fix(vscode): honor current configuration and prepare CLI-example releases

.docs/vscode-configuration-release-20261014.md

@@ -0,0 +1,26 @@
+# VS Code configuration fixes and Continue 0.1.1
+
+Refs terraphim/terraphim-ai#3488 (Gitea).
+
+The released VS Code 0.1.2 package ignored the configured Atomic agent on first autocomplete activation, retained a Store after endpoint changes, and did not consult `enableLocalServer` when sending requests. Its README also attributed a two-character trigger to the Atomic provider, which only responds after a space.
+
+## Changes
+
+- `src/helpers/getStore.ts` reads current settings and keys the actual `@tomic/lib` Store by endpoint and agent. Empty credentials use anonymous access; invalid credentials do not replace a valid cache entry or claim successful activation.
+- `src/extension.ts` resolves the current Store for commands and completion requests. A response from an old Store is discarded. Configuration failures produce actionable notifications.
+- `src/helpers/serverConnection.ts` uses the configured HTTP(S) URL for every request. With local mode disabled it refuses literal localhost/loopback URLs; it never invents a public fallback. This is URL selection, not a DNS/network security boundary. Requests have a five-second timeout and endpoint/role changes advance a revision.
+- `src/helpers/completionCache.ts` tracks both request generation and configuration revision. An old response cannot populate a newer query's cache, and an old query cannot fall back to a newly configured endpoint.
+- Packaged README/settings/changelog describe this behavior and the actual Atomic space trigger. Version 0.1.3 includes the previously merged runnable examples for the separately installed `terraphim-grep` and `terraphim-agent` CLIs.
+- Continue 0.1.1 packages those CLI examples and the tested graph-restart instructions. Its actual MCP initialization version is checked against the integration manifest. This release does not add a Continue Hub listing or change model configuration.
+
+## Verification
+
+Before bumping versions: TypeScript compile and ESLint pass; 63 package/integrity tests, 29 existing actual-WASM/protocol/export/link tests, four request-cache state regressions, and six real Continue SDK/install/package/source tests pass. Continue transport uses released `terraphim-grep` 1.21.20 locally; CI retains its pinned Linux 1.21.19 binary.
+
+`tests/nativeConfiguration.cjs` runs through the existing packaged native-host suite. It updates only that suite's disposable profile, exercises the actual VS Code API and packaged Atomic Store, restores settings, and saves a separate `configuration.json`. It proves configured credentials on first activation, Store replacement after endpoint/credential changes, anonymous reset, malformed-agent refusal, canonical loopback refusal, explicit remote URL selection, real unavailable-server handling, and role revision changes. It does not claim authenticated remote service access.
+
+Local VS Code 1.141.2 passed those configuration checks and actual saved-file/KG outputs. One earlier candidate also passed native history/reopen; the later candidate refused the history assertion because its window was unfocused. That failed attempt is retained and does not qualify the final package. The immutable release workflow must pass the complete lifecycle on the exact packaged bytes on Linux, macOS and Windows before publication. No all-41 or visual-UI qualification is added by these tests.
+
+The first PR matrix passed Linux/macOS but failed Windows' local-mode assertion. Its log initialized two Stores at the same endpoint: dynamically requiring a Windows URI-derived path can instantiate another copy of a singleton. The native test now selects exactly one already loaded production module by actual file identity, records requested/loaded paths, and retains all refusal assertions. A fresh complete matrix must confirm the correction; the test never refreshes the singleton itself or substitutes its API.
+
+No release asset replacement, tag reuse, Open VSX readiness change or branch-protection change is part of this amendment.

integrations/continue/README.md

@@ -78,8 +78,16 @@ TERRAPHIM_CONTINUE_RECEIPT=/absolute/new-receipt.json \
 
 The actual SDK client initializes the actual stdio server and calls the released CLI. It verifies literal Concern baseline has no chunks, the exported graph retrieves Risk, retrieval has no answer, synthesis is unavailable by default, invalid parameters and changed graph are refused. Installer tests execute the real installer and verify preservation and symlink refusal. No provider synthesis or native Continue UI acceptance is inferred from these tests.
 
