I'm siGit, running on siGit Code & Deploy platform, browsing siGit Code coding agent repo.
feature/account-commands-system-status
| 1 | # Changelog |
| 2 | |
| 3 | ## Unreleased |
| 4 | |
| 5 | ### Added |
| 6 | |
| 7 | - **`sigit run --model <tier>` picks the siGit Code Cloud tier for a headless run.** Headless |
| 8 | runs always used the default tier, so when that tier was unavailable a script or sandbox |
| 9 | runner had no way to pick another without pointing the custom-endpoint override at siGit Code |
| 10 | Cloud. The flag takes a tier name (`prism`) or its model id (`onde-prism`) and wins over the |
| 11 | provider override and the local-inference setting. |
| 12 | |
| 13 | ## 1.7.6 |
| 14 | |
| 15 | A background-task tool for long commands, model pickers grouped by where the |
| 16 | model runs, and a shorter README. No protocol change, so an editor sees a |
| 17 | 1.7.5-shaped agent. |
| 18 | |
| 19 | ### Added |
| 20 | |
| 21 | - **`monitor_command` follows a background task in one tool call.** It waits |
| 22 | until the task exits, a line of new output matches an optional `until` |
| 23 | pattern, or a timeout passes (300 s by default, 600 s at most). In an |
| 24 | editor it is a single card that updates with the task's output as it |
| 25 | arrives, instead of a column of `command_output` cards that also used up |
| 26 | the turn's tool rounds (#253). |
| 27 | |
| 28 | ### Changed |
| 29 | |
| 30 | - Cards for `command_output`, `monitor_command` and `kill_command` name the |
| 31 | task and its command. |
| 32 | - `/models` and the editor's model picker group models by where they run, |
| 33 | on-device or cloud, instead of one flat list (#264, #265). |
| 34 | |
| 35 | ### Fixed |
| 36 | |
| 37 | - The winget pull request description gives the version of the release it was |
| 38 | filed for (#267). |
| 39 | |
| 40 | ### Docs |
| 41 | |
| 42 | - The README is shorter and the details moved into docs. Android Studio is |
| 43 | documented, and the JetBrains and download links point to the right places |
| 44 | (#266). |
| 45 | |
| 46 | ## 1.7.5 |
| 47 | |
| 48 | A new siGit Code Cloud tier, and two fixes for signing in and switching |
| 49 | accounts. No protocol change, so an editor sees a 1.7.4-shaped agent. |
| 50 | |
| 51 | ### Added |
| 52 | |
| 53 | - A new siGit Code Cloud tier, `lumen`, for long-context work over text and images. It shows in `/models` and the editor picker (#261). |
| 54 | |
| 55 | ### Fixed |
| 56 | |
| 57 | - **`/whoami` no longer reports a working sign-in as expired.** It called |
| 58 | `/api/v1/me`, which rejects the OAuth tokens the browser sign-in stores, so a |
| 59 | good session read "Session may be expired (HTTP 403)". It now calls |
| 60 | `/api/v1/user`, the endpoint the browser flow uses to read the profile |
| 61 | (#258). |
| 62 | - **Reauthenticate can switch accounts again.** `authenticate` returned early |
| 63 | when the stored session verified, which stopped Reauthenticate from opening |
| 64 | the browser. It now always runs the browser flow (#258). |
| 65 | - **After Reauthenticate, the next message uses the new account.** Every cloud |
| 66 | backend kept the token it was built with, so the live backend, parked |
| 67 | threads and subagents kept sending the old account's bearer until Reload |
| 68 | Agent. Cloud backends now read the stored token on each request (#259). |
| 69 | |
| 70 | ## 1.7.4 |
| 71 | |
| 72 | The browser sign-in page looks like the product and stops reporting success |
| 73 | before there is any. No protocol change, so an editor sees a 1.7.3-shaped agent. |
| 74 | |
| 75 | ### Fixed |
| 76 | |
| 77 | - **The sign-in page only says "Signed in" once the sign-in actually |
| 78 | happened.** The loopback success page was sent the moment the callback |
| 79 | arrived, before the authorization code was redeemed. If the exchange then |
| 80 | failed, the browser read "Signed in to siGit Code" while the app reported an |
| 81 | error. `wait_for_code` now hands back the open connection unanswered and |
| 82 | `complete_loopback` responds only after the exchange has settled, with a |
| 83 | separate page for a failure (#254). |
| 84 | - **The sign-in page is restyled.** It is now a centered logo, title and hint |
| 85 | on a dark canvas, with inline CSS and an inlined logo, so the page served |
| 86 | from the loopback address makes no second request. Title and hint are |
| 87 | distinct, so a decline, a stray request and a mismatched callback each read |
| 88 | as themselves (#254). |
| 89 | |
| 90 | ## 1.7.3 |
| 91 | |
| 92 | One fix, and no protocol change, so an editor sees a 1.7.2-shaped agent. |
| 93 | |
| 94 | ### Fixed |
| 95 | |
| 96 | - **A thread whose directory is gone no longer runs tools elsewhere.** The |
| 97 | process stayed in whichever directory the previous thread left it in, so |
| 98 | `read_file`, `edit_file` and `run_command` acted on the wrong project. A |
| 99 | prompt on such a thread now fails with resource not found, and a turn that |
| 100 | loses its directory mid-wait is cancelled. `session/load`, `session/resume` |
| 101 | and `session/fork` still succeed, so the saved history stays readable (#179). |
| 102 | |
| 103 | ## 1.7.2 |
| 104 | |
| 105 | The interactive terminal tells the program that launched it what it is doing, |
| 106 | and a model that writes its tool calls as prose gets them run more often. No |
| 107 | protocol change, so an editor sees a 1.7.1-shaped agent. |
| 108 | |
| 109 | ### Added |
| 110 | |
| 111 | - **Program status in the interactive terminal.** siGit Code now writes an |
| 112 | `OSC 7501` record (`app=sigit`) as its state changes, so a terminal that |
| 113 | tracks program status can show it: `idle`, `working`, `done`, `error`, and |
| 114 | `blocked` with `kind=permission`, `question` or `auth` while it waits on the |
| 115 | user. Repeated states are collapsed, a write failure is ignored rather than |
| 116 | ending the turn, and the root record is deliberately left alone on exit, so |
| 117 | a bare clear cannot wipe another program's records (#235). |
| 118 | |
| 119 | ### Fixed |
| 120 | |
| 121 | - **More inline tool calls are recovered.** Models that write a call into the |
| 122 | content as text instead of the tool channel are now understood in more |
| 123 | spellings: a DSML envelope named `function_calls` or bare `calls` as well as |
| 124 | `tool_calls`, a closer that puts its slash before the bar |
| 125 | (`</｜DSML｜invoke>`), and the `<minimax:tool_call>` wrapper around |
| 126 | `<invoke name="…">` with parameters written either as |
| 127 | `<parameter name="k">v</parameter>` or `<k>v</k>`. The tokenizer's |
| 128 | `]<]minimax[>[` special token, which leaks into content between tags and in |
| 129 | prose, is stripped instead of being left in the reply and in history (#249). |
| 130 | - **Headless mode says when a tool round is the last one.** The round that |
| 131 | reaches the cap is answered in text with no tools, which the model could not |
| 132 | see, so it spent its final reply announcing a step that would never run. That |
| 133 | round's last tool result now carries a note giving the round count, saying no |
| 134 | tools remain and that nobody is there to reply. The interactive client has |
| 135 | said this for a while; headless was left without it (#250). |
| 136 | |
| 137 | ### Docs |
| 138 | |
| 139 | - **A README for `sigit-agent`.** The crate a host embeds had no front page. |
| 140 | It now has a short one: what the profile offers, and a `serve` example that |
| 141 | notes the host must call it from inside a tokio runtime. |
| 142 | |
| 143 | ## 1.7.1 |
| 144 | |
| 145 | Two process-global stores in the CLI leaked between the sessions one process |
| 146 | serves. A patch release, so nothing here changes the protocol surface 1.7.0 |
| 147 | introduced. |
| 148 | |
| 149 | ### Fixed |
| 150 | |
| 151 | - **A todo list cannot leak into another thread.** `tools.rs` kept the list in |
| 152 | a single process-global slot, shared by every session the process serves, so |
| 153 | a plan written in one conversation showed up in the next. It is keyed by |
| 154 | session now, like the permission grants, and cleared when the session ends. |
| 155 | The TUI carries a session key of its own (`permissions::TUI_SESSION`) rather |
| 156 | than the session-less `""` key, so its background commands, plan and |
| 157 | permission grants are torn down on exit; the unused `TODOS_TEST_LOCK` and |
| 158 | `reset_todos` are gone. |
| 159 | - **The model picker's roots are resolved per caller instead of through the |
| 160 | environment.** `setup.rs` built its model store by mutating `HF_HUB_CACHE`, |
| 161 | `HF_HOME` and `HOME` under `ENV_TEST_LOCK`, which never isolated the values |
| 162 | because the picker reads those variables on other threads — `setup::tests` |
| 163 | failed intermittently. Production callers resolve the roots once with |
| 164 | `ModelRoots::from_env()` and pass them into the internals, so a test points |
| 165 | the readers at a scratch directory instead of aiming process-global |
| 166 | variables at it. |
| 167 | - **`sigit` publishes again.** The crate listed eight keywords and crates.io |
| 168 | accepts five, so the v1.7.0 publish failed with a 400. The list is trimmed to |
| 169 | `cli`, `ai`, `coding-agent`, `llm`, `acp`. |
| 170 | |
| 171 | ## 1.7.0 |
| 172 | |
| 173 | Finishes the Agent Client Protocol v1 surface. An editor can now delete a |
| 174 | thread, show a context meter, tell one message from the next, cancel a request |
| 175 | by its id and page through a long thread list, and a reopened thread comes back |
| 176 | with its reasoning and attachments. |
| 177 | |
| 178 | ### Added |
| 179 | |
| 180 | - **`session/delete`.** A thread removed in the editor is removed from disk, so |
| 181 | it no longer comes back in "Import Threads". A turn still running on it is |
| 182 | stopped first, and deleting an id that is already gone succeeds (#192). |
| 183 | - **A saved thread reports its title and time as they change.** Each save sends |
| 184 | a `session_info_update` with a fresh `updatedAt`, and the title the first time |
| 185 | there is one. A new thread used to stay untitled in the sidebar until the next |
| 186 | `session/list` (#193). |
| 187 | - **Context usage.** A `usage_update` follows every model response, so an editor |
| 188 | can show how full the context window is. `used` is the endpoint's own token |
| 189 | count when it gives one and an estimate otherwise, which is always the case |
| 190 | on-device (#194). |
| 191 | - **Message ids.** Every message chunk carries a `messageId`. An inference round |
| 192 | is one message, so its reply and its reasoning share an id and the round after |
| 193 | a tool call starts a new one (#195). |
| 194 | - **Sign-in through the editor.** For a client that advertises URL-mode |
| 195 | elicitation, `authenticate` hands it the sign-in page instead of launching a |
| 196 | browser from the agent. The user sees where they are being sent, and sign-in |
| 197 | works where siGit Code has no browser to open (#197). |
| 198 | - **The Inference switch is a toggle** for a client that renders boolean config |
| 199 | options. Other clients keep the two-value select (#198). |
| 200 | - **Deny for the session.** A permission prompt offers "deny for this session" |
| 201 | next to "allow for this session", so a tool the user does not want is not |
| 202 | asked about again in that thread (#199). |
| 203 | - **`$/cancel_request`.** A client can cancel a request by its JSON-RPC id. For |
| 204 | `session/prompt` that stops the turn and the command it is running exactly as |
| 205 | `session/cancel` does, and the prompt is answered with the `cancelled` stop |
| 206 | reason. For `authenticate` it ends the wait on the browser and the request is |
| 207 | answered `-32800`. The notification used to be ignored. |
