Changelog

Preview 0.1.16 adds recoverable workspace snapshots, storage migration, instruction customization, alongside beta completions and revised web research.

0.1.16 workspace recovery and customization (2026-11-03)

Add per-turn change review and workspace recovery, with bounded snapshots that protect pre-existing and later edits.
Save independent drafts and image attachments for each chat, restore them after reloads, and fix cross-window history conflicts.
Add global and workspace instructions, editable starter templates, and instruction references in the chat composer.
Add optional editor completions, manual chat suggestions, and beta code-generation tools with separate controls and usage reporting.
Use an installed Chromium browser for local web reads and screenshots; download and update Chrome Headless Shell automatically when none is found. Web search still uses DeepSeek, while page reads no longer call its Fetch API.
Improve visual testing with managed application sessions, native Wayland window capture, and more accurate screenshot cropping.
Run commands as internal processes with output in chat, without opening or focusing a VS Code terminal. Preserve timeouts, cancellation and per-chat process ownership. Refresh settings and menus, and add privacy controls for automatically generated metadata.
Migrate legacy storage, consolidate drafts and recovery data, and update dependencies.

0.1.15 path tools, Vision, and the context window

Added the move_path tool: it moves or renames a file or a whole directory inside the workspace and creates the destination's parent folder. The destination must not exist, so nothing is overwritten by accident, and an optional expectedBeforeHash rejects the move if the source file changed after the preview.
Added the delete_path tool: it deletes a file or, with recursive: true, a directory and everything inside it. The path goes to the operating system trash unless permanent: true is passed, and recursive is never inferred, so a directory deletion fails instead of silently taking its contents with it.
Path changes can now be decided from Git facts. In the automatic permission modes, move_path and delete_path skip the security review when Git proves the change can be undone: the path is inside a repository, tracked, not ignored, and free of uncommitted changes. An untracked, ignored, modified, or non-repository path keeps the confirmation it had before, so a deletion that cannot be undone is never treated as a routine workspace write.
DeepSeek V4 Pro is selectable again, and its images are delegated to Flash. The model registry records capability flags, so the extension knows that V4 Pro cannot read images itself: a Pro generation that carries a live attachment is offered analyze_images, which asks Flash about the attachments named in the current message, sends DeepSeek file IDs instead of Base64 or local paths, disables thinking, caps its own output at 8K tokens, rejects expired files and files uploaded to another API origin, and reports the delegated usage against Flash in the vision_analysis phase. A Flash generation keeps reading images natively, in chat and in tool rounds.
The usage popover now shows the context window and can compact on demand. It reports measured usage once a request has been sent and an estimate before that, with the window size, the soft and hard limits, the point where auto-compaction starts, and how many compactions the conversation has had. A Compact context action runs a manual compaction and reports the tokens it freed, or that there was nothing to compact.
Added the low reasoning effort, between off and high, so thinking can be trimmed for speed without turning reasoning off.
Conversation history can be filtered and grouped by workspace, with an All workspaces entry, a header per workspace, and the conversation count of each group.
Terminal results keep their full output viewable. The row still shows a bounded preview, and a View retained output disclosure opens the stdout or stderr that was kept, so a command whose preview looks truncated can be inspected without running it again.
Tooltips are drawn by one portal layer. data-tooltip anchors are rendered by TooltipLayer, which flips sides and aligns when the requested position has no room, so hints survive the panels that clip their children and the narrow sidebar. The composer pickers and select now share the same control metrics, so the model menu matches the permission select instead of carrying its own border and height.
Credentials are stripped from tool traffic. Tool results, stored tool-call arguments, and the content handed back after a confirmation pass through redaction, which replaces credential-shaped keys and patterns with [REDACTED] before the text reaches the transcript, the tool ledger, or a checkpoint. Structured output stays parseable, so the paths and results a tool consumer reads are unaffected.

