CHANGELOG.md · sigitcode-old/sigit

Fork 1

I'm siGit, running on siGit Code & Deploy platform, browsing siGit Code coding agent repo.

Code Commits Issues 15 Pulls 1 Cloud Agent CICD

main

claude/github-issue-40-0au5ua claude/sigit-acp-local-chat-cx6380 claude/zen-feynman-0u78dk development feature/account-commands-system-status feature/skill-slash-commands feature/tui-slash-autocomplete feature/xcode-mcp-server fix/zed-commands-after-session-response main

md 1,483 lines 82.8 KB

Rendered Raw

1	# Changelog
2
3	## 1.7.7
4
5	A launch splash for the terminal, and a way to pick the cloud tier for a
6	headless run. No protocol change, so an editor sees a 1.7.6-shaped agent.
7
8	### Added
9
10	- The terminal opens on the siGit wordmark. The banner is an animated
11	"ember wordmark" — the letters of "siGit" are the blank cells in the art and
12	the digits are a flame that ignites from the right and trails off to the
13	left. It is the same animation the siGit app plays at launch.
14	- The splash waits on the startup checks. The account check (a bounded
15	request to sigit.si), the model scan, the git remote lookup and MCP
16	discovery each run on their own task and report as they finish; the results
17	print as Account, Models, Workspace and Tools lines under the chat's opening
18	quote. The model scan, the git lookup and MCP discovery used to run before
19	the first frame, so a slow MCP server meant a blank terminal for up to its
20	8 s handshake timeout. The splash leaves once the checks are in and 1.4 s
21	have passed, any key skips it, and 4 s is the hard cap. A skip or the cap
22	does not cancel the checks, so the model picker and the Repo tab still fill
23	in behind the chat. `SIGIT_REDUCE_MOTION=1` draws the finished frame, and
24	terminals without truecolor fall back to the nearest 256-colour cell.
25	- `sigit run --model <tier>` picks the siGit Code Cloud tier for a headless run. Headless
26	runs always used the default tier, so when that tier was unavailable a script or sandbox
27	runner had no way to pick another without pointing the custom-endpoint override at siGit Code
28	Cloud. The flag takes a tier name (`prism`) or its model id (`onde-prism`) and wins over the
29	provider override and the local-inference setting.
30
31	### Fixed
32
33	- `/whoami` has a timeout. The account check behind it now gives up after
34	10 s instead of waiting on an unreachable server.
35
36	### Known limitations
37
38	- A turn sent before MCP discovery finishes has no MCP tools for that turn.
39	The splash normally covers that window, but a skip or the 4 s cap can end
40	it earlier.
41
42	### Docs
43
44	- The release skill now records that the public MCP Registry listing moved to
45	`getsigit/si`, that winget goes live only after a human merges the manifest
46	PR, and which name each registry publishes under.
47
48	## 1.7.6
49
50	A background-task tool for long commands, model pickers grouped by where the
51	model runs, and a shorter README. No protocol change, so an editor sees a
52	1.7.5-shaped agent.
53
54	### Added
55
56	- `monitor_command` follows a background task in one tool call. It waits
57	until the task exits, a line of new output matches an optional `until`
58	pattern, or a timeout passes (300 s by default, 600 s at most). In an
59	editor it is a single card that updates with the task's output as it
60	arrives, instead of a column of `command_output` cards that also used up
61	the turn's tool rounds (#253).
62
63	### Changed
64
65	- Cards for `command_output`, `monitor_command` and `kill_command` name the
66	task and its command.
67	- `/models` and the editor's model picker group models by where they run,
68	on-device or cloud, instead of one flat list (#264, #265).
69
70	### Fixed
71
72	- The winget pull request description gives the version of the release it was
73	filed for (#267).
74
75	### Docs
76
77	- The README is shorter and the details moved into docs. Android Studio is
78	documented, and the JetBrains and download links point to the right places
79	(#266).
80
81	## 1.7.5
82
83	A new siGit Code Cloud tier, and two fixes for signing in and switching
84	accounts. No protocol change, so an editor sees a 1.7.4-shaped agent.
85
86	### Added
87
88	- A new siGit Code Cloud tier, `lumen`, for long-context work over text and images. It shows in `/models` and the editor picker (#261).
89
90	### Fixed
91
92	- `/whoami` no longer reports a working sign-in as expired. It called
93	`/api/v1/me`, which rejects the OAuth tokens the browser sign-in stores, so a
94	good session read "Session may be expired (HTTP 403)". It now calls
95	`/api/v1/user`, the endpoint the browser flow uses to read the profile
96	(#258).
97	- Reauthenticate can switch accounts again. `authenticate` returned early
98	when the stored session verified, which stopped Reauthenticate from opening
99	the browser. It now always runs the browser flow (#258).
100	- After Reauthenticate, the next message uses the new account. Every cloud
101	backend kept the token it was built with, so the live backend, parked
102	threads and subagents kept sending the old account's bearer until Reload
103	Agent. Cloud backends now read the stored token on each request (#259).
104
105	## 1.7.4
106
107	The browser sign-in page looks like the product and stops reporting success
108	before there is any. No protocol change, so an editor sees a 1.7.3-shaped agent.
109
110	### Fixed
111
112	- **The sign-in page only says "Signed in" once the sign-in actually
113	happened.** The loopback success page was sent the moment the callback
114	arrived, before the authorization code was redeemed. If the exchange then
115	failed, the browser read "Signed in to siGit Code" while the app reported an
116	error. `wait_for_code` now hands back the open connection unanswered and
117	`complete_loopback` responds only after the exchange has settled, with a
118	separate page for a failure (#254).
119	- The sign-in page is restyled. It is now a centered logo, title and hint
120	on a dark canvas, with inline CSS and an inlined logo, so the page served
121	from the loopback address makes no second request. Title and hint are
122	distinct, so a decline, a stray request and a mismatched callback each read
123	as themselves (#254).
124
125	## 1.7.3
126
127	One fix, and no protocol change, so an editor sees a 1.7.2-shaped agent.
128
129	### Fixed
130
131	- A thread whose directory is gone no longer runs tools elsewhere. The
132	process stayed in whichever directory the previous thread left it in, so
133	`read_file`, `edit_file` and `run_command` acted on the wrong project. A
134	prompt on such a thread now fails with resource not found, and a turn that
135	loses its directory mid-wait is cancelled. `session/load`, `session/resume`
136	and `session/fork` still succeed, so the saved history stays readable (#179).
137
138	## 1.7.2
139
140	The interactive terminal tells the program that launched it what it is doing,
141	and a model that writes its tool calls as prose gets them run more often. No
142	protocol change, so an editor sees a 1.7.1-shaped agent.
143
144	### Added
145
146	- Program status in the interactive terminal. siGit Code now writes an
147	`OSC 7501` record (`app=sigit`) as its state changes, so a terminal that
148	tracks program status can show it: `idle`, `working`, `done`, `error`, and
149	`blocked` with `kind=permission`, `question` or `auth` while it waits on the
150	user. Repeated states are collapsed, a write failure is ignored rather than
151	ending the turn, and the root record is deliberately left alone on exit, so
152	a bare clear cannot wipe another program's records (#235).
153
154	### Fixed
155
156	- More inline tool calls are recovered. Models that write a call into the
157	content as text instead of the tool channel are now understood in more
158	spellings: a DSML envelope named `function_calls` or bare `calls` as well as
159	`tool_calls`, a closer that puts its slash before the bar
160	(`</｜DSML｜invoke>`), and the `<minimax:tool_call>` wrapper around
161	`<invoke name="…">` with parameters written either as
162	`<parameter name="k">v</parameter>` or `<k>v</k>`. The tokenizer's
163	`]<]minimax[>[` special token, which leaks into content between tags and in
164	prose, is stripped instead of being left in the reply and in history (#249).
165	- Headless mode says when a tool round is the last one. The round that
166	reaches the cap is answered in text with no tools, which the model could not
167	see, so it spent its final reply announcing a step that would never run. That
168	round's last tool result now carries a note giving the round count, saying no
169	tools remain and that nobody is there to reply. The interactive client has
170	said this for a while; headless was left without it (#250).
171
172	### Docs
173
174	- A README for `sigit-agent`. The crate a host embeds had no front page.
175	It now has a short one: what the profile offers, and a `serve` example that
176	notes the host must call it from inside a tokio runtime.
177
178	## 1.7.1
179
180	Two process-global stores in the CLI leaked between the sessions one process
181	serves. A patch release, so nothing here changes the protocol surface 1.7.0
182	introduced.
183
184	### Fixed
185
186	- A todo list cannot leak into another thread. `tools.rs` kept the list in
187	a single process-global slot, shared by every session the process serves, so
188	a plan written in one conversation showed up in the next. It is keyed by
189	session now, like the permission grants, and cleared when the session ends.
190	The TUI carries a session key of its own (`permissions::TUI_SESSION`) rather
191	than the session-less `""` key, so its background commands, plan and
192	permission grants are torn down on exit; the unused `TODOS_TEST_LOCK` and
193	`reset_todos` are gone.
194	- **The model picker's roots are resolved per caller instead of through the
195	environment.** `setup.rs` built its model store by mutating `HF_HUB_CACHE`,
196	`HF_HOME` and `HOME` under `ENV_TEST_LOCK`, which never isolated the values
197	because the picker reads those variables on other threads — `setup::tests`
198	failed intermittently. Production callers resolve the roots once with
199	`ModelRoots::from_env()` and pass them into the internals, so a test points
200	the readers at a scratch directory instead of aiming process-global
201	variables at it.
202	- `sigit` publishes again. The crate listed eight keywords and crates.io
203	accepts five, so the v1.7.0 publish failed with a 400. The list is trimmed to
204	`cli`, `ai`, `coding-agent`, `llm`, `acp`.
205
206	## 1.7.0
207
208	Finishes the Agent Client Protocol v1 surface. An editor can now delete a
209	thread, show a context meter, tell one message from the next, cancel a request
210	by its id and page through a long thread list, and a reopened thread comes back
211	with its reasoning and attachments.
