claude/linked-issue-acp-tui-u4vvpa
claude/github-issue-40-0au5ua
claude/linked-issue-acp-tui-u4vvpa
claude/minor-release-cut-vkugow
claude/sigit-acp-local-chat-cx6380
claude/sigit-cloud-agent-expansion-reox0a
claude/tool-permission-system
claude/zen-feynman-0u78dk
development
feature/acp-cancel-request
feature/acp-session-list-cursor
feature/acp-v1-conformance
feature/agent-tools-multiedit-glob-todos-remember
feature/cargo-workspace
feature/hooks
feature/load-local-model-explicitly
feature/sigit-agent-profile
feature/sigit-code-cloud
feature/xcode-mcp-server
fix/acp-replay-loaded-session-history
fix/acp-replay-reasoning-and-attachments
fix/dsml-doubled-bar-markers
main
release/v1.5.10
release/v1.5.6
release/v1.6.1
| 1 | # Changelog |
| 2 | |
| 3 | ## Unreleased |
| 4 | |
| 5 | ### Added |
| 6 | |
| 7 | - **Saved threads can be imported into the editor.** siGit Code now advertises |
| 8 | ACP's `sessionCapabilities.list` and answers `session/list`, so Zed's "Import |
| 9 | Threads" picker offers the conversations stored under |
| 10 | `~/.config/sigit/sessions/` instead of reporting that the agent doesn't |
| 11 | support the capability. A saved session gets a sidecar recording the project |
| 12 | directory it ran in — listing reports that `cwd`, the extra roots of a |
| 13 | multi-root project, an ISO 8601 last-activity timestamp, and a title taken |
| 14 | from the first user message — and a request may filter on `cwd` so one |
| 15 | project is never offered another's threads. Threads saved before this have no |
| 16 | sidecar and are not listed; they still reopen by id through `session/load` |
| 17 | |
| 18 | ### Changed |
| 19 | |
| 20 | - **The commit trailer names the siGit Code version and surface.** Commits |
| 21 | siGit Code makes now end with |
| 22 | `Co-Authored-By: siGit Code v<version>-<surface> <noreply@sigit.si>` instead |
| 23 | of the bare name, where the surface is `acp` (an editor), `tui` (the |
| 24 | terminal UI), or `headless` (`sigit run`). The model changes from session to |
| 25 | session; the version and surface tell you which build of the agent wrote the |
| 26 | commit and how it was driven. GitHub still |
| 27 | credits the co-author, since it matches on the address. A commit that |
| 28 | already carries a siGit Code trailer from an older version is left alone. |
| 29 | |
| 30 | |
| 31 | ## 1.5.10 |
| 32 | |
| 33 | ### What changed |
| 34 | |
| 35 | - **Xcode's context no longer buries slash commands.** Xcode sends the user's |
| 36 | prompt as the last of several text blocks, with project context in the |
| 37 | blocks before it, so `/models` and friends sat in the middle of joined text |
| 38 | and were handed to the model instead of dispatching locally. Slash-command |
| 39 | parsing now searches the prompt's text blocks from the end, so a standalone |
| 40 | command in the final user block dispatches no matter what context the client |
| 41 | prepends |
| 42 | - **The nova tier is the default cloud engine.** When local inference is off |
| 43 | and no explicit provider override is set, the cloud tier now defaults to |
| 44 | `nova` (the `onde-nova` model) instead of the balanced tier, in both the |
| 45 | interactive and headless paths |
| 46 | |
| 47 | ### Fixed |
| 48 | |
| 49 | - **Malformed Chinese-model tool calls are handled end-to-end in ACP.** The |
| 50 | inline-call recovery that 1.5.9 added for Kimi K3's XTML protocol and GLM's |
| 51 | mis-tagged blocks only applied to the interactive and headless surfaces; |
| 52 | the ACP path never ran it, so an editor session still surfaced raw protocol |
| 53 | text and dropped the calls. Recovery now runs in the ACP prompt loop too, |
| 54 | covered by integration tests, and the tool names are checked against the |
| 55 | turn's offered tools before anything executes |
| 56 | - **Suppressed tool-call log spam is gone.** The guard that logs when a |
| 57 | structured call is dropped for arriving as forced text fired once per |
| 58 | streamed argument fragment — one malformed call could log a warning per |
