Every release, in one place

A GPU vexp cannot use no longer takes the daemon with it. A user on Windows sent five seconds of log, repeated five times: the graphics driver on his laptop is older than the toolchain our GPU code was compiled against, so the first operation failed inside the graphics library and killed the process outright. Our supervisor restarted it, it chose the same GPU, and it died again, until the attempts ran out and he was left with an error in the corner of his editor and no idea why. The safety net we had could not help, because it catches a GPU that reports an error and this one never got that far. vexp now records that a GPU attempt is under way and clears the record once the model is loaded and running. Finding that record still there at the next start means the previous attempt did not survive, so this one runs on the processor and says so. It is remembered per machine, not per project, because an incompatible driver is a property of the machine, and any successful start clears it, so updating your driver brings the GPU back on its own with nothing to undo.

Using the processor only now means the processor only. Three separate paths asked for the model to run without the GPU: the setting in your config, the rule that protects Intel Macs, and the automatic fallback after a GPU failure. All three arrived at one line of code that left the layer count at its default, and that default means every layer, on the GPU. Every documented way of avoiding the GPU still handed it the entire model. Verified on a four gigabyte laptop card, before and after: nought of thirty-six layers offloaded when the processor is asked for, thirty-six of thirty-six when it is not.

A finished download is no longer deleted as incomplete. The expected size of the model was written down in megabytes and compared against bytes counted in mebibytes, two units that differ by about seven percent. A complete download therefore looked short of a number that was never right, was removed as corrupt, and started again from zero, forever, on a file of several gigabytes. The check now compares against the length the download server itself declared, so the only thing that can fail it is a download that really is short.

Your licence says what you bought. Two reports, one week, both about the same screen telling people something untrue. Activating a licence stored the key but left the cached status alone, so the device you had just activated showed as zero devices until a refresh hours later, which reads as an activation that did not work. And a lifetime licence displayed a renewal date a month out, because the date shown was an internal token roll rather than the entitlement behind it. Activation now registers the machine immediately, and a lifetime licence is described as one everywhere it appears.

Diagnostics that check the thing, not the paperwork. vexp doctor read the Codex configuration and stopped there, so a per-prompt orientation hook that pointed at a binary no longer on disk passed every check while doing nothing on every prompt, silently, forever. Doctor now runs the hook and names the path it cannot find. An Intel Mac is no longer told its accelerator is the GPU, which has been correctly unused there since 2.6.1 while the line reporting it stayed wrong. The extension stops warning about optional files that are absent by design, and the savings view has the command it was already advertising.

Documentation cannot crowd your code out of the answer. On a repository that is mostly documentation, and many are, every candidate the search returned could be a doc section, so a question about the code came back empty. Measured on a public project where documentation is 81 percent of the index: a question its own code answers returned nothing at all, while naming the exact symbol worked. Code is now guaranteed a place in the candidates and reserved slots in the answer. On a repository without documentation nothing changes at all. This one arrived an hour after 2.6.1 was cut, so it ships here.

Every platform, both marketplaces, same version. The VS Code gallery accepts a version several minutes before it serves it, and our release check gave up first, reporting a publish that had worked as a failure. It now waits long enough. Open VSX has a second state entirely, a version it has accepted but not activated, which is invisible to install and yet blocks republishing; the release now recognises that state by name instead of counting it as already done.

Documentation pivots arrive with the documentation in them. A user compared vexp against plain file reading on his Blazor project and published the result. vexp ranked the right two files, his architecture notes and his roadmap, and returned them as a score and a line range with no text at all, so his agent had to read them anyway and the call was pure overhead. His verdict was correct. Three causes were stacked: documentation is indexed by heading rather than by prose, both renderers printed that empty body, and markdown has a grammar, so once the text was restored it went through the code compressor, which turns declarations into opcodes and a paragraph into silence. A pivot with no stored body now reads its own lines, bounded, and prose skips the code path entirely. Answers about your documentation now contain your documentation.

Your index no longer loses files in silence. On a busy or small machine a database error during indexing was logged and skipped, so files vanished from the index while the run reported success. Nothing said so, and a search that found nothing looked exactly like code that did not exist. The transient is retried where it happens, and a file that still fails is now reported by name as missing from the index. Two clean runs of the whole test suite on two cores, the shape that reproduced it every time before.

Intel Macs: no more daemon crash on start. On a MacBook Pro with a Radeon Pro the daemon died on every start, and the CPU fallback in our documentation never ran. It could not: the bundled Metal shaders target Apple Silicon, so a missing kernel takes the process down inside the graphics layer, where there is no error left for us to catch. Intel Macs now run the local model on CPU without asking for the GPU at all, which is exactly where the fallback would have landed, and the daemon stays up. Apple Silicon is unchanged.

The VS Code extension installs the verification gate too. A beginner wrote asking what he was supposed to do with vexp after installing the extension. Checking his setup to answer him found the real problem: the extension wrote the orientation and context hooks but never the completion check, so verify_done only ever reached people who also ran vexp setup in a terminal. Anyone who installed the extension and stopped there, which is what an extension invites you to do, had half the product and no way to know. Both halves now install together.

Blazor markup bindings count as callers. A handler wired to a button through markup alone, Click="LoadDirectory" and its relatives, reported zero dependents while being the only thing that button does. Worse, a handler called once from code and once from markup reported one caller out of two, and a plausible wrong number is harder to catch than an obvious zero. Markup outside the code block is now scanned and the component becomes a real caller of the handler it names.

Connecting an agent is not permission to index. A user found a private repository indexed twice without being asked, simply because a session started in that directory. An agent launches vexp wherever it happens to be, so a connection can never mean index this. The presence of a .vexp directory is the consent record now: without it the server refuses, names the directory, and says which command to run if you do want it served. The refusal leaves the folder exactly as it found it.

Smaller truths: hooks, status, Windows, dry runs. Git hooks written where git will never run them, because a custom core.hooksPath was configured, now say so instead of reporting success. Daemon status no longer claims running when the process holding that pid is not the one serving. A dry run stops announcing that the daemon is up when it started nothing. A terminal-only setup no longer tells you to restart an editor it never touched. And the Windows daemon probe, which referenced a helper that does not exist and could only fail on Windows, is gone.

Impacted tests: the run-or-update mandate. When you finish a change, verify_done now lists the exact test files mechanically tied to what you touched: tests that reference your changed symbols through the dependency graph, plus suites the graph cannot see (anonymous jest/vitest files) caught by an import scan. Shared test infrastructure gets its own instruction: a test-utils helper tied to your change says UPDATE me, never run me. At the stop gate this becomes one precise instruction per session: run these files, fix what is red, then finish. Opt in to run mode and the gate executes them itself with your repo's own runner (jest, vitest, go test, pytest, cargo, gradle, maven, dotnet, rspec, phpunit) and blocks only on an actual failure, with the failing output as evidence. In the benchmark campaign this converted misses that a premium frontier model left on the table.

No more verify loops. Field data showed agents calling verification up to 16 times on an unchanged working tree, burning turns to re-confirm the same verdict. Now a repeat call on an identical tree returns instantly with the cached verdict and a clear instruction: nothing changed, the mandate stands, go run the tests. One call carries the signal; the loop is gone.

The layer survives compaction, and knows when to be quiet. Two sides of the same discipline. When your agent's context window is compacted or resumed, a lifecycle hook re-injects one paragraph so the fresh window still knows the daemon, the tools and the verification contract exist. And once a session is warm, orientation hints stop: after three served orientations vexp goes silent for that session, because by then the agent knows the repo and every extra injection is pure cost. Measured on long sessions, this is the difference between a layer that helps and a layer that lingers.

Stylesheets, Blazor components, WordPress wiring. Four file types that carried real structure and were simply invisible before. CSS, SCSS and LESS are parsed into rules, mixins and variables, so a class name in a template now leads somewhere. Razor and Blazor components (.razor, .cshtml) are parsed through their C# code blocks, which is what makes a Blazor caller of a C# service visible to impact analysis at all. And WordPress plugins finally wire up: add_action and add_filter registrations resolve to the handler they name, including the object forms ($this, method) and Class::method that every real plugin uses. Thirty-six languages now, with stylesheets alongside them.

The index tells you what it could not read. A user asked why a C# service reported zero dependents when a Blazor component clearly called it. The honest answer was that we had never parsed the caller's file type, and the honest answer was nowhere in the output. A confident zero is worse than no answer. So every orientation now carries a coverage line when it applies: these file types exist in your repository, vexp cannot parse them yet, so callers living in them are invisible to impact analysis, and an empty result means none found in indexed files rather than none exist. It names the extensions and the counts. You can trust the zero or go look, but you are no longer guessing which one you are reading.

A setup you can audit, and diagnostics that stop guessing. A measured third-party evaluation spent two days on a hook that setup had quietly failed to install: everything reported healthy, nothing was wired. That report is now a checklist we shipped. vexp setup --dry-run lists every file it would write, agent by agent, and writes nothing. A config it refuses to touch, or an agent whose target is not on the machine yet, gets a visible block at the end instead of a line lost inside a spinner. vexp doctor runs the orientation, verification and restore hooks the way your agent would, and reports what actually happened. When orientation stays silent, it now says which rule decided: this prompt already names known code, the session is already oriented, or this prompt is in the measurement control group. And the local LLM says why it fell back to CPU rather than leaving you to guess at a GPU that is right there.