0.1.14 DeepSeek V4.1 Flash migration

Moved the extension to deepseek-flash (DeepSeek-V4.1-Flash), which replaces the retired V4 Flash and V4 Flash Vision models and serves V4 Pro requests from September 14, 2026.
Removed the DeepSeek V4 Pro option, the analyze_images delegation tool, and the hidden Vision-to-Flash transport fallback: the current model reads DeepSeek Files API image references natively, in chat and in tool rounds.
Removed the retired-model compatibility map: the official endpoint accepts only deepseek-flash, so a model name left over from an earlier preview is rejected instead of rewritten and must be selected again in Settings.
Updated the official USD cost catalog to the current DeepSeek-V4.1-Flash rates, including the documented weekday peak and off-peak split.
Usage cost can be shown in US dollars or Chinese yuan from Settings. Each currency uses DeepSeek's own published table (off-peak per 1M tokens: $0.003/$0.15/$0.6 and ¥0.02/¥1/¥4 for cache hits, cache misses, and output, doubled inside the peak windows), so no exchange rate is invented. Saved totals stay canonical in USD and are repriced for display.
Fixed the largest avoidable cost of a long chat: the system message ended with a minute-precision timestamp, so the first request of every generation invalidated DeepSeek's prefix cache for the tool schemas and the entire history. The current date now travels with the newest user message, which is new anyway, and the serialized prefix stays byte-stable between rounds.
Reviewer guidance no longer costs a full cache miss: the progress checkpoint and the completion-recovery nudge are appended as the newest message instead of being spliced into the system prompt, which used to re-bill the whole transcript once per checkpoint. Both reviewers ignore that guidance when reading the user's request.
The coding prompt now budgets code comments: they state intent only where the code does not already say it, never restate the code, and match the file's existing density. A comment is output paid once and input paid again on every later round that re-reads the file.
The usage popover reports the conversation-wide total computed by the extension host instead of adding up the messages the webview currently holds, so a long chat no longer appears to spend less once history paging drops older messages from memory.
Auxiliary context compaction uses per-phase output ceilings (2,048 tokens for a prose summary, 512 for line-range selection) instead of one shared 4,096-token cap, the cache-hit ratio is visible per request phase, and model capability flags that were declared and set but never read by any consumer were removed.
Added the read_func tool, which returns only the functions, methods, or types named in a source file, chained through their enclosing declarations (Class.method, outer.inner), and reports ambiguous names by their candidates instead of guessing. Reading one function no longer pulls the whole document into the context. Symbols come from the editor's language providers instead of a text heuristic.
read_file reads a line range through offset and limit, the fallback for content the editor cannot name as a symbol: search_content locates the name and only those lines are read, with the range bounds, hasMore, and the whole-file hash.
The prompt and both read tools now state the same reading order: read_func for a named declaration, search_content plus a read_file range for what the editor cannot name, and a whole-file read only for context spanning declarations, so inspecting one function is no longer a whole-document dump. The preference travels with every request because it lives in the system prompt and in the tool descriptions, not in the habits of one conversation.
A finished turn now ends with an edited-files summary: one row per written file with its additions and deletions, Show N more files beyond the first three, and Review to open every change of the turn. The host keeps the exact before and after contents for the session, so a change stays fully reviewable even though the diff stored in a tool result is bounded for the model context. Reverting changes is not part of this release.
Pending edit_file and apply_patch previews no longer steal focus: the inline change preview reuses an editor that already shows the affected file, otherwise it opens a transient preview tab in the column where the file is already tabbed, and it hands focus back to the user's editor when the platform activates the shown editor despite being asked to preserve focus, which is what macOS does. A confirmation therefore never interrupts chat input, terminal work, or typing elsewhere.
Attached images open an enlarged viewer from both the composer thumbnails and the images of a sent message. The viewer fits the image to the window, keeps its aspect ratio, and lets a zoomed image be dragged to pan instead of being squashed.
Long conversations render lazily: only the newest messages are mounted, earlier ones are revealed on demand while the message being read stays in place, and memoized rows keep typing responsive.
Reasoning blocks in the chat timeline now render Markdown, so code fences, lists, and emphasis read the same way in reasoning as in the final answer.
Added breathing room between the composer text area and its toolbar row, and fixed the expand chevron of a tool call so it points down once the call is expanded.
Safety decisions now start from machine-verifiable facts instead of a model round whenever the facts prove the action bounded. In the automatic modes, create_file, edit_file, and apply_patch run without a security review once the host proved the target inside the workspace and the path is not sensitive, so a routine workspace edit no longer stops for a confirmation; finite version, help, and availability queries such as dotnet --version && node --version && npm --version execute directly; and a workspace script runs unattended only when its path is contained, its bytes still match the agent-authored hash, and its declared effects stay bounded (localhost-only network, one owned child process, finite wait, exact-process cleanup, workspace-contained artifacts, no dynamic evaluation, policy change, escalation, credentials, interactive input, or background job). -ExecutionPolicy Bypass passed to powershell is treated as process-scoped rather than elevation. Everything unproven still goes to the independent review, which now also receives the body of a script the command runs, and a positive reviewer decision is cached only while the conversation, workspace, permission fingerprint, command, content hash, and effect profile stay identical.
A second incomplete verdict from the completion reviewer no longer discards the turn: the delivered answer is kept instead of being replaced with an error banner, and the reviewer is told explicitly that a reply waiting for a user confirmation, authorization, choice, or missing information is complete even when it names the action it will perform once the user answers. A borderline judgement about the user's own decision request can no longer turn a finished turn into a failure.