212
213	### Added
214
215	- `session/delete`. A thread removed in the editor is removed from disk, so
216	it no longer comes back in "Import Threads". A turn still running on it is
217	stopped first, and deleting an id that is already gone succeeds (#192).
218	- A saved thread reports its title and time as they change. Each save sends
219	a `session_info_update` with a fresh `updatedAt`, and the title the first time
220	there is one. A new thread used to stay untitled in the sidebar until the next
221	`session/list` (#193).
222	- Context usage. A `usage_update` follows every model response, so an editor
223	can show how full the context window is. `used` is the endpoint's own token
224	count when it gives one and an estimate otherwise, which is always the case
225	on-device (#194).
226	- Message ids. Every message chunk carries a `messageId`. An inference round
227	is one message, so its reply and its reasoning share an id and the round after
228	a tool call starts a new one (#195).
229	- Sign-in through the editor. For a client that advertises URL-mode
230	elicitation, `authenticate` hands it the sign-in page instead of launching a
231	browser from the agent. The user sees where they are being sent, and sign-in
232	works where siGit Code has no browser to open (#197).
233	- The Inference switch is a toggle for a client that renders boolean config
234	options. Other clients keep the two-value select (#198).
235	- Deny for the session. A permission prompt offers "deny for this session"
236	next to "allow for this session", so a tool the user does not want is not
237	asked about again in that thread (#199).
238	- `$/cancel_request`. A client can cancel a request by its JSON-RPC id. For
239	`session/prompt` that stops the turn and the command it is running exactly as
240	`session/cancel` does, and the prompt is answered with the `cancelled` stop
241	reason. For `authenticate` it ends the wait on the browser and the request is
242	answered `-32800`. The notification used to be ignored.
243	- `session/list` is paged. A reply holds at most 100 threads and a
244	`nextCursor` when there are more. The cursor names the last thread on the
245	page instead of counting an offset, so the next page is right when a thread is
246	saved or deleted in between. A cursor the agent did not hand out is rejected
247	with `-32602`; `cursor` used to be ignored.
248
249	### Fixed
250
251	- A reopened thread shows its reasoning and attachments. `session/load`
252	replayed only the text of each message. The model's reasoning now comes back
253	as `agent_thought_chunk` under the reply's `messageId`, and the images and
254	audio clips of a user message come back as `image` and `audio` blocks.
255	- Cancelling a turn stops the command it is running. A foreground
256	`run_command` used to run to its own end (up to two minutes) before the turn
257	noticed the cancel. A cancel or `session/close` now kills the process tree, or
258	sends `terminal/kill` when the command runs in the editor's terminal, and the
259	turn ends `cancelled` within a moment.
260	- Switching permission mode works while a turn is running. `session/set_mode`
261	and the Permissions config option queued behind the turn's session lock, so
262	choosing Auto while a permission prompt was open did nothing until the turn
263	ended. They now take no lock, are answered at once, and the pending call's
264	successors follow the new mode. Model and Inference changes still wait for
265	the turn.
266	- `authenticate` checks the method id. An id that `initialize` never offered
267	is now rejected with `invalid_params` (`-32602`) instead of starting a
268	browser sign-in. A sign-in that fails reports `-32603`, since `-32000` means
269	authentication is required before a call.
270	- A session the agent does not know is `-32002`. `session/prompt`,
271	`session/set_mode` and `session/set_config_option` answered `-32602` for an
272	unknown id; they now say resource not found, as `session/load` and
273	`session/resume` already did.
274	- A finished terminal command no longer names a released terminal. The
275	closing `tool_call_update` of a command that ran in the editor's terminal
276	re-sent the terminal id after `terminal/release`. It now leaves the content
277	alone, so the embedded terminal stays as it was, and the result still goes out
278	as `rawOutput`.
279	- `session/list` rejects a relative `cwd` filter with `-32602`, as
280	`session/new` does.
281	- An embedded binary resource is read when the model can read it. An image
282	blob becomes an image input and an audio blob an audio input. Any other blob
283	keeps its placeholder, now with its MIME type.
284
285	## 1.6.9
286
287	### Fixed
288
289	- Doubled-bar DSML markers survive inline tool-call recovery. Some models
290	write `\|\|name\|\|args\|\|` (and single-bar `\|name\|args\|`) instead of the
291	underscore-form `__name__args__` that `inline_tool_calls` was matching.
292	These were being dropped from the recovered reply and from history, so the
293	model thought its call had run. The scanner now accepts both forms, and
294	a buffer that contains no doubled bar skips the regex fold entirely
295	instead of allocating an empty `String`.
296
297	### Changed
298
299	- The release workflow is split into full-release and scoped-patch flows.
300	`sigit-code-release` now leads with a scoped-patch path for one or two
301	commits on top of the last tag (no new release skill, no ACP advert,
302	no `## $version` requirement), then a full-release path for normal
303	development → `main` releases. Winget CI also gets a blank line between
304	the issue body and the manifest PR body so the rendered issue no longer
305	runs the two together.
306
307	## 1.6.8
308
309	### Fixed
310
311	- A bare launch of `sigit.exe` on Windows exits 0 instead of bailing. A
312	no-argument launch with a TTY stdin falls through to the non-Unix branch,
313	which has no TUI to start (the interactive client needs Unix-only fd
314	redirection). It now prints a short usage message pointing at ACP and
315	headless modes and exits 0, so winget's installer validator no longer reports
316	a `Validation-Executable-Error`.
317
318	### Changed
319
320	- winget submissions link back to their Package Request issue. The release
321	workflow scrapes the winget-pkgs PR URL from wingetcreate, opens a Package
322	Request issue on first submission, and rewrites the PR body to fill the
323	Description, tick the issue checkbox, and add `Resolves #NNN` — replacing the
324	manual per-PR edit that used to follow each release.
325	- **The winget release workflow files its Package Request issue first and uses
326	two scoped tokens.** The Package Request issue is opened before the
327	winget-pkgs PR so the PR can reference it immediately, and issue creation and
328	PR submission now use separate tokens (`WINGET_ISSUE_TOKEN` and
329	`WINGET_PR_TOKEN`) rather than one shared token.
330
331	## 1.6.7
332
333	### Fixed
334
335	- A cancel that arrives before the turn starts is no longer lost. A prompt
336	now registers for `session/cancel` as soon as it begins, not once it reaches
337	inference. A cancel that lands while the turn is queued on the workspace,
338	switching threads, loading a model, or running a slash command ends it with
339	`cancelled` instead of `end_turn`.
340	- A prompt that is only audio is answered. A clip with no text or image used
341	to end the turn at once with nothing sent to the model, even though the agent
342	advertises audio.
343
344	## 1.6.6
345
346	### Added
347
348	- A tool call carries its programmatic tool name. The `tool_call` an editor
349	gets for a running tool now includes `name` (`read_file`, `run_command`,
350	`mcp__…`) next to the human title, sent on the first report of the call only
351	as the protocol asks. A client can tell a command from a file edit without
352	parsing the title, and a replayed thread from `session/load` carries the same
353	name (#196).
354
355	### Changed
356
357	- MCP runs on `rmcp`, the official Rust SDK, through `ed-mcp`. siGit Code's
358	own JSON-RPC client for stdio and Streamable HTTP servers (about 600 lines)
359	is gone; `ed-mcp` is the layer every Onde agent shares. `mcp.toml`, the
360	baked-in `sigit` and `smbcloud` servers, tool names and `/mcp` are unchanged.
361	An HTTP server that stops answering is now reconnected and the call retried
362	once for any failure but a timeout, not only on a 404.
363
364	### Fixed
365
366	- A reply that degenerates into a repetition loop is cut off. After a tool
367	call, a model could fall into thousands of words from a tiny vocabulary
368	(`find: list: check: get: …`) with no tool call and no end, and the junk went
369	into history for the next turn. siGit Code now watches a streamed reply for a
370	window of 200 words with very few distinct ones (code blocks excepted), stops
371	reading, keeps only the text before the loop, tells you it stopped, and asks
372	the model once to make its call or answer briefly (#123).
373	- A linked selection written as `L10-L20` or `L10` reads just those lines.
374	siGit Code read the line range of a `resource_link` only as `L10:20` or
375	`L10-20`, so `L10-L20` (the GitHub style) and a single line `L10` sent the
376	whole file instead of the selection. It now reads the same forms Zed's own
377	mention parser does, and a range that starts at line 0 or runs backwards
378	counts as no range.
379
380	## 1.6.5
381
382	### Added
383
384	- An `@file` mention can carry unsaved edits. siGit Code now advertises
385	`promptCapabilities.embeddedContext`, so a client can put a resource's
386	contents in the prompt instead of sending a link to it. Before, a client
387	that follows the spec only sent `resource_link`, and siGit Code read the
388	file from disk, missing whatever the user had not saved yet (#141).
389	- A prompt can carry audio. siGit Code now advertises
390	`promptCapabilities.audio` and sends an attached clip to the model as an
391	OpenAI `input_audio` part. It works the way image attachments do: a model on
392	an endpoint you configure yourself gets the clip and decides for itself,
393	while siGit Code Cloud tiers and on-device models, none of which take audio
394	today, get a note in its place and the editor says the clip was left out
395	(#143).
396	- The README says what telemetry is sent. A new Telemetry section covers
397	the model-timing events Onde Inference can report for on-device models,
398	what they leave out, and how to turn them off with `ONDE_DISABLE_PULSE=1`.
399
400	### Changed
401
402	- A turn that cannot get its session back stops. A turn on an HTTP backend
403	gives up the process-wide working directory while it waits and reinstalls
404	its session before a tool runs. If the reinstall failed, the turn logged a
405	warning and carried on in whichever directory was current. Nothing makes it
406	fail today, since a close waits for the turn, but the turn now ends as
407	cancelled instead of depending on that.
408	- Dependencies match the rest of the Onde stack. Onde 1.2.2 to 1.3.1,
409	reqwest 0.12 to 0.13 and ratatui 0.29 to 0.30, the versions Ed, OndeCode and
410	SplitFire Agent use. ratatui is built with only its crossterm backend, which
411	drops the second copy of crossterm (0.28) from the build.