| 59 | chunk. The check now fires once per turn with the count and names of what |
| 60 | was dropped, and the non-streaming path reports the same |
| 61 | - **A history-replay test no longer races on the process cwd.** One ACP test |
| 62 | built its expected path from `std::env::current_dir()` while other tests |
| 63 | briefly swap that process-global cwd, so on CI it could read a temp |
| 64 | directory mid-swap and compare a truncated title against an untruncated |
| 65 | expectation. It now uses a fixed path it never needed to derive |
| 66 | |
| 67 | ## 1.5.9 |
| 68 | |
| 69 | ### Fixed |
| 70 | |
| 71 | - **Kimi K3 tool calls no longer arrive as raw protocol text.** Kimi K3 renders |
| 72 | a call in Moonshot's XTML protocol — pipe-delimited open/sep/close tokens |
| 73 | wrapping named blocks — and when the serving stack doesn't parse that back |
| 74 | into structured tool calls, the whole block surfaced in the editor as literal |
| 75 | text and the turn ended as though the model had answered in prose. The |
| 76 | inline-call recovery now speaks that protocol alongside the legacy XML tags: |
| 77 | tools blocks are parsed into real calls (several per block, argument values |
| 78 | decoded and typed from the block's own type attribute or, when it is |
| 79 | missing, the turn's tool schemas), response blocks are unwrapped so their |
| 80 | text still renders, and think blocks are dropped as private reasoning rather |
| 81 | than shown. The streaming scanner watches all the opening markers, so a |
| 82 | block split across chunk boundaries still recovers |
| 83 | - **GLM's mis-tagged calls recover too.** GLM sometimes precedes the legacy |
| 84 | block's first argument key with another tool-call opening tag instead of the |
| 85 | arg-key opening tag the format calls for, and the recovery rejected the |
| 86 | whole block when it did — the call surfaced as text and whatever it was |
| 87 | trying to do was dropped. The parser now accepts that alias for the first |
| 88 | argument only — later arguments stay strict, so text that merely resembles a |
| 89 | call cannot be recovered as one — in both the whole-blob and streaming |
| 90 | paths, and the scanner tolerates the malformed marker split across chunk |
| 91 | boundaries. Recovery in both protocols also checks the call's name against |
| 92 | the tools actually offered in the turn: a tag naming a tool that was never |
| 93 | in the turn's spec stays on screen instead of being executed |
| 94 | |
| 95 | ## 1.5.8 |
| 96 | |
| 97 | ### What changed |
| 98 | |
| 99 | - **Editor panels can switch permission mode without a slash command.** ACP |
| 100 | clients now get a Permissions selector next to the model controls with |
| 101 | Manual, Auto, and Plan choices for the current session. Manual keeps the |
| 102 | existing approval prompts, Auto lets mutating tools run unattended while |
| 103 | still respecting explicit deny rules in `settings.toml`, and Plan keeps the |
| 104 | agent in research-only mode. The selector follows `/plan` and `/clear`, and |
| 105 | it is deliberately session-scoped so a risky Auto choice does not persist |
| 106 | into the next task |
| 107 | - **Tool calls in the editor are worth opening now.** Zed only drew the |
| 108 | disclosure arrow on the handful of cards siGit set `content` on — the model |
| 109 | download and switch spinners — because everything else carried nothing but |
| 110 | `rawInput` and `rawOutput`, fields ACP gives clients no display guidance for. |
| 111 | Every tool call now gets a fenced content block: the pretty-printed arguments |
| 112 | while it runs, then the tool's output once it finishes, with a `(no output)` |
| 113 | placeholder for a silent command like `git add`. Cards are titled |
| 114 | `<tool> · <arg>` rather than the bare tool name, path-bearing tools set |
| 115 | `locations` so the editor can follow along, and a replayed session gets the |
| 116 | same treatment as a live one |
