LevelCode v1.1.0

The chat moves to the middle of the editor and starts reading like a document. This release takes the panel out of the narrow column on the right, gives the transcript a real measure and type scale, and lets the agent answer you even when no folder is open.

Highlights

The chat is an editor tab now

It opens centred, as a tab, like a file — and that is the only place it lives. Drag it to a split, move it between groups, pull it into a second window: it behaves like every other editor because it now is one.

The old right-hand chat view is gone rather than deprioritised. One conversation with two possible hosts needed a hand-over card, a detached state, a move command and a replay on every transition — machinery for a choice nobody wanted. Sessions keeps the right-hand panel to itself, which is the right place for an index of past conversations: it no longer splits a narrow column with the conversation it indexes.

Closing the tab closes the chat, and closing is an ending rather than a discard — the session is sealed into History and memory learns from it, exactly as New Chat has always done. ⇧⌘I opens it again.

If you don’t want it opening on its own, set levelcode.ai.chat.startLocation: "none".

The transcript reads like a document

Nothing constrained line length before this. In a 380px sidebar the container did that job, so it never looked wrong — but a chat in an editor tab at 900px produced 154-character lines, and no amount of good prose survives that.

• A bounded measure. The column caps at 820px and centres, matched against the Claude Code console rather than derived from print typography — the 45–75 character rule assumes prose without identifiers, file paths or fenced code.
• Prose gets its own type. Message bodies now read one step above the workbench UI size, with looser leading. Expressed as an offset rather than a fixed number, so it tracks the editor font instead of inverting against it if you have raised that for accessibility.
• Hierarchy you can see. The heading scale moves from 1.3 / 1.18 / 1.07 — three levels inside a quarter of an em — to 1.45 / 1.25 / 1.1, with more space above a heading than below it.
• Rhythm that scales. Prose spacing is in em, anchored to the prose size, so raising the type opens the page instead of tightening it.
• Code blocks get room. pre padding widens and its margins join the same rhythm.

The whole panel shares one column: the composer, the status row and the notice bars line up with the prose above them instead of spanning the full width beneath it.

Speakers are told apart by treatment, not by a label

YOU and LEVELCODE AI sat above every message restating what the shape of the message already said. Your turn is now a tinted bubble on the right that hugs its content — "Yes" is a short bubble, a pasted stack trace is a wide one — and the assistant's is unadorned prose on the left.

The labels are gone from the screen but kept in the accessibility tree: the bubble is a purely visual cue, so removing the element outright would leave a screen reader with an unattributed wall of text.

The agent answers without a folder open

Opening LevelCode without a workspace used to refuse every request outright — "Open a folder first." That guard was written for the file tools and placed where it failed the whole run, so a question that never needed a workspace died on it: what an error means, anything through an MCP server, a follow-up about the conversation itself.

The root now gates the tools that resolve a path against it, and nothing else. Rootless, list_files, read_file, search, edit_file, write_file, delete_file and run_command are withheld — a tool that is present but always fails is worse than one that is absent, because the model retries it — while update_plan, ask_user, use_skill and every MCP tool keep working. The model is told plainly why the file tools are missing, so it says so in a line instead of improvising about files it cannot see.

New settings

Both sizes are clamped at the boundary (8–24 and 320–2000). The minimum/maximum in a contribution schema only drive the settings editor; a hand-edited settings.json reaches the extension unchecked, and these land directly in CSS, where proseWidth: 1 is a one-pixel transcript with nothing left on screen to open settings with.

Also fixed

• Closing the chat no longer leaves the conversation loaded. Sealing the session ended it — so the next chat opened visually empty — while the in-memory history was still there and shipped to the model on the next message. The teardown now also stops in-flight work and reaps background commands and MCP servers, which are detached children and were outliving the surface that reported on them.
• A teardown cannot be raced by the run it is tearing down. Closing mid-stream aborts the request, and the abort landed in a handler that pushed the partial reply back into the history that had just been cleared — the exact leak the teardown exists to prevent, caused by the teardown's own abort.
• Reveals of the chat can no longer become unhandled promise rejections in the extension host. Failures are logged with the caller named rather than surfacing as an error attributed to nothing.