412
413	### Fixed
414
415	- Tags a model makes up no longer show in the reply. After a long run of
416	tool rounds, a model could start writing markup that looked like it came
417	from siGit Code: a `<system_warning>` block telling the user the previous
418	turn was injected and should be ignored, or a question wrapped in
419	`<Option_Picker>`. Neither tag means anything to siGit Code or the editor,
420	so both rendered as raw text. A `system_*` block is now dropped from the
421	reply and from the history, and other made-up tags are removed while the
422	text inside them stays. Code blocks are left alone. The system prompt also
423	tells the model to write plain Markdown and to list choices as plain text
424	(#122).
425	- Closing a thread that is waiting at a permission prompt no longer hangs.
426	`session/close` cancels the session's running turn and waits for it to end,
427	but a turn stopped at a permission prompt only went on when the client
428	answered the request. A client that closed the thread without answering
429	left the close, and every later request for that thread, waiting for good.
430	The same held for `session/cancel` with a client that did not send the
431	cancelled outcome the protocol asks for. The permission wait now ends on
432	the cancellation as well, and an approval that arrives after the turn was
433	cancelled runs nothing.
434
435	- A closed thread no longer leaves its request lock behind. The process
436	kept one lock per session id for as long as it ran, for closed threads and
437	for ids no session ever had. The entry now goes with the last request that
438	used it.
439
440	- A tool call that did not run no longer shows as completed. When policy
441	or plan mode denied a call, when the user picked Deny at the permission
442	prompt, or when the repeat guard skipped a call the model made three times,
443	the editor's card still ended `completed`. Those cards now end `failed`, the
444	same way a call cancelled at the prompt already did. A call denied at the
445	prompt also gets its own title back instead of keeping the permission
446	request's (#139).
447
448	- On-device inference no longer panics on some non-English text. siGit Code
449	now builds on Onde 1.3.1, which fixes a panic when a message longer than 100
450	bytes had a multi-byte character (an accented letter, CJK, or an emoji) at
451	byte 100. Onde 1.3 also reports Pulse events for streaming inference, which
452	is the path on-device turns take, so those turns are now reported alongside
453	model loads. `ONDE_DISABLE_PULSE=1` turns Pulse off.
454
455	## 1.6.4
456
457	### Added
458
459	- DeepSeek DSML tool calls written into the reply text are recovered. A
460	DeepSeek-family endpoint can render a tool call as literal
461	`<｜DSML｜tool_calls>` text instead of the structured `tool_calls` field,
462	which streamed the tag into the editor and ended the turn with nothing run.
463	The inline tool-call scanner that already recovered the GLM XML and Kimi K3
464	shapes now recovers the DSML shape too, including a marker split across
465	stream chunks. A block that fails to parse is still kept out of the reply
466	and the history, and the model is told the call did not run (#181).
467
468	### Fixed
469
470	- The round-cap stop message no longer carries a stray run of spaces.
471	When the tool-round cap ended a turn, the closing message could collapse a
472	space run into the wrong spot, which the editor then rendered verbatim
473	(#177).
474
475	## 1.6.3
476
477	### Added
478
479	- A client can resume a session and close one. siGit Code now advertises
480	`sessionCapabilities.resume` and `sessionCapabilities.close`.
481	`session/resume` restores a saved thread the way `session/load` does, but
482	sends none of it back: it is for a client that still has the thread on
483	screen, after an agent restart for example. `session/close` cancels the
484	session's running turn and drops what the process held for it, which is its
485	state, its permission grants and plan mode, the MCP servers the client named
486	for it, and the background commands it started. The saved history is left
487	alone, so a closed thread still lists and reopens (#149).
488
489	- The permission modes are also offered as ACP session modes. Manual, Auto
490	and Plan were only reachable as a config option, which is what the protocol
491	now recommends and what Zed reads. A client that draws the older mode
492	selector saw nothing. `session/new`, `session/load` and `session/fork` now
493	return the same three in `modes`, `session/set_mode` switches between them,
494	and a change made any other way (the config option, `/plan`, `/clear`,
495	`/reload`) is announced with `current_mode_update`. A client that reads
496	config options ignores `modes`, so nothing changes there (#148).
497
498	- An editor can sign out of siGit Code. The `initialize` reply carried an
499	empty `auth` object, so a client drew no sign out button, and typing
500	`/logout` was the only way out of an account. The reply now advertises
501	`agentCapabilities.auth.logout`, and a `logout` request ends the account
502	session through the method `/logout` calls. The request names no session,
503	so it moves every open thread that used the account, not only the live one:
504	a thread parked on a cloud tier goes on-device with the live thread instead
505	of failing to restore its tier on its next prompt, and every thread that
506	moved gets a fresh model picker. Local inference is switched back on if it
507	was off, so a thread opened after signing out asks for no cloud tier
508	(#150).
509
510	### Changed
511
512	- Two threads can run a turn at the same time. An editor runs one siGit
513	Code process for every thread it has open, and a single lock ordered every
514	turn-affecting request in it, so a second prompt waited for the first
515	thread's whole turn and two prompts never overlapped. The lock held what a
516	session installs process-wide — the working directory, the workspace roots,
517	the MCP servers the client named for it, the live backend — none of which a
518	turn touches while it waits on an HTTP endpoint, which is most of its time.
519	A session on an HTTP backend now keeps a backend of its own, so its
520	conversation is no longer swapped in and out of a shared one, and a turn
521	releases the process-wide lock while it waits on the endpoint or on a
522	permission answer and takes it back, reinstalling its session, before any
523	tool runs. On-device turns are unchanged, since the engine keeps one
524	conversation, and tool execution still runs one session at a time (#176).
525
526	### Fixed
527
528	- A prompt whose inference failed is kept through a model switch. A turn
529	that ended in an endpoint error stayed in the client's thread, but the
530	carryover into a new model dropped its trailing user message, and the error
531	path never saved the session. Only a cancelled prompt should be taken back
532	out, so cancellation now removes it from the live history, and the error
533	path persists the session (#124).
534
535	## 1.6.2
536
537	### Added
538
539	- `sigit --version` prints the release. `sigit --version` and `sigit -V`
540	print `sigit <version>` on stdout and exit 0. Before, the flag was not
541	recognized and siGit Code started a session, which left a script that asked
542	for the version waiting.
543
544	- File tools read and write through the editor when it offers to. An ACP
545	client that advertises `fs.readTextFile` or `fs.writeTextFile` serves those
546	requests from its open buffers. siGit Code always used the disk, so
547	`read_file` missed unsaved changes and `edit_file` wrote underneath a buffer
548	the user might have modified. `read_file`, `create_file`, `edit_file` and
549	`multi_edit` now go through the client for paths inside the session's roots.
550	The two capabilities are independent, and the disk is still the fallback:
551	for a path outside the roots, and for a request the client fails or leaves
552	unanswered for 30 seconds. `SIGIT_CLIENT_FS=off` keeps the file tools on
553	disk (#147).
554
555	### Fixed
556
557	- A file attached from the editor is found when its path needs escaping.
558	A `resource_link` was read by stripping `file://` and using the rest as the
559	path, so a space arrived as `%20`, a non-ASCII name failed, and a Windows
560	URI kept its leading slash. A `#` in a file name was also taken for the
561	line-range fragment. The URI is now parsed properly (#170).
562
563	## 1.6.1
564
565	### Added
566
567	- Images can be attached to a prompt in the editor. siGit Code now
568	advertises `promptCapabilities.image`, so an ACP client offers image
569	attachments. The image goes to the model when the active model reads images.
570	The model picker marks those models with "reads images". The on-device
571	models and four cloud tiers (`nova`, `orbit`, `apex`, `flux`) are text-only:
572	with one of them active the image is left out, a note in the thread says so,
573	and the model is told an image was withheld. Switching a thread that already
574	holds images to a text-only model flags that once as well. Cloud tiers need
575	siGit Code Cloud to accept image parts, which is rolling out separately
576	(#134).
577
578	- The tool-round cap of a headless run can be set. `--max-tool-rounds <n>`
579	or `SIGIT_MAX_TOOL_ROUNDS` (1 to 500) replaces the built-in 24 for
580	`sigit run` and `sigit -p`. The flag wins over the variable.
581
582	### Fixed
583
584	- A prompt turn now reports why it stopped. ACP defines five stop reasons
585	and siGit Code only ever sent `end_turn` and `cancelled`. A turn that runs
586	into the tool-round cap now ends with `max_turn_requests`, a reply cut off
587	at the token limit with `max_tokens`, and a reply the endpoint withheld
588	(`content_filter`) with `refusal`. A refused turn is also taken out of the
589	conversation, which is what the protocol tells the client to expect (#140).
590
591	- A tool call that needs approval is one card, not two. The permission
592	request carried an id of its own, so an ACP client showed an approval card
593	beside a call that already claimed to be running. The call is now announced
594	as `pending`, the permission request names that same call, and it moves to
595	`in_progress` once approved. Calls allowed by policy still start out
596	`in_progress` (#138).
597
598	- A turn that runs out of tool rounds says so. In an editor, a long task
599	could stop on a line like "Now commit:" with nothing after it. The turn had
600	used all 24 tool rounds, the model spent its last reply announcing the next
601	step, and the call behind it was dropped. siGit Code now tells the model
602	that its rounds are used up before that last reply, and ends the turn with a
603	message saying why it stopped and that "continue" picks it back up.
604	`SIGIT_MAX_TOOL_ROUNDS` now sets the cap for editor sessions too (#120).
605
606	- A headless run no longer ends silently with no final message. When the
607	last round came back empty, which is what happens when a run is cut off at
608	the tool-round cap mid-task, stdout was empty and the exit status was 0, so
609	a caller could not tell it from a run with nothing to report. siGit Code now
610	asks the model once for its final message before finishing.
611
612	## 1.6.0
613
614	### Added
615
616	- Editors can pass HTTP MCP servers to a session. siGit Code now
617	advertises `mcpCapabilities.http`, so an ACP client may list Streamable HTTP
618	servers in `mcpServers` next to stdio ones. They are connected with the URL
619	and headers the client sent and are scoped to that session, like the stdio
620	ones. SSE is still not advertised, since the MCP spec deprecated it (#151).