| 208 | - **`session/list` is paged.** A reply holds at most 100 threads and a |
| 209 | `nextCursor` when there are more. The cursor names the last thread on the |
| 210 | page instead of counting an offset, so the next page is right when a thread is |
| 211 | saved or deleted in between. A cursor the agent did not hand out is rejected |
| 212 | with `-32602`; `cursor` used to be ignored. |
| 213 | |
| 214 | ### Fixed |
| 215 | |
| 216 | - **A reopened thread shows its reasoning and attachments.** `session/load` |
| 217 | replayed only the text of each message. The model's reasoning now comes back |
| 218 | as `agent_thought_chunk` under the reply's `messageId`, and the images and |
| 219 | audio clips of a user message come back as `image` and `audio` blocks. |
| 220 | - **Cancelling a turn stops the command it is running.** A foreground |
| 221 | `run_command` used to run to its own end (up to two minutes) before the turn |
| 222 | noticed the cancel. A cancel or `session/close` now kills the process tree, or |
| 223 | sends `terminal/kill` when the command runs in the editor's terminal, and the |
| 224 | turn ends `cancelled` within a moment. |
| 225 | - **Switching permission mode works while a turn is running.** `session/set_mode` |
| 226 | and the Permissions config option queued behind the turn's session lock, so |
| 227 | choosing Auto while a permission prompt was open did nothing until the turn |
| 228 | ended. They now take no lock, are answered at once, and the pending call's |
| 229 | successors follow the new mode. Model and Inference changes still wait for |
| 230 | the turn. |
| 231 | - **`authenticate` checks the method id.** An id that `initialize` never offered |
| 232 | is now rejected with `invalid_params` (`-32602`) instead of starting a |
| 233 | browser sign-in. A sign-in that fails reports `-32603`, since `-32000` means |
| 234 | authentication is required before a call. |
| 235 | - **A session the agent does not know is `-32002`.** `session/prompt`, |
| 236 | `session/set_mode` and `session/set_config_option` answered `-32602` for an |
| 237 | unknown id; they now say resource not found, as `session/load` and |
| 238 | `session/resume` already did. |
| 239 | - **A finished terminal command no longer names a released terminal.** The |
| 240 | closing `tool_call_update` of a command that ran in the editor's terminal |
| 241 | re-sent the terminal id after `terminal/release`. It now leaves the content |
| 242 | alone, so the embedded terminal stays as it was, and the result still goes out |
| 243 | as `rawOutput`. |
| 244 | - **`session/list` rejects a relative `cwd` filter** with `-32602`, as |
| 245 | `session/new` does. |
| 246 | - **An embedded binary resource is read when the model can read it.** An image |
| 247 | blob becomes an image input and an audio blob an audio input. Any other blob |
| 248 | keeps its placeholder, now with its MIME type. |
| 249 | |
| 250 | ## 1.6.9 |
| 251 | |
| 252 | ### Fixed |
| 253 | |
| 254 | - **Doubled-bar DSML markers survive inline tool-call recovery.** Some models |
| 255 | write `||name||args||` (and single-bar `|name|args|`) instead of the |
| 256 | underscore-form `__name__args__` that `inline_tool_calls` was matching. |
| 257 | These were being dropped from the recovered reply and from history, so the |
| 258 | model thought its call had run. The scanner now accepts both forms, and |
| 259 | a buffer that contains no doubled bar skips the regex fold entirely |
| 260 | instead of allocating an empty `String`. |
| 261 | |
| 262 | ### Changed |
| 263 | |
| 264 | - **The release workflow is split into full-release and scoped-patch flows.** |
| 265 | `sigit-code-release` now leads with a scoped-patch path for one or two |
| 266 | commits on top of the last tag (no new release skill, no ACP advert, |
| 267 | no `## $version` requirement), then a full-release path for normal |
| 268 | development → `main` releases. Winget CI also gets a blank line between |
| 269 | the issue body and the manifest PR body so the rendered issue no longer |
| 270 | runs the two together. |
| 271 | |
| 272 | ## 1.6.8 |
| 273 | |
| 274 | ### Fixed |
| 275 | |
| 276 | - **A bare launch of `sigit.exe` on Windows exits 0 instead of bailing.** A |
| 277 | no-argument launch with a TTY stdin falls through to the non-Unix branch, |
| 278 | which has no TUI to start (the interactive client needs Unix-only fd |
| 279 | redirection). It now prints a short usage message pointing at ACP and |
| 280 | headless modes and exits 0, so winget's installer validator no longer reports |
| 281 | a `Validation-Executable-Error`. |
| 282 | |
| 283 | ### Changed |
| 284 | |
| 285 | - **winget submissions link back to their Package Request issue.** The release |
| 286 | workflow scrapes the winget-pkgs PR URL from wingetcreate, opens a Package |
| 287 | Request issue on first submission, and rewrites the PR body to fill the |
| 288 | Description, tick the issue checkbox, and add `Resolves #NNN` — replacing the |
| 289 | manual per-PR edit that used to follow each release. |
| 290 | - **The winget release workflow files its Package Request issue first and uses |
| 291 | two scoped tokens.** The Package Request issue is opened before the |
| 292 | winget-pkgs PR so the PR can reference it immediately, and issue creation and |
| 293 | PR submission now use separate tokens (`WINGET_ISSUE_TOKEN` and |
| 294 | `WINGET_PR_TOKEN`) rather than one shared token. |
| 295 | |
| 296 | ## 1.6.7 |
| 297 | |
| 298 | ### Fixed |
| 299 | |
| 300 | - **A cancel that arrives before the turn starts is no longer lost.** A prompt |
| 301 | now registers for `session/cancel` as soon as it begins, not once it reaches |
| 302 | inference. A cancel that lands while the turn is queued on the workspace, |
| 303 | switching threads, loading a model, or running a slash command ends it with |
| 304 | `cancelled` instead of `end_turn`. |
| 305 | - **A prompt that is only audio is answered.** A clip with no text or image used |
| 306 | to end the turn at once with nothing sent to the model, even though the agent |
| 307 | advertises audio. |
| 308 | |
| 309 | ## 1.6.6 |
| 310 | |
| 311 | ### Added |
| 312 | |
| 313 | - **A tool call carries its programmatic tool name.** The `tool_call` an editor |
| 314 | gets for a running tool now includes `name` (`read_file`, `run_command`, |
| 315 | `mcp__…`) next to the human title, sent on the first report of the call only |
| 316 | as the protocol asks. A client can tell a command from a file edit without |
| 317 | parsing the title, and a replayed thread from `session/load` carries the same |
| 318 | name (#196). |
| 319 | |
| 320 | ### Changed |
| 321 | |
| 322 | - **MCP runs on `rmcp`, the official Rust SDK, through `ed-mcp`.** siGit Code's |
| 323 | own JSON-RPC client for stdio and Streamable HTTP servers (about 600 lines) |
| 324 | is gone; `ed-mcp` is the layer every Onde agent shares. `mcp.toml`, the |
| 325 | baked-in `sigit` and `smbcloud` servers, tool names and `/mcp` are unchanged. |
| 326 | An HTTP server that stops answering is now reconnected and the call retried |
| 327 | once for any failure but a timeout, not only on a 404. |
| 328 | |
| 329 | ### Fixed |
| 330 | |
| 331 | - **A reply that degenerates into a repetition loop is cut off.** After a tool |
| 332 | call, a model could fall into thousands of words from a tiny vocabulary |
| 333 | (`find: list: check: get: …`) with no tool call and no end, and the junk went |
| 334 | into history for the next turn. siGit Code now watches a streamed reply for a |
| 335 | window of 200 words with very few distinct ones (code blocks excepted), stops |
| 336 | reading, keeps only the text before the loop, tells you it stopped, and asks |
| 337 | the model once to make its call or answer briefly (#123). |
| 338 | - **A linked selection written as `L10-L20` or `L10` reads just those lines.** |
| 339 | siGit Code read the line range of a `resource_link` only as `L10:20` or |
| 340 | `L10-20`, so `L10-L20` (the GitHub style) and a single line `L10` sent the |
| 341 | whole file instead of the selection. It now reads the same forms Zed's own |
| 342 | mention parser does, and a range that starts at line 0 or runs backwards |
| 343 | counts as no range. |
| 344 | |
| 345 | ## 1.6.5 |
| 346 | |
| 347 | ### Added |
| 348 | |
| 349 | - **An `@file` mention can carry unsaved edits.** siGit Code now advertises |
| 350 | `promptCapabilities.embeddedContext`, so a client can put a resource's |
| 351 | contents in the prompt instead of sending a link to it. Before, a client |
| 352 | that follows the spec only sent `resource_link`, and siGit Code read the |
| 353 | file from disk, missing whatever the user had not saved yet (#141). |
| 354 | - **A prompt can carry audio.** siGit Code now advertises |
| 355 | `promptCapabilities.audio` and sends an attached clip to the model as an |
| 356 | OpenAI `input_audio` part. It works the way image attachments do: a model on |
| 357 | an endpoint you configure yourself gets the clip and decides for itself, |
| 358 | while siGit Code Cloud tiers and on-device models, none of which take audio |
| 359 | today, get a note in its place and the editor says the clip was left out |
| 360 | (#143). |
| 361 | - **The README says what telemetry is sent.** A new Telemetry section covers |
| 362 | the model-timing events Onde Inference can report for on-device models, |
| 363 | what they leave out, and how to turn them off with `ONDE_DISABLE_PULSE=1`. |
| 364 | |
| 365 | ### Changed |
| 366 | |
| 367 | - **A turn that cannot get its session back stops.** A turn on an HTTP backend |
| 368 | gives up the process-wide working directory while it waits and reinstalls |
| 369 | its session before a tool runs. If the reinstall failed, the turn logged a |
| 370 | warning and carried on in whichever directory was current. Nothing makes it |
| 371 | fail today, since a close waits for the turn, but the turn now ends as |
| 372 | cancelled instead of depending on that. |
| 373 | - **Dependencies match the rest of the Onde stack.** Onde 1.2.2 to 1.3.1, |
| 374 | reqwest 0.12 to 0.13 and ratatui 0.29 to 0.30, the versions Ed, OndeCode and |
| 375 | SplitFire Agent use. ratatui is built with only its crossterm backend, which |
| 376 | drops the second copy of crossterm (0.28) from the build. |
| 377 | |
| 378 | ### Fixed |
| 379 | |
| 380 | - **Tags a model makes up no longer show in the reply.** After a long run of |
| 381 | tool rounds, a model could start writing markup that looked like it came |
| 382 | from siGit Code: a `<system_warning>` block telling the user the previous |
| 383 | turn was injected and should be ignored, or a question wrapped in |
| 384 | `<Option_Picker>`. Neither tag means anything to siGit Code or the editor, |
| 385 | so both rendered as raw text. A `system_*` block is now dropped from the |
| 386 | reply and from the history, and other made-up tags are removed while the |
| 387 | text inside them stays. Code blocks are left alone. The system prompt also |
| 388 | tells the model to write plain Markdown and to list choices as plain text |
| 389 | (#122). |
| 390 | - **Closing a thread that is waiting at a permission prompt no longer hangs.** |
| 391 | `session/close` cancels the session's running turn and waits for it to end, |
| 392 | but a turn stopped at a permission prompt only went on when the client |
| 393 | answered the request. A client that closed the thread without answering |
| 394 | left the close, and every later request for that thread, waiting for good. |
| 395 | The same held for `session/cancel` with a client that did not send the |
| 396 | cancelled outcome the protocol asks for. The permission wait now ends on |
| 397 | the cancellation as well, and an approval that arrives after the turn was |
| 398 | cancelled runs nothing. |
| 399 | |
| 400 | - **A closed thread no longer leaves its request lock behind.** The process |
| 401 | kept one lock per session id for as long as it ran, for closed threads and |
