make LevelCode yours: an init script that runs your own code at startup, Atom and Notepad++ keymap presets, and your own packages, reloaded as you edit them.",
   "publisher": "levelcode",
   "version": "0.1.0",
   "license": "MIT",
@@ -54,7 +54,7 @@
       }
     ],
     "configuration": {
-      "title": "LevelCode Hackability",
+      "title": "LevelCode Customization",
       "properties": {
         "levelcode.init.enabled": {
           "type": "boolean",