621
622	- The plan panel survives a failed turn. The last `write_todos` list is
623	now kept by siGit Code itself. When a turn ends in an endpoint error before
624	the model gets to call `write_todos` again, the saved list is sent to the
625	editor again, so the plan stays on screen where it used to go blank (#132).
626
627	### Changed
628
629	- The ACP Rust SDK is now 2.2 (`agent-client-protocol`, up from 1.3).
630	siGit Code still speaks ACP protocol v1 to the editor, so nothing changes on
631	the wire. The `unstable_auth_methods` feature is gone because agent auth
632	methods are stable in 2.x.
633
634	### Fixed
635
636	- MCP servers the editor passes to a session are connected. ACP clients
637	can name MCP servers in `mcpServers` when they open a session, and agents
638	are required to connect to the stdio ones. siGit Code accepted the field and
639	ignored it. The servers are now spawned when the session opens, their tools
640	are offered to that session only, and `/mcp` lists them as coming from the
641	editor. `SIGIT_MCP=off` still turns all of it off (#135).
642
643	- A relative `cwd` is rejected when a session starts. ACP requires the
644	working directory and every `additionalDirectories` entry to be absolute.
645	`session/new`, `session/load` and `session/fork` used to accept a relative
646	one and resolve it against wherever the editor spawned the process. They now
647	answer with an invalid-params error (#136).
648
649	- Loading a session that does not exist is an error. `session/load` with
650	an id that was never saved used to succeed and open an empty session under
651	that id, so the editor showed a blank thread that looked restored. It now
652	answers "not found" (`-32002`). A thread opened in the running process but
653	not spoken in yet still loads (#137).
654
655	- Compaction no longer dead-ends a long session. The summarization request
656	used to carry the whole conversation, which by then was already over the
657	model's window, so siGit Code Cloud timed out with a 504 and the session
658	stopped with "start a new thread". The transcript sent for summarizing is
659	now capped, cut from the middle so the opening request and the latest state
660	are kept. If summarizing still fails, the oldest messages are dropped until
661	the history fits, with whole tool rounds removed together. A failed attempt
662	leaves the conversation as it was (#125).
663
664	- Gateway error pages stay out of the chat. When an endpoint answers with
665	an HTML error page, the error shown is the status line, not the page's
666	markup (#125).
667
668	- Issue and pull request work no longer assumes GitHub. The system prompt
669	treated forge features as if every repository lived on GitHub, while the
670	built-in `mcp__sigit__*` tools only work for repositories hosted on
671	sigit.si. The agent now checks the remote first, uses those tools only for
672	sigit.si repositories, and reaches for the forge's own CLI (`gh`, `glab`,
673	`tea`) elsewhere (#127).
674
675	## 1.5.13
676
677	### Added
678
679	- Three more siGit Code Cloud tiers: `flare`, `zenith` and `prism`. They
680	show up in `/models` and in the editor's model picker alongside the existing
681	tiers. Selecting one needs a signed-in account, as before.
682
683	## 1.5.12
684
685	### Fixed
686
687	- **The Windows binaries start on machines without the Visual C++
688	Redistributable.** They used to import `VCRUNTIME140.dll` and the UCRT
689	`api-ms-win-crt-*` DLLs, so a clean Windows install refused to load them
690	with `STATUS_DLL_NOT_FOUND` (0xC0000135). That is what failed winget's
691	post-install check. The C runtime is now linked statically, and CI and the
692	release build fail if a Windows exe picks up that dependency again.
693
694	- Watching a slow background command no longer ends the turn early.
695	Polling `command_output` on the same task id three times tripped the
696	repeated-tool-call guard, which refused the call and dropped tools for the
697	rest of the turn. `command_output` now long-polls — it waits up to
698	`wait_seconds` (default 10, max 30) for the task to exit, then returns
699	everything printed in the meantime — and the repeat guard exempts it, since
700	polling the same task is the whole point of the tool.
701
702	- A turn that ends with no visible text says why. When the
703	repeated-tool-call guard blocked a call and the forced no-tools round came
704	back empty, sigit sent nothing more — the turn just stopped with no answer
705	and no question. When the last round of a tool-using turn produces no
706	visible text, sigit now sends a short closing message naming the repeated
707	tool and asking you to reply "continue" or redirect.
708
709	## 1.5.11
710
711	### Added
712
713	- `sigit run` drives the agent headlessly with resumable sessions. A new
714	non-interactive subcommand runs a prompt through the same agent loop as the
715	editor and terminal surfaces, for scripts, CI, and Factory clients. Every run
716	gets a UUID session id, writes a JSON-lines history file under
717	`~/.config/sigit/sessions/`, and can be restored with `--resume <id>`.
718	`--output jsonl` emits a structured session/delta/tool/result stream on
719	stdout while logs stay on stderr, and `--allow-tool` pre-approves a tool so
720	permission prompts collapse to denial in a non-interactive context. The
721	legacy `-p` form still works. Each run also rewrites the session metadata
722	with its own cwd and extra roots, so resuming keeps multi-root projects
723
724	- Saved threads can be imported into the editor. siGit Code now advertises
725	ACP's `sessionCapabilities.list` and answers `session/list`, so Zed's "Import
726	Threads" picker offers the conversations stored under
727	`~/.config/sigit/sessions/` instead of reporting that the agent doesn't
728	support the capability. A saved session gets a sidecar recording the project
729	directory it ran in — listing reports that `cwd`, the extra roots of a
730	multi-root project, an ISO 8601 last-activity timestamp, and a title taken
731	from the first user message — and a request may filter on `cwd` so one
732	project is never offered another's threads. Threads saved before this have no
733	sidecar and are not listed; they still reopen by id through `session/load`
734
735	### Changed
736
737	- The commit trailer names the siGit Code version and surface. Commits
738	siGit Code makes now end with
739	`Co-Authored-By: siGit Code v<version>-<surface> <noreply@sigit.si>` instead
740	of the bare name, where the surface is `acp` (an editor), `tui` (the
741	terminal UI), or `headless` (`sigit run`). The model changes from session to
742	session; the version and surface tell you which build of the agent wrote the
743	commit and how it was driven. GitHub still credits the co-author, since it
744	matches on the address. A commit that already carries a siGit Code trailer
745	from an older version is left alone
746
747	- The terminal UI's model knows which directory the project is in. The
748	editor (ACP) and headless paths put the working directory in the system
749	prompt, but the terminal UI only added the project's instruction files, so
750	on `/init` a small on-device model invented a `AGENTS.md` path and failed.
751	All three places the terminal UI builds a prompt now go through the same
752	session context path the ACP sessions get. The cloud tier switch had also
753	been dropping the instruction files; that's fixed too
754
755	- An empty `write_todos` list clears the plan. `write_todos` rejected an
756	empty list, so the model had no way to clear a finished checklist and the
757	last plan stayed in the editor until the session ended. An empty list now
758	returns "Task list cleared." and goes to the client as an ACP plan with no
759	entries. The tool description tells the model it can do this
760
761	- `sigit run` gives clearer usage errors. A second positional prompt says
762	"unexpected extra argument", a bare `sigit run` says "missing prompt", and a
763	mistyped flag like `--quite` is rejected instead of becoming the prompt
764
765	### Fixed
766
767	- Each ACP session keeps its own roots, conversation, and tasks. Zed runs
768	one siGit process for every open thread, but the process had a single cwd,
769	workspace root list, backend conversation, and background task table. The
770	most recent session owned all of them, so a prompt from an older thread ran
771	against another repo with another thread's history. A `SessionState` is now
772	kept per session id; before a prompt or config change runs, the live
773	conversation is parked and the requested session's cwd, extra roots, and
774	conversation are installed, rebuilding the system prompt from its roots.
775	`new`/`load`/`fork` share a single session-opening path, and fork carries the
776	source thread's conversation. Background tasks are scoped to the session that
777	started them, opening a session no longer wipes every other session's
778	permission grants, and model selection is routed per session
779
780	- New sessions no longer carry the previous thread's history. Opening a
781	new thread in Zed showed a `[Conversation summary]` from an earlier session.
782	The session handlers cleared the on-device engine but not the history a cloud
783	backend keeps for itself, and the startup routing to the cloud tier then
784	carried that history into the installed backend. A provider override had the
785	same leak. All session entry points now share a path that strips stale
786	history too, and unknown session ids are rejected instead of borrowing the
787	live thread's state
788
789	- Unparseable tool-call markup is hidden and retried, not shown as text.