Cline support, static Linux build, supervisor fix. Cline joins the supported agents: Setup Agents writes the rules file and registers the MCP server in every VS Code variant where Cline is installed, full tool surface included. The release train now ships a fully static Linux binary, smoke-tested on Alpine in CI, for containers, sandboxes and distroless images where dynamically linked binaries refuse to start. And an audit-grade field report on macOS led us straight to a supervisor defect: the shared MCP child was being replaced every 60 seconds because a version field was dropped on read. Fixed, with the reporter's exact regression cases in the suite.

Docs drift detection, at verify time. Rename a function, and somewhere a guide, a session note or an onboarding doc still describes the old shape. Hunting those down was a manual sweep; one power user had even assigned that exact job to vexp in his own review tooling. Now verification does it: when a session removes or renames a symbol, verify_done reports every markdown location still referencing it, each with file and line and the source file it vanished from. The design is deliberately anchored to the change, never to the corpus: we measured a corpus-wide "looks stale" scan at 61 percent noise on a real repository, which is how an oracle gets muted and forgotten. Anchored to what the session actually changed, findings are near-certain. Advisory by contract: it never blocks a stop and never fails a build. Release-notes files are recognized as records, not drift.

vexp daemons: see who holds your workspace slots. The concurrent-workspace ceiling made slots a resource, and one field report showed the failure mode: a notes vault opened once in an editor quietly held a slot for a day. vexp daemons lists every daemon on the machine with a live probe: which workspace, which engine version, index size, uptime, live entries first, stale entries labeled and never counted against you. The plan ceiling sits in the header and the release command in the footer. It also makes mixed-version daemons visible at a glance after an upgrade, which used to surface only as confusing tool errors. --json for scripting.

Retry storms can no longer amplify. An agent client that retries aggressively could fire the same request many times in under a second; each copy queued pipeline work and, with the local LLM enabled, stacked GPU jobs behind a busy device. One field report traced a machine-level crash to exactly that pile-up. Three defenses now ship together: identical concurrent requests are coalesced into one computation (strictly in-flight, nothing cached); the interactive LLM paths wait briefly and then fall open to the deterministic path instead of queueing behind a busy GPU; and a full inference queue refuses new work immediately rather than stalling callers that have already given up. A burst of eight retries now costs one computation.

Containers, sandboxes and Intel Macs. License readers in the CLI and the extension now resolve VEXP_HOME exactly like the engine does, so sandboxed and containerized setups read and refresh license tokens in the directory the daemon actually watches. On Intel Macs, the Metal shader now ships precompiled next to the binary, removing a compile of roughly 26 seconds that previously ran on every process start. And the LLM status probe now reports the Metal backend truthfully on healthy installs.

vexp search: exhaustive by design. Orientation tools rank and cap results on purpose: an agent needs the right five files, not five hundred. But rename sweeps, dead-reference audits and "is this term still mentioned anywhere" are the opposite shape: they need every match or the answer is worthless. vexp search walks the full-text index of everything vexp knows, code in 34 languages and markdown alike, and prints every hit in file order. --files-only gives you the distinct file list, --json gives you a stable machine-readable shape, --substring matches partial identifiers the way a raw LIKE would, and --limit exists only if you ask for it. It reads the index directly, so it works with or without a running daemon. If you have been querying .vexp/index.db by hand: this is the supported version, and it will not break under you on the next schema change.

Docs are first-class citizens of the graph. The user behind this feature keeps 18,000 of his 22,000 indexed nodes in markdown: every time a rule migrates from docs into code, some document somewhere still describes the old shape. One conceptual query surfaces the right document; one vexp search confirms nothing else mentions the old name. Keeping documentation and code in agreement is a problem grep cannot solve by construction, and it turns out a code graph that indexes markdown can. We are exploring how far to push this; if docs drift is a pain you recognize, we want to hear your version of it.

A blocked start now leaves no fingerprints. In 2.5.1 a start refused by the workspace ceiling stopped flickering the socket; in 2.5.2 it stops touching the workspace entirely. The ceiling check now runs before the git hooks install and before the index database is created, so a refused workspace is left exactly as it was, with only a log line and the machine-readable refusal reason in .vexp/start-blocked.

VS Code stops retrying into a wall. The extension now reads the refusal reason the daemon writes and shows it where you are looking: the status bar reports "workspace cap" with the full message, which workspaces hold the slots and the command to free one, and clicking goes to the logs instead of the license panel. The respawn loop fails fast when the ceiling is the cause, because a plan boundary does not clear by retrying, and the notification offers an explicit Retry for when you have freed a slot.

AppSumo Tier 3 and 4: full Team workspace ceiling. The AppSumo deal maps Tiers 3 and 4 to the Team plan, and the node and repo limits always resolved that way, but the concurrent-workspace ceiling shipped at the Pro value of 4. A Tier 3 developer running parallel Claude Code sessions across git worktrees hit it mid-session and told us within hours. Tiers 3 and 4 now allow 8 live workspaces, the same as Team. If you run agents in parallel worktrees, this is your fix.

A blocked start now says why, before anything flickers. In 2.5.0, starting a daemon past the workspace ceiling briefly brought the socket up, reported success, and then died: indistinguishable from a crash. The ceiling check now runs before the socket ever binds. vexp daemon-cmd start reports the actual reason with the list of live workspaces, and the new vexp stop <workspace> command, the one the message suggests, stops any of them from wherever you are standing. No more cd-ing into each workspace to free a slot.

vexp verify, now truly on both surfaces. The 2.5.0 notes promised verification as an MCP tool and a CLI command. The MCP tool shipped; the CLI entry point did not. vexp verify now works from the terminal with --json for machine-readable output, --task-file for instruction-level oracles, and --gate for CI pipelines that want a hard exit code on mechanical violations.

Errors that identify themselves. When a request lands on a daemon older than the tool it names (a mixed-version moment right after an upgrade, or a fallback to another workspace’s daemon), the answer used to be a bare "Unknown tool", which reads as "unimplemented" and sends you debugging the wrong thing. The daemon now states its version, the workspace it serves, and the one command that fixes it. On the SDK line, the gateway gained the same spirit: if a query routes to a shard that just died, it degrades to the surviving shards and returns partial results clearly flagged as such, instead of failing the call.

Horizon verification: verify_done, everywhere and free. A new MCP tool and CLI command (vexp verify) that checks a session’s work against the code graph: files that no longer parse, imports broken by a rename, dependents of changed files that were never updated, and constraints stated in the task itself (files it forbade touching, artifacts it promised). Findings always carry file:line evidence you can check in seconds. It is free on every plan, because gating “did you actually finish” behind a paywall would be the wrong kind of business model. Claude Code sessions also get a stop-time check that challenges provably incomplete work once, with the evidence, and never blocks a clean stop.

Shield: see what your code hands to any AI agent. vexp shield scan (CLI, VS Code palette, SDK route) walks your workspace and reports the PII and secrets sitting in comments and string literals: emails, phone numbers, IBANs with real checksum validation, credit cards past a Luhn check, AWS and GitHub tokens, JWTs, private keys, credentialed URLs, high-entropy literals. Detection is deterministic, runs entirely on your machine, and the report only ever shows masked previews. Reserved documentation values (example.com, 555 numbers, test PANs, RFC1918 addresses) are deliberately not findings: a scanner you cannot trust to stay quiet is a scanner you turn off.

Honest ceilings on paid plans. Pro and Team now carry explicit daily-call and concurrent-workspace ceilings (1,000 and 1,500 calls per day, 4 and 8 live workspaces) sized so that interactive use never meets them: the heaviest measured day stays under half the Pro ceiling, and ambient hints never count. They exist as a boundary: automated, headless or service use belongs on the SDK line, and the Terms now say exactly that. Hitting a ceiling on a paid plan refuses the call with a clear message and leaves the daemon and everything else running.

SDK parity and a doctor in the palette. The SDK line (REST) gains verify_done and shield_scan with per-repo union merging across a fleet, so a clean repo can never mask another’s broken imports. VS Code gains two palette commands: vexp: Doctor (version skew, daemon health, license, hooks wiring) and vexp: Shield Scan. The engine also hardened its certification pipeline: pinned language-server toolchains, because a floating latest is how green turns red with no code change.

Ambient orientation, on every prompt. A new classification engine in the daemon reads each prompt and checks it against the symbols and files of your indexed workspace. Name the code you want to touch and vexp adds nothing at all, zero tokens, zero noise. Describe a problem in an unfamiliar area and your agent receives a single orientation line before its first file read. The mechanism is fail-open by construction: if the daemon is off, the answer is silence, never an error in your session.

One brain, five agents. The same per-prompt intelligence now reaches Claude Code, OpenAI Codex (project-scoped, nothing global touched), VS Code Copilot, opencode and Kilo Code, each through its native extension point. Agents without a prompt channel keep the streamlined mandate and the full MCP toolset. One daemon, one behavior, conjugated per harness.