0.1.13 on-demand compaction, long output, and composer layout

Added the compact_context tool, a read-only request for a tool-cycle context compaction that rolls over at the next round; the model is expected to trust prior successful outcomes and not repeat completed mutations.
Raised the default maximum output allowance to DeepSeek's documented 384K limit, so long reasoning and file-generation rounds are no longer truncated prematurely.
Replaced the native VS Code workspace-reassign prompt with an in-webview Workspace Mismatch modal offering Open here or Cancel, localized in English, Spanish, and Chinese.
run_terminal_command now reuses one dedicated VS Code integrated terminal across successive commands so its scrollback and history stay visible; the terminal closes only on timeout, cancellation, a working-directory mismatch, or extension shutdown.
Fixed generation-event scoping so protocol handlers that update conversation and generation refs before the next React render accept the first user message immediately after admission.
Reworked the chat composer footer around CSS grid and container queries: narrow sidebars collapse the model and permission pickers into a settings gear with an inline usage breakdown, and the activity and tool panels use a cleaner left-indented layout without status capsules.

0.1.12 native tool calls and maintenance cleanup

Removed the provider-specific DSML text detector, streaming buffer, hidden retry, and recovery prompt. Only native API tool_calls can execute tools; tool-shaped assistant text remains ordinary content.
Split chat generation, history, settings, webview protocol, attachments, usage accounting, tool-call completion, and SearXNG installation into focused services without changing their external contracts.
Removed obsolete compatibility shims, forwarding modules, unused provider and FIM paths, and redundant tool-result aliases. Restored and hardened the immutable SearXNG runtime publication workflow with pre-publish metadata and checksum gates.
Enabled TypeScript unused-code checks and a Knip production gate, then removed trivial implementation-detail tests while retaining behavioral and integration coverage.
Renamed the interface-language automatic option to Auto in every supported locale.

0.1.11 managed search and sustained agent execution

Replaced Chromium-driven search with an extension-managed local SearXNG runtime. It starts on demand, exposes its engine catalog, supports custom engine selection, and requires no system Python, Docker, Podman, or browser installation.
Agent commands now run visibly in a dedicated VS Code integrated terminal, retain bounded structured results, and close after completion. Detached launchers are rejected and .NET build-server reuse is disabled to prevent orphaned processes.
Removed configurable round checkpoints and per-block call budgets. Tool cycles continue until a real terminal condition, with independent progress reviews every 20 rounds and then every five rounds when long-running work continues.
Duplicate-call suppression now resets after a workspace mutation, allowing legitimate rebuilds while still blocking unproductive repeats.
Malformed DeepSeek DSML embedded in assistant text is suppressed across stream boundaries and retried once through native tool calling. A separate completion review catches premature text-only stops without turning a second incomplete result into a false success.
Progress reviews receive compact cumulative activity and can stop self-initiated verification loops once requested deliverables already build, while uncertain reviewer failures remain non-blocking.
Usage moved to a conversation-level popover with per-model totals and lower-bound cost reporting when DeepSeek omits usage for some requests.
Removed legacy history and checkpoint compatibility under issue #61. Activation now deletes incompatible conversations and checkpoints instead of migrating or quarantining them.

0.1.10 vision, permissions, composer, and cancellation

Replaced the non-visual Flash option with DeepSeek V4 Vision (Flash). Vision reads Files API references directly; V4 Pro receives analyze_images only for prompts that contain images.
Added one provider-owned retry with stable V4 Flash when experimental Vision is unavailable. Image chats disclose that visual inputs were omitted, while V4 Pro image analysis fails explicitly instead of accepting a false description.
Unified context files and images behind one + picker, added Ctrl+V/Cmd+V paste, signature-based JPEG/PNG/GIF/WebP detection, 30-day Files API expiry, local previews, and cleanup that respects history Undo.
Reduced permissions to default, auto-approve, and full-access; removed the per-tool matrix and local danger analyzer, moved Web search below Permission mode, and added one capability toggle.
Rebuilt the chat input as one compact composer with a combined model/reasoning menu and one contextual generation button: Stop for an empty draft, Guide for Enter, and Queue while Ctrl is held or with Ctrl+Enter.
Stop preserves the prompt, partial timeline, and completed tool results as cancelled. Steering now verifies its source generation, explicitly continues the original task under the latest guidance, and hides the internal interrupted transport boundary.

