What's new.

Replaced the ModernCorrectionHUD + ModernCorrectionHUDHost + CursorSpinnerHost trio with a single adaptive CorrectionPillHUD/CorrectionPillHost: one content-sized pill anchored just below-right of the cursor that owns the whole correction lifecycle (working spinner, escalation to a wait message, success checkmark, error text).

The pill now stays hidden behind a 300ms grace period so fast corrections never flash any UI, and only escalates to a 'loading the model' explanation after 6 seconds (raised from 4) — cloud providers get a generic 'Still working…' instead.

Tightened the pill to the cursor (cursorGap 12→4pt) and made it more compact (mini spinner, footnote text/icons, reduced padding) so it takes up less of the screen and reads as less of a distraction.

Rewired CorrectionCoordinator and StreamingCorrector onto the new pill host lifecycle (begin/noteResponseStarted/succeed/fail/dismiss), generation-gated so a stale correction can never resolve or dismiss a successor's pill; success only shows a checkmark when the pill is already visible.

Added a CorrectionPillTests Swift Testing suite covering phase→content mapping, per-provider escalation messages, grace/escalation timing invariants, and panel-placement geometry (edge clamping and above-cursor flip).

Settings visual polish: a shared SettingsSectionHeader (accent-tinted, uppercase, SF Symbol) applied consistently across the General, Prompts, Personalization, and About tabs.

Added Qwen3 4B Instruct-2507 (mlx-community/Qwen3-4B-Instruct-2507-4bit) to the On-Device model lineup — a non-thinking, multilingual (200+ language) model that passes the full MLX smoke suite (grammar, Markdown preservation, German language retention, short-input sizing).

Replaced Granite 3.3 2B with Granite 4.0 Micro (mlx-community/granite-4.0-h-micro-4bit) in SettingsManager.availableMLXModels: a 3B hybrid model that preserves Markdown where the 2B stripped it. Users who had Granite 3.3 selected migrate to the Phi-4 Mini default via the existing availableMLXModels fallback in the mlxModel getter.

New Manage Downloads UI in MLXProviderSettings: a disclosure listing every on-device model on disk (including orphans removed from the picker) with its size and a confirmation-gated Delete. Backed by new MLXService helpers downloadedModelIDs(), modelDiskSizeBytes(), deleteDownloadedModel(), and modelID(fromCacheDirectoryName:).

deleteDownloadedModel() unloads the resident model before removing its weights and refuses to delete a model that is mid-download (guards on _loadingModelID under the loader lock), preventing a corrupt half-downloaded cache.

Fixed the custom prompt editor (PromptEditorSheet): a long instruction now scrolls inside a fixed-height text area instead of scrolling the whole sheet, and the sheet is taller so the Shortcut row is no longer clipped.

CorrectionCoordinator.performCorrection gained a `mode:` override that runs a one-shot correction in a specific built-in mode without persisting the user's selected default mode. Standard-correction semantics (single-line preservation, trailing-commentary stripping, silent no-changes) are preserved by keeping the gating on the `systemPrompt` parameter, so a mode-override correction never behaves like a custom prompt.

Per-mode global shortcuts — each CorrectionMode exposes a stable, no-default KeyboardShortcuts.Name (mode_*), so opt-in bindings never collide with the primary Cmd+Shift+G trigger. Handlers register once at launch (registerModeShortcuts); a new 'Correct As' menu-bar submenu and a per-mode Recorder section in the General settings tab surface them for discoverability.

The currently-selected default mode is filtered out of the Mode Shortcuts list and its dedicated binding is cleared — live on the Mode-picker onChange and defensively at launch — so it can't fire as an invisible duplicate of the global shortcut.

SettingsManager.ollamaBaseURL + OllamaService.normalizedBaseURL — user-configurable Ollama server address (custom port, proxy, or remote host). Normalized at use time (prepends http:// when scheme-less, strips trailing slashes, empty falls back to the default) and read dynamically per request so a change takes effect without relaunch. Works on both the sandboxed App Store build and the DMG build.

GeneralSettingsTab — the Ollama provider section gains a Connected / Not reachable status line (parity with OpenAI and OpenRouter), re-checked on provider switch and ~1s after the server address is edited; the model picker clears when the server is unreachable.