| 402 | for ids no session ever had. The entry now goes with the last request that |
| 403 | used it. |
| 404 | |
| 405 | - **A tool call that did not run no longer shows as completed.** When policy |
| 406 | or plan mode denied a call, when the user picked Deny at the permission |
| 407 | prompt, or when the repeat guard skipped a call the model made three times, |
| 408 | the editor's card still ended `completed`. Those cards now end `failed`, the |
| 409 | same way a call cancelled at the prompt already did. A call denied at the |
| 410 | prompt also gets its own title back instead of keeping the permission |
| 411 | request's (#139). |
| 412 | |
| 413 | - **On-device inference no longer panics on some non-English text.** siGit Code |
| 414 | now builds on Onde 1.3.1, which fixes a panic when a message longer than 100 |
| 415 | bytes had a multi-byte character (an accented letter, CJK, or an emoji) at |
| 416 | byte 100. Onde 1.3 also reports Pulse events for streaming inference, which |
| 417 | is the path on-device turns take, so those turns are now reported alongside |
| 418 | model loads. `ONDE_DISABLE_PULSE=1` turns Pulse off. |
| 419 | |
| 420 | ## 1.6.4 |
| 421 | |
| 422 | ### Added |
| 423 | |
| 424 | - **DeepSeek DSML tool calls written into the reply text are recovered.** A |
| 425 | DeepSeek-family endpoint can render a tool call as literal |
| 426 | `<｜DSML｜tool_calls>` text instead of the structured `tool_calls` field, |
| 427 | which streamed the tag into the editor and ended the turn with nothing run. |
| 428 | The inline tool-call scanner that already recovered the GLM XML and Kimi K3 |
| 429 | shapes now recovers the DSML shape too, including a marker split across |
| 430 | stream chunks. A block that fails to parse is still kept out of the reply |
| 431 | and the history, and the model is told the call did not run (#181). |
| 432 | |
| 433 | ### Fixed |
| 434 | |
| 435 | - **The round-cap stop message no longer carries a stray run of spaces.** |
| 436 | When the tool-round cap ended a turn, the closing message could collapse a |
| 437 | space run into the wrong spot, which the editor then rendered verbatim |
| 438 | (#177). |
| 439 | |
| 440 | ## 1.6.3 |
| 441 | |
| 442 | ### Added |
| 443 | |
| 444 | - **A client can resume a session and close one.** siGit Code now advertises |
| 445 | `sessionCapabilities.resume` and `sessionCapabilities.close`. |
| 446 | `session/resume` restores a saved thread the way `session/load` does, but |
| 447 | sends none of it back: it is for a client that still has the thread on |
| 448 | screen, after an agent restart for example. `session/close` cancels the |
| 449 | session's running turn and drops what the process held for it, which is its |
| 450 | state, its permission grants and plan mode, the MCP servers the client named |
| 451 | for it, and the background commands it started. The saved history is left |
| 452 | alone, so a closed thread still lists and reopens (#149). |
| 453 | |
| 454 | - **The permission modes are also offered as ACP session modes.** Manual, Auto |
| 455 | and Plan were only reachable as a config option, which is what the protocol |
| 456 | now recommends and what Zed reads. A client that draws the older mode |
| 457 | selector saw nothing. `session/new`, `session/load` and `session/fork` now |
| 458 | return the same three in `modes`, `session/set_mode` switches between them, |
| 459 | and a change made any other way (the config option, `/plan`, `/clear`, |
| 460 | `/reload`) is announced with `current_mode_update`. A client that reads |
| 461 | config options ignores `modes`, so nothing changes there (#148). |
| 462 | |
| 463 | - **An editor can sign out of siGit Code.** The `initialize` reply carried an |
| 464 | empty `auth` object, so a client drew no sign out button, and typing |
| 465 | `/logout` was the only way out of an account. The reply now advertises |
| 466 | `agentCapabilities.auth.logout`, and a `logout` request ends the account |
| 467 | session through the method `/logout` calls. The request names no session, |
| 468 | so it moves every open thread that used the account, not only the live one: |
| 469 | a thread parked on a cloud tier goes on-device with the live thread instead |
| 470 | of failing to restore its tier on its next prompt, and every thread that |
| 471 | moved gets a fresh model picker. Local inference is switched back on if it |
| 472 | was off, so a thread opened after signing out asks for no cloud tier |
| 473 | (#150). |
| 474 | |
| 475 | ### Changed |
| 476 | |
| 477 | - **Two threads can run a turn at the same time.** An editor runs one siGit |
| 478 | Code process for every thread it has open, and a single lock ordered every |
| 479 | turn-affecting request in it, so a second prompt waited for the first |
| 480 | thread's whole turn and two prompts never overlapped. The lock held what a |
| 481 | session installs process-wide — the working directory, the workspace roots, |
| 482 | the MCP servers the client named for it, the live backend — none of which a |
| 483 | turn touches while it waits on an HTTP endpoint, which is most of its time. |
| 484 | A session on an HTTP backend now keeps a backend of its own, so its |
| 485 | conversation is no longer swapped in and out of a shared one, and a turn |
| 486 | releases the process-wide lock while it waits on the endpoint or on a |
| 487 | permission answer and takes it back, reinstalling its session, before any |
| 488 | tool runs. On-device turns are unchanged, since the engine keeps one |
| 489 | conversation, and tool execution still runs one session at a time (#176). |
| 490 | |
| 491 | ### Fixed |
| 492 | |
| 493 | - **A prompt whose inference failed is kept through a model switch.** A turn |
| 494 | that ended in an endpoint error stayed in the client's thread, but the |
| 495 | carryover into a new model dropped its trailing user message, and the error |
| 496 | path never saved the session. Only a cancelled prompt should be taken back |
| 497 | out, so cancellation now removes it from the live history, and the error |
| 498 | path persists the session (#124). |
| 499 | |
| 500 | ## 1.6.2 |
| 501 | |
| 502 | ### Added |
| 503 | |
| 504 | - **`sigit --version` prints the release.** `sigit --version` and `sigit -V` |
| 505 | print `sigit <version>` on stdout and exit 0. Before, the flag was not |
| 506 | recognized and siGit Code started a session, which left a script that asked |
| 507 | for the version waiting. |
| 508 | |
| 509 | - **File tools read and write through the editor when it offers to.** An ACP |
| 510 | client that advertises `fs.readTextFile` or `fs.writeTextFile` serves those |
| 511 | requests from its open buffers. siGit Code always used the disk, so |
| 512 | `read_file` missed unsaved changes and `edit_file` wrote underneath a buffer |
| 513 | the user might have modified. `read_file`, `create_file`, `edit_file` and |
| 514 | `multi_edit` now go through the client for paths inside the session's roots. |
| 515 | The two capabilities are independent, and the disk is still the fallback: |
| 516 | for a path outside the roots, and for a request the client fails or leaves |
| 517 | unanswered for 30 seconds. `SIGIT_CLIENT_FS=off` keeps the file tools on |
| 518 | disk (#147). |
| 519 | |
| 520 | ### Fixed |
| 521 | |
| 522 | - **A file attached from the editor is found when its path needs escaping.** |
| 523 | A `resource_link` was read by stripping `file://` and using the rest as the |
| 524 | path, so a space arrived as `%20`, a non-ASCII name failed, and a Windows |
| 525 | URI kept its leading slash. A `#` in a file name was also taken for the |
| 526 | line-range fragment. The URI is now parsed properly (#170). |
| 527 | |
| 528 | ## 1.6.1 |
| 529 | |
| 530 | ### Added |
| 531 | |
| 532 | - **Images can be attached to a prompt in the editor.** siGit Code now |
| 533 | advertises `promptCapabilities.image`, so an ACP client offers image |
| 534 | attachments. The image goes to the model when the active model reads images. |
| 535 | The model picker marks those models with "reads images". The on-device |
| 536 | models and four cloud tiers (`nova`, `orbit`, `apex`, `flux`) are text-only: |
| 537 | with one of them active the image is left out, a note in the thread says so, |
| 538 | and the model is told an image was withheld. Switching a thread that already |
| 539 | holds images to a text-only model flags that once as well. Cloud tiers need |
| 540 | siGit Code Cloud to accept image parts, which is rolling out separately |
| 541 | (#134). |
| 542 | |
| 543 | - **The tool-round cap of a headless run can be set.** `--max-tool-rounds <n>` |
| 544 | or `SIGIT_MAX_TOOL_ROUNDS` (1 to 500) replaces the built-in 24 for |
| 545 | `sigit run` and `sigit -p`. The flag wins over the variable. |
| 546 | |
| 547 | ### Fixed |
| 548 | |
| 549 | - **A prompt turn now reports why it stopped.** ACP defines five stop reasons |
| 550 | and siGit Code only ever sent `end_turn` and `cancelled`. A turn that runs |
| 551 | into the tool-round cap now ends with `max_turn_requests`, a reply cut off |
| 552 | at the token limit with `max_tokens`, and a reply the endpoint withheld |
| 553 | (`content_filter`) with `refusal`. A refused turn is also taken out of the |
| 554 | conversation, which is what the protocol tells the client to expect (#140). |
| 555 | |
| 556 | - **A tool call that needs approval is one card, not two.** The permission |
| 557 | request carried an id of its own, so an ACP client showed an approval card |
| 558 | beside a call that already claimed to be running. The call is now announced |
| 559 | as `pending`, the permission request names that same call, and it moves to |
| 560 | `in_progress` once approved. Calls allowed by policy still start out |
| 561 | `in_progress` (#138). |
| 562 | |
| 563 | - **A turn that runs out of tool rounds says so.** In an editor, a long task |
| 564 | could stop on a line like "Now commit:" with nothing after it. The turn had |
| 565 | used all 24 tool rounds, the model spent its last reply announcing the next |
| 566 | step, and the call behind it was dropped. siGit Code now tells the model |
| 567 | that its rounds are used up before that last reply, and ends the turn with a |
| 568 | message saying why it stopped and that "continue" picks it back up. |
| 569 | `SIGIT_MAX_TOOL_ROUNDS` now sets the cap for editor sessions too (#120). |
| 570 | |
| 571 | - **A headless run no longer ends silently with no final message.** When the |
| 572 | last round came back empty, which is what happens when a run is cut off at |
| 573 | the tool-round cap mid-task, stdout was empty and the exit status was 0, so |
| 574 | a caller could not tell it from a run with nothing to report. siGit Code now |
| 575 | asks the model once for its final message before finishing. |
| 576 | |
| 577 | ## 1.6.0 |
| 578 | |
| 579 | ### Added |
| 580 | |
| 581 | - **Editors can pass HTTP MCP servers to a session.** siGit Code now |
| 582 | advertises `mcpCapabilities.http`, so an ACP client may list Streamable HTTP |
| 583 | servers in `mcpServers` next to stdio ones. They are connected with the URL |
| 584 | and headers the client sent and are scoped to that session, like the stdio |
| 585 | ones. SSE is still not advertised, since the MCP spec deprecated it (#151). |
| 586 | |
| 587 | - **The plan panel survives a failed turn.** The last `write_todos` list is |
| 588 | now kept by siGit Code itself. When a turn ends in an endpoint error before |
| 589 | the model gets to call `write_todos` again, the saved list is sent to the |
| 590 | editor again, so the plan stays on screen where it used to go blank (#132). |
| 591 | |
| 592 | ### Changed |
| 593 | |
| 594 | - **The ACP Rust SDK is now 2.2** (`agent-client-protocol`, up from 1.3). |
| 595 | siGit Code still speaks ACP protocol v1 to the editor, so nothing changes on |
| 596 | the wire. The `unstable_auth_methods` feature is gone because agent auth |