0.1.9 concurrent chat isolation, cancellation, and calibrated context

Concurrent generations now use conversation- and generation-scoped protocol events, navigation IDs, background activity state, and snapshot restoration without leaking updates into another chat.
Stop removes the complete cancelled turn and restores its prompt as a draft. Cancellation now propagates through context discovery, streaming, browser work, confirmations, tools, terminal descendants, and persistence with one terminal outcome.
Automatic compaction uses provider-calibrated generation budgets, bounded UTF-8 text and merged file ranges, records only effective reductions, and safely rolls over closed tool cycles near the hard context limit.
Reasoning-heavy responses receive preventive output-overflow recovery while incomplete states remain visible and legacy history and checkpoints remain compatible.
Marketplace now receives normal-channel builds while package.json retains preview: true, and GitHub releases remain prereleases. A restored conversation from another VS Code workspace or window starts a new workspace-bound chat automatically.

0.1.8 human-style headless search and isolated semantic reads

Search now opens the selected Bing, Google, or Baidu home page, focuses the search field, types with short per-key delays, and submits with Enter. Bing is the default; CAPTCHA, blocking, and timeout failures are terminal without visible-browser escalation or automatic retries.
Search returns at most ten normalized organic HTTPS URL strings. read_web accepts an exact URL registered to its search_id, while direct URLs remain limited to addresses explicitly supplied by the user.
Page reads retain only headings and paragraphs from document.body, group adjacent content into stable numbered sections, split long sections between paragraphs, and paginate through opaque cursors without renumbering.
Every read uses a fresh cryptographic 128-bit nonce around JSON-safe untrusted content, with prompt-injection reminders before and after the page data and nonce collision regeneration.
Settings now provide dedicated API and Web search tabs. Obsolete native web settings, visible-browser controls, manual CAPTCHA flow, and configurable usage-warning budgets were removed while the isolated proxy and browsing limits remain enforced.

0.1.7 integrated-browser search and context compaction

Reworked integrated-browser search around one reusable VS Code page: searches type into the active engine, registered results open by click, navigation returns through browser history, and a compatibility mode remains available when newer browser tools are missing.
Added localized DuckDuckGo, Bing, Google, and Yahoo fallback, semantic organic-result parsing, Bing redirect decoding, public-HTTPS validation, bounded caches, compact responses, semantic page extraction, and sanitized browser diagnostics.
Replaced model-visible page IDs, DOM references, arbitrary navigation, and generic link following with opaque search/document IDs and only two constrained tools: search_web and the multi-mode read_web.
Compacted completed conversation context to user/final-answer pairs, retaining full provider transcripts only for active or incomplete recovery, and lazily compacted duplicate legacy web output when history is saved again.

0.1.6 privacy, reliability, and usage observability

Added Incognito mode for ephemeral chats: prompts, references, checkpoints, and usage remain in memory until the user explicitly saves or discards the conversation.
Added provider-reported usage per request phase, generation, and conversation, including nested reasoning tokens and separate cache-hit/cache-miss counts. Missing values remain unavailable rather than becoming zero.
Added current official DeepSeek V4 Flash/Pro cost estimates with a persisted catalog version, local usage breakdowns, redacted diagnostics, and warning budgets for auxiliary calls, cache-miss input, output, and generation cost.
Hardened tool-call integrity, unsaved buffers, concurrent storage, partial streams, process shutdown, webview protocol negotiation, provider validation, diagnostics, CI, and packaged-VSIX release gates.

0.1.5 packaging hotfix

Added an explicit *.log exclusion to the VSIX package rules so local files such as debug.log cannot be distributed.