790	Some models write tool calls into the reply as text. Well-formed blocks were
791	already recovered and run, but a block that failed to parse or never closed
792	was printed to the editor as-is and stayed in history, so the model later
793	read back a call it had "made" with no result and began writing invented
794	`<function_results>`. The scanner now reports those blocks as malformed; the
795	backend drops them from the reply and history, and when the only tool call
796	was malformed the model gets one retry telling it the call didn't run. A
797	block that merely mentions a tool-call marker (a backticked `<tool_call>` or an
798	unclosed XTML `<\|open\|>tools`) is now kept as prose, so a reply explaining
799	the scanner no longer loses everything after the first marker. The
800	non-streamed path now strips broken blocks beside structured calls and runs
801	any inline calls that did parse, matching the streaming path
802
803	- The co-author trailer ends a conflicted merge commit. Finishing a
804	conflicted merge with `git commit --no-edit` keeps git's `# Conflicts:` list
805	in the message, since no editor runs to strip it. When siGit Code then added
806	its trailer, the trailer went in above that list, so it was no longer the last
807	paragraph and GitHub didn't credit the co-author. The amend now drops the
808	leftover comment block and puts the trailer last. It also fixes a commit
809	that already has the trailer but still ends in that block
810
811	## 1.5.10
812
813	### What changed
814
815	- Xcode's context no longer buries slash commands. Xcode sends the user's
816	prompt as the last of several text blocks, with project context in the
817	blocks before it, so `/models` and friends sat in the middle of joined text
818	and were handed to the model instead of dispatching locally. Slash-command
819	parsing now searches the prompt's text blocks from the end, so a standalone
820	command in the final user block dispatches no matter what context the client
821	prepends
822	- The nova tier is the default cloud engine. When local inference is off
823	and no explicit provider override is set, the cloud tier now defaults to
824	`nova` (the `onde-nova` model) instead of the balanced tier, in both the
825	interactive and headless paths
826
827	### Fixed
828
829	- Malformed Chinese-model tool calls are handled end-to-end in ACP. The
830	inline-call recovery that 1.5.9 added for Kimi K3's XTML protocol and GLM's
831	mis-tagged blocks only applied to the interactive and headless surfaces;
832	the ACP path never ran it, so an editor session still surfaced raw protocol
833	text and dropped the calls. Recovery now runs in the ACP prompt loop too,
834	covered by integration tests, and the tool names are checked against the
835	turn's offered tools before anything executes
836	- Suppressed tool-call log spam is gone. The guard that logs when a
837	structured call is dropped for arriving as forced text fired once per
838	streamed argument fragment — one malformed call could log a warning per
839	chunk. The check now fires once per turn with the count and names of what
840	was dropped, and the non-streaming path reports the same
841	- A history-replay test no longer races on the process cwd. One ACP test
842	built its expected path from `std::env::current_dir()` while other tests
843	briefly swap that process-global cwd, so on CI it could read a temp
844	directory mid-swap and compare a truncated title against an untruncated
845	expectation. It now uses a fixed path it never needed to derive
846
847	## 1.5.9
848
849	### Fixed
850
851	- Kimi K3 tool calls no longer arrive as raw protocol text. Kimi K3 renders
852	a call in Moonshot's XTML protocol — pipe-delimited open/sep/close tokens
853	wrapping named blocks — and when the serving stack doesn't parse that back
854	into structured tool calls, the whole block surfaced in the editor as literal
855	text and the turn ended as though the model had answered in prose. The
856	inline-call recovery now speaks that protocol alongside the legacy XML tags:
857	tools blocks are parsed into real calls (several per block, argument values
858	decoded and typed from the block's own type attribute or, when it is
859	missing, the turn's tool schemas), response blocks are unwrapped so their
860	text still renders, and think blocks are dropped as private reasoning rather
861	than shown. The streaming scanner watches all the opening markers, so a
862	block split across chunk boundaries still recovers
863	- GLM's mis-tagged calls recover too. GLM sometimes precedes the legacy
864	block's first argument key with another tool-call opening tag instead of the
865	arg-key opening tag the format calls for, and the recovery rejected the
866	whole block when it did — the call surfaced as text and whatever it was
867	trying to do was dropped. The parser now accepts that alias for the first
868	argument only — later arguments stay strict, so text that merely resembles a
869	call cannot be recovered as one — in both the whole-blob and streaming
870	paths, and the scanner tolerates the malformed marker split across chunk
871	boundaries. Recovery in both protocols also checks the call's name against
872	the tools actually offered in the turn: a tag naming a tool that was never
873	in the turn's spec stays on screen instead of being executed
874
875	## 1.5.8
876
877	### What changed
878
879	- Editor panels can switch permission mode without a slash command. ACP
880	clients now get a Permissions selector next to the model controls with
881	Manual, Auto, and Plan choices for the current session. Manual keeps the
882	existing approval prompts, Auto lets mutating tools run unattended while
883	still respecting explicit deny rules in `settings.toml`, and Plan keeps the
884	agent in research-only mode. The selector follows `/plan` and `/clear`, and
885	it is deliberately session-scoped so a risky Auto choice does not persist
886	into the next task
887	- Tool calls in the editor are worth opening now. Zed only drew the
888	disclosure arrow on the handful of cards siGit set `content` on — the model
889	download and switch spinners — because everything else carried nothing but
890	`rawInput` and `rawOutput`, fields ACP gives clients no display guidance for.
891	Every tool call now gets a fenced content block: the pretty-printed arguments
892	while it runs, then the tool's output once it finishes, with a `(no output)`
893	placeholder for a silent command like `git add`. Cards are titled
894	`<tool> · <arg>` rather than the bare tool name, path-bearing tools set
895	`locations` so the editor can follow along, and a replayed session gets the
896	same treatment as a live one
897	- The context window is visible before compaction fires. Both model pickers
898	show each model's window, and the TUI title bar has a gauge for how much of
899	it the conversation is using. Cloud tiers report their own window instead of
900	the compaction budget — the budget is when siGit Code summarizes history, not
901	how much the model can hold, and labelling one with the other understated the
902	window by an order of magnitude
903	- `write_todos` renders as a plan, not a tool card. Zed and other clients
904	have real progress UI for `session/update` plans, so the model's todo list
905	goes there
906	- Picker changes read as status rather than chat. Switching model or
907	inference backend is UI state, so it renders as a completed think-kind tool
908	call. The sign-in prompt stays an assistant message, since it needs the user
909	to act on it
910
911	### Fixed
912
913	- A reopened thread comes back with its history. Clicking a saved thread in
914	Zed sends `session/load`, and the client draws the thread purely from the
915	`session/update` notifications the agent streams while that request is in
916	flight. siGit restored the saved history into the backend, which is what
917	makes the model remember, but sent the client nothing — so the thread opened
918	empty and looked like a brand new conversation. The snapshot is now turned
919	into updates before it is restored: user and assistant text as message chunks
920	with reasoning stripped, each tool call completed with its result folded in,
921	and `write_todos` as a plan the way it renders live. System messages stay
922	out, since they seeded the model and were never on screen
923	- Compaction no longer fails in every session that ran a tool.
924	`compact_history` asked for the summary through `complete(None, None)`, which
925	sends no tools array but left the live history in place. That history is
926	thick with assistant `tool_calls` and `role: "tool"` messages, and an
927	endpoint handed tool shapes with no schema to check them against rejects the
928	request — Anthropic answers 400. So compaction failed on every attempt in any
929	session that had run a single tool, however small the history was, and then
930	retried on every prompt and tool round while that history kept growing. The
931	conversation now goes as a flattened transcript in one user message, which
932	keeps what the summary needs and drops the shapes that only mean anything
933	next to a tool schema
934	- A tool call emitted as text is no longer dropped. Qwen 3, GLM and
935	DeepSeek write a call as `<tool_call>NAME<arg_key>…` in their chat template
936	and rely on the serving stack to parse it back into `tool_calls`. When that
937	doesn't happen the tag arrives as ordinary content, so it was rendered
938	verbatim in the editor and the turn ended as though the model had chosen to
939	answer in prose. Both the streaming and non-streaming paths now scan content
940	for those blocks and turn well-formed ones back into real calls, typing
941	argument values from the turn's own tool schemas. The streaming scanner holds
942	back only enough text to catch a tag straddling a chunk boundary, so ordinary
943	answers still stream token by token. A block that doesn't match the expected
944	shape is left in the text untouched: reissuing a `run_command` is cheap, but
945	guessing wrong at a half-parsed `edit_file` would write the wrong change to a
946	file
947	- Tool-call content survives awkward output. Whitespace-only output is
948	preserved rather than collapsed, malformed arguments no longer get a
949	misleading JSON fence, and fence language identifiers are sanitized
950
951	## 1.5.7
952
953	### What changed
954
955	- `@smbcloud/sigit` gets releases again. The npm scope moved to
956	`@getsigit` in 1.5.5 and the old package was left sitting on the registry at
957	1.5.2, so an install made before the rename went quiet — `npm update` had
958	nothing to give it and nothing said why. All seven packages now publish under
959	both scopes from the same build, so `@smbcloud/sigit` is a full install again
960	rather than a stub, with its own platform binaries and no dependency on the
961	new scope. It prints a line on stderr saying where the package moved to;
962	`SIGIT_SUPPRESS_SCOPE_NOTICE=1` turns that off. This is a migration path, not
963	a second home: `@getsigit/sigit` is what the docs, the Homebrew tap, and the
964	ACP registry entry point at, and it is the name to move to
965	- Multi-root projects now work in the editor. When a client opens several
966	directories in one project, ACP sends the extra ones as
967	`additionalDirectories` — but only to an agent that says it wants them, which
968	siGit never did, so Zed kept the first root and showed a banner saying
969	multi-root workspaces were unsupported. The capability is now advertised at
970	`initialize`, and the directories that arrive are no longer logged and thrown
971	away. All the roots are now part of the session: the model is told about each
972	one, every root's `AGENTS.md` / `CLAUDE.md` is loaded, and skills, slash
973	commands, and subagent types are discovered from all of them (primary root
974	first, so it still wins name collisions). `/status` lists the roots when
975	there is more than one, and headless runs take the same thing as repeatable
976	`--add-dir <dir>` flags. MCP servers are the exception: discovery happens
977	once at startup, before a session exists, so a second root's `.sigit/mcp.toml`
978	is not picked up
979
980	### Fixed
981
982	- A shell command can no longer wedge the editor session. Tool commands
983	inherited siGit's own stdin, which in ACP mode is the JSON-RPC pipe from the
984	editor. A command that read stdin — a signing passphrase prompt, a pager, a
985	`git` credential ask — blocked on it and consumed the client's next request
986	out of the pipe, so nothing typed afterwards ever reached the agent and the
987	session stayed dead past the command timeout. Commands, hooks, and the
988	co-author `git` helpers now run with stdin closed, so a command that wants
989	input gets EOF and reports an error instead
990	- A command that prints a lot no longer stalls for two minutes.
991	`run_command` waited for the command to exit before reading its output, so
992	anything past the pipe buffer (a build, a verbose test run) blocked writing
993	while siGit blocked waiting, until the 120-second timeout killed it. Output
994	is now drained while the command runs
995	- The command timeout now stops the whole command. It killed only the
996	shell, leaving anything that shell had started running and unreaped; it now
997	kills the process group
998	- A refused turn now shows the endpoint's own message. siGit pasted the
999	status line and the raw JSON body into the editor's error banner, so a
1000	billing or allowance message arrived wrapped in
1001	`endpoint returned 429 Too Many Requests: {"error":{"message":…`. The message
1002	the endpoint wrote is what the banner shows now; the status is only used when
1003	there is no message to show
1004	- An error that arrives mid-stream is no longer silent. An endpoint that
1005	fails after the response is already open reports it as a frame in the stream.