Not in this release

The Sessions panel still does not search. No filter, no fuzzy switcher, no keyboard jump — you scroll the list. It was the stated gap in v1.0.5 and it is still the gap; the chat surface took this cycle.

The empty-state wordmark had a false start. A redrawn mark shipped and had to be pulled: it was built from full block characters on the assumption they tile seamlessly in any monospace font, which is not true — whether █ fills its cell is a property of the font, and in Monaco it does not, so the logo shattered into disconnected bars. The replacement is drawn from box-drawing rules and real text, and was checked in seven font families before shipping this time.

Test coverage

• 34 suites, 575 cases across the bundled extensions — all green.
• test/chatSurface.test.js (23 cases) — the single-surface contract: one live webview, one message handler, the transcript surviving a hand-over, and a close that seals rather than discards.
• test/webviewCss.test.js (33 cases) — the layout invariants no DOM test can see: the measure, the shell column, the type scale, and the wordmark's width against its container.
• test/agentNoWorkspace.test.js (6 cases) — which tools are withheld without a root, which must keep working, and that the context meter is billed for the list that was actually sent.

Full changelog: v1.0.5...v1.1.0

LevelCode v1.0.5

Your chats stop disappearing. This release turns every conversation into a session you can find, resume, fork and export — and gives each project a memory that carries what you did last time into the next chat. Both are plain files on your disk, both are readable and correctable by hand, and both treat what they learned as possibly stale, possibly poisoned rather than as gospel.

Highlights

Chats are sessions now

Every conversation is persisted as it happens — one append-only JSONL file per session, under ~/.levelcode/sessions/<project>/. New Chat no longer throws work away; it seals the session and starts a fresh one.

The Sessions panel (AI: Sessions, and a sidebar view) lists them in time buckets — Today, Yesterday, This week, Earlier — with the title, the file it touched most, and an activity sparkline. Click a card to resume it. On hover the second line swaps to the actions: Rename · Fork · Copy · Done · Delete · Pin.

Nothing is destroyed by accident. Done archives rather than deletes, Delete is a soft trash, and both offer Undo immediately afterwards. Sessions you stop touching auto-archive after 30 days (levelcode.ai.sessions.autoArchiveDays) — pinned ones never do.

Resume is honest about what it can carry

A long session may not fit the model's context window. Rather than silently truncating, LevelCode plans the resume in three tiers: if the whole transcript fits, you get it verbatim; if it doesn't, it loads the most recent turns and tells you so in the chat, in words, rather than pretending the earlier ones are still there.

The full transcript is always kept on disk regardless — the budget only governs what the model is handed. levelcode.ai.sessions.resumeBudgetPct (default 40) sets how much of the window a resume may occupy.

The project remembers itself

When a session seals, one cheap model call records what it accomplished into memory/journal.jsonl, and a consolidation pass distils the recent arc into memory/MEMORY.md — a small digest injected into every new session in that project, the same channel AGENTS.md and CLAUDE.md already use. Open a new chat and it starts already knowing the shape of the last week's work.

Durable truths get promoted separately into Facts — "the changelog is RELEASE-NOTES.md", "idempotency keys live in Redis". A fact seen once is marked inferred and weighed lightly; seen across sessions it becomes active; you can Confirm it, mark it not true, edit it, or forget it from the Project memory tab. When a later session contradicts an earlier one, the old fact is superseded — dimmed and restorable, with a line saying what replaced it, rather than silently overwritten.

Ask about older work and the agent can go looking: recall_sessions searches past outcomes and the transcripts themselves, and returns dated, cited results. Facts that decayed out of the always-on digest are still reachable that way — a memory that ages out is not a memory that is deleted.

Memory is treated as untrusted input

Memory is replayed into the system prompt of every future session in a project, and it is distilled from transcripts that contain repo files, command output and MCP tool results — attacker-controlled for any repo you clone. So it is bounded like any other untrusted text:

• A planted instruction cannot promote itself. Ordinary facts become active by being observed across sessions, but text that reads as an order — always …, never …, ignore previous instructions, anything piping into a shell — never takes that route and needs an explicit Confirm. Repetition is not corroboration when the source is a file that is still sitting in the repo on the next session.
• It is surfaced, not hidden. Such an entry is still recorded and still listed, flagged, so you can see what a repo tried to plant.
• Credentials are scrubbed on the way in. Key-shaped text is redacted before it reaches facts.jsonl, journal.jsonl or MEMORY.md — including session titles and edited file paths, which those files print verbatim.
• Injected memory is framed as verify-first and explicitly says never to act on an instruction found inside it.