The Savings Ledger. A new surface in the CLI (vexp savings), the sidebar and index_status shows what vexp actually did for you: prompts analyzed, deliberate silences, orientations served, and, when your agent calls the tools, measured per-call token savings computed against a full-read baseline. Decisions are visible in real time, and the numbers are the same on every surface.

Upgrades that take effect instantly. The VS Code extension now recognizes a running daemon from an earlier version and replaces it automatically the moment you reload, so new capabilities are live the instant you update. CLI users get the same awareness in vexp doctor, down to the exact command to run.

Multi-repo, industrial grade. Workspaces with connected repositories get a stronger backbone: secondary repos come online one by one as each becomes ready, re-attach themselves automatically if anything is missing, and cross-repo edges are now durably persisted across restarts. Nested repositories are recognized as first-class boundaries by the watcher, the walker and reconciliation alike.

Configuration that listens, live. exclude_patterns joins the indexing engine across full walks, watcher events and reconciliation, and the daemon now picks up changes to your config and ignore files while it runs, no restart needed. Settings written under the legacy [index] table are honored too, and unknown keys produce an explicit warning naming every accepted option.

Windows, first class. On Windows with an NVIDIA GPU, the local LLM now engages CUDA acceleration out of the box: the runtime libraries load automatically from the plugin directory, with no environment variables and no editor restart. The guard uses one cross-platform invocation shape on every OS, and vexp doctor exercises it live on Windows just like everywhere else.

Sharper impact analysis. Blast-radius results are now built exclusively from corroborated call edges, so every listed caller genuinely references your symbol. The dependents count is one clearly labeled number, pivot headers carry exact line ranges for surgical follow-up reads, and the default MCP surface is leaner, with the reference expander appearing dynamically the moment compact output needs it.

Name a file in your task, get that file back. Queries that mention exact file paths, like "review admin/protected-apps.php", resolve straight to those files as top results in every one of the 34 indexed languages. Path detection covers everything vexp indexes, understands Windows-style backslash paths, and shrugs off trailing punctuation.

Searches understand paths and dotted names. Query tokens are now split the same way the index itself splits text, so multi-word questions that mention paths like includes/dashboard-sections.php, dotted symbols like AuthService.validateToken, or hyphenated names match the code they refer to with full precision. Snake_case identifiers stay intact, exactly as before.

Minified bundles stay out of your context. Files with minified naming patterns, like a vendored editor or video player committed under assets/, are now skipped automatically wherever they live, and the max_file_size_kb setting (default 512) keeps huge generated files out of the graph. Every skip is logged, so you always know what was left out and why.

Status that tells the truth. Status now probes the actual socket or named pipe for a live answer, reports a daemon started by another process as exactly that, and labels a leftover socket as stale. What you read is what is running, on every platform.

doctor proves your setup end to end. vexp doctor now executes your configured guard hook the same way the agent would and reports the live allow-or-deny verdict, turning configuration checks into real end-to-end proof. It also reads project-level Codex configurations, so per-project setups are recognized everywhere.

Guard hook, robust on every path. The Claude Code guard hook is now registered in the invocation style Claude Code recommends, with a sensible timeout, and handles project folders with spaces in their names out of the box. Re-running vexp setup --guard-strict migrates an existing installation cleanly.

Your ranking preferences apply everywhere. priority_paths and depriority_paths from .vexp/vexp.toml now influence results in the standalone vexp capsule command too, not just through the daemon. If you deprioritise docs/old, that choice follows you into every entry point. Remember that these lists load at daemon start, so restart after editing them.

A default workflow that measurably costs less. vexp used to insist on being consulted for everything and blocked your agent's own search tools while its engine was running. Real-world benchmarks showed the opposite of the intent: the block did not increase good usage, and in the worst case, a long-context session hitting the deny wall over and over, it multiplied the cost of a task many times over. The new default is the workflow that won every measurement: one run_pipeline call at the start of a task for architectural orientation, native search for literal text sweeps, direct reads on files being edited. Nothing is blocked anymore; teams that explicitly want enforcement can opt back in with vexp setup --guard-strict.

Every answer says what it is based on. Every run_pipeline response now opens with a one-line coverage header: how many files and symbols the index holds and which compression engine produced the result. If the index is too small to answer reliably, the response says so in plain words and tells the agent to use its own tools until the index is ready, an entire benchmark round was once run against a near-empty index without anyone noticing, and that can no longer happen silently.

The index repairs itself. Files written while the engine was off, a scaffolding tool, a git operation in another window, a container writing into the workspace, used to be invisible forever until a manual re-index. The engine now periodically compares what is on disk with what it has indexed and quietly folds in anything that was missed, including brand-new files it never saw being created.

Multi-topic questions return every topic. Ask about storage handling and auth tokens in one query, and vexp used to hand back three results from one dominant file while the second topic vanished entirely. Result selection now guarantees file diversity and rescues the best match of each area involved, verified by a permanent test suite: every area named in the query surfaces in the results, with the most relevant file still ranked first.

Plain relative imports count now, and C# has a call graph. Two long-standing blind spots, found by a new per-language conformance harness that measures what actually resolves instead of assuming. Imports written as ./module or ../module never produced a connection in any language, only alias-style paths worked, so the graph under-reported how files relate on exactly the codebases that use the plainest syntax. And in C#, method calls were never recognised at all, leaving an entire ecosystem with structure but no call graph. Both are fixed, and the measured capability of every supported language is now published in the docs, including an honest note when a language only gets structural coverage.

See whether the local LLM is actually on. A user benchmarked "vexp with local LLM" three times, and the model was only running in one of them, with nothing anywhere to tell them. The active compression engine (rule-based or local LLM, CPU or GPU) is now visible in the status output, the sidebar, and vexp doctor, and if a model is installed but not actually serving, vexp says so instead of letting you believe otherwise.

Swift declarations, all of them. Two Swift methods sharing a name, the language's bread and butter, collapsed into one entry, taking real declarations out of the graph, and init, deinit and subscript were never indexed at all. Every declaration now persists with a distinct identity, overloaded calls link to every candidate honestly, and constructors and subscripts show up as what they are. Validated against a regression bundle contributed by the user who reported it: all 24 checks pass.

Your code never leaves your machine, now in writing, where agents read it. vexp has always run entirely locally: the engine is a process on your machine, the index lives inside your workspace, and analysis sends nothing to any external service. One thing was missing, saying so where AI agents read their instructions. Without that line, a cautious agent classified vexp as an external service and asked its user for data-disclosure consent over and over. Every generated instruction file now states the locality guarantee explicitly.

Faster and steadier under the hood. Pipeline calls no longer wait on a cold or CPU-bound model, expensive analysis steps are skipped when they cannot pay for themselves, so no more 14-second first calls. Statistics that were recomputed on every request are cached. Configuration writes are atomic, closing a race where two engine starts seconds apart could read different settings. And the background supervisor no longer resurrects a workspace's engine against the wrong socket, an obscure multi-repo failure mode that could leave a stale engine squatting where the real one should be.

vexp finally sees how your files connect. On projects that import through path aliases, the @/lib/… style Next.js and Vite use, vexp was dropping almost every link between your files: on a real app, more than nine in ten internal imports never resolved. Everything built on those links suffered with it, the blast radius of a change, following a call from one file into another, the ranking of results. vexp now follows path aliases, retries links that the indexing order had skipped, and refuses to guess a connection to a different file's same-named symbol rather than wire it wrong. On our own web app, the internal connections it found went from a couple of dozen to nearly three hundred.

Index every repo in a workspace with one command. Indexing a multi-repo workspace used to cover only the main repository and leave the rest empty, so you would set the workspace up, run the index, and see a single repo. It now indexes every connected repo in one pass, and a plain re-run reliably picks up file types that have only just become indexable.

Drupal modules are indexed now. Drupal keeps most of a module's code in files that do not end in .php, .module and .install hold its hooks, the most important code it has. vexp only recognised .php, so an entire custom module indexed down to almost nothing. It now reads all of Drupal's PHP file types, so your hooks, forms and services are in the graph where your assistant can find them.

Kiro connects to vexp. In Kiro, vexp's tools were never actually reaching the assistant: the connection was set up in a way a Mac launched from the dock could not start, so it failed quietly and the assistant fell back to plain text search, with vexp contributing nothing. Kiro is now pointed straight at vexp in a way that always starts, and its tools are pre-approved so you are not asked to confirm on every call.

Multi-repo setups are more forgiving. A workspace file that labelled itself with the older workspace_id key instead of name failed to load outright, silently taking every connected repo down with it. Both spellings are now accepted, so a config copied from an older example just works.

Type-resolved connections from the first session. The editor bridge that captures type-resolved links between symbols now reads every file you already have open the moment it starts, so those connections are present from your very first session instead of only after you save or reopen a file.

Connect a repo and it indexes right away, no restart. vexp read your workspace list only at startup, so a repository you connected to a running workspace sat there unindexed until the next restart. It now watches that list and reacts within seconds: a newly connected repo is indexed, served, and kept live as you edit, and one you remove is dropped just as quickly, with its files left untouched on disk. Connecting a repo from VS Code or the terminal no longer asks you to restart anything.