-`risk-concern.exported.json` is the exact public graph exported by the existing VS Code editor in the 2026-10-12 native proof; it is a reusable example input, not evidence of a new operation. The integration CI downloads the immutable 1.21.19 Linux archive, verifies its pinned digest, runs these tests, and produces a separately downloadable zip and SHA256SUMS. A dedicated `terraphim_continue-v0.1.0` tag runs the checks before publishing its own two-asset integration release; it never attaches to VS Code releases. The bundle records its source commit, clean-tree state and payload hashes. Immediately before each release mutation, the workflow verifies the live remote peeled tag still equals the qualified source and belongs to main history. Existing release assets must match exactly; partial uploads fail closed for inspection. The release job uses immutable action versions, a `continue-releases` environment, per-tag concurrency, and mandatory anonymous exact-byte download verification after publication.
+`risk-concern.exported.json` is the exact public graph exported by the existing VS Code editor in the 2026-10-12 native proof; it is a reusable example input, not evidence of a new operation. The integration CI downloads the immutable 1.21.19 Linux archive, verifies its pinned digest, runs these tests, and produces a separately downloadable zip and SHA256SUMS. A dedicated `terraphim_continue-v0.1.1` tag runs the checks before publishing its own two-asset integration release; it never attaches to VS Code releases. The bundle records its source commit, clean-tree state and payload hashes. Immediately before each release mutation, the workflow verifies the live remote peeled tag still equals the qualified source and belongs to main history. Existing release assets must match exactly; partial uploads fail closed for inspection. The release job uses immutable action versions, a `continue-releases` environment, per-tag concurrency, and mandatory anonymous exact-byte download verification after publication.
 
 We inspected the existing clients `terraphim_mcp_server`: it is a broader role-configured `TerraphimService` server, not installed in this environment, and its search path does not delegate the exact released grep exported-graph/`--answer` behavior. This thin transport reuses the released CLI instead of changing that service or reimplementing KG semantics. The maintained MCP v1 SDK 1.30.0 is pinned to match the existing stdio API; v2 is available but requires a separate compatibility qualification.
 
 References: [Continue MCP configuration](https://docs.continue.dev/customize/deep-dives/mcp), [Continue rules](https://docs.continue.dev/customize/deep-dives/rules), [official MCP Python SDK](https://github.com/modelcontextprotocol/python-sdk).
+
+## Release notes
+
+### 0.1.1
+
+- Include runnable examples for the separately installed `terraphim-grep` and `terraphim-agent` CLIs, including Logseq-compatible `synonyms::` concept Markdown.
+- Clarify graph updates: a running connection refuses changed graph bytes; reviewing the replacement and restarting captures the new graph digest.
+- Verify that behavior with the actual MCP transport and released `terraphim-grep` output.

integrations/continue/integration.json

@@ -1 +1 @@
-{"name":"terraphim-continue-integration","version":"0.1.0","tagPrefix":"terraphim_continue-v","mode":"Agent","nativeContinueQualified":false}
+{"name":"terraphim-continue-integration","version":"0.1.1","tagPrefix":"terraphim_continue-v","mode":"Agent","nativeContinueQualified":false}

integrations/continue/server.py

@@ -94,7 +94,7 @@ async def call(name, arguments):
                 return await execute(name, arguments)
 
     async with stdio_server() as (read, write):
-        await server.run(read, write, InitializationOptions(server_name='terraphim-continue', server_version='0.1.0', capabilities=server.get_capabilities(notification_options=NotificationOptions(), experimental_capabilities={})))
+        await server.run(read, write, InitializationOptions(server_name='terraphim-continue', server_version='0.1.1', capabilities=server.get_capabilities(notification_options=NotificationOptions(), experimental_capabilities={})))
 
 
 if __name__ == '__main__':