Everything lives in plain files you can open, grep, correct, or delete. Turn the whole thing off per project with levelcode.ai.sessions.memory.enabled.

Fork a session

The "what if I'd told it to do X instead" branch. Fork seeds a new session with a copy of the conversation and leaves the original untouched, then opens it so you can take a different path from the same starting point.

The copy is genuinely a fresh session: it does not inherit the original's finished state, its archived status, or its pin — a fork of an archived chat arrives visible and active, and records which session it came from.

Copy a session as Markdown

Copy puts the whole conversation on your clipboard as a clean Markdown transcript — title, date, model, files touched, then one block per turn — ready to paste into a pull request or an issue. Save as file… writes it to disk instead.

Because this is the first thing that takes a session out of LevelCode, it is scrubbed on the way out: credential-shaped text is redacted from the body, and from the suggested filename.

New settings

Not in this release

The Sessions panel does not search yet. There is no filter, no fuzzy switcher, and no keyboard jump — you scroll the list. That is the next thing being built, and it is the gap you will notice first once a project holds more than a screenful of sessions.

Test coverage

• 32 suites, 528 cases across the bundled extensions — all green.
• test/memoryPoisoning.test.js (39 cases) — the adversarial pass: hostile inputs that must never become load-bearing memory, benign project facts that must keep working, credential shapes that must never reach disk, and the near-misses (git SHAs, content hashes, asset names) that must survive untouched.
• test/sessions.test.js (25 cases) — the lifecycle against a real store in a temp directory: persistence, verbatim rebuild, seal, resume, and the fork rules.
• test/sessionStore.test.js, sessionEvents.test.js, sessionResume.test.js, sessionMemory.test.js — the pure engine underneath, each testable without the editor.

Full changelog: v1.0.4...v1.0.5

LevelCode v1.0.4

The big one: the agent can now use external tools over MCP — a filesystem server, GitHub, Postgres, an internal company server — alongside its own built-in tools, with a security model that treats an MCP server as exactly what it is: arbitrary code that runs with your privileges. Plus autopilot now honors a changed step limit live, and the agent's activity timeline reads as one clean thread.

Highlights

Bring your own tools, over MCP

Point LevelCode at any Model Context Protocol server and its tools join the agent's own — namespaced server__tool, usable by every model LevelCode supports, with no code to write. This first release speaks stdio (a server you run as a local subprocess), which covers the overwhelming majority of servers and sidesteps the remote-transport spec churn landing this year; remote/HTTP servers come later.

You declare a server in one of two places, and they are trusted differently on purpose:

• levelcode.ai.mcp.servers (your own settings) — you typed it, so it starts.
• .levelcode/mcp.json (committed in a repo) — read and listed, but it never starts on its own.

Security is the feature, not a footnote

Spawning an MCP server is at least as dangerous as running a shell command, so every edge is gated:

• A launch gate for repo servers. A .levelcode/mcp.json server asks before it ever runs, showing you the literal command, arguments, and environment — no summarizing. Approve once and it's remembered, but trust is bound to a SHA-256 fingerprint of exactly what would run: change the command, an argument, or an env var and it asks again — so a repo can't get npx …server-filesystem approved and then quietly swap in curl … | sh under the same name. With no window to ask in (a headless or test context) it fails closed and simply doesn't start.
• Every tool call asks by default, showing server · tool · arguments before it runs.
• Autopilot doesn't relax this. MCP tools are third-party code, so autopilot still prompts for them — the only thing that grants a silent run is your own per-tool allow-list ("github__list_issues": "allow"). A server's own "this is safe" hint grants nothing on its own; its "this is destructive" hint forces a prompt regardless.