1006	That frame carries no `choices`, so siGit parsed it as an empty chunk and
1007	skipped it, and the turn ended as though the model had answered with nothing
1008
1009	## 1.5.6
1010
1011	### What changed
1012
1013	- Switching models mid-conversation no longer restarts it. Both switching
1014	to a local GGUF model and picking a different cloud tier now carry the live
1015	conversation history across, repairing any half-finished tool call so
1016	strict OpenAI-compatible endpoints don't reject the session
1017	- Long-running tools now show progress in ACP clients. Synchronous tools
1018	(shell commands, file operations, `read_website`, ...) run on a blocking
1019	thread pool instead of the ACP connection's own task, so a slow command's
1020	`in_progress` update reaches the client — and Zed's spinner — while the
1021	command is still running instead of arriving with the result
1022	- Text from consecutive tool rounds no longer runs together. ACP and
1023	headless clients concatenate consecutive message chunks, so a reply that
1024	continued after a tool call used to glue onto the previous round's last
1025	sentence with no space. A blank line now opens the next round's text
1026	- New onde-cloud model tiers. The model picker (`/models` in the TUI, the
1027	config panel in editors) now offers five additional siGit Code Cloud tiers —
1028	`flux`, `apex`, `aura`, `orbit`, and `nova` — alongside the existing Fast,
1029	Balanced, Large, Mini, Air, Pro, and KKK options. The tier list mirrors
1030	onde-cloud's router catalogue, so all three sides (the picker, the router,
1031	and the cloud catalogue) have to be updated together when a tier is added
1032	- MCP Registry listing moved to `getsigit/si`. The `server.json` manifest
1033	and its `release-mcp-registry.yml` publish workflow now live in the
1034	[`getsigit/si`](https://github.com/getsigit/si) repo alongside the si CLI's
1035	other code, since the registry entry describes the si platform rather than
1036	the coding agent
1037
1038	## 1.5.5
1039
1040	A distribution release. siGit Code itself is unchanged. What moved is how it
1041	reaches you on npm and on Windows.
1042
1043	### What changed
1044
1045	- The npm package is now `@getsigit/sigit`. The six platform packages moved
1046	with it. `@smbcloud/sigit` stays on the registry but stops receiving updates,
1047	so upgrading means switching names:
1048	`npm uninstall -g @smbcloud/sigit && npm install -g @getsigit/sigit`. The old
1049	package had been stuck at 1.5.2, so this picks up 1.5.3 and 1.5.4 as well.
1050	- npm publishes over OIDC. Every `@getsigit/*` package has a trusted
1051	publisher pointing at the release workflow, so no npm token is stored in the
1052	repository. The release workflow moves to Node 22, which trusted publishing
1053	requires.
1054	- winget releases actually go out. The workflow could only update a package
1055	already present in `microsoft/winget-pkgs`, and siGit Code had never been
1056	submitted there, so every dispatch failed. It now submits the package the
1057	first time and updates it on later releases. The identifier is
1058	`getSigit.siGitCode`.
1059
1060	## 1.5.4
1061
1062	- CI: nfpm config expanded to include package version and binary path
1063
1064	## 1.5.3
1065
1066	Adds browser-based sign-in, expands distribution channels to Windows (winget,
1067	Scoop), Linux (AUR, deb, rpm), and .NET (NuGet), gives ACP clients live
1068	visibility into tool activity, adds the KKK and Moonshot AI cloud tiers, and
1069	fixes the co-authored-by trailer email.
1070
1071	### What changed
1072
1073	- Browser sign-in: `sigit login` now opens a browser OAuth flow (PKCE S256
1074	against the siGit Code Cloud authorization server) so you can sign in without
1075	a password. A loopback listener catches the redirect automatically; a
1076	paste-back fallback handles environments where a loopback isn't reachable.
1077	`--paste` forces the paste path, `--password` keeps the old email/password
1078	prompt. Zed's "Sign in to siGit Code" button uses the loopback path via ACP
1079	`authenticate`
1080	- New release channels: siGit Code is now published to winget
1081	(`getsigit.siGitCode`), Scoop (`getsigit/scoop-bucket`), the AUR
1082	(`sigit-bin`), and as `.deb`/`.rpm` packages alongside the existing
1083	Homebrew, npm, PyPI, crates.io, and NuGet channels
1084	- NuGet .NET tool: `dotnet tool install --global SiGit.Code` now works on
1085	Windows, macOS, and Linux — the package bundles all six platform binaries and
1086	a managed shim that execs the right one, leaving stdin/stdout/stderr
1087	unredirected so TUI vs ACP mode detection still works
1088	- New cloud tiers: the model picker (`/models` in the TUI, the config
1089	panel in Zed) now offers the `onde-kkk` (KKK) and Moonshot AI (`oke`) tiers
1090	alongside the existing Fast, Balanced, Large, Mini, Air, and Pro options
1091	- ACP tool visibility: the agent loop now emits `ToolCall(InProgress)`
1092	before each tool runs and `ToolCallUpdate(Completed/Failed)` after it
1093	returns, so clients like Zed gain live visibility into tool activity between
1094	inference rounds. `tool_choice: "auto"` is also sent explicitly whenever
1095	tools are present, fixing models that describe actions in prose rather than
1096	issuing a tool call when the field is absent
1097	- Malformed tool argument logging: invalid tool argument JSON is now logged
1098	at three sites (TUI pretty-printer, ACP tool-call event, permission request)
1099	instead of silently falling back to a string value, making malformed payloads
1100	visible in logs while preserving backward-compatible behaviour
1101	- Co-authored-by trailer fix: the `Co-Authored-By` trailer email was
1102	updated to `noreply@sigit.si` (platform-neutral); the commit attribution
1103	check was tightened to use idiomatic ownership
1104	- NuGet trusted publishing: the NuGet release workflow now exchanges a
1105	GitHub OIDC token for a short-lived NuGet API key (via `NuGet/login`) instead
1106	of relying on a long-lived `NUGET_API_KEY` secret, so there is no stored
1107	credential to rotate or leak
1108	- AUR dispatch temporarily disabled: the AUR release workflow is no longer
1109	dispatched from `release-github` while new AUR account registration is
1110	closed; the `sigit-bin` channel returns once registration reopens
1111	- Legal and branding copy updated
1112
1113	## 1.5.2
1114
1115	Brings the latest siGit Code Cloud tiers to the picker and aligns the MCP
1116	registry metadata with the server release.
1117
1118	### What changed
1119
1120	- `/models` now lists the Pro, Air, and Mini siGit Code Cloud tiers alongside
1121	Fast, Balanced, and Large
1122	- Updated the MCP registry manifest to version 1.2.5, matching the siGit Code
1123	Cloud server release
1124	- Updated the Agent Client Protocol SDK to the latest v1 release
1125
1126	## 1.5.1
1127
1128	Makes siGit Code work as an Xcode custom agent, and updates the Onde SDK.
1129
1130	### What changed
1131
1132	- Xcode can now run siGit Code as a custom agent. Point it at the binary with
1133	`--acp` as the argument, and that explicit mode loads the selected on-device
1134	model on the first prompt, since Xcode's chat has no equivalent of `/load`.
1135	The README covers the setup, including wiring up `xcrun mcpbridge` in
1136	`mcp.toml` so the agent can use Xcode's build, test, and project tools
1137	- MCP calls to the `xcode` server time out after 30 seconds instead of 120, so
1138	a request Xcode cannot service no longer leaves the prompt looking busy for
1139	two minutes. String JSON-RPC ids from the bridge are handled too
1140	- The agent stops repeating itself: a tool call made three times with identical
1141	arguments now forces a text reply instead of looping
1142	- Onde SDK bumped to 1.2.2
1143	- The registry listing in `server.json` matches what sigit.si publishes
1144
1145	## 1.5.0
1146
1147	Opens the agent up to user extension: lifecycle hooks, custom slash commands,
1148	and configurable subagent types. Also adds web search, a Repo tab in the TUI,
1149	and a baked-in smbCloud MCP server.
1150
1151	### What changed
1152
1153	- Hooks let you run shell commands at three points in the agent's lifecycle:
1154	`session_start`, `pre_tool_use`, and `post_tool_use`, configured under
1155	`[hooks]` in `settings.toml`. Commands get context through variable
1156	substitution (`{cwd}`, `{tool_name}`, `{tool_result_len}`) and run in the
1157	session working directory. A hook that fails is logged and the session
1158	continues; a hook that hangs is killed on a timeout, along with its whole
1159	process group
1160	- User-defined slash commands: drop a Markdown file in `.sigit/commands/` or
1161	`.claude/commands/` (or the personal `$SIGIT_CONFIG_DIR/commands/` and
1162	`~/.claude/commands/`) with optional `description` and `argument-hint`
1163	frontmatter, and the body becomes a prompt template. `$ARGUMENTS` takes the
1164	whole argument string and `$1`..`$9` the positional words. A subdirectory
1165	namespaces the command with `:`, so `.sigit/commands/git/commit.md` becomes
1166	`/git:commit`. They run as ordinary agent turns through the usual tools and
1167	permission checks, and are advertised to ACP clients like Zed. `/commands`
1168	lists what was discovered
1169	- Configurable subagent types for the `task` tool: a Markdown file in
1170	`.sigit/agents/` or `.claude/agents/` with `name`, `description`, and an
1171	optional `tools:` allow-list, whose body becomes that subagent's system
1172	prompt. Pass its name as `subagent_type` to swap the prompt in. The
1173	`tools:` list can only narrow the subagent's read-only ceiling, never widen
1174	it, so a config file cannot grant itself `edit_file` or `run_command` and
1175	route around the permission system. `/agents` lists the discovered types
1176	- New `web_search` tool, backed by the Brave-Search-backed search on siGit
1177	Code Cloud's MCP server. It is offered only when you are signed in, and it
1178	is classified read-only, so searching never triggers a permission prompt
1179	- The TUI gains a Repo tab, shown when the session's `origin` remote points at
1180	the sigit.si host. It lists issues and pull requests fetched through the
1181	official MCP server: Up and Down select, Enter opens a scrollable detail,
1182	`i`, `p`, Left and Right switch sections, `r` refreshes. The tab is hidden
1183	and skipped in the cycle for any other remote
1184	- The smbCloud CLI's stdio MCP server (`smb --mcp`) is now baked in, so
1185	smbCloud project and deployment tools work with no `mcp.toml` setup. It is
1186	added only when the `smb` binary is on `PATH`, its read-only tools (`me`,
1187	`deployments`, `project_list`, `project_show`) skip permission prompts, and
1188	you can opt out with `smbcloud = false` in `mcp.toml` or
1189	`SIGIT_MCP_SMBCLOUD=off`
1190	- siGit Code Cloud's MCP server is now listed in the public MCP Registry as
1191	`si.sigit/sigit`, published from `server.json` at the repository root
1192
1193	### Fixes
1194
1195	- An explicit `deny` rule now applies to read-only first-party tools instead
1196	of being skipped
1197	- A subagent type whose `tools:` list resolves to an empty set is rejected
1198	rather than producing a subagent with no tools
1199	- Command templates render in a single substitution pass, so an argument that