| 117 | - **The context window is visible before compaction fires.** Both model pickers |
| 118 | show each model's window, and the TUI title bar has a gauge for how much of |
| 119 | it the conversation is using. Cloud tiers report their own window instead of |
| 120 | the compaction budget — the budget is when siGit Code summarizes history, not |
| 121 | how much the model can hold, and labelling one with the other understated the |
| 122 | window by an order of magnitude |
| 123 | - **`write_todos` renders as a plan, not a tool card.** Zed and other clients |
| 124 | have real progress UI for `session/update` plans, so the model's todo list |
| 125 | goes there |
| 126 | - **Picker changes read as status rather than chat.** Switching model or |
| 127 | inference backend is UI state, so it renders as a completed think-kind tool |
| 128 | call. The sign-in prompt stays an assistant message, since it needs the user |
| 129 | to act on it |
| 130 | |
| 131 | ### Fixed |
| 132 | |
| 133 | - **A reopened thread comes back with its history.** Clicking a saved thread in |
| 134 | Zed sends `session/load`, and the client draws the thread purely from the |
| 135 | `session/update` notifications the agent streams while that request is in |
| 136 | flight. siGit restored the saved history into the backend, which is what |
| 137 | makes the model remember, but sent the client nothing — so the thread opened |
| 138 | empty and looked like a brand new conversation. The snapshot is now turned |
| 139 | into updates before it is restored: user and assistant text as message chunks |
| 140 | with reasoning stripped, each tool call completed with its result folded in, |
| 141 | and `write_todos` as a plan the way it renders live. System messages stay |
| 142 | out, since they seeded the model and were never on screen |
| 143 | - **Compaction no longer fails in every session that ran a tool.** |
| 144 | `compact_history` asked for the summary through `complete(None, None)`, which |
| 145 | sends no tools array but left the live history in place. That history is |
| 146 | thick with assistant `tool_calls` and `role: "tool"` messages, and an |
| 147 | endpoint handed tool shapes with no schema to check them against rejects the |
| 148 | request — Anthropic answers 400. So compaction failed on every attempt in any |
| 149 | session that had run a single tool, however small the history was, and then |
| 150 | retried on every prompt and tool round while that history kept growing. The |
| 151 | conversation now goes as a flattened transcript in one user message, which |
| 152 | keeps what the summary needs and drops the shapes that only mean anything |
| 153 | next to a tool schema |
| 154 | - **A tool call emitted as text is no longer dropped.** Qwen 3, GLM and |
| 155 | DeepSeek write a call as `<tool_call>NAME<arg_key>…` in their chat template |
| 156 | and rely on the serving stack to parse it back into `tool_calls`. When that |
| 157 | doesn't happen the tag arrives as ordinary content, so it was rendered |
| 158 | verbatim in the editor and the turn ended as though the model had chosen to |
| 159 | answer in prose. Both the streaming and non-streaming paths now scan content |
| 160 | for those blocks and turn well-formed ones back into real calls, typing |
| 161 | argument values from the turn's own tool schemas. The streaming scanner holds |
| 162 | back only enough text to catch a tag straddling a chunk boundary, so ordinary |
| 163 | answers still stream token by token. A block that doesn't match the expected |
| 164 | shape is left in the text untouched: reissuing a `run_command` is cheap, but |
| 165 | guessing wrong at a half-parsed `edit_file` would write the wrong change to a |
| 166 | file |
| 167 | - **Tool-call content survives awkward output.** Whitespace-only output is |
| 168 | preserved rather than collapsed, malformed arguments no longer get a |
| 169 | misleading JSON fence, and fence language identifiers are sanitized |
| 170 | |
| 171 | ## 1.5.7 |
| 172 | |
| 173 | ### What changed |
| 174 | |