Manage MCP servers without touching JSON

A new AI: Manage MCP Servers… command (and a link at the foot of /mcp) lets you:

• Add or remove a server through a prompt instead of hand-editing settings — it writes your global settings only, never a repo's, so adding one can never weaken the launch gate above. The arguments box takes a real command line and splits it quote-aware, so -y @modelcontextprotocol/server-filesystem "/Users/me/My Documents" stays one path.
• Revoke trust you granted a repo server, per server or workspace-wide — the missing other half of "trust on first use," which used to be a write-once decision.
• See a stale approval for what it is — a server whose command changed since you approved it now reads command changed — needs approval, not a bland "not started," because that gap is exactly the attack the launch gate exists to stop.

See what's configured with /mcp

/mcp lists every configured server — running or not — with its state, where it came from, its exact command, and (once live) its tools and whether each is allow-listed. It answers the two questions you actually have — why isn't my server being used? and what is this repo asking to run? — that a list of only-running servers can't. The context-usage popover now also breaks out an MCP tools line, so the standing per-turn cost of a chatty server is no longer invisible.

A cleaner agent timeline

The activity thread under each run — its tool calls, approvals, and commands — now reads as one connected line instead of disconnected stubs: the connector rail threads continuously through consecutive steps (only a stretch of narration breaks it), the way GitHub, Cursor, and Claude Code draw theirs. And an approved MCP tool call is now a single row — not an Approved · server · tool chip plus a separate 🔌 server · tool node — so it's one row per action, matching how allow-listed calls already looked.

Autopilot honors a changed step limit, live

Raising Maximum tool-use steps mid-run now takes effect on the very next step, instead of being frozen at the value from when the goal started — so bumping it from 25 to 1000 when autopilot pauses at "step limit" actually lets it keep going.

Test coverage

• 27 suites across the bundled extensions, all green.
• The MCP core is pure, testable modules by design: config merge + tool-name namespacing + the approval policy (mcpConfig), the launch fingerprint and trust logic, and the /mcp + manage-servers row builders are all unit-tested without spawning a process or opening the editor — in the same two-corpus style the command-danger classifier uses, where the test banner states the load-bearing direction.
• The webview timeline changes are pinned by the chat UI's static-CSS-invariant suite (webviewCss) — e.g. the rail's connector offset can't silently drift from the row gap, and the one-row MCP fold stays wired end to end (agent.js → approval chip → run-node).

Full changelog: v1.0.3...v1.0.4

LevelCode v1.0.3

A design release for the one screen everyone opens: the signed-in account panel is rebuilt in the levelcode.ai "classic" look — a floating-chevron hero, a model-agnostic plan pill, a Documentation link, and a primary Manage account button — followed by the fixes that make it fit and close cleanly.

Highlights

A redesigned account panel

The signed-in panel used to be a plain card: an initials avatar, a model name, a credits figure, and a paragraph explaining "gateway mode." It's now the levelcode.ai classic (atom.io) surface end to end — the same light / One Dark palette, system type, and tabular numerals as the rest of the product.

• A floating-chevron hero. The three rising chevrons and drifting "portal" circles from the landing page open the panel in place of the initials block — brand-forward and quietly in motion (portalDrift, 7s, staggered per layer), and perfectly still for anyone who sets prefers-reduced-motion.
• Model-agnostic. The pill reads plan · Pro+ on the gateway, or your own key on BYOK — never a specific model name (those churn, and naming one confused people about what they were paying for). The credits number is gone from here; it lives on the account page, where there's room to explain it.
• The gateway explainer is gone. That "how the gateway works" paragraph wasn't telling you anything the routing chip in the footer doesn't. BYOK keeps a single line — that your keys never leave your machine — because there it's genuinely reassuring.
• A Documentation link (→ levelcode.ai/ai/docs) sits in the footer beside the "Synced · settings · skills · keymaps" note. It's keyboard-operable, and like every external link in the panel it can only ever open a fixed, known destination — never a URL handed in from the page.
• Manage account is the primary button — the one you're most likely to want — except on the free tier, where the accent belongs to Upgrade to Pro so two buttons never compete for it.

Fit and finish

The redesign shipped with three follow-ups from actually living with it:

• The chevron no longer clips. It's smaller and top-anchored, so the hero is fully contained at every window size instead of being cut off along the top edge.
• The × closes again. The full-bleed hero was painting over the close button and swallowing the click; it's back on top (z-index above the hero, which no longer intercepts pointer events) and closes the panel as expected — by keyboard too.
• High-contrast themes defer to the editor's own tokens. The card maps its colors to --vscode-contrastBorder and friends under a high-contrast theme, so your VS Code accessibility choice wins instead of the card hard-coding its palette.