| 597 | methods are stable in 2.x. |
| 598 | |
| 599 | ### Fixed |
| 600 | |
| 601 | - **MCP servers the editor passes to a session are connected.** ACP clients |
| 602 | can name MCP servers in `mcpServers` when they open a session, and agents |
| 603 | are required to connect to the stdio ones. siGit Code accepted the field and |
| 604 | ignored it. The servers are now spawned when the session opens, their tools |
| 605 | are offered to that session only, and `/mcp` lists them as coming from the |
| 606 | editor. `SIGIT_MCP=off` still turns all of it off (#135). |
| 607 | |
| 608 | - **A relative `cwd` is rejected when a session starts.** ACP requires the |
| 609 | working directory and every `additionalDirectories` entry to be absolute. |
| 610 | `session/new`, `session/load` and `session/fork` used to accept a relative |
| 611 | one and resolve it against wherever the editor spawned the process. They now |
| 612 | answer with an invalid-params error (#136). |
| 613 | |
| 614 | - **Loading a session that does not exist is an error.** `session/load` with |
| 615 | an id that was never saved used to succeed and open an empty session under |
| 616 | that id, so the editor showed a blank thread that looked restored. It now |
| 617 | answers "not found" (`-32002`). A thread opened in the running process but |
| 618 | not spoken in yet still loads (#137). |
| 619 | |
| 620 | - **Compaction no longer dead-ends a long session.** The summarization request |
| 621 | used to carry the whole conversation, which by then was already over the |
| 622 | model's window, so siGit Code Cloud timed out with a 504 and the session |
| 623 | stopped with "start a new thread". The transcript sent for summarizing is |
| 624 | now capped, cut from the middle so the opening request and the latest state |
| 625 | are kept. If summarizing still fails, the oldest messages are dropped until |
| 626 | the history fits, with whole tool rounds removed together. A failed attempt |
| 627 | leaves the conversation as it was (#125). |
| 628 | |
| 629 | - **Gateway error pages stay out of the chat.** When an endpoint answers with |
| 630 | an HTML error page, the error shown is the status line, not the page's |
| 631 | markup (#125). |
| 632 | |
| 633 | - **Issue and pull request work no longer assumes GitHub.** The system prompt |
| 634 | treated forge features as if every repository lived on GitHub, while the |
| 635 | built-in `mcp__sigit__*` tools only work for repositories hosted on |
| 636 | sigit.si. The agent now checks the remote first, uses those tools only for |
| 637 | sigit.si repositories, and reaches for the forge's own CLI (`gh`, `glab`, |
| 638 | `tea`) elsewhere (#127). |
| 639 | |
| 640 | ## 1.5.13 |
| 641 | |
| 642 | ### Added |
| 643 | |
| 644 | - **Three more siGit Code Cloud tiers: `flare`, `zenith` and `prism`.** They |
| 645 | show up in `/models` and in the editor's model picker alongside the existing |
| 646 | tiers. Selecting one needs a signed-in account, as before. |
| 647 | |
| 648 | ## 1.5.12 |
| 649 | |
| 650 | ### Fixed |
| 651 | |
| 652 | - **The Windows binaries start on machines without the Visual C++ |
| 653 | Redistributable.** They used to import `VCRUNTIME140.dll` and the UCRT |
| 654 | `api-ms-win-crt-*` DLLs, so a clean Windows install refused to load them |
| 655 | with `STATUS_DLL_NOT_FOUND` (0xC0000135). That is what failed winget's |
| 656 | post-install check. The C runtime is now linked statically, and CI and the |
| 657 | release build fail if a Windows exe picks up that dependency again. |
| 658 | |
| 659 | - **Watching a slow background command no longer ends the turn early.** |
| 660 | Polling `command_output` on the same task id three times tripped the |
| 661 | repeated-tool-call guard, which refused the call and dropped tools for the |
| 662 | rest of the turn. `command_output` now long-polls — it waits up to |
| 663 | `wait_seconds` (default 10, max 30) for the task to exit, then returns |
| 664 | everything printed in the meantime — and the repeat guard exempts it, since |
| 665 | polling the same task is the whole point of the tool. |
| 666 | |
| 667 | - **A turn that ends with no visible text says why.** When the |
| 668 | repeated-tool-call guard blocked a call and the forced no-tools round came |
| 669 | back empty, sigit sent nothing more — the turn just stopped with no answer |
| 670 | and no question. When the last round of a tool-using turn produces no |
| 671 | visible text, sigit now sends a short closing message naming the repeated |
| 672 | tool and asking you to reply "continue" or redirect. |
| 673 | |
| 674 | ## 1.5.11 |
| 675 | |
| 676 | ### Added |
| 677 | |
| 678 | - **`sigit run` drives the agent headlessly with resumable sessions.** A new |
| 679 | non-interactive subcommand runs a prompt through the same agent loop as the |
| 680 | editor and terminal surfaces, for scripts, CI, and Factory clients. Every run |
| 681 | gets a UUID session id, writes a JSON-lines history file under |
| 682 | `~/.config/sigit/sessions/`, and can be restored with `--resume <id>`. |
| 683 | `--output jsonl` emits a structured session/delta/tool/result stream on |
| 684 | stdout while logs stay on stderr, and `--allow-tool` pre-approves a tool so |
| 685 | permission prompts collapse to denial in a non-interactive context. The |
| 686 | legacy `-p` form still works. Each run also rewrites the session metadata |
| 687 | with its own cwd and extra roots, so resuming keeps multi-root projects |
| 688 | |
| 689 | - **Saved threads can be imported into the editor.** siGit Code now advertises |
| 690 | ACP's `sessionCapabilities.list` and answers `session/list`, so Zed's "Import |
| 691 | Threads" picker offers the conversations stored under |
| 692 | `~/.config/sigit/sessions/` instead of reporting that the agent doesn't |
| 693 | support the capability. A saved session gets a sidecar recording the project |
| 694 | directory it ran in — listing reports that `cwd`, the extra roots of a |
| 695 | multi-root project, an ISO 8601 last-activity timestamp, and a title taken |
| 696 | from the first user message — and a request may filter on `cwd` so one |
| 697 | project is never offered another's threads. Threads saved before this have no |
| 698 | sidecar and are not listed; they still reopen by id through `session/load` |
| 699 | |
| 700 | ### Changed |
| 701 | |
| 702 | - **The commit trailer names the siGit Code version and surface.** Commits |
| 703 | siGit Code makes now end with |
| 704 | `Co-Authored-By: siGit Code v<version>-<surface> <noreply@sigit.si>` instead |
| 705 | of the bare name, where the surface is `acp` (an editor), `tui` (the |
| 706 | terminal UI), or `headless` (`sigit run`). The model changes from session to |
| 707 | session; the version and surface tell you which build of the agent wrote the |
| 708 | commit and how it was driven. GitHub still credits the co-author, since it |
| 709 | matches on the address. A commit that already carries a siGit Code trailer |
| 710 | from an older version is left alone |
| 711 | |
| 712 | - **The terminal UI's model knows which directory the project is in.** The |
| 713 | editor (ACP) and headless paths put the working directory in the system |
| 714 | prompt, but the terminal UI only added the project's instruction files, so |
| 715 | on `/init` a small on-device model invented a `AGENTS.md` path and failed. |
| 716 | All three places the terminal UI builds a prompt now go through the same |
| 717 | session context path the ACP sessions get. The cloud tier switch had also |
| 718 | been dropping the instruction files; that's fixed too |
| 719 | |
| 720 | - **An empty `write_todos` list clears the plan.** `write_todos` rejected an |
| 721 | empty list, so the model had no way to clear a finished checklist and the |
| 722 | last plan stayed in the editor until the session ended. An empty list now |
| 723 | returns "Task list cleared." and goes to the client as an ACP plan with no |
| 724 | entries. The tool description tells the model it can do this |
| 725 | |
| 726 | - **`sigit run` gives clearer usage errors.** A second positional prompt says |
| 727 | "unexpected extra argument", a bare `sigit run` says "missing prompt", and a |
| 728 | mistyped flag like `--quite` is rejected instead of becoming the prompt |
| 729 | |
| 730 | ### Fixed |
| 731 | |
| 732 | - **Each ACP session keeps its own roots, conversation, and tasks.** Zed runs |
| 733 | one siGit process for every open thread, but the process had a single cwd, |
| 734 | workspace root list, backend conversation, and background task table. The |
| 735 | most recent session owned all of them, so a prompt from an older thread ran |
| 736 | against another repo with another thread's history. A `SessionState` is now |
| 737 | kept per session id; before a prompt or config change runs, the live |
| 738 | conversation is parked and the requested session's cwd, extra roots, and |
| 739 | conversation are installed, rebuilding the system prompt from its roots. |
| 740 | `new`/`load`/`fork` share a single session-opening path, and fork carries the |
| 741 | source thread's conversation. Background tasks are scoped to the session that |
| 742 | started them, opening a session no longer wipes every other session's |
| 743 | permission grants, and model selection is routed per session |
| 744 | |
| 745 | - **New sessions no longer carry the previous thread's history.** Opening a |
| 746 | new thread in Zed showed a `[Conversation summary]` from an earlier session. |
| 747 | The session handlers cleared the on-device engine but not the history a cloud |
| 748 | backend keeps for itself, and the startup routing to the cloud tier then |
| 749 | carried that history into the installed backend. A provider override had the |
| 750 | same leak. All session entry points now share a path that strips stale |
| 751 | history too, and unknown session ids are rejected instead of borrowing the |
| 752 | live thread's state |
| 753 | |
| 754 | - **Unparseable tool-call markup is hidden and retried, not shown as text.** |
| 755 | Some models write tool calls into the reply as text. Well-formed blocks were |
| 756 | already recovered and run, but a block that failed to parse or never closed |
| 757 | was printed to the editor as-is and stayed in history, so the model later |
| 758 | read back a call it had "made" with no result and began writing invented |
| 759 | `<function_results>`. The scanner now reports those blocks as malformed; the |
| 760 | backend drops them from the reply and history, and when the only tool call |
| 761 | was malformed the model gets one retry telling it the call didn't run. A |
| 762 | block that merely *mentions* a tool-call marker (a backticked `<tool_call>` or an |
| 763 | unclosed XTML `<|open|>tools`) is now kept as prose, so a reply explaining |
| 764 | the scanner no longer loses everything after the first marker. The |
| 765 | non-streamed path now strips broken blocks beside structured calls and runs |
| 766 | any inline calls that did parse, matching the streaming path |
| 767 | |
| 768 | - **The co-author trailer ends a conflicted merge commit.** Finishing a |
| 769 | conflicted merge with `git commit --no-edit` keeps git's `# Conflicts:` list |
| 770 | in the message, since no editor runs to strip it. When siGit Code then added |
| 771 | its trailer, the trailer went in above that list, so it was no longer the last |
| 772 | paragraph and GitHub didn't credit the co-author. The amend now drops the |
| 773 | leftover comment block and puts the trailer last. It also fixes a commit |
| 774 | that already has the trailer but still ends in that block |
| 775 | |
| 776 | ## 1.5.10 |
| 777 | |
| 778 | ### What changed |
| 779 | |
| 780 | - **Xcode's context no longer buries slash commands.** Xcode sends the user's |
| 781 | prompt as the last of several text blocks, with project context in the |