No more killing everything to open a connected repo. Opening a connected repository on its own used to start a second vexp for it, which then loaded the entire parent workspace and fought the first one over the same index files, until the only way out was to kill every process and begin again. Now a repo that belongs to a workspace simply uses that workspace: the terminal, the editor, and the background engine all point at the one already serving it, and tell you so. If that one genuinely is not running, the repo opens on its own exactly as before.

Status finally shows every repo in the workspace. Ask vexp for its status in a multi-repo workspace and it showed you one repo while quietly serving three. It now lists every connected repository with its own file, symbol, and connection counts, and flags the ones still catching up, so you can see at a glance what is indexed and what is not.

Connect and list repos from the terminal. The vexp command gained a Repos and Workspace menu: list the repositories connected to your workspace, or add another one, writing exactly the same configuration the VS Code command does, with the same plan limit checked before anything is saved. Run it from a connected repo and it operates on the workspace that repo belongs to.

The model download resumes instead of starting over. Installing the optional local model on a slow or flaky connection used to restart the multi-gigabyte download from zero every time the network dropped mid-transfer. It now picks up from where it left off, and a stalled transfer fails fast instead of hanging the install.

A search guard for Cursor. Cursor now gets the same guard Claude Code and opencode already had: while vexp is running it steers the agent to vexp instead of raw search, and steps aside the moment vexp is not, so an unindexed project still works. The copy that ships in the terminal and the copy that ships in the extension are kept identical by a test.

Call edges now tell you how sure they are. The type-resolved connections vexp captures from your editor come from sources with very different confidence, and once stored they all looked the same, so a quiet drop to a weaker, best-guess method was indistinguishable from a fully resolved one. Each edge now records how it was found, and that difference is visible in your index status.

Smaller terminal fixes. Re-indexing from the menu now covers every connected repo rather than just the current folder, the daemon menu can restart the engine, a one-shot index no longer double-counts a repo nested inside another, and a hint that pointed at a command that does not exist now points at the right one.

Your licence is the same one in the CLI and in VS Code. A lifetime-plan user watched the CLI report his paid plan correctly while VS Code, on the same machine and reading the same licence file, called it Free and refused to add a second repo. vexp identifies a machine with a value it invents on first run and keeps privately, so the CLI and the extension had each invented their own and registered as two separate devices. On a plan that allows one device, whichever checked in first took the slot and the other was turned away, which from the inside is indistinguishable from having no licence at all. Both now settle on a single identity per machine, and the one your account already knows about is the one that wins. Updating is enough: a client that had been pushed to Free re-checks under the identity the server already has and is let straight back in.

Your index stops storing the same connection dozens of times. Every time vexp re-resolved your call graph, which is every time you save, it appended the whole set of connections again instead of recognising the ones it already had. Real indexes reached 45 times their true size: 270,589 stored connections for 5,951 real ones, one pair of functions recorded 75 times over. That was never just wasted space. vexp ranks results partly by how connected a symbol is, so a symbol counted 75 times looked 75 times more important than it was, and vexp flow answered with the same route printed several times because each copy looked like its own path. Both are fixed at the root: repeats are now rejected on the way in, while genuinely distinct call sites on the same pair are kept, because that is real multiplicity rather than duplication. Existing projects collapse once, automatically, the next time vexp opens them. No reindex, nothing to click, and if the cleanup cannot run for any reason your index keeps working exactly as it does today.

Git hooks were never running your index on an npm install. The git hook vexp installs looked for a program that does not exist in the distribution, so on an npm install both of the places it checked came up empty every single time and the hook quietly did nothing. It now uses the command that is actually there. Installs where no vexp is on your PATH at all, which is every VS Code extension install since it carries its own copy, fall back to the exact binary that is running, rewritten on every start so it can never go stale across an upgrade or a Node version switch.

vexp tells you when a file simply has nothing to index. vexp indexes declarations: functions, classes, methods, types. A file that declares none of those, a config object, a barrel of re-exports, a script that is just top-level statements, indexes to zero symbols. That is expected, but vexp answered as though the file had never been indexed at all, which sent people looking for a bug that was not there. One Tier 4 user concluded vexp did not support .mjs files, when the real answer was that their .mjs files were config objects. vexp now checks first and, when the file is indexed, says so and explains what genuinely extracts nothing. Asking about a file from inside a subfolder works too: a relative path used to be looked up against the wrong location and reported as missing.

vexp is visible before your first index. vexp only starts on its own once a project has an index, so in a project it had never seen it showed nothing at all: no status bar, and a sidebar icon that can hide in the activity bar overflow. The first thing you needed was the one thing you could not find. The status bar now starts on a prompt to run that first index. Commands that need an open folder also used to fail with a bare "command not found"; they now say what is actually wrong.

Running out of daily calls no longer looks like a broken install. On the Starter plan vexp stops itself once the day's 20 calls are spent, and VS Code says exactly that in the status bar. Every other agent got something far worse: a bare connection error, which a model reads as a passing glitch and retries, and retries. One user's local model looped on it for over 200,000 tokens and concluded vexp had broken his whole setup, which from where he sat it had. Agents now get a clear, final answer that says the quota is spent, when it resets, and not to retry until it does. Activating a licence clears it on the spot, so upgrading mid-day is never held to the free tier's reset.

The guard stops blocking searches vexp cannot answer. The opencode guard that steers your agent to vexp instead of raw search was refusing every grep and glob while vexp was running, whatever they were aimed at: runtime logs, build output, files outside your project. vexp has no answer for any of those, so the refusal was a dead end rather than a redirect. One agent debugging a rendering bug had its log searches blocked, was told to use vexp instead, and was left with no working tool at all. The guard now blocks only what vexp actually indexed, your source, and steps aside for everything else. It never touches shell commands either, which is what keeps an escape hatch open for everything the index does not cover.

A blocked search tells your agent what to do instead. The refusal used to say only that vexp was running, which a model reads as a tool failure, something to route around rather than a rule to follow. It now says plainly what to call instead, and the generated instructions spell out what vexp does not cover, so your agent stops both working around the block and spending calls on files that were never indexed.

Every agent is told how to phrase a query, not just Claude Code and Cursor. vexp finds code by identifier and path first, so a question written as prose ranks far worse than the same question anchored on the symbols and files it is about. That one rule had only ever been written into 2 of the 9 agent instruction sets, and one example actively demonstrated the weak version. Two separate reports that "the index seems not very useful" traced straight back to it. All nine now carry the same guidance from a single shared source, with examples built on real identifiers, and a test fails if any template loses it. Nothing changed in the engine: the index was never the problem.

Setting up agents no longer reports success while configuring nothing. Agent names had to match exactly, so asking for "opencode" rather than "Opencode" matched nothing, configured nothing, and still printed success and exited cleanly. That is the worst possible outcome for a flag whose whole purpose is unattended automation: a CI step that sets up no agent at all and reports green. Names now match regardless of case and punctuation, and one that still matches nothing is a hard error listing the valid names with a suggestion. The whole list is checked before anything is written, so a single typo can no longer leave a half-configured project behind.

A hand-tuned guard is kept when you upgrade. Setup still refreshes the opencode guard plugin whenever it differs, since freezing you on a stale one would be worse, but your previous version is now saved next to it as a .vexp-bak file, the same treatment every other vexp-managed config file already gets.

Multi-repo workspaces index your project, not its parent folder. If you added a second repo through the VS Code command, vexp recorded your main repo with a shorthand that, since 2.1.0, pointed one directory too high, at the folder your projects live in. That folder is real, so vexp took it at its word and indexed everything inside it: one user got 6,098 files and 66,853 nodes, two thirds of their plan's capacity spent on projects that had nothing to do with the one they were working in; on another machine the same shorthand grew a 19 GB index of 77 unrelated projects. Meanwhile the repo they had actually added pointed at a path that didn't exist and indexed nothing at all. So cross-repo answers, the entire reason for adding it, had never once worked. Existing setups keep working exactly as they are: vexp recognises the old shorthand and resolves it correctly. And a repo path that lands outside and above your workspace is now refused outright rather than indexed, so this class of mistake can't cost you capacity again.

Your MCP config stops being overwritten when you switch editors. Run VS Code, Antigravity and another agent against the same project and each one rewrote the shared MCP config on startup, pointing it at its own copy of vexp, so the setup broke whenever you switched. One user was keeping a copy per editor and renaming them by hand. (The same thing happened to a single editor on every vexp update, for the same reason.) vexp now leaves a working config alone, whoever wrote it: the piece it points at is a standalone helper that talks to your local vexp, and it doesn't care which editor's folder it came from. If it ever does point at something no longer installed, that's repaired automatically. You can retire the renaming.

opencode now enforces vexp instead of just suggesting it. In Claude Code, vexp installs a guard that hard-blocks raw grep/glob while it's running. That enforcement is what actually produces the token savings. opencode only ever got the written instruction, which a model follows when it feels like it, so vexp would run once and the rest of the turn fell back to native search (field report: "vexp only runs once, token savings is minimal"). Setup now installs a real guard plugin for opencode that blocks native search (and shelled-out grep, ripgrep and find) exactly like the Claude Code one, while still stepping aside when vexp isn't running so an unindexed project still works. Projects configured with a commented opencode.jsonc are now detected too; they were being skipped entirely.