Test coverage

• 24 suites across the bundled extensions, all green.
• This is a webview change, so it's verified the way the picker and plan-card work were — by parsing the shipped chat.html (the webviewCss suite and friends) rather than by snapshot.

Full changelog: v1.0.2...v1.0.3

LevelCode v1.0.2

A UI-polish release. The model picker is name-forward instead of a wall of detail, a finished plan folds away on its own, and the footer shed a redundant chip.

Highlights

A cleaner model picker

Picking a model used to mean reading three technical fields per row — the raw id (anthropic/claude-opus-5), the context size, and a 6.67× credits · 1000K ctx · ≈103 turns left second line. Handy for debugging, noise for choosing. Each model is now a single, name-forward line: just the name, an active check, and a lock on "coming soon" models — the way Cursor and Claude Code present them.

Your plan and remaining credits still sit in the picker's header, so the number that matters isn't lost; only the per-row debug detail is gone. Type to filter by model name.

A finished plan cleans up after itself

When the agent works from a checklist, a completed plan used to sit fully expanded in the sticky bar — a large part of the panel — long after the run had ended. Now, matching how Claude Code and Cursor handle a finished plan:

• It auto-collapses to its green header the moment every item is done: still there, still one click to expand, just no longer hogging the view.
• A dismiss (×) closes it outright — and also clears a plan left stranded by a run that was stopped or errored. It's keyboard-operable (Tab to it, Enter / Space to close), like the other controls in the plan bar.

A slimmer footer

Dropped the redundant home-icon "LevelCode Cloud" chip from the status bar. The mode-and-plan chip on the right (Gateway · Pro+, BYO key, Direct · no key) already tells you where your requests go.

Test coverage

• 24 suites across the bundled extensions, all green on every release.
• These are webview / picker UI changes, so they're verified by parsing the shipped chat.html — every script block, plus the webviewCss and creditFormat suites that read it — rather than by snapshot.

Full changelog: v1.0.1...v1.0.2

LevelCode v1.0.1

A reliability patch. A transient upstream hiccup now retries and recovers instead of killing your run, and when something does fail you get an honest, readable message rather than a wall of proxy HTML mislabeled "OpenAI".

Highlights

Runs survive a transient upstream blip

When the model gateway briefly can't reach a healthy backend it returns a 502 / 503 / 504 — a momentary hiccup that used to end the whole run. LevelCode now retries once, before anything has streamed, so the common case (the backend is fine a second later) just recovers and your turn carries on. You'll see a brief upstream busy — retrying… instead of a dead run.

It's deliberate about when it retries: only a 502, 503, or 504, and only before any output has appeared — so a retry can never duplicate text or double-charge. It does not retry a rate-limit (429), a 500, any other 4xx, or an aborted request, and a 401 still refreshes your session as before. Hitting Stop during the wait stays instant.

Honest error messages

A gateway failure used to land in the chat verbatim, like this:

OpenAI API 502: <html><head><title>502 Bad Gateway</title></head><body>…

Two things were wrong: it was labelled OpenAI even for an Anthropic model on your LevelCode Cloud plan, and it pasted the raw nginx error page into the transcript. The same failure now reads:

LevelCode Cloud API 502: Bad Gateway

The route is named correctly — LevelCode Cloud, OpenRouter, or whichever provider actually handled it — and the body is parsed for a real message. An HTML proxy page carries none, so it falls back to the plain status reason instead of being dumped in.

Under the hood

• The repository's LICENSE is now recognised as MIT by GitHub. The MIT text is kept verbatim so the detector matches it, the Code-OSS provenance + trademark notice moved to a dedicated NOTICE file, and the in-app license link points at a branch that exists (HEAD) rather than a main that never did (it had been a 404).

Test coverage

• 24 suites across the bundled extensions, all green on every release.
• providers.test.js grew to 28 cases: the error sanitiser (a real nginx 502 page collapses to Bad Gateway, a JSON {error:{message}} is preserved, the label names the route — not the adapter) and the retry (recovers on a 502-then-200, gives up cleanly after one try, never retries a 4xx or an abort). The retry is also exercised end-to-end against a stubbed stream, so the whole router → adapter path is covered, not just the helper.