On-device stack validated against mlx-swift-lm 3.31.4 (build + full unit suite including real-model MLX smoke tests all green); not pinned, as Package.resolved is intentionally gitignored and the graph floats to latest-in-constraint at build time.

Tests — ModeShortcutTests (per-mode shortcut-identifier stability, uniqueness, and namespacing) and OllamaBaseURLTests (URL normalization shapes: scheme prepend, trailing-slash strip, whitespace/empty fallback).

PersonalizationStore — new on-device adaptive-personalization layer (@MainActor) that learns the substitutions a user keeps reverting and re-applies their preferred form to future model output. Fully deterministic string processing — no model inference, no prompt injection — so it behaves identically across model sizes and cannot regress correction behavior. Durable state is a rules-only JSON profile in Application Support (short from→to token rules + counters, never user prose); raw correction text lives exclusively in an in-memory ring buffer that is cleared on quit.

Reversion detection is MAS-safe: rather than reading the document back after paste (Accessibility, blocked by the App Store sandbox), each new correction input is LCS-diffed against WunderType's own recent outputs, so the edits a user made are recovered from text the coordinator already holds. Gated by token similarity (>=0.6) and edit-cluster count (<=3) so rewrites are not mistaken for reversions; enforcement is whole-word ICU (\b) substitution, Unicode-aware. Learned rules promote at hitCount 2; manual rules apply immediately.

PersonalizationSettingsTab — new Settings tab that doubles as a transparency inspector: every learned and manual rule is listed in plain language with its status (Learning / Ready / Active), and each is individually toggleable, editable, and deletable, with a Clear Everything action. Users can also add manual always-on word-swap rules by hand.

Consent is tri-state (undecided/enabled/disabled) so the existing-user vs deliberately-off distinction is never conflated: new users choose on the onboarding Completion step (default off), existing users get a one-time disclosure card gated on its own marker, and .undecided behaves as off. All three CorrectionCoordinator hooks (observe/enforce/recordOutput) are a strict no-op unless the user has opted in.

CorrectionCoordinator — recordOutput runs only on the confirmed-write tail so corrections aborted mid-flight (cancellation, selection-changed) never enter the reversion-detection buffer as text that was never pasted.

Settings — grouped Forms drop their gray canvas (scrollContentBackground hidden) and the window uses a full-size, transparent, title-less titlebar for a cleaner multi-tab surface; the Prompts tab clarifies that Writing Context is soft, model-interpreted guidance versus Personalization's exact, always-applied word swaps.

MLXService — critical memory-pressure monitor (DispatchSource .critical) unloads the resident On-Device model when macOS reports memory pressure and calls Memory.clearCache() so freed Metal buffers actually return to the OS; the model reloads from the disk cache on the next correction. Warning-level pressure is intentionally ignored (transient), and the prefix cache is not repopulated if the model was evicted mid-generation.

AppDelegate health polling — cloud providers (OpenAI/OpenRouter) now background-poll every 5 min instead of 30s, sleeping in 30s slices so a provider switch is picked up promptly; polling pauses while a correction is in flight, and menu-open triggers a throttled one-shot refresh so the status line stays current. Fast 10→60s backoff retained when unhealthy.

KeychainHelper — API-key saves use update-then-add (no delete-then-add window where a key could be lost), return a Bool, and surface failures via NotificationService; the legacy UserDefaults→Keychain migration deletes the plaintext copy only after a confirmed Keychain write.

ClipboardService.writeString — correction text written to the pasteboard is now marked org.nspasteboard.TransientType + ConcealedType so clipboard-manager apps don't record it during the copy → AI → paste cycle; target apps still read the plain string.

AppDelegate menu + SettingsManager — the status menu is built once and only its dynamic items (connection status, Launch-at-Login) refresh per open, with the custom-prompt section rebuilt only on change notification; the decoded customPrompts array is cached behind an NSLock and invalidated by the setter, removing per-open JSON decode churn.

MLXService — inference is now cancellable: the token stream checks Task.isCancelled and stops the GPU loop promptly instead of running to maxTokens, freeing the serialized container for the next correction; On-Device model downloads in Settings are cancellable too.