Codex over HTTP no longer fails for one workspace in sixteen. Some projects got "no daemon" from Codex no matter what, on every platform, while vexp doctor insisted a perfectly healthy vexp was down. The workspace fingerprint that routes Codex to the right project is computed in five places that can't share code; two of them formatted it slightly differently, and for roughly one workspace in sixteen (those whose fingerprint happens to start with a zero) the two never matched. All five now agree, with a test built around exactly that case so they can't drift apart again.

Deeply nested projects work on macOS again, and Windows status tells the truth. macOS caps how long a connection path can be, and vexp has always had a fallback for projects buried deep in your folder tree, but the editor extension didn't know about it and forced the too-long path onto vexp anyway, so it simply never started. The CLI had the mirror image: it looked for vexp at the long path while vexp was listening at the short one, and declared it stopped. On Windows the CLI had been looking for a Mac/Linux connection file that never exists there, so it reported a running vexp as stopped, warned that startup had failed right after it succeeded, and retried on every command.

The edits you make by hand are remembered again. vexp quietly records what changed in your project so it can surface it later. Any edit you made without an agent attached, just you typing in your editor, was being dropped on the way into memory: 127 lost in two days of one user's log, with nothing to show for it but a line in a file nobody reads. Those edits are now kept.

Test runs stop flooding the log. If you use Playwright, vexp chased the throwaway folder created for every test case, usually already gone by the time it looked, and filled your log with dozens of warnings per run. Those folders are now skipped like node_modules, and a folder that disappears before vexp can watch it is no longer worth a warning.

Run the local model on an NPU, or any local server you already run. vexp's optional local model compresses context on your machine, privately. It can now talk to any local inference server that speaks the standard OpenAI API. Point it at one line of config and you're set. That opens the door to NPU acceleration on AMD Ryzen AI laptops (via FastFlowLM), and works just as well with llama.cpp's server, LM Studio, vLLM, AMD Lemonade, or Ollama. If the server isn't reachable, vexp falls back to its built-in engine automatically, nothing to babysit.

Worktrees and submodules no longer inflate your index. A user's large project was being indexed at nearly four times its real size (31,914 files where git tracked 7,488) and a full index dragged on for hours. The cause: vexp indexed anything git didn't explicitly ignore, and the worktrees an AI coding agent creates under .claude/worktrees/ are each a complete copy of your repo (git hides them structurally, so no ignore rule ever matched them), as was a submodule. vexp now respects git's own boundary: a folder that is itself a separate git checkout (a worktree, a submodule, a nested clone) is left to git, exactly as it never appears in your project's own file list. Your real project indexes in minutes and stays inside your plan's capacity. Projects with no nested checkouts are unaffected.

The Windows "use vexp, not grep" guard finally works. On Windows, the guard that steers your agent toward vexp's context tools instead of raw grep/glob never actually fired. It looked for a connection file that only exists on Mac and Linux, so it silently allowed every fallback search with no sign anything was wrong. It now uses the right signal on every platform, and a lockstep test keeps the extension and CLI copies from ever drifting apart again.

No more duplicate results for classes with a constructor. Ask about a C# or Java class that has an explicit constructor, and vexp returned it twice, once for the class and once for the constructor, which share a name, printing the same code in full both times and reporting two different impact counts for what is really one symbol. That roughly doubled the cost of those results and muddied blast-radius numbers. The class now comes back once, cleanly.

expand_vexp_ref returns real source code. The tool that expands a compact code reference back to its full form was returning a lossy reconstruction that wasn't valid code in the file's language. It now returns the actual indexed source, and labels what it handed back so a caller can always tell real code from a last-resort sketch.

Plain-English questions don't latch onto filler words. A question phrased in prose could match on incidental words: a query about combat once surfaced an economy class and a weather class because they happened to share a word like "behavior" with the sentence, scored as confidently as a real match. vexp is now stricter about what counts as a real symbol reference, so those false matches drop away, and the setup guidance notes that naming real identifiers or file paths gives the most reliable results.

get_skeleton works in Codex and other native MCP clients. Editors that connect vexp's context tools directly over the native MCP protocol, Codex among them, got an empty result from get_skeleton for every file, on both Windows and Linux, no matter how the request was phrased. The tool takes a list of file paths, and clients that sent them as plain strings (exactly as the tool advertises) tripped a format mismatch that came back as an empty list instead of the file's structure. The engine now accepts every shape a client can reasonably send (plain paths or detailed entries, with or without an explicit repository) so get_skeleton returns real skeletons everywhere. Claude Code and the VS Code extension were never affected.

Large-repo indexing: hours become minutes. Resolving imports during a full index did a slow, whole-table search for every imported name in every file. Cheap on a small project, but it grew with the size of the index itself, so on a very large repository (100k+ symbols) a clean index could take over four hours. That lookup is now backed by a database index and matches names exactly, which also removes a subtle inaccuracy where importing User could pull in UserService or getUser. Existing projects pick up the speedup automatically on the next open, no reindex needed.

run_pipeline honours your path priorities. If you told vexp to rank certain folders up, or down, in results, that preference was applied by the older context tool but silently skipped by run_pipeline, the primary one. run_pipeline now respects priority and de-priority paths in both single- and multi-repo workspaces, so the folders you care about rank where you asked.

Linux: the local LLM works on minimal container images. On slimmed-down Linux images (Replit, distroless and similar) the local LLM reported "Backends registered: 0" and every model load failed, because a system library the CPU backend needs isn't present on those bases. The Linux packages now bundle that library next to the binary, so the local LLM is self-contained regardless of the image, the Linux counterpart to the Windows runtime fix in 2.1.6.

A clearer answer to how big your project is. When a plan's capacity limit stops an index short, vexp now prints how many source files it skipped and an estimate of the project's full size: the numbers you need to trim what's indexed or pick a plan.

Seven new languages: Vue, Svelte, Astro, SQL, PowerShell, Groovy, Julia. Vue, Svelte and Astro components are indexed the way they deserve: vexp extracts the script block (and Astro's frontmatter), parses it as TypeScript, keeps every symbol on its real line in the component file, and adds a component node so files are searchable by name. SQL brings your migrations and schema files into the graph: tables, views, functions, indexes, triggers. PowerShell (dash-names included), Groovy (including plain build.gradle scripts) and Julia round out the set. 34 languages total.

Antigravity support that actually works. The previous Antigravity integration wrote a rules file the IDE never read, into a folder it never looks at, and never registered the MCP server. vexp now writes the cross-tool AGENTS.md that Antigravity reads natively, detects Antigravity both from your workspace and from the machine, and registers its context tools in Antigravity's global MCP configuration: one setup, every project.

Two more agents: Trae and Firebase Studio. ByteDance's Trae and Google's Firebase Studio join the auto-configured family (14 agents total): project rules plus MCP wiring, written by the same one-shot vexp setup.

On Open VSX, for Antigravity, Cursor, Windsurf, Kiro & co.. The AI-IDE forks of VS Code can't use the Microsoft Marketplace; their Extensions views run on the Open VSX registry. vexp is published there, so installing it inside Antigravity, Cursor, Windsurf, Kiro or VSCodium is a search away, and the same VSIX still installs manually everywhere else, Trae included.

Only one indexer can ever run on a workspace. Every write path to the index (full index, watcher saves, git-hook syncs, recovery) now goes through an exclusive per-workspace lock. A second indexer waits its turn and says so ("Another vexp indexer is already running…"), git hooks never hang behind a long index (they skip safely and catch up on the next sync), and the lock releases itself if its holder dies. The three-hour double-index death spiral is gone: the same scenario now completes in minutes, with one clean result.

Activating a license takes effect immediately, no restart. The capacity limit used to be read once at process start: activate a license while the engine was running and it kept enforcing the free-tier cap, with "upgrade your plan" messages, until you restarted it. Limits are now read live: the moment your license lands, the running engine picks it up, mid-index included. Single-file saves respect the cap coherently too, instead of quietly bypassing it.

The engine can no longer delete a database it merely failed to open. A transient "database is locked" during startup or a health check used to be treated like corruption, and the recovery path deleted the index to rebuild it, potentially destroying a healthy index another process was still writing. Locked now means locked: the engine waits or retries, re-checks health after acquiring the lock, and deletes only on genuine corruption.

Windows: the local LLM works without the VC++ Redistributable. On Windows machines without Microsoft's VC++ Redistributable, the LLM engine reported "Backends registered: 0" and every model load failed: the CPU backend needs a runtime DLL that Windows itself doesn't ship. The Windows packages now bundle the runtime app-local (self-contained, ~1 MB), and the diagnostics name the exact missing DLL with the fix link instead of a generic "reinstall" hint.

Engine logs survive a restart. Restarting the engine used to erase its log, exactly the evidence needed when something looked wrong. The previous session is now kept alongside the current one.

The engine answers in about a second, even during a huge first index. The engine used to open its door only after the entire first index finished. On a big repo that meant minutes of silence, and VS Code stopped waiting after five of them, landing in an error state that only a restart cleared. The door now opens right away: the status bar shows a live "indexing" spinner, status reports honest progress, and anything you ask too early gets a clear "index in progress, retry shortly" instead of dead air. Agents, the CLI, and other editors see the engine immediately too.