| 175 | - **`@smbcloud/sigit` gets releases again.** The npm scope moved to |
| 176 | `@getsigit` in 1.5.5 and the old package was left sitting on the registry at |
| 177 | 1.5.2, so an install made before the rename went quiet — `npm update` had |
| 178 | nothing to give it and nothing said why. All seven packages now publish under |
| 179 | both scopes from the same build, so `@smbcloud/sigit` is a full install again |
| 180 | rather than a stub, with its own platform binaries and no dependency on the |
| 181 | new scope. It prints a line on stderr saying where the package moved to; |
| 182 | `SIGIT_SUPPRESS_SCOPE_NOTICE=1` turns that off. This is a migration path, not |
| 183 | a second home: `@getsigit/sigit` is what the docs, the Homebrew tap, and the |
| 184 | ACP registry entry point at, and it is the name to move to |
| 185 | - **Multi-root projects now work in the editor.** When a client opens several |
| 186 | directories in one project, ACP sends the extra ones as |
| 187 | `additionalDirectories` — but only to an agent that says it wants them, which |
| 188 | siGit never did, so Zed kept the first root and showed a banner saying |
| 189 | multi-root workspaces were unsupported. The capability is now advertised at |
| 190 | `initialize`, and the directories that arrive are no longer logged and thrown |
| 191 | away. All the roots are now part of the session: the model is told about each |
| 192 | one, every root's `AGENTS.md` / `CLAUDE.md` is loaded, and skills, slash |
| 193 | commands, and subagent types are discovered from all of them (primary root |
| 194 | first, so it still wins name collisions). `/status` lists the roots when |
| 195 | there is more than one, and headless runs take the same thing as repeatable |
| 196 | `--add-dir <dir>` flags. MCP servers are the exception: discovery happens |
| 197 | once at startup, before a session exists, so a second root's `.sigit/mcp.toml` |
| 198 | is not picked up |
| 199 | |
| 200 | ### Fixed |
| 201 | |
| 202 | - **A shell command can no longer wedge the editor session.** Tool commands |
| 203 | inherited siGit's own stdin, which in ACP mode is the JSON-RPC pipe from the |
| 204 | editor. A command that read stdin — a signing passphrase prompt, a pager, a |
| 205 | `git` credential ask — blocked on it and consumed the client's next request |
| 206 | out of the pipe, so nothing typed afterwards ever reached the agent and the |
| 207 | session stayed dead past the command timeout. Commands, hooks, and the |
| 208 | co-author `git` helpers now run with stdin closed, so a command that wants |
| 209 | input gets EOF and reports an error instead |
| 210 | - **A command that prints a lot no longer stalls for two minutes.** |
| 211 | `run_command` waited for the command to exit before reading its output, so |
| 212 | anything past the pipe buffer (a build, a verbose test run) blocked writing |
| 213 | while siGit blocked waiting, until the 120-second timeout killed it. Output |
| 214 | is now drained while the command runs |
| 215 | - **The command timeout now stops the whole command.** It killed only the |
| 216 | shell, leaving anything that shell had started running and unreaped; it now |
| 217 | kills the process group |
| 218 | - **A refused turn now shows the endpoint's own message.** siGit pasted the |
| 219 | status line and the raw JSON body into the editor's error banner, so a |
| 220 | billing or allowance message arrived wrapped in |
| 221 | `endpoint returned 429 Too Many Requests: {"error":{"message":…`. The message |
| 222 | the endpoint wrote is what the banner shows now; the status is only used when |
| 223 | there is no message to show |
| 224 | - **An error that arrives mid-stream is no longer silent.** An endpoint that |
| 225 | fails after the response is already open reports it as a frame in the stream. |
| 226 | That frame carries no `choices`, so siGit parsed it as an empty chunk and |
| 227 | skipped it, and the turn ended as though the model had answered with nothing |
| 228 | |
| 229 | ## 1.5.6 |