OpenAICompatibleProvider — OpenAI and OpenRouter unified behind a shared provider protocol over OpenAIChatClient, collapsing duplicated REST/error-mapping code; ResponseArtifacts centralizes the stop-marker / preamble / filler-prefix lists shared by the MLX atomic cleaner and the streaming cleaner.

AppDelegate Ollama warm-up loop — re-checks the keepOllamaLoaded toggle every 30s (warm-up cadence still 600s) so enabling it takes effect within ~30s instead of up to 10 minutes.

MLXProviderSettings — model unload is gated on app state rather than a view's .onDisappear, so switching Settings tabs no longer evicts the loaded On-Device model; MLXModelLoadController extracts the load/cancel/progress state machine from the view.

Tests — added PromptPersistenceTests (legacy decode, round-trip, bundled starter-pack) and ProviderResponseParsingTests (ChatResponse/ErrorResponse decoding, extractResult rules, full mapError matrix for OpenAI + OpenRouter); seedDefaultPromptsIfNeeded split into a pure, tested seedingDecision plus an I/O wrapper.

MLXDownloadProgressMonitor — new disk-based progress source for On-Device model downloads: sums the HuggingFace blobs directory plus the in-flight CFNetworkDownload temp file against each model's approximate size to drive a determinate progress bar. Works around swift-huggingface #48, where the library's own progress callback never reports incremental bytes for the large safetensors download on the LFS transport (didWriteData does not fire for the redirected CDN transfer), leaving the old bar stuck near 1% then jumping to 100%.

MLXService — uncached model downloads now report accurate progress via MLXDownloadProgressMonitor instead of the unreliable library callback; added modelCacheDirectory(_:) and downloadSizeBytes(for:) helpers, and a per-tick progress fraction capped at 99% until the model finishes loading.

MLXService.cleanUpOrphanedDownloadTempFiles() — sweeps orphaned CFNetworkDownload_*.tmp files (multi-GB leftovers from cancelled/failed downloads) older than 10 minutes; runs at app launch (off-main) and before each new download.

SettingsManager — added approxDownloadBytes to each MLXModelInfo entry, used as the denominator for the download progress bar.

MLXDownloadProgressMonitorTests — new Swift Testing suite covering the fraction cap math and the on-disk byte accounting (baseline orphan exclusion, temp-file matching, missing directories).

StreamingCorrector — new experimental streaming correction engine: types the On-Device model's output into the focused control as it generates, paced at ~280 chars/sec, with prefix-hold (identical output never touches the document), focus-change abort, and clipboard-paste paragraph separators (typed newlines would send messages in chat apps)

TypingService — posts synthetic Unicode keystrokes (CGEvent keyboardSetUnicodeString) for sandbox-compatible insertion that also reaches Chromium/Electron apps which swallow Accessibility writes; waits for the correction shortcut's modifiers to be released before typing so keystrokes don't register as shortcuts

MLXService.streamCorrectText — ChatSession-based streaming returning an AsyncThrowingStream<String, Error>, with cancellation wired through the stream's onTermination; added readyContainerSnapshot and effectiveSystemPrompt helpers now shared with the atomic correctText path

StreamingResponseCleaner — incremental counterpart to MLXService.cleanResponse; filters thinking blocks, preamble lines, code fences, leaked EOS markers, and "Okay, here's the corrected…" filler prefixes before each chunk is emitted, since typed text cannot be un-typed

ResponseCommentary — shared detection of trailing model commentary ("(Note: I corrected…)"), now multilingual across the languages WunderType supports, used by both the atomic and streaming correction paths

Settings — "Stream corrections into the document" toggle (default off) under a new Experimental section in General, gated to Apple Silicon, with inline known-limitations guidance when enabled

CorrectionCoordinator — routes On-Device corrections through StreamingCorrector when streaming is enabled, with full outcome handling (completed, no-changes, cancelled, failed, aborted-mid-stream); the standard atomic path now also strips trailing model commentary for parity

Tests — added ResponseCommentaryTests and StreamingResponseCleanerTests (21 cases) covering multilingual commentary detection, legitimate-parenthetical preservation, and incremental artifact/filler filtering across chunk boundaries