1200	contains something like `$1` is no longer re-substituted
1201	- Frontmatter is stripped with the same leniency it is parsed with
1202	- The Repo tab's detail view no longer shows stale data after a refresh
1203
1204	## 1.4.1
1205
1206	Two small fixes: correct co-author attribution and a Homebrew tap fix.
1207
1208	### What changed
1209
1210	- The `Co-Authored-By` trailer siGit Code adds to commits now uses the GitHub
1211	noreply address for the [sigitc](https://github.com/sigitc) account instead
1212	of `sigit@sigit.si`, so GitHub reliably attributes co-authored commits to
1213	the siGit Code profile
1214	- Fixed the Homebrew tap install docs to trust the tap with `brew trust`
1215	instead of a `brew tap --force` flag
1216
1217	## 1.4.0
1218
1219	Adds a headless one-shot mode, fine-grained permission rules, stdio transport
1220	for MCP servers, an `/init` command, and a set of TUI upgrades: tabs, a live
1221	thinking display, and collapsible tool calls.
1222
1223	### What changed
1224
1225	- New headless mode: `sigit -p "prompt"` runs one agent turn with tools and exits — 0 on a completed turn, 1 on inference errors, 2 on bad invocations. Assistant text streams to stdout while logs and tool progress stay on stderr; `--cwd` sets the working directory and `--quiet` prints only the final message. Nobody can answer a permission prompt in a headless run, so `ask` collapses to a denial: grant tools for the run with `--allow-tool`, block them with `--deny-tool`, or use `SIGIT_PERMISSIONS=allow`
1226	- Permission rules make autonomy granular: `[permissions.rules]` in `settings.toml` holds ordered `allow` and `deny` lists of `tool_name(pattern)` entries, e.g. `run_command(git )` or `edit_file(src/)`. Patterns match the command string for `run_command` and the path for file tools; deny always beats allow, and unparseable patterns fail closed, so a bad rule can only narrow access. Always-allow on a `run_command` prompt now grants that command family (its first two tokens), not the whole shell
1227	- The MCP client speaks stdio: `mcp.toml` server entries can give a `command`, `args`, and an `env` map instead of a `url`, so the stdio-first majority of published MCP servers plugs in. Same handshake, timeouts, tool namespacing, and output caps as HTTP; `/mcp` shows the command line for stdio servers
1228	- New `/init` command (TUI and ACP): runs a normal agent turn that explores the repository and writes an `AGENTS.md` — or improves an existing `AGENTS.md`/`CLAUDE.md` in place — going through the ordinary tools and permission checks
1229	- The TUI gains tabs, cycled with the Tab key: Session is the chat, History lists saved sessions (restore with Enter, delete with a confirmed double-`d`, refresh with `r`), and Cloud shows the signed-in account, inference mode, current model and engine state, permission policy, and config dir, with a live Local Inference toggle
1230	- The TUI shows model thinking: while a reply streams, the last three lines of the reasoning appear live under the spinner, dim and italic; finished replies collapse to a one-line indicator with the line count, and `/thinking` expands the full reasoning block above each reply. Display only — nothing changes in what is sent to the model, saved to sessions, or streamed over ACP
1231	- Tool calls in the TUI transcript collapse to single dim title lines (the command for `run_command`, the path for file tools, the pattern for search and glob); `/tools` expands every entry to show the pretty-printed arguments and a capped tail of the result. Permission prompts keep showing the full command, and the model still receives full outputs
1232	- When `AGENTS.md` and `CLAUDE.md` sit in the same directory, the instructions loader now prefers `AGENTS.md`, so shared content is injected once
1233
1234	## 1.3.2
1235
1236	Adds a tool permission system with plan mode, durable sessions with context
1237	compaction, background command execution, a subagent research tool, and commit
1238	co-author attribution.
1239
1240	### What changed
1241
1242	- Every tool call now passes a permission policy before executing. Read-only tools always run; mutating tools (and all MCP or unknown tools) are governed by, in order: plan mode, session grants, per-tool overrides, and a default mode from `[permissions]` in `settings.toml` (`allow`/`ask`/`deny`, default `ask`). On `ask`, editors get a native ACP permission dialog (allow once / allow for this session / deny) and the TUI pauses on a y/a/n prompt showing the tool and its arguments. `SIGIT_PERMISSIONS` overrides the default mode for headless runs and clients without permission support
1243	- New `/plan [on\|off]` command: plan mode blocks mutating tools and asks the model to present a plan while research tools keep working. `/permissions` prints the effective policy
1244	- Sessions are durable: conversation history is saved per session under `~/.config/sigit/sessions/` after every turn. ACP `session/load` actually restores it, the TUI gets `/resume`, and `/clear` deletes the saved file
1245	- Context compaction: `/compact` compresses the conversation on demand, and the agent compacts automatically once the history approaches a 24k-token budget, summarizing older turns and keeping the recent ones. The tool-round cap rises from 10 to 24 now that long sessions have a defense other than the cap
1246	- `run_command` can run work in the background: pass `run_in_background` and the tool returns a task id immediately, so builds, test suites, and dev servers are no longer killed by the 120 second foreground timeout. Poll with the new `command_output` tool (read-only, never prompts) and stop with `kill_command`
1247	- New `task` tool: delegate research to a fresh subagent conversation that only gets the read-only tools and returns its final answer, keeping the main context small. Available on OpenAI-compatible backends; on-device returns a clear fallback until onde supports a second context
1248	- Commits created by the agent are co-authored: commit messages end with `Co-Authored-By: siGit Code <sigit@sigit.si>` (the [sigitc](https://github.com/sigitc) account), which GitHub renders next to the human author. If the model forgets the trailer, siGit amends it in, never rewriting commits that already exist on a remote
1249	- ACP mode now honors the `OPENAI_BASE_URL`/`OPENAI_API_KEY` provider override at startup, matching the interactive client
1250
1251	## 1.3.1
1252
1253	Adds [Model Context Protocol](https://modelcontextprotocol.io) (MCP) client
1254	support with the official siGit Code MCP server baked in, a set of agent tools
1255	that close parity gaps in the tool layer, and refreshed branding and licensing.
1256
1257	### What changed
1258
1259	- siGit Code is now an MCP client: it connects to MCP servers over the Streamable HTTP transport (a single JSON-RPC endpoint), discovers the tools they expose, and offers them to the model alongside the built-in tools. When the model calls one, the call is forwarded to the owning server and the result fed back into the agent loop
1260	- Bakes in the official siGit Code MCP server at `https://sigit.si/api/v1/mcp` (follows `SIGIT_CLOUD_URL`). When you are signed in (`sigit login`), the cloud session token is sent as the bearer credential
1261	- Configure additional servers in `mcp.toml` — global (`~/.config/sigit/mcp.toml`) or project-local (`.sigit/mcp.toml`). Each `[[server]]` has a `name`, `url`, optional `enabled`, and optional `[server.headers]`; set `official = false` to opt out of the baked-in server
1262	- MCP tools are namespaced `mcp__<server>__<tool>` so they never collide with built-in tools or across servers; tool output is capped to protect the model's context
1263	- Discovery is best-effort at startup and bounded by a per-server timeout, so an unreachable server never blocks startup — it just contributes no tools
1264	- Added a `/mcp` slash command (TUI and ACP) that lists configured servers, their connection status, and the tools each exposes
1265	- Disable MCP entirely with `SIGIT_MCP=off`, or just the official server with `SIGIT_MCP_OFFICIAL=off`
1266	- New agent tools that close parity gaps in the tool layer: `multi_edit` (apply a batch of exact-substring edits to one file atomically — written only if every edit matches), `glob` (locate files by name pattern with `*`/``/`?`/`{a,b}`, most-recently-modified first), `write_todos` (render a live task checklist through the tool result for multi-step work), and `remember` (append durable notes to the nearest `AGENTS.md`/`CLAUDE.md`)
1267	- `edit_file` now supports `replace_all` and returns actionable failure context — naming the line whose trimmed text matches when only whitespace differs — so the model self-corrects in one round
1268	- `search_files` gained a `file_glob` filter and a `max_results` cap (default 50, hard-capped at 1000) that also bounds the directory walk
1269	- Refreshed branding and legal: updated `LICENSE`, `README`, and the npm/PyPI package descriptions
1270
1271	## 1.3.0
1272
1273	Adds a Local Inference on/off toggle, the open [Agent Skills](https://agentskills.io)
1274	format, and support for project instruction files (`AGENTS.md` and the like).