No more random "connection closed" mid-answer. When a result happened to include a JSON manifest (a package.json, a service registry, a catalog file) the engine could crash mid-request, taking every open session down with it and reloading the local LLM from scratch. It looked random because it depended on which files matched your question. That whole failure class is gone: manifests now flow through results as plain content, and the code path that killed the engine can't be reached by any file type anymore.

The local LLM installs everywhere: GPU when it works, CPU when it can't. On some machines the GPU is detected but can't actually run the model, most commonly an NVIDIA driver older than what the GPU plugin is built against. The installer used to fail its smoke test there and give up, leaving the LLM disabled. Now the engine proves the GPU with a real warm-up inference at startup; if that fails, it tells you why (usually "update your driver"), finishes the install, and runs on CPU for the session. Your GPU preference is never rewritten. It's retried at every start, so the moment the driver is updated, inference moves back to the GPU by itself.

Force Re-index is now a true reset, even on a damaged index. If the index database was ever damaged (a hard power-off, a disk hiccup), Force Re-index used to rebuild into the damaged file, and the engine crashed on the spot, over and over, with no way out. The button now clears the index completely and rebuilds from zero, and the engine itself repairs a damaged index automatically at startup: it detects the failure, replaces the database, and re-indexes without you doing anything.

VS Code finds its way back on its own. If the engine ever dies or stalls while starting, the editor now notices immediately and respawns or reconnects with backoff, instead of parking in an error state until you restart VS Code.

New directories are indexed the moment they appear. To keep from exhausting the OS on huge repos, vexp watches folders one at a time rather than the whole tree at once, which meant a folder created after the engine started wasn't being watched, so files added inside it stayed invisible to the live index until a restart or a force re-index. Now a new folder is picked up as soon as it appears: it and its subfolders are watched, and the source files already inside are swept into the index straight away (respecting .gitignore / .vexpignore).

Deleted files leave the index right away. Removing a file while the engine was running used to leave its symbols behind until the next full re-index, so the live file count slowly drifted above reality. Deletions are now pruned on the spot, keeping the index and its counts accurate.

"Still indexing" instead of a misleading empty answer. A full re-index briefly clears the index while it rebuilds. A symbol lookup landing in that window used to come back empty, indistinguishable from "this file has no code," which could fool an agent into thinking a file was never indexed when it actually was. It now says the index is rebuilding and to retry, rather than returning a false blank.

Checking status is always safe. The status command read index stats by opening the database directly; while the engine was actively writing (indexing new files, sweeping folders) that could crash the command. It now reads in a strictly read-only mode that is safe alongside a live writer, so vexp daemon-cmd status is safe to run at any moment.

One daemon, even during a long first index. On a large codebase, or when vexp is opened from a very broad folder like your home directory, the initial index can take well over a minute. The engine now registers itself before indexing begins, so a second launch during that window is a clean no-op instead of a duplicate process. No more pile-up of background daemons while the first index runs.

Status tells the truth: "starting", not "stopped". While the first index is running, daemon-cmd status now reports "starting (initial index in progress)" with a note not to restart, instead of "stopped", which is what made the engine look dead and triggered the restart loop in the first place.

A first index you can watch. The background engine now logs its progress by default, so .vexp/daemon.log shows the index starting, the file count, completion, and the socket coming online. Tail it and watch the first index move instead of guessing whether it stalled, without flooding the log with per-file noise.

Status is safe to run at any moment. Checking status while the engine was mid-index, or shutting down, could abort the status command. It now reads index statistics only when the daemon is fully up or fully stopped, so a status check is always safe, even in the middle of a large first index.

CodeLens driven by the real index. The dependent-count lenses are now built from the daemon's own symbol list rather than a per-language text scan, so they carry the exact fully-qualified name of each definition. The impact click resolves every time, across all languages vexp parses, and lenses land only on real definitions, skipping tests and whole-file nodes that were just noise.

Exact dependent counts, no string guessing. The engine now returns structured impact numbers (total dependents, distinct files, cross-repo hits) instead of the client re-parsing a rendered string. The number on each lens is accurate, including cross-repo callers.

Smooth scrolling, fewer daemon round-trips. File symbols and their impact counts are cached per document version, so scrolling and re-rendering a file no longer re-queries the engine for unchanged code.

VS Code registers your device immediately. Activating in VS Code now runs its first license validation without hitting the 24-hour refresh backoff. That validation is what registers the machine as a device, so your seat is counted right away instead of after a restart-past-24h window. Unresolved-symbol clicks also show a friendly note instead of failing silently.

A code query never gets docs passed off as code. On a doc-heavy or freshly-started repo (planning docs, spec-kit artifacts), the query words often live in Markdown, so the engine used to surface doc sections as pivots to avoid an empty result, handing back prose for a code question. It now never manufactures a doc hit to fill a code-shaped query; docs still appear when they earn it on their own merit, but code queries get code.

Legacy non-UTF-8 files index without crashing. Source files saved in Windows-1252 (legacy PHP, accented Latin text like ção or ê) could panic the engine mid-index. Files are now decoded UTF-8-first with a Windows-1252 fallback and parsed from the decoded text, so legacy encodings index cleanly and stay searchable instead of turning into replacement characters.

Login autostart is opt-in. vexp no longer writes any OS login-persistence on its own. Autostart is installed only when you ask for it, via the setup wizard prompt or vexp autostart install, and non-interactive installs skip it entirely.

Windows build fix. A connection handler was compiled Unix-only, breaking the Windows build; it is now cross-platform.

vexp SDK: code intelligence as infrastructure. The same engine, exposed for automation: a self-hosted, machine-to-machine gateway that serves type-accurate context and cross-repo blast-radius over a simple REST API, with Python and TypeScript clients. Built for coding agents, PR review, and incident triage at fleet scale, on your own infrastructure, so your code never leaves your network. Details at vexp.dev/sdk.

Sharper retrieval for multi-word queries. Natural-language and multi-word searches now line up better with compound identifiers: PascalCase and snake_case names whose parts are spread across your query surface more reliably as the top pivots, so context capsules land on the right symbol more often. Existing indexes pick this up automatically on the first open after upgrading.

Fuller call graphs and blast-radius. The indexer reconciles more call edges when it builds the graph, so get_impact_graph and search_logic_flow return more complete callers and callees and a refactor blast-radius reflects more of the real connections, visible after the next reindex.

Impact and ranking refresh after every edit. Call edges and ranking signals are now recomputed after each batch of indexed changes, so impact analysis and search stay current as you work instead of lagging until a full reindex.

Activation clears a stale refresh token. Activating a license now clears any leftover short-lived refresh token first, so a re-activation or a plan change takes effect immediately instead of being shadowed by a cached token from the previous state.

Plan changes persist the new server token. When your plan changes, the server-issued long-lived token is now persisted on the spot, so the new node and repo caps apply across VS Code and the CLI without waiting for the next refresh cycle.

Per-session targeting wins over a stale global pin. A global VEXP_WORKSPACE environment variable used to override each session's own project, pinning every agent, Claude Code and Codex alike, to one repo's daemon. Agents working in other repos then queried the wrong index and got empty results from get_skeleton and run_pipeline (while the CLI, which resolves the index from the file's own folder, kept working, the tell-tale split). When VEXP_WORKSPACE disagrees with a session's actual project, the per-session signal now takes precedence, so parallel sessions across repos each target their own index. A deliberate single-project pin still behaves as before.

get_skeleton fails loud instead of returning nothing. Asking for a file in a repo the connected daemon does not serve used to silently fall back to the primary repo and return an empty list, indistinguishable from "file not found." It now returns a clear error naming the repos the daemon actually serves and pointing at the likely cause, so a misrouted request is obvious instead of masquerading as missing data.

vexp doctor catches the global-pin trap. vexp doctor now warns when a global VEXP_WORKSPACE is overriding per-session targeting, or when several daemons are registered behind a single pin, the exact misconfiguration behind empty cross-repo results, instead of reporting "no issues detected." A shell or OS-level environment variable is invisible to the config checks, so this surfaces it directly.

VS Code adopts a CLI-started daemon. When the CLI auto-start had already launched the engine, the extension could refuse to attach to that healthy daemon and sit on "starting" indefinitely, even though your agent was being served fine. It now recognizes and adopts a running daemon (including one started in a different context, where the liveness probe returns "permission denied" rather than "gone"), and a failed start resolves to a clear state instead of hanging on "starting."

Windows: the Claude guard hook works again. The PreToolUse hook that steers Claude toward vexp instead of Grep/Glob checked for a Unix socket file that never exists on Windows, so there it always failed open and Grep/Glob were never intercepted. The hook is now platform-aware (Windows keys off the named-pipe marker, Unix/macOS keep the socket-plus-live-PID check unchanged) so re-running agent setup restores the nudge.

Impact on a class now includes its methods' callers. Call edges target method nodes, not the class node, so an impact query on a class found zero incoming edges (querying an individual method worked; querying its class did not). Impact analysis is now container-aware: for a class/struct/interface it seeds the dependents search with the class and all its members, so everyone who calls any method of the class counts as its blast radius. A query like "NpcProfile blast radius" now enumerates the callers instead of returning nothing.