StreamingCorrector / TypingService — cancellation now propagates into the detached typing task (withTaskCancellationHandler + Task.isCancelled between keystroke chunks), so a focus change or user cancel aborts at the next keystroke boundary instead of finishing the in-flight slice into whatever app gained focus

MLXPromptPrefixCache — extracted the prompt-prefix match into a pure reusablePrefixLength(promptTokens:cachedTokens:cachedOffset:) function, documented the precondition that take/store must run inside ModelContainer.perform, and added MLXPromptPrefixCacheTests (7 cases) pinning the reuse boundaries

CursorSpinnerHost — coalesced the global mouse-move handler to reposition the progress spinner at most once per frame (~60 Hz) instead of a window-server setFrameOrigin round trip on every event for the full correction duration

Onboarding — replaced the Int-keyed step state machine with a type-checked OnboardingStep enum (centralized progress mapping, no dead default branch); extracted shared APIKeyField (debounced OpenAI/OpenRouter key validation), CopyCommandRow, and AboutRow components; made the cloud provider cards data-driven

Accessibility — added VoiceOver labels for the API-key validation status icons and the onboarding progress indicator; moved PromptEditorSheet's generation-error alert from a derived Binding(get:set:) to a Bool state flag

MLXService — new AI provider using Apple's mlx-swift-lm framework for in-process Metal GPU inference. Supports model download from HuggingFace, automatic caching, EOS token handling, and response cleaning (thinking blocks, code fences, preambles, leaked special tokens)

AIProvider — added .mlx ("On-Device") case wired through UnifiedAIService checkHealth, correctText, generateSystemPrompt, and showError

MLXSetupStep — new onboarding step with model picker, download with indeterminate progress spinner, model descriptions, error display, and download cancellation on Back

GeneralSettingsTab — On-Device provider section with model picker, descriptions, download/load/unload buttons, error display, and model-change state reset

ProviderSelectionStep — added On-Device provider card with cpu icon and Recommended badge, reorganized from 3-column to a 2x2 grid with compacted card spacing to fit the onboarding window; Intel Macs keep the original 3-card row with Ollama recommended

AppDelegate — MLX model pre-loading at launch when On-Device is the configured provider, with stored task handle for cancellation on termination

MLXService.cleanResponse — shared post-processing strips thinking blocks, EOS tokens (Gemma, Phi, Llama, Qwen), code fences, and preamble lines from all model output

Smart prompt routing — each entry in the model list declares whether it needs a compact prompt; Gemma 3 1B receives a compact grammar-focused prompt, while 2B+ models receive the full commonRules system prompt (matching Ollama behavior)

Race-safe model loading — concurrent calls wait for in-flight loads instead of duplicating downloads, with error and cancellation propagation to waiters; waiters time out after 120 seconds for cached loads or 30 minutes for active downloads

Apple Silicon gating — MLXService.isDeviceSupported hides the On-Device provider on Intel Macs (onboarding card and Settings picker), coerces a stored On-Device provider setting back to Ollama, and loadModel throws unsupportedDevice as a final guard; the app binary remains universal

MLX memory management — switching the AI provider away from On-Device (in Settings or onboarding) now frees the model weights, and loading a different model releases the previous one first instead of transiently holding two models in unified memory

Correction shortcut never triggers a silent multi-GB download — if the selected on-device model isn't cached (e.g. macOS purged the cache), the correction fails fast with a "Model not loaded" HUD instead of blocking for minutes while downloading

Corrections always run on the model selected in Settings — correctText reloads when the in-memory model diverges from the persisted selection, instead of silently serving from the previously loaded model

Model cache detection resolves the HuggingFace cache directory through the library's own CacheLocationProvider (sandbox- and env-var-aware) and requires config.json alongside the weights, so partial or interrupted downloads aren't mistaken for cached models

GeneralSettingsTab — model picker disabled while a load is in flight, loaded state verified against the service after each load, Reload Model actually unloads first (was a no-op), Unload guarded during loads, and cache checks moved off the SwiftUI render path

MLXSetupStep — restores the previously chosen model and loaded state when re-entering the step, no longer shows a download error when the user cancels via Back, and progress copy shows the model size and distinguishes downloading from loading