integrations/continue/test_package.py

@@ -12,7 +12,7 @@ def test_complete_allowlisted_bundle_and_refuse_overwrite(self):
         with tempfile.TemporaryDirectory() as directory:
             root = Path(directory)
             package(root)
-            archive = root / 'terraphim-continue-integration-0.1.0.zip'
+            archive = root / 'terraphim-continue-integration-0.1.1.zip'
             with zipfile.ZipFile(archive) as bundle:
                 self.assertEqual(bundle.namelist(), ['terraphim-continue/' + name for name in FILES] + ['terraphim-continue/source.json'])
             self.assertEqual((root / 'terraphim-continue-SHA256SUMS').read_text(), hashlib.sha256(archive.read_bytes()).hexdigest() + '  ' + archive.name + '\n')

integrations/continue/test_source.py

@@ -12,6 +12,7 @@ def test_lightweight_and_annotated_tag_identity(self):
 
     def test_actual_git_tag_gate_and_moved_tag_refusal(self):
         from pathlib import Path
+        import json
         import shutil
         import subprocess
         import sys
@@ -29,13 +30,15 @@ def git(*args, cwd=repo):
             git('add', '.')
             git('commit', '-m', 'Public integration fixture')
             head = git('rev-parse', 'HEAD')
-            tag = 'terraphim_continue-v0.1.0'
+            manifest = json.loads((here / 'integration.json').read_text())
+            tag = manifest['tagPrefix'] + manifest['version']
+            archive_name = f"terraphim-continue-integration-{manifest['version']}.zip"
             git('tag', tag)
             git('clone', '--bare', str(repo), str(origin))
             git('remote', 'add', 'origin', str(origin))
             build = root / 'build'
             subprocess.check_call([sys.executable, str(repo / 'integrations/continue/package.py'), str(build)], stdout=subprocess.DEVNULL)
-            command = [sys.executable, str(repo / 'integrations/continue/verify_source.py'), '--tag', tag, '--qualified', head, '--archive', str(build / 'terraphim-continue-integration-0.1.0.zip')]
+            command = [sys.executable, str(repo / 'integrations/continue/verify_source.py'), '--tag', tag, '--qualified', head, '--archive', str(build / archive_name)]
             self.assertEqual(subprocess.run(command, capture_output=True).returncode, 0)
             (repo / 'new.md').write_text('New public source revision\n')
             git('add', 'new.md')
@@ -46,7 +49,7 @@ def git(*args, cwd=repo):
             git('update-ref', 'refs/tags/' + tag, changed, cwd=origin)
             unreviewed_build = root / 'unreviewed-build'
             subprocess.check_call([sys.executable, str(repo / 'integrations/continue/package.py'), str(unreviewed_build)], stdout=subprocess.DEVNULL)
-            unreviewed = [sys.executable, str(repo / 'integrations/continue/verify_source.py'), '--tag', tag, '--qualified', changed, '--archive', str(unreviewed_build / 'terraphim-continue-integration-0.1.0.zip')]
+            unreviewed = [sys.executable, str(repo / 'integrations/continue/verify_source.py'), '--tag', tag, '--qualified', changed, '--archive', str(unreviewed_build / archive_name)]
             self.assertNotEqual(subprocess.run(unreviewed, capture_output=True).returncode, 0)
             git('checkout', '--detach', head)
             refused = subprocess.run(command, capture_output=True)

integrations/continue/test_transport.py

@@ -27,15 +27,17 @@ async def exercise():
                 (corpus / 'brief.md').write_text('Risk: supplier delays require a backup plan.\n')
                 local_graph = Path(directory) / 'graph.json'
                 local_graph.write_bytes(graph.read_bytes())
-                baseline = json.loads(subprocess.check_output([str(binary), '--search-only', '--json', '--paths', str(corpus), '--', 'Concern'], cwd=corpus))
+                baseline = json.loads(subprocess.check_output([str(binary), '--search-only', '--json', '--paths', str(corpus), '--', 'Concern'], cwd=corpus, timeout=30))
                 self.assertEqual(baseline['chunks'], [])
                 receipt['baseline'] = baseline
                 params = StdioServerParameters(command=sys.executable, args=[str(HERE / 'server.py'),
                     '--binary', str(binary), '--binary-sha256', hashlib.sha256(binary.read_bytes()).hexdigest(),
                     '--graph', str(local_graph), '--corpus', str(corpus)])
                 async with stdio_client(params) as streams:
                     async with ClientSession(*streams) as session:
-                        await session.initialize()
+                        initialized = await session.initialize()
+                        self.assertEqual(initialized.serverInfo.version, json.loads((HERE / 'integration.json').read_text())['version'])
+                        receipt['serverVersion'] = initialized.serverInfo.version
                         tools = await session.list_tools()
                         self.assertEqual([t.name for t in tools.tools], ['terraphim_retrieve'])
                         result = await session.call_tool('terraphim_retrieve', {'query': 'Concern'})