| 782 | blocks before it, so `/models` and friends sat in the middle of joined text |
| 783 | and were handed to the model instead of dispatching locally. Slash-command |
| 784 | parsing now searches the prompt's text blocks from the end, so a standalone |
| 785 | command in the final user block dispatches no matter what context the client |
| 786 | prepends |
| 787 | - **The nova tier is the default cloud engine.** When local inference is off |
| 788 | and no explicit provider override is set, the cloud tier now defaults to |
| 789 | `nova` (the `onde-nova` model) instead of the balanced tier, in both the |
| 790 | interactive and headless paths |
| 791 | |
| 792 | ### Fixed |
| 793 | |
| 794 | - **Malformed Chinese-model tool calls are handled end-to-end in ACP.** The |
| 795 | inline-call recovery that 1.5.9 added for Kimi K3's XTML protocol and GLM's |
| 796 | mis-tagged blocks only applied to the interactive and headless surfaces; |
| 797 | the ACP path never ran it, so an editor session still surfaced raw protocol |
| 798 | text and dropped the calls. Recovery now runs in the ACP prompt loop too, |
| 799 | covered by integration tests, and the tool names are checked against the |
| 800 | turn's offered tools before anything executes |
| 801 | - **Suppressed tool-call log spam is gone.** The guard that logs when a |
| 802 | structured call is dropped for arriving as forced text fired once per |
| 803 | streamed argument fragment — one malformed call could log a warning per |
| 804 | chunk. The check now fires once per turn with the count and names of what |
| 805 | was dropped, and the non-streaming path reports the same |
| 806 | - **A history-replay test no longer races on the process cwd.** One ACP test |
| 807 | built its expected path from `std::env::current_dir()` while other tests |
| 808 | briefly swap that process-global cwd, so on CI it could read a temp |
| 809 | directory mid-swap and compare a truncated title against an untruncated |
| 810 | expectation. It now uses a fixed path it never needed to derive |
| 811 | |
| 812 | ## 1.5.9 |
| 813 | |
| 814 | ### Fixed |
| 815 | |
| 816 | - **Kimi K3 tool calls no longer arrive as raw protocol text.** Kimi K3 renders |
| 817 | a call in Moonshot's XTML protocol — pipe-delimited open/sep/close tokens |
| 818 | wrapping named blocks — and when the serving stack doesn't parse that back |
| 819 | into structured tool calls, the whole block surfaced in the editor as literal |
| 820 | text and the turn ended as though the model had answered in prose. The |
| 821 | inline-call recovery now speaks that protocol alongside the legacy XML tags: |
| 822 | tools blocks are parsed into real calls (several per block, argument values |
| 823 | decoded and typed from the block's own type attribute or, when it is |
| 824 | missing, the turn's tool schemas), response blocks are unwrapped so their |
| 825 | text still renders, and think blocks are dropped as private reasoning rather |
| 826 | than shown. The streaming scanner watches all the opening markers, so a |
| 827 | block split across chunk boundaries still recovers |
| 828 | - **GLM's mis-tagged calls recover too.** GLM sometimes precedes the legacy |
| 829 | block's first argument key with another tool-call opening tag instead of the |
| 830 | arg-key opening tag the format calls for, and the recovery rejected the |
| 831 | whole block when it did — the call surfaced as text and whatever it was |
| 832 | trying to do was dropped. The parser now accepts that alias for the first |
| 833 | argument only — later arguments stay strict, so text that merely resembles a |
| 834 | call cannot be recovered as one — in both the whole-blob and streaming |
| 835 | paths, and the scanner tolerates the malformed marker split across chunk |
| 836 | boundaries. Recovery in both protocols also checks the call's name against |
| 837 | the tools actually offered in the turn: a tag naming a tool that was never |
| 838 | in the turn's spec stays on screen instead of being executed |
| 839 | |
| 840 | ## 1.5.8 |
| 841 | |
| 842 | ### What changed |
| 843 | |
| 844 | - **Editor panels can switch permission mode without a slash command.** ACP |
| 845 | clients now get a Permissions selector next to the model controls with |
| 846 | Manual, Auto, and Plan choices for the current session. Manual keeps the |
| 847 | existing approval prompts, Auto lets mutating tools run unattended while |
| 848 | still respecting explicit deny rules in `settings.toml`, and Plan keeps the |
| 849 | agent in research-only mode. The selector follows `/plan` and `/clear`, and |
| 850 | it is deliberately session-scoped so a risky Auto choice does not persist |
| 851 | into the next task |
| 852 | - **Tool calls in the editor are worth opening now.** Zed only drew the |
| 853 | disclosure arrow on the handful of cards siGit set `content` on — the model |
| 854 | download and switch spinners — because everything else carried nothing but |
| 855 | `rawInput` and `rawOutput`, fields ACP gives clients no display guidance for. |
| 856 | Every tool call now gets a fenced content block: the pretty-printed arguments |
| 857 | while it runs, then the tool's output once it finishes, with a `(no output)` |
| 858 | placeholder for a silent command like `git add`. Cards are titled |
| 859 | `<tool> · <arg>` rather than the bare tool name, path-bearing tools set |
| 860 | `locations` so the editor can follow along, and a replayed session gets the |
| 861 | same treatment as a live one |
| 862 | - **The context window is visible before compaction fires.** Both model pickers |
| 863 | show each model's window, and the TUI title bar has a gauge for how much of |
| 864 | it the conversation is using. Cloud tiers report their own window instead of |
| 865 | the compaction budget — the budget is when siGit Code summarizes history, not |
| 866 | how much the model can hold, and labelling one with the other understated the |
| 867 | window by an order of magnitude |
| 868 | - **`write_todos` renders as a plan, not a tool card.** Zed and other clients |
| 869 | have real progress UI for `session/update` plans, so the model's todo list |
| 870 | goes there |
| 871 | - **Picker changes read as status rather than chat.** Switching model or |
| 872 | inference backend is UI state, so it renders as a completed think-kind tool |
| 873 | call. The sign-in prompt stays an assistant message, since it needs the user |
| 874 | to act on it |
| 875 | |
| 876 | ### Fixed |
| 877 | |
| 878 | - **A reopened thread comes back with its history.** Clicking a saved thread in |
| 879 | Zed sends `session/load`, and the client draws the thread purely from the |
| 880 | `session/update` notifications the agent streams while that request is in |
| 881 | flight. siGit restored the saved history into the backend, which is what |
| 882 | makes the model remember, but sent the client nothing — so the thread opened |
| 883 | empty and looked like a brand new conversation. The snapshot is now turned |
| 884 | into updates before it is restored: user and assistant text as message chunks |
| 885 | with reasoning stripped, each tool call completed with its result folded in, |
| 886 | and `write_todos` as a plan the way it renders live. System messages stay |
| 887 | out, since they seeded the model and were never on screen |
| 888 | - **Compaction no longer fails in every session that ran a tool.** |
| 889 | `compact_history` asked for the summary through `complete(None, None)`, which |
| 890 | sends no tools array but left the live history in place. That history is |
| 891 | thick with assistant `tool_calls` and `role: "tool"` messages, and an |
| 892 | endpoint handed tool shapes with no schema to check them against rejects the |
| 893 | request — Anthropic answers 400. So compaction failed on every attempt in any |
| 894 | session that had run a single tool, however small the history was, and then |
| 895 | retried on every prompt and tool round while that history kept growing. The |
| 896 | conversation now goes as a flattened transcript in one user message, which |
| 897 | keeps what the summary needs and drops the shapes that only mean anything |
| 898 | next to a tool schema |
| 899 | - **A tool call emitted as text is no longer dropped.** Qwen 3, GLM and |
| 900 | DeepSeek write a call as `<tool_call>NAME<arg_key>…` in their chat template |
| 901 | and rely on the serving stack to parse it back into `tool_calls`. When that |
| 902 | doesn't happen the tag arrives as ordinary content, so it was rendered |
| 903 | verbatim in the editor and the turn ended as though the model had chosen to |
| 904 | answer in prose. Both the streaming and non-streaming paths now scan content |
| 905 | for those blocks and turn well-formed ones back into real calls, typing |
| 906 | argument values from the turn's own tool schemas. The streaming scanner holds |
| 907 | back only enough text to catch a tag straddling a chunk boundary, so ordinary |
| 908 | answers still stream token by token. A block that doesn't match the expected |
| 909 | shape is left in the text untouched: reissuing a `run_command` is cheap, but |
| 910 | guessing wrong at a half-parsed `edit_file` would write the wrong change to a |
| 911 | file |
| 912 | - **Tool-call content survives awkward output.** Whitespace-only output is |
| 913 | preserved rather than collapsed, malformed arguments no longer get a |
| 914 | misleading JSON fence, and fence language identifiers are sanitized |
| 915 | |
| 916 | ## 1.5.7 |
| 917 | |
| 918 | ### What changed |
| 919 | |
| 920 | - **`@smbcloud/sigit` gets releases again.** The npm scope moved to |
| 921 | `@getsigit` in 1.5.5 and the old package was left sitting on the registry at |
| 922 | 1.5.2, so an install made before the rename went quiet — `npm update` had |
| 923 | nothing to give it and nothing said why. All seven packages now publish under |
| 924 | both scopes from the same build, so `@smbcloud/sigit` is a full install again |
| 925 | rather than a stub, with its own platform binaries and no dependency on the |
| 926 | new scope. It prints a line on stderr saying where the package moved to; |
| 927 | `SIGIT_SUPPRESS_SCOPE_NOTICE=1` turns that off. This is a migration path, not |
| 928 | a second home: `@getsigit/sigit` is what the docs, the Homebrew tap, and the |
| 929 | ACP registry entry point at, and it is the name to move to |
| 930 | - **Multi-root projects now work in the editor.** When a client opens several |
| 931 | directories in one project, ACP sends the extra ones as |
| 932 | `additionalDirectories` — but only to an agent that says it wants them, which |
| 933 | siGit never did, so Zed kept the first root and showed a banner saying |
| 934 | multi-root workspaces were unsupported. The capability is now advertised at |
| 935 | `initialize`, and the directories that arrive are no longer logged and thrown |
| 936 | away. All the roots are now part of the session: the model is told about each |
| 937 | one, every root's `AGENTS.md` / `CLAUDE.md` is loaded, and skills, slash |
| 938 | commands, and subagent types are discovered from all of them (primary root |
| 939 | first, so it still wins name collisions). `/status` lists the roots when |
| 940 | there is more than one, and headless runs take the same thing as repeatable |
| 941 | `--add-dir <dir>` flags. MCP servers are the exception: discovery happens |
| 942 | once at startup, before a session exists, so a second root's `.sigit/mcp.toml` |
| 943 | is not picked up |
| 944 | |
| 945 | ### Fixed |
| 946 | |
| 947 | - **A shell command can no longer wedge the editor session.** Tool commands |
| 948 | inherited siGit's own stdin, which in ACP mode is the JSON-RPC pipe from the |
| 949 | editor. A command that read stdin — a signing passphrase prompt, a pager, a |
| 950 | `git` credential ask — blocked on it and consumed the client's next request |
| 951 | out of the pipe, so nothing typed afterwards ever reached the agent and the |