SettingsManager — MLX model list converted from a tuple to a typed MLXModelInfo struct; a stored model ID that's no longer in the list falls back to the default instead of blanking the picker and dropping its EOS token configuration

Download progress handler removed for uncached models — workaround for swift-huggingface issue #48 where @MainActor progress callbacks stall large downloads

CompletionStep — model summary row now shows the display name for all four providers including On-Device

AboutSettingsTab — model name switch handles .mlx case, displaying the friendly model name from the available models list

CorrectionCoordinator — hudMessage(for:) handles MLXServiceError with user-facing messages for model-not-loaded, download-failed, and correction-failed states

OnboardingView — default provider changed from .ollama to .mlx for new users, step 9 added for MLX setup with correct progress bar mapping

MLXPromptPrefixCache — KV-cache prefix reuse for on-device corrections: the templated system prompt (~150–430 tokens) is prefilled once and reused across corrections via token-level prefix matching, so each correction only prefills the selected text (~0.3–0.5s saved per correction). Mode switches, custom prompts, and model changes invalidate naturally; the stored cache is bounded to 512 tokens to keep idle memory predictable

MLXService — generation moved from ChatSession to a TokenIterator-based loop to enable prefix caching, with per-correction timing instrumentation (prefill/generation token counts, tok/s, and cached-token reuse) logged via os.Logger

MLX warm-up — a tiny throwaway generation after model load (launch pre-load, Settings load button, onboarding download) compiles the Metal kernels and pre-builds the system-prompt prefix cache, so the user's first correction no longer pays that cost

Gemma 3 1B no longer flips messy English input into German — the compact system prompt named languages ("German stays German, French stays French"), which primed the 1B model to translate. Reworded to name no languages; validated 0/4 German after vs 6/6 before, with German input still staying German

MLXService.cleanResponse — strips filler-prefixed preambles ("Okay, here's the corrected text:") that previously leaked past the preamble check into the corrected output

MLXCleanResponseTests — 27 unit tests covering EOS stripping (5 token formats), thinking block removal, code fence unwrapping, preamble stripping, and combined scenarios

MLXSmokeTests — parameterized integration tests running real inference across all shipped models, checking grammar correction, markdown preservation, German language preservation, and response sizing; plus a prefix-cache reuse test (asserts cached-token reuse with clean output, including identical resubmission) and a Gemma 1B language-stability regression test

SwiftPM dependencies added: mlx-swift-lm (3.0.0+), swift-huggingface (0.9.0+), swift-transformers (1.3.0+) with MLXLLM, MLXLMCommon, MLXHuggingFace, HuggingFace, and Tokenizers product dependencies

ShortcutStep — new onboarding step between Accessibility and Completion that presents a KeyboardShortcuts.Recorder, letting users customize their global shortcut before finishing setup

OnboardingView — added progressStep computed property that maps all internal step numbers to correct logical positions; previously the OpenAI setup path (step 3) showed progress position 3 instead of 2, causing the progress bar to jump

OllamaSetupStep — added a visible ProgressView spinner and "Launch Ollama and it will be detected automatically" hint in the not-running state, so users know polling is active without navigating away

OllamaSetupStep — first 3 health checks now run at 500ms intervals before settling to the 2s polling cadence, improving detection speed when Ollama is already running but slow to respond

OllamaSetupStep — running-state transition now animates smoothly with withAnimation instead of snapping

CompletionStep — removed the large green checkmark icon that was pushing the "Start Using WunderType" button off-screen on the 600×500 onboarding window

CompletionStep — summary section now shows the configured keyboard shortcut, and the Quick Start instructions display the actual shortcut (e.g. "Press ⌘⇧G") instead of generic "Press your keyboard shortcut"

AppDelegate — default-prompt seeding moved from applicationDidFinishLaunching into post-onboarding setup. Previously seedDefaultPromptsIfNeeded() ran before the Completion step wrote the installDefaultPrompts toggle, so the seed was version-stamped first and a user who opted out still received all 8 starter prompts. The opt-out is now honored