Full changelog: v1.0.0...v1.0.1

LevelCode v1.0.0

LevelCode reaches 1.0 — running Anthropic's frontier model. Claude Opus 5 is now a first-class pick: in your roster if you're on a LevelCode Cloud plan, or in the OpenRouter list if you bring your own key — wired at its full 1M-token context and priced exactly where Opus 4.8 sat.

The 0.9 line built the parts — the agent loop, apply-then-review edits, the browser that opens itself, credits instead of dollars. 1.0 is that foundation, stable, running on Opus 5.

Highlights

Claude Opus 5

Opus 5 is Anthropic's newest frontier model, and LevelCode reaches it two ways:

• On a LevelCode Cloud plan, it's already in your roster. Models come from the server, so Opus 5 shows up without updating the editor, metered in credits like everything else — roughly 195 Opus 5 turns on the top plan's 10,000 credits.
• Bring your own OpenRouter key and it's in the picker. Claude Opus 5 — Anthropic · frontier, 1M · via OpenRouter, near the top of the OpenRouter list. Your key, billed by OpenRouter; the editor shows a cost estimate rather than a credit balance.

Two things it gets right that a bare model id wouldn't:

• The full 1M-token window. LevelCode's context heuristic assumes 200K for any claude- model; left at that, the in-run context meter would warn "full" at a fifth of Opus 5's real budget. Opus 5 has an explicit 1,000,000-token caps row, so the meter reflects the window you actually have.
• Honest pricing, whichever slug you type. Opus 5 costs what Opus 4.8 did — $5 / M in, $25 / M out, cached reads at $0.50 / M — so the OpenRouter "powerful" tier moved to the newer model for the same money, and prompt caching is on so repeated context bills at the cached rate. The fast variant is double ($10 / $50 per M); its price is pinned explicitly so the estimate can't quietly under-report it by half.

Your whole roster on the first open

Opening LevelCode with a briefly-expired Cloud token used to collapse the model picker to a two-model fallback — you'd see two models on a plan that offers the full lineup, and only a reopen fixed it. The roster fetch now refreshes the token and retries, and if anything still fails it keeps the last-known-good list rather than discarding it. You get your full roster on the first try.

Under the hood

• 1M context, measured — not guessed. Opus 4.8 on OpenRouter is also a 1M-window route, so its caps row was split by route: the OpenRouter slug reports 1M, the bare Anthropic id stays at 200K. We deliberately did not raise the native path to 1M — this editor sends no anthropic-beta header there, so the long window isn't confirmed reachable, and promising room the API would refuse is the worse failure. Each route reports its own truth.
• The "powerful" OpenRouter tier now names a model the registry knows. The old Opus 4.8 slug never was in it, so a per-node model override pointing there failed validation and fell back silently; moving the tier to Opus 5 fixes that as a side effect.
• Release builds moved off the deprecated Node 20 runtime. GitHub had begun force-running the release actions on Node 24 with a per-step warning; the action pins now target Node 24 natively.

Test coverage

• 24 suites across the bundled extensions, all green on every release.
• catalog.test.js (13 cases) pins both sides of the 1M split — the OpenRouter slug at 1,000,000, the bare id at 200,000 — plus the heuristic default for an unlisted Claude model, so the context meter can't silently regress. sketch.test.js (16 cases) pins Opus 5's pricing, including the fast variant the family fallback would otherwise have billed at half.

Full changelog: v0.9.2...v1.0.0

LevelCode v0.9.2

A small, practical release: your site opens itself in the editor while the agent builds it, and what a run costs is now measured in credits rather than dollars.

Highlights

The browser opens itself

LevelCode has always shipped a built-in browser — but you had to know the command to find it, so most people never did. Now it appears on its own: the moment the agent starts a web server in the background, the site opens beside the chat.