vs-code-terraphim-it/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.1.3 (preview)
+
+- Read the configured Atomic agent on first autocomplete activation and rebuild the store when its agent or endpoint changes. Clearing the agent selects anonymous access; invalid credentials refuse activation.
+- Apply `enableLocalServer` to every server request: disabling it refuses localhost and loopback URLs with an actionable warning. An explicit remote `serverUrl` is required; no remote fallback is selected automatically.
+- Discard stale autocomplete responses when the role, endpoint, agent or query changes while loading.
+- Correct the Atomic autocomplete instructions: it triggers after a space, not merely after two characters.
+- Include runnable `terraphim-grep` synonym-search and `terraphim-agent` memory examples, with separate CLI installation and links to the public walkthroughs.
+
 ## 0.1.2 (preview)
 
 - Verify the federated service principal and its Azure DevOps profile before Marketplace publication; retain non-secret identity evidence and refuse an unconfirmed profile.

vs-code-terraphim-it/README.md

@@ -92,12 +92,14 @@ Configure the extension through VS Code settings:
 ### Server Configuration
 - `terraphimIt.serverUrl`: Main Terraphim server URL (default: `http://localhost:8000`)
 - `terraphimIt.atomicServerUrl`: Atomic server URL for knowledge base (default: `https://common.terraphim.io/drive/h6grD0ID`)
-- `terraphimIt.enableLocalServer`: Use local server instead of remote (default: `true`)
+- `terraphimIt.enableLocalServer`: Allow localhost and loopback URLs (default: `true`). When `false`, set `serverUrl` to your remote Terraphim server. Local URLs are refused with a configuration warning; the extension never selects a remote service automatically. This checks the configured URL, not DNS resolution.
 
 ### Role and Agent Configuration
 - `terraphimIt.selectedRole`: Default role for searches and autocomplete (default: `Terraphim Engineer`)
 - `terraphimIt.agent`: Agent string for authentication (optional)
 
+Endpoint and agent changes take effect on the next Atomic request, including an already enabled autocomplete provider. Clearing `agent` selects anonymous access. Server endpoint and role changes invalidate cached completion results.
+
 ## Getting Started
 
 1. **Install Terraphim It** from the [Visual Studio Marketplace](https://marketplace.visualstudio.com/items?itemName=applied-knowledge-systems.terraphim-it) or [Open VSX](https://open-vsx.org/extension/applied-knowledge-systems/terraphim-it). Compatible Cursor installations use the Open VSX package.
@@ -136,8 +138,8 @@ Uses atomic store integration:
 ### Autocomplete Usage
 1. Enable your preferred autocomplete provider
 2. Start typing in any file
-3. Autocomplete suggestions will appear as you type
-4. Suggestions are triggered after 2+ characters and on space
+3. For **Terraphim AI Autocomplete**, type a space after your text. It offers terms from the Atomic knowledge base; typing two characters alone does not trigger Atomic results. Manual completion also requires a trailing space.
+4. For **Terraphim Server Autocomplete**, type at least two characters and invoke completion, or type a space after that word. The configured server supplies the suggestions.
 
 ### Server Health Check
 Use the health check command to verify:
@@ -188,7 +190,7 @@ The editor importer verifies published hashes. The existing link wrapper reuses
 
 **Autocomplete not working:**
 - Ensure you've activated an autocomplete provider
-- Check that you're typing at least 2 characters
+- For Atomic autocomplete, place the cursor after a space. For server autocomplete, use a word with at least two characters.
 - Verify server connectivity if using server-based providers
 
 **Authentication errors:**