AppDelegate / PromptsSettingsTab — adding, editing, or deleting a custom prompt now posts a customPromptsDidChange notification; AppDelegate re-registers the onKeyUp shortcut handlers and rebuilds the menu. Newly added or re-bound shortcuts now fire without relaunching the app. v1.4.1 fixed edits to existing prompts (trigger-time lookup); this fixes brand-new shortcuts, which had a key binding but no action handler until restart

SettingsManager — the customPrompts getter now logs decode failures via os.Logger instead of silently returning an empty array. A silent decode failure is the mechanism behind the v1.4.1 data-loss bug (an empty load gets overwritten on the next save); logging makes any future recurrence observable

CorrectionCoordinator — the direct-write (Accessibility) path re-reads the selection immediately before writing and aborts with a "Selection changed" HUD if it moved during the AI call, instead of overwriting the wrong text. A pre-write cancellation check was also added. The write now returns a three-state outcome (written / needs-fallback / selection-changed) so a moved selection aborts cleanly rather than pasting into the wrong place. Affects non-sandboxed builds (the AX path)

CorrectionCoordinator / AccessibilityService — Smart Selection now restores the original caret position when no replacement happens (the AI returns identical text, errors, or is cancelled), so the user isn't left with the whole paragraph selected. New getSelectedRange / setSelectedRange helpers capture and restore the kAXSelectedTextRange. Affects non-sandboxed builds (the AX path)

CustomPrompt — added custom init(from:) decoder with decodeIfPresent for isDefault field, fixing a crash when decoding v1.3.x prompts that lack the field. Previously the decode failed silently, returning an empty array, which caused seedDefaultPromptsIfNeeded to overwrite existing user prompts with defaults

Custom prompt keyboard shortcuts now read the prompt from SettingsManager at trigger time instead of capturing the systemPrompt string at registration. Edits to prompt text take effect immediately without restarting the app

CorrectionCoordinator — when a custom prompt returns text identical to the input, a "No changes made" HUD is now shown instead of silently skipping. Built-in correction modes still skip silently (unchanged text means already correct)

PromptEditorSheet — on save, bare instructions that don't start with "You are" are automatically framed with "You are an in-place text editor" prefix and "Return ONLY the result" suffix for more reliable AI compliance

PromptsSettingsTab — writingContext switched from @AppStorage to @State with explicit SettingsManager sync, ensuring the 500-character clamp is always enforced

PromptsSettingsTab — Edit and Delete buttons now have per-prompt VoiceOver accessibility labels

PromptEditorSheet — keyboard shortcut recorder now has a VoiceOver accessibility label

Writing Context — new persistent text field in Settings (Prompts tab) appended to every AI system prompt. 500-character cap enforced at both UI and storage level

8 curated default prompts bundled as default-prompts.json, seeded on first launch with stable UUIDs for deduplication. Users can edit or delete defaults

Ollama keep-alive — pass keep_alive: -1 on API requests when enabled, plus periodic 10-minute warm-up ping to prevent model unloading. New toggle in Settings under Ollama provider

Tabbed Settings — SettingsView refactored into GeneralSettingsTab, PromptsSettingsTab, and AboutSettingsTab with TabView container. Custom prompt CRUD moved from NSAlert dialogs to SwiftUI sheet (PromptEditorSheet)

Menu bar dropdown slimmed — removed Add/Edit/Remove prompt items; prompt management now in Settings. Dropdown shows only executable prompts

NSApp.activate(ignoringOtherApps:) replaced with NSApp.activate() across 3 call sites (deprecated since macOS 14)

CorrectionCoordinator.normalizeUnicode — replaced Foundation replacingOccurrences(of:with:) with Swift-native replacing(_:with:)

OllamaService.GenerateRequest — custom encode(to:) with encodeIfPresent for keep_alive to avoid sending null (key omission instead)

Smart selection AX calls collapsed from 3 sequential Task.detached round-trips into a single detached block with 50ms focus-settle delay for macOS 15+ compatibility

SettingsManager.seedDefaultPromptsIfNeeded — decode errors now logged via os.Logger instead of silently swallowed

ModernCorrectionHUD — replaced force unwrap on optional message with safe optional chaining to prevent potential crash

OllamaSetupStep — copy-to-clipboard buttons now have VoiceOver-accessible text labels with .labelStyle(.iconOnly)