| 952 | session stayed dead past the command timeout. Commands, hooks, and the |
| 953 | co-author `git` helpers now run with stdin closed, so a command that wants |
| 954 | input gets EOF and reports an error instead |
| 955 | - **A command that prints a lot no longer stalls for two minutes.** |
| 956 | `run_command` waited for the command to exit before reading its output, so |
| 957 | anything past the pipe buffer (a build, a verbose test run) blocked writing |
| 958 | while siGit blocked waiting, until the 120-second timeout killed it. Output |
| 959 | is now drained while the command runs |
| 960 | - **The command timeout now stops the whole command.** It killed only the |
| 961 | shell, leaving anything that shell had started running and unreaped; it now |
| 962 | kills the process group |
| 963 | - **A refused turn now shows the endpoint's own message.** siGit pasted the |
| 964 | status line and the raw JSON body into the editor's error banner, so a |
| 965 | billing or allowance message arrived wrapped in |
| 966 | `endpoint returned 429 Too Many Requests: {"error":{"message":…`. The message |
| 967 | the endpoint wrote is what the banner shows now; the status is only used when |
| 968 | there is no message to show |
| 969 | - **An error that arrives mid-stream is no longer silent.** An endpoint that |
| 970 | fails after the response is already open reports it as a frame in the stream. |
| 971 | That frame carries no `choices`, so siGit parsed it as an empty chunk and |
| 972 | skipped it, and the turn ended as though the model had answered with nothing |
| 973 | |
| 974 | ## 1.5.6 |
| 975 | |
| 976 | ### What changed |
| 977 | |
| 978 | - **Switching models mid-conversation no longer restarts it.** Both switching |
| 979 | to a local GGUF model and picking a different cloud tier now carry the live |
| 980 | conversation history across, repairing any half-finished tool call so |
| 981 | strict OpenAI-compatible endpoints don't reject the session |
| 982 | - **Long-running tools now show progress in ACP clients.** Synchronous tools |
| 983 | (shell commands, file operations, `read_website`, ...) run on a blocking |
| 984 | thread pool instead of the ACP connection's own task, so a slow command's |
| 985 | `in_progress` update reaches the client — and Zed's spinner — while the |
| 986 | command is still running instead of arriving with the result |
| 987 | - **Text from consecutive tool rounds no longer runs together.** ACP and |
| 988 | headless clients concatenate consecutive message chunks, so a reply that |
| 989 | continued after a tool call used to glue onto the previous round's last |
| 990 | sentence with no space. A blank line now opens the next round's text |
| 991 | - **New onde-cloud model tiers.** The model picker (`/models` in the TUI, the |
| 992 | config panel in editors) now offers five additional siGit Code Cloud tiers — |
| 993 | `flux`, `apex`, `aura`, `orbit`, and `nova` — alongside the existing Fast, |
| 994 | Balanced, Large, Mini, Air, Pro, and KKK options. The tier list mirrors |
| 995 | onde-cloud's router catalogue, so all three sides (the picker, the router, |
| 996 | and the cloud catalogue) have to be updated together when a tier is added |
| 997 | - **MCP Registry listing moved to `getsigit/si`.** The `server.json` manifest |
| 998 | and its `release-mcp-registry.yml` publish workflow now live in the |
| 999 | [`getsigit/si`](https://github.com/getsigit/si) repo alongside the si CLI's |
| 1000 | other code, since the registry entry describes the si platform rather than |
| 1001 | the coding agent |
| 1002 | |
| 1003 | ## 1.5.5 |
| 1004 | |
| 1005 | A distribution release. siGit Code itself is unchanged. What moved is how it |
| 1006 | reaches you on npm and on Windows. |
| 1007 | |
| 1008 | ### What changed |
| 1009 | |
| 1010 | - **The npm package is now `@getsigit/sigit`.** The six platform packages moved |
| 1011 | with it. `@smbcloud/sigit` stays on the registry but stops receiving updates, |
| 1012 | so upgrading means switching names: |
| 1013 | `npm uninstall -g @smbcloud/sigit && npm install -g @getsigit/sigit`. The old |
| 1014 | package had been stuck at 1.5.2, so this picks up 1.5.3 and 1.5.4 as well. |
| 1015 | - **npm publishes over OIDC.** Every `@getsigit/*` package has a trusted |
| 1016 | publisher pointing at the release workflow, so no npm token is stored in the |
| 1017 | repository. The release workflow moves to Node 22, which trusted publishing |
| 1018 | requires. |
| 1019 | - **winget releases actually go out.** The workflow could only update a package |
| 1020 | already present in `microsoft/winget-pkgs`, and siGit Code had never been |
| 1021 | submitted there, so every dispatch failed. It now submits the package the |
| 1022 | first time and updates it on later releases. The identifier is |
| 1023 | `getSigit.siGitCode`. |
| 1024 | |
| 1025 | ## 1.5.4 |
| 1026 | |
| 1027 | - **CI**: nfpm config expanded to include package version and binary path |
| 1028 | |
| 1029 | ## 1.5.3 |
| 1030 | |
| 1031 | Adds browser-based sign-in, expands distribution channels to Windows (winget, |
| 1032 | Scoop), Linux (AUR, deb, rpm), and .NET (NuGet), gives ACP clients live |
| 1033 | visibility into tool activity, adds the KKK and Moonshot AI cloud tiers, and |
| 1034 | fixes the co-authored-by trailer email. |
| 1035 | |
| 1036 | ### What changed |
| 1037 | |
| 1038 | - **Browser sign-in:** `sigit login` now opens a browser OAuth flow (PKCE S256 |
| 1039 | against the siGit Code Cloud authorization server) so you can sign in without |
| 1040 | a password. A loopback listener catches the redirect automatically; a |
| 1041 | paste-back fallback handles environments where a loopback isn't reachable. |
| 1042 | `--paste` forces the paste path, `--password` keeps the old email/password |
| 1043 | prompt. Zed's "Sign in to siGit Code" button uses the loopback path via ACP |
| 1044 | `authenticate` |
| 1045 | - **New release channels:** siGit Code is now published to winget |
| 1046 | (`getsigit.siGitCode`), Scoop (`getsigit/scoop-bucket`), the AUR |
| 1047 | (`sigit-bin`), and as `.deb`/`.rpm` packages alongside the existing |
| 1048 | Homebrew, npm, PyPI, crates.io, and NuGet channels |
| 1049 | - **NuGet .NET tool:** `dotnet tool install --global SiGit.Code` now works on |
| 1050 | Windows, macOS, and Linux — the package bundles all six platform binaries and |
| 1051 | a managed shim that execs the right one, leaving stdin/stdout/stderr |
| 1052 | unredirected so TUI vs ACP mode detection still works |
| 1053 | - **New cloud tiers:** the model picker (`/models` in the TUI, the config |
| 1054 | panel in Zed) now offers the `onde-kkk` (KKK) and Moonshot AI (`oke`) tiers |
| 1055 | alongside the existing Fast, Balanced, Large, Mini, Air, and Pro options |
| 1056 | - **ACP tool visibility:** the agent loop now emits `ToolCall(InProgress)` |
| 1057 | before each tool runs and `ToolCallUpdate(Completed/Failed)` after it |
| 1058 | returns, so clients like Zed gain live visibility into tool activity between |
| 1059 | inference rounds. `tool_choice: "auto"` is also sent explicitly whenever |
| 1060 | tools are present, fixing models that describe actions in prose rather than |
| 1061 | issuing a tool call when the field is absent |
| 1062 | - **Malformed tool argument logging:** invalid tool argument JSON is now logged |
| 1063 | at three sites (TUI pretty-printer, ACP tool-call event, permission request) |
| 1064 | instead of silently falling back to a string value, making malformed payloads |
| 1065 | visible in logs while preserving backward-compatible behaviour |
| 1066 | - **Co-authored-by trailer fix:** the `Co-Authored-By` trailer email was |
| 1067 | updated to `noreply@sigit.si` (platform-neutral); the commit attribution |
| 1068 | check was tightened to use idiomatic ownership |
| 1069 | - **NuGet trusted publishing:** the NuGet release workflow now exchanges a |
| 1070 | GitHub OIDC token for a short-lived NuGet API key (via `NuGet/login`) instead |
| 1071 | of relying on a long-lived `NUGET_API_KEY` secret, so there is no stored |
| 1072 | credential to rotate or leak |
| 1073 | - **AUR dispatch temporarily disabled:** the AUR release workflow is no longer |
| 1074 | dispatched from `release-github` while new AUR account registration is |
| 1075 | closed; the `sigit-bin` channel returns once registration reopens |
| 1076 | - Legal and branding copy updated |
| 1077 | |
| 1078 | ## 1.5.2 |
| 1079 | |
| 1080 | Brings the latest siGit Code Cloud tiers to the picker and aligns the MCP |
| 1081 | registry metadata with the server release. |
| 1082 | |
| 1083 | ### What changed |
| 1084 | |
| 1085 | - `/models` now lists the Pro, Air, and Mini siGit Code Cloud tiers alongside |
| 1086 | Fast, Balanced, and Large |
| 1087 | - Updated the MCP registry manifest to version 1.2.5, matching the siGit Code |
| 1088 | Cloud server release |
| 1089 | - Updated the Agent Client Protocol SDK to the latest v1 release |
| 1090 | |
| 1091 | ## 1.5.1 |
| 1092 | |
| 1093 | Makes siGit Code work as an Xcode custom agent, and updates the Onde SDK. |
| 1094 | |
| 1095 | ### What changed |
| 1096 | |
| 1097 | - Xcode can now run siGit Code as a custom agent. Point it at the binary with |
| 1098 | `--acp` as the argument, and that explicit mode loads the selected on-device |
| 1099 | model on the first prompt, since Xcode's chat has no equivalent of `/load`. |
| 1100 | The README covers the setup, including wiring up `xcrun mcpbridge` in |
| 1101 | `mcp.toml` so the agent can use Xcode's build, test, and project tools |
| 1102 | - MCP calls to the `xcode` server time out after 30 seconds instead of 120, so |
| 1103 | a request Xcode cannot service no longer leaves the prompt looking busy for |
| 1104 | two minutes. String JSON-RPC ids from the bridge are handled too |
| 1105 | - The agent stops repeating itself: a tool call made three times with identical |
| 1106 | arguments now forces a text reply instead of looping |
| 1107 | - Onde SDK bumped to 1.2.2 |
| 1108 | - The registry listing in `server.json` matches what sigit.si publishes |
| 1109 | |
| 1110 | ## 1.5.0 |
| 1111 | |
| 1112 | Opens the agent up to user extension: lifecycle hooks, custom slash commands, |
| 1113 | and configurable subagent types. Also adds web search, a Repo tab in the TUI, |
| 1114 | and a baked-in smbCloud MCP server. |
| 1115 | |
| 1116 | ### What changed |
| 1117 | |
| 1118 | - Hooks let you run shell commands at three points in the agent's lifecycle: |
| 1119 | `session_start`, `pre_tool_use`, and `post_tool_use`, configured under |
| 1120 | `[hooks]` in `settings.toml`. Commands get context through variable |
| 1121 | substitution (`{cwd}`, `{tool_name}`, `{tool_result_len}`) and run in the |
| 1122 | session working directory. A hook that fails is logged and the session |
| 1123 | continues; a hook that hangs is killed on a timeout, along with its whole |
| 1124 | process group |
| 1125 | - User-defined slash commands: drop a Markdown file in `.sigit/commands/` or |
| 1126 | `.claude/commands/` (or the personal `$SIGIT_CONFIG_DIR/commands/` and |
| 1127 | `~/.claude/commands/`) with optional `description` and `argument-hint` |
| 1128 | frontmatter, and the body becomes a prompt template. `$ARGUMENTS` takes the |
| 1129 | whole argument string and `$1`..`$9` the positional words. A subdirectory |
| 1130 | namespaces the command with `:`, so `.sigit/commands/git/commit.md` becomes |
| 1131 | `/git:commit`. They run as ordinary agent turns through the usual tools and |
| 1132 | permission checks, and are advertised to ACP clients like Zed. `/commands` |
| 1133 | lists what was discovered |
| 1134 | - Configurable subagent types for the `task` tool: a Markdown file in |
| 1135 | `.sigit/agents/` or `.claude/agents/` with `name`, `description`, and an |
| 1136 | optional `tools:` allow-list, whose body becomes that subagent's system |
| 1137 | prompt. Pass its name as `subagent_type` to swap the prompt in. The |