| 230 | |
| 231 | ### What changed |
| 232 | |
| 233 | - **Switching models mid-conversation no longer restarts it.** Both switching |
| 234 | to a local GGUF model and picking a different cloud tier now carry the live |
| 235 | conversation history across, repairing any half-finished tool call so |
| 236 | strict OpenAI-compatible endpoints don't reject the session |
| 237 | - **Long-running tools now show progress in ACP clients.** Synchronous tools |
| 238 | (shell commands, file operations, `read_website`, ...) run on a blocking |
| 239 | thread pool instead of the ACP connection's own task, so a slow command's |
| 240 | `in_progress` update reaches the client — and Zed's spinner — while the |
| 241 | command is still running instead of arriving with the result |
| 242 | - **Text from consecutive tool rounds no longer runs together.** ACP and |
| 243 | headless clients concatenate consecutive message chunks, so a reply that |
| 244 | continued after a tool call used to glue onto the previous round's last |
| 245 | sentence with no space. A blank line now opens the next round's text |
| 246 | - **New onde-cloud model tiers.** The model picker (`/models` in the TUI, the |
| 247 | config panel in editors) now offers five additional siGit Code Cloud tiers — |
| 248 | `flux`, `apex`, `aura`, `orbit`, and `nova` — alongside the existing Fast, |
| 249 | Balanced, Large, Mini, Air, Pro, and KKK options. The tier list mirrors |
| 250 | onde-cloud's router catalogue, so all three sides (the picker, the router, |
| 251 | and the cloud catalogue) have to be updated together when a tier is added |
| 252 | - **MCP Registry listing moved to `getsigit/si`.** The `server.json` manifest |
| 253 | and its `release-mcp-registry.yml` publish workflow now live in the |
| 254 | [`getsigit/si`](https://github.com/getsigit/si) repo alongside the si CLI's |
| 255 | other code, since the registry entry describes the si platform rather than |
| 256 | the coding agent |
| 257 | |
| 258 | ## 1.5.5 |
| 259 | |
| 260 | A distribution release. siGit Code itself is unchanged. What moved is how it |
| 261 | reaches you on npm and on Windows. |
| 262 | |
| 263 | ### What changed |
| 264 | |
| 265 | - **The npm package is now `@getsigit/sigit`.** The six platform packages moved |
| 266 | with it. `@smbcloud/sigit` stays on the registry but stops receiving updates, |
| 267 | so upgrading means switching names: |
| 268 | `npm uninstall -g @smbcloud/sigit && npm install -g @getsigit/sigit`. The old |
| 269 | package had been stuck at 1.5.2, so this picks up 1.5.3 and 1.5.4 as well. |
| 270 | - **npm publishes over OIDC.** Every `@getsigit/*` package has a trusted |
| 271 | publisher pointing at the release workflow, so no npm token is stored in the |
| 272 | repository. The release workflow moves to Node 22, which trusted publishing |
| 273 | requires. |
| 274 | - **winget releases actually go out.** The workflow could only update a package |
| 275 | already present in `microsoft/winget-pkgs`, and siGit Code had never been |
| 276 | submitted there, so every dispatch failed. It now submits the package the |
| 277 | first time and updates it on later releases. The identifier is |
| 278 | `getSigit.siGitCode`. |
| 279 | |
| 280 | ## 1.5.4 |
| 281 | |
| 282 | - **CI**: nfpm config expanded to include package version and binary path |
| 283 | |
| 284 | ## 1.5.3 |
| 285 | |
| 286 | Adds browser-based sign-in, expands distribution channels to Windows (winget, |
| 287 | Scoop), Linux (AUR, deb, rpm), and .NET (NuGet), gives ACP clients live |
| 288 | visibility into tool activity, adds the KKK and Moonshot AI cloud tiers, and |
| 289 | fixes the co-authored-by trailer email. |
| 290 | |
| 291 | ### What changed |
| 292 | |
| 293 | - **Browser sign-in:** `sigit login` now opens a browser OAuth flow (PKCE S256 |
| 294 | against the siGit Code Cloud authorization server) so you can sign in without |
| 295 | a password. A loopback listener catches the redirect automatically; a |