ModernCorrectionHUD — replaced hardcoded font size with semantic .caption for Dynamic Type support

OllamaSetupStep — replaced onAppear/onDisappear polling with .task {} for automatic cancellation on view disappear

Onboarding screens — replaced fontWeight(.bold) with bold() across 8 files for correct system weight selection

OpenRouterSetupStep — new onboarding step with API key validation and model ID input, matching the existing OpenAI setup flow

ProviderSelectionStep — added OpenRouter as a third provider card alongside Ollama and OpenAI

OnboardingView — routing updated to handle Ollama (step 2), OpenAI (step 3), and OpenRouter (step 7) setup paths with correct progress bar normalization

AccentColor asset added — app-wide accent color changed from system blue to a warm brown matching the WunderType brand

ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME build setting added for both Debug and Release configurations

App Store metadata updated — revised keywords, promotional text, and description to better showcase custom prompts and improve discoverability

ModernCorrectionHUD — added optional message parameter; HUD widens from 64pt to 180pt when a message is present and displays it below the icon

ModernCorrectionHUDHost — show() and update() now accept an optional message string passed through to the HUD view

CorrectionCoordinator — new hudMessage(for:) helper maps errors to short user-facing strings ("No text selected", "API key not configured", "Invalid API key", "Ollama is not running", "Model not found", "Insufficient credits", "Correction failed")

CorrectionCoordinator — error HUD display time increased from 1.5s to 2.5s to give users time to read the message

CorrectionCoordinator — "No text selected" now shows the error HUD with message in addition to the system notification

NotificationStep — new onboarding step that requests notification permission before the Accessibility step, with inline grant/deny handling and skip option

Onboarding flow expanded from 5 to 6 steps: Welcome → Provider → Provider Setup → Notifications → Accessibility → Completion

CorrectionCoordinator — skip AX/clipboard replacement when the AI returns text identical to the input, avoiding unnecessary cursor flicker on already-perfect text

CorrectionCoordinator — defensive output truncation caps AI responses at max(2× input length, 50K characters) with a user notification when triggered

ModernCorrectionHUD — reads accessibilityReduceMotion environment and disables the .symbolEffect(.bounce) animation when Reduce Motion is enabled

CursorSpinnerHost — checks NSWorkspace.shared.accessibilityDisplayShouldReduceMotion and shows a static indicator instead of the spinning progress indicator

NotificationStep icon uses @ScaledMetric for Dynamic Type support, consistent with other onboarding steps

Updated app icons and logo images with refreshed color scheme for improved visual consistency

Anti-asterisk rule in commonRules — small models (gemma3:4b, gemma3:1b) had a tendency to wrap changed words in *…* to highlight edits. Explicit rule prevents this

CorrectionMode prompts — refactored into shared commonRules block applied to every built-in mode. Enforces same-language responses, markdown preservation (in both directions — never strip, never add), opaque code blocks, proper-noun preservation, paragraph structure, and voice/rhythm preservation

Make Concise prompt — strengthened from "aim to reduce by 25–40%" to imperative "MUST be at least 25% shorter; count words and verify before responding". Validated across 4 Ollama models

CorrectionMode — new user-facing description property; Settings Mode picker now shows plain-language descriptions instead of the raw multi-paragraph system prompt

AccessibilityService — added per-PID focused-element fallback when AXUIElementCreateSystemWide() returns -25204. Recurring macOS 15 quirk when AX is queried from a global-shortcut handler; the per-PID query is more reliable for non-sandboxed builds

AccessibilityService — new frontmostApplicationPID() helper to safely fetch the PID on MainActor (NSWorkspace is MainActor-isolated) before dispatching AX work to Task.detached

docs/BUILD_DMG.md — documented the leftover sandbox container gotcha. Flipping ENABLE_APP_SANDBOX from YES to NO leaves ~/Library/Containers/com.wunderpen.app behind, and macOS keeps routing preference I/O through the container until it's manually deleted

docs/STREAMING_RESEARCH.md — captured the streaming-insertion spike as research. Validated the technical approach but not shipped due to App Store sandbox restrictions on cross-process Accessibility writes. Code removed from the binary; design and findings preserved for revival if Apple ever permits sandboxed AX text manipulation

