feat: add LexAI status bar and suggestion panel

- Implemented a status bar item for LexAI with dynamic status updates (ready, processing, notReady).
- Created a suggestion panel for displaying and interacting with AI-generated suggestions.
- Added functionality for accepting, regenerating, and discarding suggestions within the suggestion zone.
- Introduced configuration options for writing style, prompt patterns, personas, and formats.
- Integrated progress indicators for long-running tasks and improved user feedback.
- Established TypeScript configuration for the vscode package.

docs/PROJECT_BRIEF.md

@@ -1,52 +1,55 @@
-# Project brief — LexAI
+# Project brief
 
-> Source of truth for *what* LexAI is and *why*. Keep it under two screens; link out for detail.
+> The single source of truth for *what* this app is and *why*. Keep it under two screens; link out for detail.
 
 ## Outcome
 
-- **One-line product:** A Grammarly-like Chrome extension (Manifest V3) that gives AI writing help — grammar fix, rephrase, shorten, expand, explain — on any webpage, using the user's own LLM API key.
-- **Measurable outcome:** A user can select text on any page, pick an action from the floating toolbar (or right-click menu / popup), and replace or copy an AI-improved version — with no LexAI backend and no subscription.
-- **Primary user:** Individuals who already hold an LLM API key (OpenAI / Anthropic / Groq / OpenRouter) and want inline writing assistance without paying a SaaS subscription or sending text through a third-party server.
-- **Why now:** BYO-key removes the cost and privacy objections to hosted writing assistants; MV3 + WXT makes a lightweight, serverless extension practical.
+- **One-line product:** LexAI — BYO-LLM writing help as a Chrome MV3 extension and a VS Code extension, sharing one provider/prompt core.
+- **Measurable outcome:** Select text → AI action (fix / rephrase / shorten / expand / explain / prompt) → replace in place (Chrome also supports Copy), with no LexAI backend and no subscription.
+- **Primary user:** People who already hold an LLM API key and want inline writing help without a SaaS subscription.
+- **Why now:** BYO-key writing help without accounts, telemetry, or a LexAI server in the path.
 
 ## Non-goals
 
-- No LexAI backend, account system, or subscription. The extension talks directly to the user's chosen provider.
-- Not a full document editor; it augments existing page inputs (textarea/input/contenteditable).
-- No telemetry or transmission of user text anywhere except the user-selected provider endpoint.
-- Not (yet) streaming, autocomplete, tone profiles, or custom style profiles — those are roadmap.
+- No LexAI backend, account, or subscription
+- No telemetry; no transmission of text or API key except to the user’s chosen provider
+- Not a full document editor
+- VS Code v1: no floating toolbar, Prompt Builder UI, or Copy As; Firefox/Safari packaging not in scope
 
 ## Acceptance tests
 
-1. `npm run typecheck` and `npm test -- --run` pass.
-2. `npm run build` produces a loadable `.output/chrome-mv3/` bundle (~166 KB baseline).
-3. Loaded unpacked, selecting text on a page shows the toolbar; an action returns a result modal; Replace edits both textarea/input and contenteditable targets.
-4. API key is stored via the encrypted path (`apiKeyEnc` + `encKey`) and never logged or sent anywhere but the provider endpoint.
+1. `npm run typecheck` and `npm test -- --run` pass
+2. `npm run build` yields a loadable `.output/chrome-mv3/`
+3. Chrome: Replace works on `textarea`/`input` and `contenteditable` (load-unpacked — unit tests do not cover DOM timing)
+4. Chrome: API key uses the encrypted path (`apiKeyEnc` + `encKey`) and is never logged or exfiltrated
+5. `npm run vscode:typecheck` and `npm run vscode:build` succeed; VS Code stores the key in Secret Storage and replaces the editor selection
 
 ## Constraints
 
-- **Stack:** WXT `^0.20` (Vite), React 18 + TypeScript (Options/Popup only), tweetnacl for key encryption. Tailwind is installed but **inactive** — all UI is inline styles.
-- **Runtime:** Node 22 (CI pins `node:22-bookworm`). `npm install` required before any `npm run *`.
-- **Security/compliance:** Handles a user secret (LLM API key) and reads page-selected text. Manifest currently requests `<all_urls>` — a Chrome Web Store review risk (see `attacksurface.md`).
-- **Release:** CI is **Gitea** (`.gitea/workflows/`), not GitHub Actions. Version must match in `package.json` and `wxt.config.ts`; a `v*.*.*` tag deploys to the Chrome Web Store.
+- **Deadline / milestones:** none fixed; track in Plane (LEXAI) and `docs/TASKS.md`
+- **Budget / cost ceiling:** user pays their own provider; extension has no LexAI infra bill
+- **Stack:** WXT ^0.20 + React 18 + TypeScript (Chrome); `packages/vscode` + esbuild (VS Code); shared `src/lib`; Node 22; providers OpenAI / Anthropic / Groq / OpenRouter
+- **Security / compliance:** never log the key; Chrome encrypts in `chrome.storage.local`; VS Code uses Secret Storage; content/popup must not call providers
+- **Team / bus factor:** solo owner; operating system in `AGENTS.md` + `CLAUDE.md` + `docs/`
 
 ## Stakeholders
 
 | Role | Who | Decision authority |
 | --- | --- | --- |
-| Owner / maintainer | John Kevin Asprec | scope, priorities, release |
-| Project tracking | Plane (LEXAI project) | https://plane-pro.juankibin.space |
+| Product owner | John Kevin | scope, priorities, release, reference-bar acceptance |
+| Eng / harness | this Cursor kit + Claude kit in-repo | architecture proposals, implementation under gates |
 
 ## Unknowns
 
-- Whether to narrow host permissions to `activeTab`/allowlist before a serious Web Store push (see Decisions + attack surface).
-- Whether the current tweetnacl approach should be replaced given `encKey` is co-located with the ciphertext (it is obfuscation, not protection).
+- Reference bar for selection-toolbar/card UX is proposed (Grammarly screenshots into `docs/reference/`) but **not yet concrete** — no gauntlet until artifacts exist
+- Whether Cursor picker IDs match the profile-table slugs written in `docs/MODEL_ROUTING.md` (live scout verifies `fast`; mid/strong fail loudly on first Task if not)
 
 ## Source of truth
 
-- **Issue tracker:** Plane — LEXAI project (link above).
-- **This repo:** entrypoints in `entrypoints/`, shared code in `src/`, tests in `tests/`. `CLAUDE.md` is the working guide for architecture and conventions.
+- **Issue tracker:** Plane (LEXAI)
+- **Design / specs:** `docs/` (+ `DESIGN_SYSTEM.md` / `design/` when created)
+- **This repo:** `AGENTS.md` (Cursor control plane), `CLAUDE.md` (Claude control plane), Chrome in `entrypoints/`, VS Code in `packages/vscode/`, shared core in `src/lib/`, tasks in `docs/TASKS.md`
 
 ---
 
-*Related: `ARCHITECTURE.md`, `DECISIONS.md`, `TASKS.md` (from RECOMMENDATIONS), `attacksurface.md`, `SELF_MODEL.md`.*
+*Related: `ARCHITECTURE.md` (how it's built), `DECISIONS.md` (why choices were made), `TASKS.md` (active work), `SELF_MODEL.md` (who the harness is building for).*