0.1.4 preview credential safety, command review, and focused tool UI

Stored API credentials are isolated by normalized API origin in VS Code Secret Storage. The legacy key migrates automatically, changing origins requires confirmation, and the webview receives only configured state plus a masked placeholder preview.
DeepSeek requests enforce the selected credential origin across redirects and redact credentials from errors, logs, history, settings, checkpoints, and visible messages.
Auto-approve now uses a conservative local analyzer first. Uncertain workspace-contained terminal commands can receive a separate DeepSeek review with the initial user request and bounded, non-sensitive previews of explicitly named workspace files.
The reviewer can approve, request safer replanning, or require manual confirmation. Automatic decisions require medium-high confidence or above and never override workspace containment or delegate credentials, elevation, publishing, deployment, remote mutation, external access, broad process termination, or destructive operations.
Adjacent reasoning and tool calls are compacted into expandable Activity panels with step count and aggregate status.
Successful read_file contents are omitted from Chat. File tools provide Open file, while completed creates, edits, and patches can open the exact recorded tool change as a native VS Code diff.
Confirmation panels, Settings, tool controls, and the composer now use the available width in wide sidebars and avoid global overflow in narrow sidebars.
Contracts, built-in tools, command review, chat orchestration, VS Code workspace adapters, Settings, Chat UI, and tests were reorganized by domain while retaining public messages, tool names, settings, and history compatibility.

0.1.3 workspace safety and generation coordination

Raised the default DeepSeek output allowance from 8,192 to 65,536 tokens, retaining the 384K maximum and documenting its relationship to the 1M-token context window.
Turned the tool-round limit into a checkpoint: unattended modes ask DeepSeek whether to continue, request instructions, or stop, while attended modes retain the user decision.
Improved extreme-width responsiveness across Settings, tool permissions, the chat composer/footer, and History, including VS Code's narrowest sidebar layouts.
Added one active generation per conversation with configurable cross-conversation concurrency from 1 to 16, defaulting to 8.
Added Queue message and Interrupt and guide controls, targeted cancellation, and generation-bound stream and tool events.
Added atomic generation checkpoints that recover partial output, cancel unfinished tools, and expose queued prompts as drafts after restart.
Introduced conversation schema v2 with generation ownership and a verified activation-time migration for valid legacy or partially migrated history; compatibility remains active until its scheduled cleanup release.
Pinned each generation to its conversation workspace and serialized mutating tools per workspace while allowing concurrent read-only work.
Added revisioned logical-workspace bindings, deterministic multi-root aliases, disconnected-history reassignment, ./-only autocomplete, and bounded external file snapshots that never grant tool access.
Added coordinated provider shutdown so active work is checkpointed, cancelled, and flushed during extension deactivation.
Added host-only canonical DeepSeek tool transcripts with exact reasoning, JSON arguments, tool results, protocol ordering, checkpoint recovery, and safe replay.
Added total request budgeting, atomic conversation summaries, and literal relevant-line extraction for large references, with at most four auxiliary DeepSeek calls and a deterministic local fallback.

0.1.2 opt-in auto-approve, clearer settings, and the technical wiki

Added the opt-in auto-approve permission mode, which delegates approval to DeepSeek for every non-disabled tool while keeping tool schemas and workspace path validation enforced.
Reorganized Settings around a clearer General section and improved the English, Spanish, and Chinese interface translations.
Asked for an explicit confirmation before continuing when a conversation reaches the tool-call round limit, and aligned the maximum output-token setting with DeepSeek's 384K-token limit.
Fixed pending tool confirmations that stayed visible after cancellation, and the active conversation identity being lost when history was updated.
Added the in-repository technical wiki covering architecture, tools, storage, the DeepSeek API, testing, and maintenance.

0.1.1 reliability and security

Replaced text control markers with a native chronological assistant timeline for reasoning, content, and tool groups.
Unified tool states and fixed rejection, cancellation, host acknowledgement, stale pending calls, duplicate calls, and maximum-round termination.
Added real process-tree cancellation and structured non-interactive terminal results with bounded output and platform-aware danger analysis.
Hardened SSE, response validation, URL joining, timeouts, Retry-After retries, and React stream batching.
Moved settings and history to ~/.yrs-dpsk-copilot/. History uses one validated JSON file per conversation and no separate index.
Added multi-root conversation association, context pruning, staged Git context, binary detection, delimited references, AGENTS.md limits, and optimistic file hashes.
Fixed history deletion so deleting the active conversation clears Chat view while deleting another conversation leaves the current chat untouched.
Completed the accessibility and UX pass with modal focus management, controlled autoscroll, streaming drafts, localized UI, workspace permissions, recoverable settings, and paginated history.

0.1.0 preview

Introduced the layered source architecture, React chat webview, History, Settings, tool configuration, path autocomplete, and Marketplace packaging.
Focused the product on DeepSeek and stored API keys in VS Code Secret Storage.