| 296 | paste-back fallback handles environments where a loopback isn't reachable. |
| 297 | `--paste` forces the paste path, `--password` keeps the old email/password |
| 298 | prompt. Zed's "Sign in to siGit Code" button uses the loopback path via ACP |
| 299 | `authenticate` |
| 300 | - **New release channels:** siGit Code is now published to winget |
| 301 | (`getsigit.siGitCode`), Scoop (`getsigit/scoop-bucket`), the AUR |
| 302 | (`sigit-bin`), and as `.deb`/`.rpm` packages alongside the existing |
| 303 | Homebrew, npm, PyPI, crates.io, and NuGet channels |
| 304 | - **NuGet .NET tool:** `dotnet tool install --global SiGit.Code` now works on |
| 305 | Windows, macOS, and Linux — the package bundles all six platform binaries and |
| 306 | a managed shim that execs the right one, leaving stdin/stdout/stderr |
| 307 | unredirected so TUI vs ACP mode detection still works |
| 308 | - **New cloud tiers:** the model picker (`/models` in the TUI, the config |
| 309 | panel in Zed) now offers the `onde-kkk` (KKK) and Moonshot AI (`oke`) tiers |
| 310 | alongside the existing Fast, Balanced, Large, Mini, Air, and Pro options |
| 311 | - **ACP tool visibility:** the agent loop now emits `ToolCall(InProgress)` |
| 312 | before each tool runs and `ToolCallUpdate(Completed/Failed)` after it |
| 313 | returns, so clients like Zed gain live visibility into tool activity between |
| 314 | inference rounds. `tool_choice: "auto"` is also sent explicitly whenever |
| 315 | tools are present, fixing models that describe actions in prose rather than |
| 316 | issuing a tool call when the field is absent |
| 317 | - **Malformed tool argument logging:** invalid tool argument JSON is now logged |
| 318 | at three sites (TUI pretty-printer, ACP tool-call event, permission request) |
| 319 | instead of silently falling back to a string value, making malformed payloads |
| 320 | visible in logs while preserving backward-compatible behaviour |
| 321 | - **Co-authored-by trailer fix:** the `Co-Authored-By` trailer email was |
| 322 | updated to `noreply@sigit.si` (platform-neutral); the commit attribution |
| 323 | check was tightened to use idiomatic ownership |
| 324 | - **NuGet trusted publishing:** the NuGet release workflow now exchanges a |
| 325 | GitHub OIDC token for a short-lived NuGet API key (via `NuGet/login`) instead |
| 326 | of relying on a long-lived `NUGET_API_KEY` secret, so there is no stored |
| 327 | credential to rotate or leak |
| 328 | - **AUR dispatch temporarily disabled:** the AUR release workflow is no longer |
| 329 | dispatched from `release-github` while new AUR account registration is |
| 330 | closed; the `sigit-bin` channel returns once registration reopens |
| 331 | - Legal and branding copy updated |
| 332 | |
| 333 | ## 1.5.2 |
| 334 | |
| 335 | Brings the latest siGit Code Cloud tiers to the picker and aligns the MCP |
| 336 | registry metadata with the server release. |
| 337 | |
| 338 | ### What changed |
| 339 | |
| 340 | - `/models` now lists the Pro, Air, and Mini siGit Code Cloud tiers alongside |
| 341 | Fast, Balanced, and Large |
| 342 | - Updated the MCP registry manifest to version 1.2.5, matching the siGit Code |
| 343 | Cloud server release |
| 344 | - Updated the Agent Client Protocol SDK to the latest v1 release |
| 345 | |
| 346 | ## 1.5.1 |
| 347 | |
| 348 | Makes siGit Code work as an Xcode custom agent, and updates the Onde SDK. |
| 349 | |
| 350 | ### What changed |
| 351 | |
| 352 | - Xcode can now run siGit Code as a custom agent. Point it at the binary with |
| 353 | `--acp` as the argument, and that explicit mode loads the selected on-device |
| 354 | model on the first prompt, since Xcode's chat has no equivalent of `/load`. |
| 355 | The README covers the setup, including wiring up `xcrun mcpbridge` in |
| 356 | `mcp.toml` so the agent can use Xcode's build, test, and project tools |
| 357 | - MCP calls to the `xcode` server time out after 30 seconds instead of 120, so |
| 358 | a request Xcode cannot service no longer leaves the prompt looking busy for |