The impacted counter no longer zeroes itself out. The pipeline capped collected impact nodes at a value derived from the token budget (impact_budget / 50), which rounded to 0 for the refactor preset, silently discarding every dependent so the "impacted" count read 0 even when the analysis found real callers. That cap is now a sensible node-count limit, independent of the token budget, so the count reflects the actual blast radius.

Dotted Class.Method callees now resolve. VS Code's Call Hierarchy names a callee as file::Class.Method(params) (and file::Ns.Class.Method), a dotted containing type, while the source side comes through as file::Method(params):ret. Our FQN parser stripped the parameter list but not the dotted class prefix, so the callee resolved to "BtDebugLogger.Header", matching no node. On the reported index that meant 17,675 sources resolved but only 37 callees, so every call edge was dropped. The method is now taken as the final segment after the last "." or "::", so dotted callees resolve: 0 → 10,944 reconciled CALLS edges on the same index.

Call edges resolve at submit time, no reindex. The socket path that accepts LSP edges from the extension created graph edges only on an exact FQN match, so format-mismatched edges had to wait for a full reindex to be picked up. Both the submit path and the indexer reconcile pass now share one format-tolerant resolver (exact match, then an unambiguous (file, method) fallback that declines on overloads). Open VS Code, let the bridge submit edges, and get_impact_graph / search_logic_flow light up immediately.

Spec-Kit and feature directories no longer filtered out. The capsule's test/benchmark path filter matched the substring "/spec", so a codebase laid out under Spec-Kit directories (Claude/SPEC-08_CombatSystem/…) was classified as spec/test code and dropped from every result, only Markdown survived. Path classification now matches whole directory segments (tests/, spec/, __tests__/, benches/) and unambiguous filename patterns, never substrings, so SPEC-08_*/, specifications/, and latest.cs are treated as the production code they are. Query-side fix, no reindex required.

Cleaner embeddings, calibrated semantic scoring. TF-IDF tokenization now splits on every non-alphanumeric character and drops numeric and syntax artifacts (get;, key(5)], <summary>), and language keywords are filtered from the embedding vocabulary while the symbol name is kept verbatim. The query vector is computed against the index's global IDF statistics instead of a tiny per-query mini-corpus, so semantic similarity is meaningful: PascalCase queries that previously scored ~0 now score 70–90% on the right symbol.

Large classes are never dropped from a capsule. The pivot loop used to break on the first candidate whose body exceeded the budget, so an exactly-named 750-line C# class returned an empty capsule while a 350-line one worked. The top-ranked pivot is now always included (capped to the total budget and truncated if enormous) and oversized lower-ranked pivots are skipped instead of ending the loop.

LSP call edges resolve across FQN formats. VS Code emitted call edges as file::Method(params):ret while the indexer stored file::Class::Method, so the two never joined and get_impact_graph / search_logic_flow only ever returned class-membership edges. Reconciliation now resolves on (file, method) when an exact FQN match fails, declining on ambiguity, and the extension emits a file::Class::Method form. Call graphs light up for C#.

Zero-config GPU acceleration. NVIDIA acceleration with no manual setup: the CUDA runtime is fetched on demand from the public PyPI redistributable the first time a GPU is detected, including CUDA 12.8 / Blackwell SASS support. There is no separate GPU build to install.

Codex & MCP transport hardening. Codex now uses a direct MCP transport with stdout kept strictly JSON, no reindex or abort chatter under it, which previously surfaced as "Transport closed". Agent and MCP config files are merged rather than overwritten on a parse failure, and written ASCII-clean.

Per-session, multi-workspace targeting. Each session resolves to the correct workspace daemon, so several projects open at once no longer cross their indexes. Plus license diagnostics, a force-reindex restart path, and Windows single-instance daemon handling to stop duplicate vexp-core processes from leaking handles.

AppSumo lifetime tiers. Lifetime-deal plans (tier1–tier4) are recognized across the license issuer and consumer, mapping to the right node and repo caps.

Daemon no longer crashes on non-ASCII markdown. truncate_markdown_body sliced markdown content at a fixed 8000-byte offset that could land mid-codepoint, killing the daemon before it bound its socket. Every downstream call (vexp mcp --proxy, the VS Code sidebar, MCP requests) then failed silently with no diagnostic. The slice now snaps to the nearest UTF-8 char boundary via str::floor_char_boundary, so multi-byte characters at any offset are handled correctly.

Audit-wide fix, not a one-spot patch. A sweep of the Rust codebase surfaced five total sites with the same raw-byte-slice pattern (markdown indexing, JSON value summarization, tool-result logging, JSON-shape sniffing, impact-graph truncation). All five now use the stable str::floor_char_boundary stdlib method. The obsolete in-crate floor_char_boundary_safe helper was removed so contributors stop reaching for the wrong idiom.

Regression tests for the exact reproducer. Four new tests cover the reported em-dash-at-byte-8000 case plus the pathological all-em-dashes input and the 2-byte (accented letter) and 4-byte (emoji) UTF-8 boundary cases. 375/375 cargo tests green; end-to-end validated by rebuilding 2.0.17 with the local LLM feature and indexing the trigger files plus the full vexp repo.

Windows login launcher fixed. vexp 2.0.12 shipped an invalid VBScript template for the Startup-folder launcher, causing a Type mismatch error at login and silently preventing vexp serve from starting. The generator now emits valid VBScript (proper quote doubling) and routes through %ComSpec% /d /s /c so cmd.exe applies legacy single-strip quote semantics. Verified end-to-end: the MCP HTTP server starts on 127.0.0.1:7821 at login and writes to ~/.vexp/autostart.log.

Automatic migration from 2.0.12. On Windows, the next vexp invocation after upgrading detects any existing broken vexp-serve.vbs by signature and rewrites it with the fixed template, before the autostart marker short-circuit kicks in. No manual vexp autostart uninstall/install required. VEXP_NO_AUTOSTART_INSTALL=1 still opts out cleanly: the migration runs after the env-var check, so opted-out users are never touched.

Markdown indexing (first-class). .md and .mdx files are now indexed at section granularity. Each heading becomes a retrievable node; URLs inside sections become markdown_link nodes. Spec-Kit and planning artifacts (spec.md, plan.md, tasks.md, README.md, docs/adr/*) get a small ranking boost so agents surface them when relevant.

Secret filtering (default on). Files matching .env, .env.production, id_rsa, *.pem, *.key, secrets.yaml, secret.md, password.json, credentials.toml, and similar filename-boundary matches, are skipped at index time. Legitimate code like src/secret-manager.ts is unaffected. Public templates (.env.example, .env.sample, .env.template) are allowlisted. Opt out with filter_secrets = false in .vexp/vexp.toml.

.vexpignore filename alias. .vexpignore (no underscore, matching the .gitignore / .dockerignore convention) now works alongside the historical .vexp_ignore. If both files exist, their patterns are concatenated.

.ignore (ripgrep) support documented. vexp also honors .ignore files (the ripgrep / fd / Sublime Text convention) via its underlying walker. If your project already has one for ripgrep, vexp picks it up automatically.

Starter: 20 pipeline calls per day. Daily call quota raised from 8 to 20 on the Starter plan. Enough to explore vexp on real projects across a full work day. Quota still resets at midnight UTC.

Cross-repo collection respects ignore rules. The multi-repo cross-link detector now routes file collection through the same walker as the primary indexer: .gitignore, .vexp_ignore, and .vexpignore patterns are honored consistently everywhere vexp reads source files.

Runs on every Linux distro. Ubuntu 20.04+, Debian 11+, RHEL 8+, Fedora, WSL2, Amazon Linux, all supported out of the box. No extra libraries to install.

Daemon auto-start. After first setup, the background engine starts automatically whenever you or your AI agent needs it. Nothing to manage.

Interactive CLI. Type `vexp` for a guided menu with live status of the daemon and local LLM. Setup, explore, and configure agents without memorizing commands.

Reliable agent connections. AI agents (Claude Code, Codex, Cursor, …) now find the daemon automatically, even when launched from different directories. Connection errors eliminated.

vexp-devmind local LLM. A compact, code-specialised model that runs entirely on your machine for an extra +30% token savings. Zero cloud, zero account, zero code leaving your laptop. ~3.5 GB download.

GPU acceleration. Metal on Apple Silicon + Intel Macs, CUDA on NVIDIA (Linux & Windows). Auto-detected at runtime. CUDA plugin downloaded on-demand when an NVIDIA driver is detected.

Smart prompt preprocessor. Your question is analysed locally and pre-enriched with the right files, symbols, and call chains before reaching your AI agent. Fewer tool calls, sharper answers.

run_pipeline single-call. One MCP call replaces capsule + impact + memory + observation. Auto-detects intent (debug/modify/refactor/explore) from your task description.

30 language support. From 12 to 30 languages in a single release. Kotlin, Scala, Swift, Dart, PHP, Elixir, Haskell, OCaml, Lua, R, Zig, HCL/Terraform, Objective-C, Dockerfile, Clojure, and F# join the existing lineup with full AST parsing and dependency graph support.