• It updates as the agent works. Edits land on disk immediately (that's the apply-then-review model — Keep/Undo comes after), so your dev server's watcher fires HMR and the preview refreshes before you click Keep. Ask for a page, watch it appear.
• It never steals your focus. A server coming up mid-run doesn't yank the caret away from whatever you're typing.
• Closing it means closed. Each address opens at most once per session, so a chatty server can't reopen the tab you just dismissed, and a restart-on-save server can't stack one tab per reload.
• Only local addresses, ever. The address is read from the dev server's own output — which is whatever a project's start script chose to print. So only localhost, 127.0.0.1, the IPv6 loopback [::1], and the bind addresses 0.0.0.0 / [::] (treated as localhost) are opened; a remote URL printed by a script is ignored. A hostile repo can't point your editor's browser somewhere else.

Turn it off with levelcode.ai.preview.autoOpen, or open previews yourself with Simple Browser: Show.

Credits, not dollars

The response bar under each run now reads Opus 4.8 · 46 credits · 1,279 left instead of dollar amounts. $1 = 100 credits, so a $100 Ultra plan is a 10,000-credit allowance.

This is a change of unit, not of price — nothing about what you pay or what a turn costs has moved. A balance that ticks down in dollars reads as money draining away; an allowance reads as something you're meant to spend, which is what it is.

• Small runs stay honest. A cheap-model turn costs a fraction of a credit, so it shows as 0.4 rather than rounding to 0 and looking free.
• One number everywhere. The editor and levelcode.ai/ai/account now format the same figure identically, down to digit grouping.

Under the hood

• The dev-server address is sniffed from the accumulated output, not a single chunk. Node delivers stdout in arbitrary slices, so a URL routinely arrives split (http://local + host:5173/) and would otherwise never be recognised — the preview would silently never open.
• verify.js gained its first test suite, and shed a stray NUL byte that had been making the whole file invisible to grep and diff.
• Release builds no longer download a Playwright browser during bootstrap — an unnecessary network dependency that failed one architecture while the other passed.

Test coverage

• 24 suites across the bundled extensions, all green on every release.
• verify.test.js (16 cases) — the preview sniffers, led by the one that matters: a remote address in command output must open nothing. creditFormat.test.js (8 cases) extracts the real formatters out of the shipped chat.html, so the tests can't drift from what ships.

Full changelog: v0.9.1...v0.9.2

LevelCode v0.9.1

Two big things this release: the agent gains external tools via MCP, and it learns to narrate its work instead of scrolling a wall of chips.

Highlights

The agent can use external tools — MCP support

LevelCode's agent now speaks the Model Context Protocol, so it can use tools from external MCP servers — a filesystem server, GitHub, Postgres, an internal company server — right alongside its own built-in tools. There's no glue code: an MCP tool becomes an agent tool directly.

Add a server in your user settings and its tools show up in the agent, namespaced server__tool:

"levelcode.ai.mcp.servers": {
  "filesystem": { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-filesystem", "/path"] }
}

Security is the feature here, not a footnote — an MCP server is a process LevelCode spawns with your privileges:

• User-authored only. These live in your user settings; a repo's committed .vscode/settings.json can't add a server, so opening an untrusted project can never make LevelCode spawn a process. A repo's own .levelcode/mcp.json is read and listed but never started on its own.
• Nothing runs unless you allow it. Every MCP tool call is gated by default — including under Autopilot. A tool runs only once you allow-list it in levelcode.ai.mcp.toolPolicy, and a server's own "destructive" hint can only ever tighten that, never loosen it.

This is the first slice: servers are configured in settings and tools are enabled through the allow-list. A per-call approval card and a one-click "Add MCP Server…" are what come next.

A calmer, narrated transcript

An agent run now reads like a colleague narrating their work rather than a flat scroll of chips and cards.

• Short prose between actions. The agent says what it's about to do, then interprets what it found — in the same turn, so it never stops to chatter instead of working.
• Activity folds into one card. Consecutive actions collapse into a single expandable group: while it runs, the header shows the live step; when it finishes, a past-tense summary takes its place — "Read and edited PLAN.md +56 −0, ran 2 commands."
• Failures read as findings. A hiccup shows up as a one-line Correction: and a next step, not an alarm.
• Plain-language command labels. A run_command shows what it does ("Run the extension unit tests"); the raw command stays tucked behind the card.
• One question at a time. ask_user now asks a single question per prompt.

Smaller things

• Shift+Cmd+I now focuses the chat — previously only Ctrl+Cmd+I did.
• A single circle-check glyph wherever a "done" check appears, and an HTML5 shield icon for .html files.