| 1138 | `tools:` list can only narrow the subagent's read-only ceiling, never widen |
| 1139 | it, so a config file cannot grant itself `edit_file` or `run_command` and |
| 1140 | route around the permission system. `/agents` lists the discovered types |
| 1141 | - New `web_search` tool, backed by the Brave-Search-backed search on siGit |
| 1142 | Code Cloud's MCP server. It is offered only when you are signed in, and it |
| 1143 | is classified read-only, so searching never triggers a permission prompt |
| 1144 | - The TUI gains a Repo tab, shown when the session's `origin` remote points at |
| 1145 | the sigit.si host. It lists issues and pull requests fetched through the |
| 1146 | official MCP server: Up and Down select, Enter opens a scrollable detail, |
| 1147 | `i`, `p`, Left and Right switch sections, `r` refreshes. The tab is hidden |
| 1148 | and skipped in the cycle for any other remote |
| 1149 | - The smbCloud CLI's stdio MCP server (`smb --mcp`) is now baked in, so |
| 1150 | smbCloud project and deployment tools work with no `mcp.toml` setup. It is |
| 1151 | added only when the `smb` binary is on `PATH`, its read-only tools (`me`, |
| 1152 | `deployments`, `project_list`, `project_show`) skip permission prompts, and |
| 1153 | you can opt out with `smbcloud = false` in `mcp.toml` or |
| 1154 | `SIGIT_MCP_SMBCLOUD=off` |
| 1155 | - siGit Code Cloud's MCP server is now listed in the public MCP Registry as |
| 1156 | `si.sigit/sigit`, published from `server.json` at the repository root |
| 1157 | |
| 1158 | ### Fixes |
| 1159 | |
| 1160 | - An explicit `deny` rule now applies to read-only first-party tools instead |
| 1161 | of being skipped |
| 1162 | - A subagent type whose `tools:` list resolves to an empty set is rejected |
| 1163 | rather than producing a subagent with no tools |
| 1164 | - Command templates render in a single substitution pass, so an argument that |
| 1165 | contains something like `$1` is no longer re-substituted |
| 1166 | - Frontmatter is stripped with the same leniency it is parsed with |
| 1167 | - The Repo tab's detail view no longer shows stale data after a refresh |
| 1168 | |
| 1169 | ## 1.4.1 |
| 1170 | |
| 1171 | Two small fixes: correct co-author attribution and a Homebrew tap fix. |
| 1172 | |
| 1173 | ### What changed |
| 1174 | |
| 1175 | - The `Co-Authored-By` trailer siGit Code adds to commits now uses the GitHub |
| 1176 | noreply address for the [sigitc](https://github.com/sigitc) account instead |
| 1177 | of `sigit@sigit.si`, so GitHub reliably attributes co-authored commits to |
| 1178 | the siGit Code profile |
| 1179 | - Fixed the Homebrew tap install docs to trust the tap with `brew trust` |
| 1180 | instead of a `brew tap --force` flag |
| 1181 | |
| 1182 | ## 1.4.0 |
| 1183 | |
| 1184 | Adds a headless one-shot mode, fine-grained permission rules, stdio transport |
| 1185 | for MCP servers, an `/init` command, and a set of TUI upgrades: tabs, a live |
| 1186 | thinking display, and collapsible tool calls. |
| 1187 | |
| 1188 | ### What changed |
| 1189 | |
| 1190 | - New headless mode: `sigit -p "prompt"` runs one agent turn with tools and exits — 0 on a completed turn, 1 on inference errors, 2 on bad invocations. Assistant text streams to stdout while logs and tool progress stay on stderr; `--cwd` sets the working directory and `--quiet` prints only the final message. Nobody can answer a permission prompt in a headless run, so `ask` collapses to a denial: grant tools for the run with `--allow-tool`, block them with `--deny-tool`, or use `SIGIT_PERMISSIONS=allow` |
| 1191 | - Permission rules make autonomy granular: `[permissions.rules]` in `settings.toml` holds ordered `allow` and `deny` lists of `tool_name(pattern)` entries, e.g. `run_command(git *)` or `edit_file(src/*)`. Patterns match the command string for `run_command` and the path for file tools; deny always beats allow, and unparseable patterns fail closed, so a bad rule can only narrow access. Always-allow on a `run_command` prompt now grants that command family (its first two tokens), not the whole shell |
| 1192 | - The MCP client speaks stdio: `mcp.toml` server entries can give a `command`, `args`, and an `env` map instead of a `url`, so the stdio-first majority of published MCP servers plugs in. Same handshake, timeouts, tool namespacing, and output caps as HTTP; `/mcp` shows the command line for stdio servers |
| 1193 | - New `/init` command (TUI and ACP): runs a normal agent turn that explores the repository and writes an `AGENTS.md` — or improves an existing `AGENTS.md`/`CLAUDE.md` in place — going through the ordinary tools and permission checks |
| 1194 | - The TUI gains tabs, cycled with the Tab key: Session is the chat, History lists saved sessions (restore with Enter, delete with a confirmed double-`d`, refresh with `r`), and Cloud shows the signed-in account, inference mode, current model and engine state, permission policy, and config dir, with a live Local Inference toggle |
| 1195 | - The TUI shows model thinking: while a reply streams, the last three lines of the reasoning appear live under the spinner, dim and italic; finished replies collapse to a one-line indicator with the line count, and `/thinking` expands the full reasoning block above each reply. Display only — nothing changes in what is sent to the model, saved to sessions, or streamed over ACP |
| 1196 | - Tool calls in the TUI transcript collapse to single dim title lines (the command for `run_command`, the path for file tools, the pattern for search and glob); `/tools` expands every entry to show the pretty-printed arguments and a capped tail of the result. Permission prompts keep showing the full command, and the model still receives full outputs |
| 1197 | - When `AGENTS.md` and `CLAUDE.md` sit in the same directory, the instructions loader now prefers `AGENTS.md`, so shared content is injected once |
| 1198 | |
| 1199 | ## 1.3.2 |
| 1200 | |
| 1201 | Adds a tool permission system with plan mode, durable sessions with context |
| 1202 | compaction, background command execution, a subagent research tool, and commit |
| 1203 | co-author attribution. |
| 1204 | |
| 1205 | ### What changed |
| 1206 | |
| 1207 | - Every tool call now passes a permission policy before executing. Read-only tools always run; mutating tools (and all MCP or unknown tools) are governed by, in order: plan mode, session grants, per-tool overrides, and a default mode from `[permissions]` in `settings.toml` (`allow`/`ask`/`deny`, default `ask`). On `ask`, editors get a native ACP permission dialog (allow once / allow for this session / deny) and the TUI pauses on a y/a/n prompt showing the tool and its arguments. `SIGIT_PERMISSIONS` overrides the default mode for headless runs and clients without permission support |
| 1208 | - New `/plan [on|off]` command: plan mode blocks mutating tools and asks the model to present a plan while research tools keep working. `/permissions` prints the effective policy |
| 1209 | - Sessions are durable: conversation history is saved per session under `~/.config/sigit/sessions/` after every turn. ACP `session/load` actually restores it, the TUI gets `/resume`, and `/clear` deletes the saved file |
| 1210 | - Context compaction: `/compact` compresses the conversation on demand, and the agent compacts automatically once the history approaches a 24k-token budget, summarizing older turns and keeping the recent ones. The tool-round cap rises from 10 to 24 now that long sessions have a defense other than the cap |
| 1211 | - `run_command` can run work in the background: pass `run_in_background` and the tool returns a task id immediately, so builds, test suites, and dev servers are no longer killed by the 120 second foreground timeout. Poll with the new `command_output` tool (read-only, never prompts) and stop with `kill_command` |
| 1212 | - New `task` tool: delegate research to a fresh subagent conversation that only gets the read-only tools and returns its final answer, keeping the main context small. Available on OpenAI-compatible backends; on-device returns a clear fallback until onde supports a second context |
| 1213 | - Commits created by the agent are co-authored: commit messages end with `Co-Authored-By: siGit Code <sigit@sigit.si>` (the [sigitc](https://github.com/sigitc) account), which GitHub renders next to the human author. If the model forgets the trailer, siGit amends it in, never rewriting commits that already exist on a remote |
| 1214 | - ACP mode now honors the `OPENAI_BASE_URL`/`OPENAI_API_KEY` provider override at startup, matching the interactive client |
| 1215 | |
| 1216 | ## 1.3.1 |
| 1217 | |
| 1218 | Adds [Model Context Protocol](https://modelcontextprotocol.io) (MCP) client |
| 1219 | support with the official siGit Code MCP server baked in, a set of agent tools |
| 1220 | that close parity gaps in the tool layer, and refreshed branding and licensing. |
| 1221 | |
| 1222 | ### What changed |
| 1223 | |
| 1224 | - siGit Code is now an MCP client: it connects to MCP servers over the Streamable HTTP transport (a single JSON-RPC endpoint), discovers the tools they expose, and offers them to the model alongside the built-in tools. When the model calls one, the call is forwarded to the owning server and the result fed back into the agent loop |
| 1225 | - Bakes in the official siGit Code MCP server at `https://sigit.si/api/v1/mcp` (follows `SIGIT_CLOUD_URL`). When you are signed in (`sigit login`), the cloud session token is sent as the bearer credential |
| 1226 | - Configure additional servers in `mcp.toml` — global (`~/.config/sigit/mcp.toml`) or project-local (`.sigit/mcp.toml`). Each `[[server]]` has a `name`, `url`, optional `enabled`, and optional `[server.headers]`; set `official = false` to opt out of the baked-in server |
| 1227 | - MCP tools are namespaced `mcp__<server>__<tool>` so they never collide with built-in tools or across servers; tool output is capped to protect the model's context |
| 1228 | - Discovery is best-effort at startup and bounded by a per-server timeout, so an unreachable server never blocks startup — it just contributes no tools |
| 1229 | - Added a `/mcp` slash command (TUI and ACP) that lists configured servers, their connection status, and the tools each exposes |
| 1230 | - Disable MCP entirely with `SIGIT_MCP=off`, or just the official server with `SIGIT_MCP_OFFICIAL=off` |
| 1231 | - New agent tools that close parity gaps in the tool layer: `multi_edit` (apply a batch of exact-substring edits to one file atomically — written only if every edit matches), `glob` (locate files by name pattern with `**`/`*`/`?`/`{a,b}`, most-recently-modified first), `write_todos` (render a live task checklist through the tool result for multi-step work), and `remember` (append durable notes to the nearest `AGENTS.md`/`CLAUDE.md`) |
| 1232 | - `edit_file` now supports `replace_all` and returns actionable failure context — naming the line whose trimmed text matches when only whitespace differs — so the model self-corrects in one round |
| 1233 | - `search_files` gained a `file_glob` filter and a `max_results` cap (default 50, hard-capped at 1000) that also bounds the directory walk |
| 1234 | - Refreshed branding and legal: updated `LICENSE`, `README`, and the npm/PyPI package descriptions |
| 1235 | |
| 1236 | ## 1.3.0 |
| 1237 | |
| 1238 | Adds a Local Inference on/off toggle, the open [Agent Skills](https://agentskills.io) |
| 1239 | format, and support for project instruction files (`AGENTS.md` and the like). |
| 1240 | |
| 1241 | ### What changed |
| 1242 | |
| 1243 | - Added a Local Inference on/off setting that is the explicit local-vs-cloud mode switch. It is persisted in `~/.config/sigit/settings.toml` (default on, local-first) and can be overridden with `SIGIT_LOCAL_INFERENCE` |
| 1244 | - Toggle it with the `/local [on|off]` command (TUI and ACP); ACP clients without slash-command support get an equivalent "Local Inference" On/Off control in the session config panel |