ProviderCard — replaced onTapGesture with Button so VoiceOver recognizes provider selection cards and announces the chosen provider via accessibilityAddTraits(.isSelected)

Dynamic Type — onboarding icons (lock, completion checkmark, provider-card glyph) now use @ScaledMetric so they grow with the user's text-size preference

Onboarding pickers — Ollama and OpenAI model pickers switched from fixed frame(width:) to frame(maxWidth:) so long model IDs aren't truncated at larger Dynamic Type sizes

OnboardingView — split the 707-line file into 10 single-responsibility files under WunderType/Onboarding/ for clearer ownership and easier navigation

ModernCorrectionHUD — split into three files under WunderType/HUD/ and converted the static-only host types (ModernCorrectionHUDHost, CursorSpinnerHost) from final class to enum namespaces

NotificationService — replaced closure-based UNUserNotificationCenter.requestAuthorization and add(request:) with async/await variants for better Swift 6 strict-concurrency safety

Concurrency cleanup — removed redundant MainActor.run wrappers from AppDelegate health polling, system-prompt generation, and onboarding poll tasks (these already inherit MainActor isolation)

ProviderCard — collapsed the background + overlay shape pair into a single chained RoundedRectangle.fill().stroke() (modern iOS 17+ Shape API)

OpenAIChatClient — shared chat completions client for OpenAI-compatible providers, eliminating ~200 lines of duplicated code between OpenAIService and OpenRouterService

AccessibilityService — extracted focusedElement() helper to replace 5x duplicated AX boilerplate

CorrectionCoordinator — consolidated clipboard restore logic into a single helper

Cached menu bar icon instead of recreating it on every health poll tick

Refreshed Settings window with larger layout (580x580) and cleaner footer with version and links

Removed last-resort clipboard fallback that could silently correct stale clipboard content when no text was selected

Removed unused AIProvider.isAvailable property

Removed dead getSelectedTextBounds() and getSelectedTextEndPosition() methods from AccessibilityService

OpenRouterService — new AI provider using OpenAI-compatible chat completions API at openrouter.ai

OpenRouter API key storage in macOS Keychain via KeychainHelper

OpenRouter provider section in Settings with API key, model ID text field, and connection status

OpenRouter error handling with user-facing notifications (rate limits, insufficient credits, invalid key)

UnifiedAIService routing extended to support three providers (Ollama, OpenAI, OpenRouter)

Default OpenRouter model set to mistralai/mistral-small-3.2-24b-instruct

Implemented cooldown mechanism to prevent re-triggers from synthetic keystrokes

Added character limit validation for text correction requests

Added unit test coverage (entitlements, input validation, keychain)

Improved OpenAI API key handling in settings

Updated sandbox entitlements for network access

Correction shortcut could fire twice due to synthetic keystroke re-triggers — added cooldown mechanism

Character limit enforcement on text correction requests to prevent oversized API calls

More secure OpenAI API key handling

Better task cancellation and isProcessing state management in CorrectionCoordinator

AI response character count now logged for diagnostics

Unit testing target and scheme configuration

Renamed from WunderPen to WunderType across the entire project

Replaced all Task.sleep(nanoseconds:) calls with Duration-based API for clarity

High-resolution logo assets (1x + 2x) for crisp rendering on Retina displays

Onboarding now automatically requests Accessibility permission on appear

Cleaned up unused duplicate service files from old WunderPen structure

CursorSpinnerHost — native spinning cursor indicator shown during text correction

AccessibilityService methods to retrieve selected text and its screen bounds

Debounce logic for OpenAI API key input in Settings

Simplified OpenAI model list to gpt-4o-mini only (removed deprecated models)

Refactored AppDelegate to use dedicated MenuBarIcon for the status item

CorrectionCoordinator cancels ongoing tasks more efficiently

CursorSpinnerHost safety timeout set to 150 seconds

System-wide text correction via keyboard shortcut

OpenAI and Ollama AI provider support

5-step onboarding flow

macOS Keychain integration for API key storage

Accessibility API text replacement with clipboard fallback

Menu bar agent (no Dock icon)

App Sandbox with network client entitlement