1275
1276	### What changed
1277
1278	- Added a Local Inference on/off setting that is the explicit local-vs-cloud mode switch. It is persisted in `~/.config/sigit/settings.toml` (default on, local-first) and can be overridden with `SIGIT_LOCAL_INFERENCE`
1279	- Toggle it with the `/local [on\|off]` command (TUI and ACP); ACP clients without slash-command support get an equivalent "Local Inference" On/Off control in the session config panel
1280	- `/models` now groups models by nature — Local vs siGit Code Cloud — and highlights the active mode's group while still showing the other, so the cloud tiers stay discoverable
1281	- Discovers Agent Skills (folders with a `SKILL.md`) from `.sigit/skills/` and `.claude/skills/` in the project, `~/.config/sigit/skills/`, and `~/.claude/skills/`
1282	- Follows the spec's progressive disclosure: each skill's name and description are advertised up front via a new `skill` tool, and the full instructions load only when the agent activates one
1283	- Added a `/skills` slash command (TUI and ACP) that lists the discovered skills
1284	- Reads project instruction files at session start: `AGENTS.md` (the cross-tool standard) and `CLAUDE.md`, walking from the working directory up to the repository root, plus a global file under `~/.config/sigit/`, and injects them into the session's system context so their guidance is always in force
1285	- Nested instruction files are ordered outermost-first so the closest, most specific file takes precedence; the scan never reads above the repository root
1286	- On-device models are no longer loaded implicitly. The chat UI and ACP sessions come up immediately, and the local model is brought into memory only when you run the `/load` command (or pick one in `/models`). Prompts sent before a model is loaded now return a hint instead of blocking on a multi-minute download.
1287
1288	## 1.2.2
1289
1290	Streams assistant tokens as they arrive, on-device and over the cloud.
1291
1292	### What changed
1293
1294	- Streamed assistant tokens live in the TUI and ACP sessions, both on-device and through siGit Code Cloud
1295	- On-device inference streams only when a turn offers no tools, since `onde` can't stream and detect tool calls in the same pass; tool-capable turns still resolve in one shot
1296	- Fixed the TUI so the latest message stays visible in long chats
1297	- Put the cloud model-switch confirmation on its own line in ACP
1298
1299	## 1.2.1
1300
1301	Stabilizes the Zed/ACP integration and finishes the cloud-tier wiring on top of 1.2.0.
1302
1303	### What changed
1304
1305	- Fixed a Zed crash by keeping model-picker labels ASCII in the ACP model selector
1306	- Wired ACP auth, cloud tiers, and slash commands into the Zed panel, including a `/reload` command to re-sync session state in place
1307	- Fixed the TUI so the loaded-model checkmark appears once a download completes
1308	- Synced bundled agent skills with the current code and added `CLAUDE.md`
1309
1310	## 1.2.0
1311
1312	Adds siGit Code Cloud — a hosted inference tier alongside on-device models.
1313
1314	### What changed
1315
1316	- Added siGit Code Cloud with cloud-tier routing, pointed at `sigit.si`
1317	- Added account management slash commands and surfaced cloud tiers in `/models`
1318	- Carried forward from 1.1.0: ACP SDK v0.13, refreshed dependencies and branding
1319
1320	## 1.1.0
1321
1322	Bumps the ACP SDK to v0.13 and pulls in updated dependencies.
1323
1324	### What changed
1325
1326	- Updated `agent-client-protocol` from v0.11 to v0.13
1327	- Updated `onde` to 1.1.2
1328	- Refreshed branding and skill metadata
1329
1330	## 1.0.4
1331
1332	This release tightens up the terminal experience and finishes a few release-facing cleanup items.
1333
1334	### What changed
1335
1336	- Added bold rich-text rendering in the TUI for assistant replies, so `text` now displays with terminal styling instead of raw markdown markers
1337	- Refreshed the bundled skill metadata to follow the current Agent Skills `SKILL.md` format
1338	- Synced the crate release metadata for the `1.0.4` cut
1339
1340	## 1.0.3
1341
1342	This is the cleanup release for the editor-side startup problems.
1343
1344	### What changed
1345
1346	- Fixed ACP sessions failing on the first real prompt because the server claimed the model was ready before anything had actually been loaded
1347	- Changed ACP startup so the default model loads lazily on the first non-slash prompt instead of pretending it is already in memory
1348	- Kept `initialize` and `session/new` lightweight while still sending proper progress updates once model loading begins
1349	- Updated the Onde integration to `1.0.0`
1350	- Removed a few dependencies we were no longer using
1351
1352	## 1.0.2
1353
1354	This release was supposed to fix the ACP auth breakage. It did fix the stdout pollution problem, but it turned out not to be the whole story.
1355
1356	### What changed
1357
1358	- Delayed model loading in ACP mode so startup diagnostics would not leak into protocol stdout during the auth handshake
1359	- Tightened up the ACP startup path for editor integrations
1360	- Refreshed some README wording while cutting `1.0.2`
1361
1362	## 1.0.1
1363
1364	The first patch after `1.0.0` was mostly about making model loading and model switching feel less opaque.
1365
1366	### What changed
1367
1368	- Added ToolCall-based progress UI for startup model loading and downloading
1369	- Improved model-switch progress reporting in ACP clients
1370	- Fixed model-load error handling so failed switches did not leave the UI in a weird state
1371	- Cleaned up a few status messages and docs while the release was going out
1372
1373	## 1.0.0 (2026)
1374
1375	siGit Code has been living in real smbCloud repos for a while now. At some point it stopped feeling like an experiment, so we called it 1.0.
1376
1377	### What this release is
1378
1379	siGit Code is a local coding agent. It runs a quantized model on your machine, talks to editors over ACP, and can read files, run commands, fetch web pages, and write code without sending your project to a hosted API.
1380
1381	You can install it with Cargo, pip, npm, or Homebrew and use it like any other tool on your machine.
1382
1383	### What shipped in 1.0
1384
1385	#### Editor integration
1386
1387	This is the core of the project.
1388
1389	Zed and VS Code can talk to siGit Code over ACP. Multi-turn sessions work. Tool calling works. Session forking works. Working-directory context works. That was the original goal, and it feels solid now.
1390
1391	#### Terminal UI
1392
1393	The terminal UI started as a side quest and turned out to be useful. You get a full-screen ratatui chat, streaming tokens, a spinner while the model is busy, and a model picker you can open in the middle of a session.
1394
1395	It runs on macOS and Linux. Windows gets ACP and editor mode for now. The Windows terminal UI is still unfinished.
1396
1397	#### Tool calling
1398
1399	This is the part that makes siGit Code feel like an agent instead of a chat box. The loop can run up to 10 rounds per message.
1400
1401	Available tools:
1402
1403	- `read_file` / `write_file` / `delete_file`
1404	- `list_directory` / `search_files`
1405	- `run_command`, with an optional working directory
1406	- `read_website`, which fetches a URL and strips it down to readable text
1407
1408	The model can call a tool, inspect the result, and keep going until it has a real answer.
1409
1410	#### Model support
1411
1412	The model list ended up wider than we expected for 1.0:
1413
1414	- Qwen 3 1.7B, 4B, 8B, and 14B
1415	- Qwen 2.5 1.5B and 3B
1416	- Qwen 2.5 Coder 1.5B, 3B, and 7B
1417	- DeepSeek Coder 6.7B
1418
1419	They are all GGUF models and they all come from Hugging Face on first run.
1420
1421	Qwen 3 is the interesting one. It uses extended thinking mode. The model reasons inside `<think>...</think>` blocks before answering. The TUI strips those blocks out and renders them dimmed above the reply, so you can see what happened without turning the whole conversation into noise.
1422
1423	The 8B model is the desktop default. Mobile stays on 1.7B because iOS gives apps roughly 2 to 3 GB of memory, and we learned the hard way that 3B can blow up on an iPhone 16e.
1424
1425	#### Model picker
1426
1427	The model picker shows:
1428
1429	- what is already cached locally
1430	- what can be downloaded
1431	- which models support tool calling
1432	- whether the local cache looks healthy
1433
1434	You can open it with `/models` in the TUI or through the editor config option. Switching models happens in the background and the UI stays alive while the download or load is in progress.
1435
1436	#### smbCloud context
1437
1438	siGit Code knows smbCloud repos better than a generic coding assistant does. It understands the difference between platform-user flows and tenant-app auth flows, how `Project`, `FrontendApp`, `AuthApp`, and GresIQ fit together, and why Next.js SSR deploys are not the same thing as the generic git-push path.
1439
1440	Outside smbCloud, it backs off and behaves like a normal coding agent.
1441
1442	#### Distribution
1443
1444	Distribution took an unreasonable amount of time, honestly.
1445
1446	There are prebuilt binaries for macOS, Linux, and Windows on both arm64 and x64 where relevant, plus install paths through Cargo, PyPI, npm, and Homebrew:
1447
1448	- `cargo install sigit`
1449	- `pip install sigit-code`
1450	- `npm install -g @smbcloud/sigit`
1451	- `brew install sigit`
1452
1453	Getting that whole pipeline to behave across CI, crates.io, PyPI, npm, and Homebrew was basically its own project.
1454
1455	### What still does not work
1456
1457	The Windows terminal UI is still missing.
1458
1459	ACP and editor mode work on Windows. The part that is still missing is the interactive full-screen terminal UI. The blocker is Unix-specific terminal handling that has not been abstracted cleanly yet.
1460
1461	### Changes since 0.1.2
1462
1463	- Added Qwen 3 14B support
1464	- Added Qwen 3 `<think>` block parsing and separate rendering in the TUI
1465	- Moved all TUI code into `#[cfg(unix)]`, which fixed a pile of dead-code errors on Windows CI
1466	- Added live download progress during model switches, including cancellation with Ctrl+C
1467	- Added model download and loading progress in the Zed agent config panel
1468	- Added an animated spinner during model switching
1469	- Added Qwen 2.5 Coder 7B
1470	- Added downloadable models to the picker, not just locally cached ones
1471	- Made model selection persist across restarts
1472	- Added session working-directory support
1473	- Moved model picker logic into a platform-independent module so Windows can compile without the TUI
1474	- Added the `/models N` shortcut for picking a model by number
1475	- Added the `read_website` tool
1476	- Improved `read_file` handling and empty-reply detection
1477	- Added async tool execution
1478	- Fixed CI cross-compilation for macOS, iOS, Linux, and Windows
1479	- Added npm, PyPI, and Homebrew distribution
1480
1481	---
1482
1483	© 2026 [siGit Code & Deploy](https://sigit.si). See [NOTICE](NOTICE) for the rights holder and distributor.