| 1245 | - `/models` now groups models by nature — Local vs siGit Code Cloud — and highlights the active mode's group while still showing the other, so the cloud tiers stay discoverable |
| 1246 | - Discovers Agent Skills (folders with a `SKILL.md`) from `.sigit/skills/` and `.claude/skills/` in the project, `~/.config/sigit/skills/`, and `~/.claude/skills/` |
| 1247 | - Follows the spec's progressive disclosure: each skill's name and description are advertised up front via a new `skill` tool, and the full instructions load only when the agent activates one |
| 1248 | - Added a `/skills` slash command (TUI and ACP) that lists the discovered skills |
| 1249 | - Reads project instruction files at session start: `AGENTS.md` (the cross-tool standard) and `CLAUDE.md`, walking from the working directory up to the repository root, plus a global file under `~/.config/sigit/`, and injects them into the session's system context so their guidance is always in force |
| 1250 | - Nested instruction files are ordered outermost-first so the closest, most specific file takes precedence; the scan never reads above the repository root |
| 1251 | - On-device models are no longer loaded implicitly. The chat UI and ACP sessions come up immediately, and the local model is brought into memory only when you run the `/load` command (or pick one in `/models`). Prompts sent before a model is loaded now return a hint instead of blocking on a multi-minute download. |
| 1252 | |
| 1253 | ## 1.2.2 |
| 1254 | |
| 1255 | Streams assistant tokens as they arrive, on-device and over the cloud. |
| 1256 | |
| 1257 | ### What changed |
| 1258 | |
| 1259 | - Streamed assistant tokens live in the TUI and ACP sessions, both on-device and through siGit Code Cloud |
| 1260 | - On-device inference streams only when a turn offers no tools, since `onde` can't stream and detect tool calls in the same pass; tool-capable turns still resolve in one shot |
| 1261 | - Fixed the TUI so the latest message stays visible in long chats |
| 1262 | - Put the cloud model-switch confirmation on its own line in ACP |
| 1263 | |
| 1264 | ## 1.2.1 |
| 1265 | |
| 1266 | Stabilizes the Zed/ACP integration and finishes the cloud-tier wiring on top of 1.2.0. |
| 1267 | |
| 1268 | ### What changed |
| 1269 | |
| 1270 | - Fixed a Zed crash by keeping model-picker labels ASCII in the ACP model selector |
| 1271 | - Wired ACP auth, cloud tiers, and slash commands into the Zed panel, including a `/reload` command to re-sync session state in place |
| 1272 | - Fixed the TUI so the loaded-model checkmark appears once a download completes |
| 1273 | - Synced bundled agent skills with the current code and added `CLAUDE.md` |
| 1274 | |
| 1275 | ## 1.2.0 |
| 1276 | |
| 1277 | Adds siGit Code Cloud — a hosted inference tier alongside on-device models. |
| 1278 | |
| 1279 | ### What changed |
| 1280 | |
| 1281 | - Added siGit Code Cloud with cloud-tier routing, pointed at `sigit.si` |
| 1282 | - Added account management slash commands and surfaced cloud tiers in `/models` |
| 1283 | - Carried forward from 1.1.0: ACP SDK v0.13, refreshed dependencies and branding |
| 1284 | |
| 1285 | ## 1.1.0 |
| 1286 | |
| 1287 | Bumps the ACP SDK to v0.13 and pulls in updated dependencies. |
| 1288 | |
| 1289 | ### What changed |
| 1290 | |
| 1291 | - Updated `agent-client-protocol` from v0.11 to v0.13 |
| 1292 | - Updated `onde` to 1.1.2 |
| 1293 | - Refreshed branding and skill metadata |
| 1294 | |
| 1295 | ## 1.0.4 |
| 1296 | |
| 1297 | This release tightens up the terminal experience and finishes a few release-facing cleanup items. |
| 1298 | |
| 1299 | ### What changed |
| 1300 | |
| 1301 | - Added bold rich-text rendering in the TUI for assistant replies, so `**text**` now displays with terminal styling instead of raw markdown markers |
| 1302 | - Refreshed the bundled skill metadata to follow the current Agent Skills `SKILL.md` format |
| 1303 | - Synced the crate release metadata for the `1.0.4` cut |
| 1304 | |
| 1305 | ## 1.0.3 |
| 1306 | |
| 1307 | This is the cleanup release for the editor-side startup problems. |
| 1308 | |
| 1309 | ### What changed |
| 1310 | |
| 1311 | - Fixed ACP sessions failing on the first real prompt because the server claimed the model was ready before anything had actually been loaded |
| 1312 | - Changed ACP startup so the default model loads lazily on the first non-slash prompt instead of pretending it is already in memory |
| 1313 | - Kept `initialize` and `session/new` lightweight while still sending proper progress updates once model loading begins |
| 1314 | - Updated the Onde integration to `1.0.0` |
| 1315 | - Removed a few dependencies we were no longer using |
| 1316 | |
| 1317 | ## 1.0.2 |
| 1318 | |
| 1319 | This release was supposed to fix the ACP auth breakage. It did fix the stdout pollution problem, but it turned out not to be the whole story. |
| 1320 | |
| 1321 | ### What changed |
| 1322 | |
| 1323 | - Delayed model loading in ACP mode so startup diagnostics would not leak into protocol stdout during the auth handshake |
| 1324 | - Tightened up the ACP startup path for editor integrations |
| 1325 | - Refreshed some README wording while cutting `1.0.2` |
| 1326 | |
| 1327 | ## 1.0.1 |
| 1328 | |
| 1329 | The first patch after `1.0.0` was mostly about making model loading and model switching feel less opaque. |
| 1330 | |
| 1331 | ### What changed |
| 1332 | |
| 1333 | - Added ToolCall-based progress UI for startup model loading and downloading |
| 1334 | - Improved model-switch progress reporting in ACP clients |
| 1335 | - Fixed model-load error handling so failed switches did not leave the UI in a weird state |
| 1336 | - Cleaned up a few status messages and docs while the release was going out |
| 1337 | |
| 1338 | ## 1.0.0 (2026) |
| 1339 | |
| 1340 | siGit Code has been living in real smbCloud repos for a while now. At some point it stopped feeling like an experiment, so we called it 1.0. |
| 1341 | |
| 1342 | ### What this release is |
| 1343 | |
| 1344 | siGit Code is a local coding agent. It runs a quantized model on your machine, talks to editors over ACP, and can read files, run commands, fetch web pages, and write code without sending your project to a hosted API. |
| 1345 | |
| 1346 | You can install it with Cargo, pip, npm, or Homebrew and use it like any other tool on your machine. |
| 1347 | |
| 1348 | ### What shipped in 1.0 |
| 1349 | |
| 1350 | #### Editor integration |
| 1351 | |
| 1352 | This is the core of the project. |
| 1353 | |
| 1354 | Zed and VS Code can talk to siGit Code over ACP. Multi-turn sessions work. Tool calling works. Session forking works. Working-directory context works. That was the original goal, and it feels solid now. |
| 1355 | |
| 1356 | #### Terminal UI |
| 1357 | |
| 1358 | The terminal UI started as a side quest and turned out to be useful. You get a full-screen ratatui chat, streaming tokens, a spinner while the model is busy, and a model picker you can open in the middle of a session. |
| 1359 | |
| 1360 | It runs on macOS and Linux. Windows gets ACP and editor mode for now. The Windows terminal UI is still unfinished. |
| 1361 | |
| 1362 | #### Tool calling |
| 1363 | |
| 1364 | This is the part that makes siGit Code feel like an agent instead of a chat box. The loop can run up to 10 rounds per message. |
| 1365 | |
| 1366 | Available tools: |
| 1367 | |
| 1368 | - `read_file` / `write_file` / `delete_file` |
| 1369 | - `list_directory` / `search_files` |
| 1370 | - `run_command`, with an optional working directory |
| 1371 | - `read_website`, which fetches a URL and strips it down to readable text |
| 1372 | |
| 1373 | The model can call a tool, inspect the result, and keep going until it has a real answer. |
| 1374 | |
| 1375 | #### Model support |
| 1376 | |
| 1377 | The model list ended up wider than we expected for 1.0: |
| 1378 | |
| 1379 | - Qwen 3 1.7B, 4B, 8B, and 14B |
| 1380 | - Qwen 2.5 1.5B and 3B |
| 1381 | - Qwen 2.5 Coder 1.5B, 3B, and 7B |
| 1382 | - DeepSeek Coder 6.7B |
| 1383 | |
| 1384 | They are all GGUF models and they all come from Hugging Face on first run. |
| 1385 | |
| 1386 | Qwen 3 is the interesting one. It uses extended thinking mode. The model reasons inside `<think>...</think>` blocks before answering. The TUI strips those blocks out and renders them dimmed above the reply, so you can see what happened without turning the whole conversation into noise. |
| 1387 | |
| 1388 | The 8B model is the desktop default. Mobile stays on 1.7B because iOS gives apps roughly 2 to 3 GB of memory, and we learned the hard way that 3B can blow up on an iPhone 16e. |
| 1389 | |
| 1390 | #### Model picker |
| 1391 | |
| 1392 | The model picker shows: |
| 1393 | |
| 1394 | - what is already cached locally |
| 1395 | - what can be downloaded |
| 1396 | - which models support tool calling |
| 1397 | - whether the local cache looks healthy |
| 1398 | |
| 1399 | You can open it with `/models` in the TUI or through the editor config option. Switching models happens in the background and the UI stays alive while the download or load is in progress. |
| 1400 | |
| 1401 | #### smbCloud context |
| 1402 | |
| 1403 | siGit Code knows smbCloud repos better than a generic coding assistant does. It understands the difference between platform-user flows and tenant-app auth flows, how `Project`, `FrontendApp`, `AuthApp`, and GresIQ fit together, and why Next.js SSR deploys are not the same thing as the generic git-push path. |
| 1404 | |
| 1405 | Outside smbCloud, it backs off and behaves like a normal coding agent. |
| 1406 | |
| 1407 | #### Distribution |
| 1408 | |
| 1409 | Distribution took an unreasonable amount of time, honestly. |
| 1410 | |
| 1411 | There are prebuilt binaries for macOS, Linux, and Windows on both arm64 and x64 where relevant, plus install paths through Cargo, PyPI, npm, and Homebrew: |
| 1412 | |
| 1413 | - `cargo install sigit` |
| 1414 | - `pip install sigit-code` |
| 1415 | - `npm install -g @smbcloud/sigit` |
| 1416 | - `brew install sigit` |
| 1417 | |
| 1418 | Getting that whole pipeline to behave across CI, crates.io, PyPI, npm, and Homebrew was basically its own project. |
| 1419 | |
| 1420 | ### What still does not work |
| 1421 | |
| 1422 | The Windows terminal UI is still missing. |
| 1423 | |
| 1424 | ACP and editor mode work on Windows. The part that is still missing is the interactive full-screen terminal UI. The blocker is Unix-specific terminal handling that has not been abstracted cleanly yet. |
| 1425 | |
| 1426 | ### Changes since 0.1.2 |
| 1427 | |
| 1428 | - Added Qwen 3 14B support |
| 1429 | - Added Qwen 3 `<think>` block parsing and separate rendering in the TUI |
| 1430 | - Moved all TUI code into `#[cfg(unix)]`, which fixed a pile of dead-code errors on Windows CI |
| 1431 | - Added live download progress during model switches, including cancellation with Ctrl+C |
| 1432 | - Added model download and loading progress in the Zed agent config panel |
| 1433 | - Added an animated spinner during model switching |
| 1434 | - Added Qwen 2.5 Coder 7B |
| 1435 | - Added downloadable models to the picker, not just locally cached ones |
| 1436 | - Made model selection persist across restarts |
| 1437 | - Added session working-directory support |
| 1438 | - Moved model picker logic into a platform-independent module so Windows can compile without the TUI |
| 1439 | - Added the `/models N` shortcut for picking a model by number |
| 1440 | - Added the `read_website` tool |
| 1441 | - Improved `read_file` handling and empty-reply detection |
| 1442 | - Added async tool execution |
| 1443 | - Fixed CI cross-compilation for macOS, iOS, Linux, and Windows |
| 1444 | - Added npm, PyPI, and Homebrew distribution |
| 1445 | |
| 1446 | --- |
| 1447 | |
| 1448 | *© 2026 [siGit Code & Deploy](https://sigit.si). See [NOTICE](NOTICE) for the rights holder and distributor.* |