Daily free tier quota. Starter plan users now get 20 pipeline calls per day, enough to explore vexp on real projects. The quota resets daily at midnight UTC.

Pipeline streaming. run_pipeline now streams results as they arrive: pivots first, then impact analysis, then memories. Agents see initial context faster on large codebases.

LSP Bridge v2. The VS Code language server integration now captures richer type information with better performance. More accurate call graphs, especially for TypeScript generics and Go interfaces.

189 automated tests. Test suite expanded from 133 to 189 tests covering all 30 languages, pipeline streaming, and the new quota system.

Smoother installs. Fixed edge cases in the npm publish pipeline and aligned package versions across the VS Code extension and standalone CLI.

Resilient license verification. License checks now handle edge cases and malformed responses gracefully. Your workflow is never interrupted by a transient verification issue.

Smarter parameter handling. MCP tool parameters are now automatically coerced to the correct types. Agents that send numbers as strings or booleans as "true" no longer cause errors.

Improved hook guard. The Claude Code hook guard now uses process-level detection to avoid conflicts with other tools. More reliable interception on busy systems.

Automatic database recovery. If the index database is corrupted (e.g. after a system crash), vexp detects it and rebuilds automatically from the manifest. Zero data loss, zero manual intervention.

Health monitoring. The daemon now monitors its own health continuously: database integrity and indexing throughput. Issues are surfaced in the status bar and index_status output.

133 automated tests. Comprehensive test suite covering database recovery, health checks, and all supported languages.

Faster, more reliable updates. We overhauled our release pipeline so new versions reach you quicker and more reliably across all platforms: Linux, macOS, and Windows.

Automatic cleanup on shutdown. vexp now cleans up all connection files when the daemon stops, preventing stale sockets even after unexpected crashes.

Smarter hook guard. The Claude Code integration now detects stale connections and gracefully falls back, so your agent always has access to code search tools.

Regex support in hooks. The hook guard now intercepts Regex tool calls in addition to Grep and Glob, ensuring your agent always uses vexp's smarter search.

Shared daemon across windows. Multiple VS Code windows now share a single vexp daemon. Only the original window manages its lifecycle, other windows connect automatically.

Automatic port recovery. If the MCP port is busy, vexp finds an available one automatically. No more restart loops or manual port changes.

Smart reconnection. If the daemon restarts, non-owner windows detect it and reconnect with exponential backoff. If the daemon is gone, a new window takes over automatically.

Resilient daemon connection. The MCP client now retries transient connection errors automatically, keeping your agent on vexp's smarter search even during brief daemon restarts.

run_pipeline MCP tool. Single-call pipeline that auto-detects intent (debug/modify/refactor/explore), combines capsule + impact + memory, and includes full file content for pivots. ~60% fewer context tokens. Available on all plans (basic on Starter, full on Pro+).

CLI license enforcement. vexp activate, vexp deactivate, and vexp license commands. Shared license file at ~/.vexp/license.jwt: activate once, both VS Code and CLI use the same plan.

Marker-delimited git hooks. Git hooks now use # --- vexp start/end --- markers. Safely coexists with existing hooks (husky, lint-staged) without overwriting them.

Mobile & React Native defaults. Pods/, DerivedData/, and .expo/ are now excluded from indexing by default for faster mobile project setup.

Intent detection fix. Fixed false positives in intent detection caused by substring matching on non-English words. Now uses exact word boundary matching.

FTS5 query fix. Fixed crashes when search queries contained special characters like parentheses, asterisks, or quotes.

Standalone CLI. npm install -g vexp-cli and start using vexp with Claude Code, Codex, Opencode, or any terminal agent. Zero dependencies, instant setup.

Direct binary mode. Run vexp-core mcp --workspace . for maximum performance. One native binary, no Node.js required.

Smarter file watcher. vexp now reads your .gitignore and skips ignored files entirely. Faster indexing, fewer false positives.

Cleaner multi-repo sidebar. Empty repositories are hidden by default. One toggle to show them when you need to.

5 platform packages. Native binaries for Linux (x64, arm64), macOS (Intel, Apple Silicon), and Windows. Downloaded automatically on first install.

Windows named pipes fixed. Each workspace now gets a unique pipe name. No more connection failures when running multiple projects.

Smaller Windows extension. The VS Code package no longer bundles binaries for other platforms. 5 MB instead of 45 MB.

Passive Observation. vexp watches every file change and correlates it with your agent's tool calls. It understands not just what changed, but why, without any setup.

Project Rules. Recurring patterns in your workflow are auto-promoted into rules. They persist across sessions and are injected into context capsules, so your agent learns your project's conventions.

Memory Consolidation. Repetitive observations are automatically merged, keeping memory clean and relevant without losing information.

Standalone MCP server. Run vexp as a native Rust daemon with MCP over stdin/stdout. Works with Claude Code, Codex, and any MCP-compatible agent, no VS Code needed.

Manifest-only git. Only a lightweight manifest.json is committed to git. No binary blobs, no merge conflicts. Teammates rebuild the full index in seconds.

Session Memory system. Full session memory: auto-capture, cross-session search, manual observations, and staleness detection, all linked to the code dependency graph. Works identically across all 12+ supported agents.

3 new MCP tools (Free Tier). get_session_context, search_memory, and save_observation. All 3 are available on the free Starter plan: memory is the product showcase.

Auto-capture every tool call. Every MCP tool call is automatically recorded as a compact observation (~100-200 bytes) with per-tool extraction: intent + pivots, symbol FQNs, start→end flows, file lists.

Capsule memory auto-surfacing. get_context_capsule automatically includes relevant memories from previous sessions, no extra tool calls needed. Budget: 10% of token budget, ranked by query + pivot proximity.

Code-graph linked staleness. Observations linked to code symbols are auto-flagged stale when the code changes. Stale memories are penalized in search ranking (-0.30) but never deleted.

Hybrid memory search. FTS5 BM25 (0.35) + TF-IDF cosine (0.25) + recency decay with 7-day half-life (0.20) + code-graph proximity (0.15) − staleness penalty. Every result includes a "why" field.

Session compression. Background task compresses inactive sessions (>2h): extracts key terms, file paths, node IDs into a structural summary. Ephemeral observations deleted; insights preserved permanently.

Progressive disclosure. 3 detail levels: L1 Headline (~20 tokens, capsule inject), L2 Standard (~50 tokens, default search), L3 Full (~100 tokens, deep queries).

Database schema v2. New tables: sessions, observations, observations_fts (FTS5 with porter stemmer), observation_node_links. Incremental migration, no existing data touched.

UTF-8 multi-byte fix. Prevent panics on multi-byte UTF-8 string slicing in skeleton generation and TF-IDF tokenization.

Cross-repo queries are live. Context capsules, impact graphs, and logic flow searches now resolve symbols across repository boundaries. One query spans your entire stack: frontend, backend, and infra.

VS Code sidebar panel. Real-time daemon status, index statistics, per-repo cards, and quick actions (Force Re-index, Generate Capsule, Add Repository, View Logs) all without leaving the editor.

CodeLens on exports. Every exported symbol shows its dependent count inline: "12 dependents across 4 files". Know the blast radius before you refactor.

Hover impact data. Hover over any exported declaration to see dependents, cross-repo references, and top callers, without running a single command.

All 12 agent configs updated. Multi-repo documentation added to every agent template, from Claude Code's full CLAUDE.md to Cursor's compact rules file.

Smarter capsule ranking. File-path detection, churn-based scoring, and path priority boosting deliver more relevant results with fewer tokens.

6 new languages. Java, C#, C, C++, Ruby, and Bash join TypeScript, JavaScript, Python, Go, and Rust. Full class, method, and interface extraction for each.

Intent detection. vexp reads your prompt and adapts. "fix bug" activates debug mode and follows error paths. "refactor" shows blast radius. "add feature" prioritizes modification targets.

Hybrid search. Combines full-text search, TF-IDF semantic similarity, and graph centrality scoring. Finds validateCredentials when you search "authentication".

LSP Bridge. VS Code captures type-resolved call edges from the Language Server and feeds them into the dependency graph. Higher confidence, zero configuration.

New MCP tool: submit_lsp_edges. Dedicated tool for IDE-level call edge submission. 7 MCP tools total.

Claude Code stdio transport. Switched from HTTP to stdio transport, eliminating "Session not found" errors. Rock-solid, zero-config connection.

Context feedback loop. Repeated queries with similar terms automatically expand the result budget, giving you deeper context on the second pass.

Core context engine. tree-sitter parsing, AST dependency graph, SQLite index, and token-efficient context capsules with 65-70% token reduction.

5 languages at launch. TypeScript, JavaScript, Python, Go, and Rust with full function, class, and type extraction.

6 MCP tools. get_context_capsule, get_impact_graph, search_logic_flow, get_skeleton, index_status, and workspace_setup.

Auto-configuration for 12 agents. One command detects your AI agent and writes the config file. Claude Code, Cursor, Windsurf, Copilot, and 8 more.

Git-native manifest. Only manifest.json (blake3 hashes) is committed to git. Clone a repo and the index rebuilds incrementally from the manifest in seconds.