Under the hood

• MCP is three small, dependency-free modules — no SDK, in keeping with the plain-JS extension style. mcpProtocol.js (JSON-RPC 2.0 framing + typed-content flattening, pure), mcpConfig.js (server config, tool-name namespacing, and the approval policy — pure), and mcpClient.js (the stdio subprocess: spawned detached and group-killed on New Chat and reload, with a per-call timeout and an output cap so one server can neither hang the agent nor flood its context). The full plan and threat model are in docs/MCP.md.
• The calm transcript ships as two halves — the voice lives in the agent's system prompt (agent.js), the grouping in the chat webview (chat.html). Scope and design are in docs/CALM-TRANSCRIPT.md.

Test coverage

• 56 MCP unit tests, all off-editor (no process, no network): mcpConfig.test.js (41 — tool names stay provider-legal across a hostile corpus, a repo's config can never shadow or auto-start a server, untrusted keys are dropped before they can reach a prototype, and the allow-list never defaults to "allow") and mcpProtocol.test.js (15 — JSON-RPC framing with partial-line buffering, and base64 image/audio payloads never reaching the stored transcript).
• The CI gate runs every bundled extension's suite on each release.

Full changelog: v0.9.0...v0.9.1

LevelCode v0.9.0

Two features this release: paste JSON and watch it tidy itself, and Kimi K3 arrives in LevelCode Cloud.

Highlights

JSON beautifies itself on paste

Working with minified JSON — one giant line, escaped, straight from a log or an API response? Paste it into LevelCode and it lands pretty-printed.

• Any buffer. A .json file, a .txt, an untitled scratch tab — it doesn't matter what the editor thinks the buffer is. (That's the difference from the built-in format on paste, which only fires in a buffer already known to be JSON.)
• Only when it's actually JSON. It transforms a paste only when the whole thing is a valid JSON object or array. A bare number, a string, code that merely contains JSON, JSON with trailing prose, or already-formatted JSON — all left exactly as pasted. Non-JSON pastes are never touched.
• Yours to tune. levelcode.jsonPaste.enabled turns it off; levelcode.jsonPaste.indent follows your editor's indentation by default, or takes a number of spaces or "tab". And a normal paste is always one click away via the paste options.

It lives in the Notepad++ Pack, alongside the macros and line operations.

Kimi K3, in LevelCode Cloud

Moonshot's Kimi K3 — a 2.8-trillion-parameter model with a 1,048,576-token context window, built for long-horizon coding and agentic work — is now a selectable Pro model in LevelCode Cloud. Sign in, open the model picker, and choose it. No API key of your own required.

• A choice, not a default. Your plan's flagship is unchanged. K3 sits in the picker with its cost shown honestly: it runs about 4× the credits per turn of the default (it reasons on every turn, and that reasoning is billed), so a Pro budget goes roughly a quarter as far on it. Pick it when the task is worth it.
• The editor now meters it correctly. Select K3 and the context gauge reflects its real ~1M window instead of the old 200K default — so long sessions don't warn "full" five times too early.

Under the hood

• extensions/levelcode-npp-pack/ — a pure analyzePaste() core (no editor dependency, fully unit-tested) behind a DocumentPasteEditProvider, so the paste transform is decided by tested logic and the size guard is measured in real UTF-8 bytes.
• extensions/levelcode-ai/providers/catalog.js — a capabilities row for moonshotai/kimi-k3 (1,048,576 ctx) so the meter is right; the model itself becomes selectable via the LevelCode Cloud roster, no editor release required.
• extensions/levelcode-ai/scripts/kimi-k3-spike.js — a standalone harness that drives the real agent tool-loop against K3, to confirm an always-on-reasoning model survives the round-trip before it's leaned on. See docs/KIMI-K3.md for the full scope.

Test coverage

• test/jsonBeautify.test.js — 13 cases: minified→pretty round-trips, the container-only / trailing-junk / already-formatted guards, indentation, and a UTF-8-byte size cap that a multibyte payload can't slip past.
• The pre-build CI gate now discovers every bundled extension's suite (not just one), so the new Notepad++-Pack tests run on each release.

Full changelog: v0.8.1...v0.9.0