| 359 | two minutes. String JSON-RPC ids from the bridge are handled too |
| 360 | - The agent stops repeating itself: a tool call made three times with identical |
| 361 | arguments now forces a text reply instead of looping |
| 362 | - Onde SDK bumped to 1.2.2 |
| 363 | - The registry listing in `server.json` matches what sigit.si publishes |
| 364 | |
| 365 | ## 1.5.0 |
| 366 | |
| 367 | Opens the agent up to user extension: lifecycle hooks, custom slash commands, |
| 368 | and configurable subagent types. Also adds web search, a Repo tab in the TUI, |
| 369 | and a baked-in smbCloud MCP server. |
| 370 | |
| 371 | ### What changed |
| 372 | |
| 373 | - Hooks let you run shell commands at three points in the agent's lifecycle: |
| 374 | `session_start`, `pre_tool_use`, and `post_tool_use`, configured under |
| 375 | `[hooks]` in `settings.toml`. Commands get context through variable |
| 376 | substitution (`{cwd}`, `{tool_name}`, `{tool_result_len}`) and run in the |
| 377 | session working directory. A hook that fails is logged and the session |
| 378 | continues; a hook that hangs is killed on a timeout, along with its whole |
| 379 | process group |
| 380 | - User-defined slash commands: drop a Markdown file in `.sigit/commands/` or |
| 381 | `.claude/commands/` (or the personal `$SIGIT_CONFIG_DIR/commands/` and |
| 382 | `~/.claude/commands/`) with optional `description` and `argument-hint` |
| 383 | frontmatter, and the body becomes a prompt template. `$ARGUMENTS` takes the |
| 384 | whole argument string and `$1`..`$9` the positional words. A subdirectory |
| 385 | namespaces the command with `:`, so `.sigit/commands/git/commit.md` becomes |
| 386 | `/git:commit`. They run as ordinary agent turns through the usual tools and |
| 387 | permission checks, and are advertised to ACP clients like Zed. `/commands` |
| 388 | lists what was discovered |
| 389 | - Configurable subagent types for the `task` tool: a Markdown file in |
| 390 | `.sigit/agents/` or `.claude/agents/` with `name`, `description`, and an |
| 391 | optional `tools:` allow-list, whose body becomes that subagent's system |
| 392 | prompt. Pass its name as `subagent_type` to swap the prompt in. The |
| 393 | `tools:` list can only narrow the subagent's read-only ceiling, never widen |
| 394 | it, so a config file cannot grant itself `edit_file` or `run_command` and |
| 395 | route around the permission system. `/agents` lists the discovered types |
| 396 | - New `web_search` tool, backed by the Brave-Search-backed search on siGit |
| 397 | Code Cloud's MCP server. It is offered only when you are signed in, and it |
| 398 | is classified read-only, so searching never triggers a permission prompt |
| 399 | - The TUI gains a Repo tab, shown when the session's `origin` remote points at |
| 400 | the sigit.si host. It lists issues and pull requests fetched through the |
| 401 | official MCP server: Up and Down select, Enter opens a scrollable detail, |
| 402 | `i`, `p`, Left and Right switch sections, `r` refreshes. The tab is hidden |
| 403 | and skipped in the cycle for any other remote |
| 404 | - The smbCloud CLI's stdio MCP server (`smb --mcp`) is now baked in, so |
| 405 | smbCloud project and deployment tools work with no `mcp.toml` setup. It is |
| 406 | added only when the `smb` binary is on `PATH`, its read-only tools (`me`, |
| 407 | `deployments`, `project_list`, `project_show`) skip permission prompts, and |
| 408 | you can opt out with `smbcloud = false` in `mcp.toml` or |
| 409 | `SIGIT_MCP_SMBCLOUD=off` |
| 410 | - siGit Code Cloud's MCP server is now listed in the public MCP Registry as |
| 411 | `si.sigit/sigit`, published from `server.json` at the repository root |
| 412 | |
| 413 | ### Fixes |
| 414 | |
| 415 | - An explicit `deny` rule now applies to read-only first-party tools instead |
| 416 | of being skipped |
| 417 | - A subagent type whose `tools:` list resolves to an empty set is rejected |
| 418 | rather than producing a subagent with no tools |
| 419 | - Command templates render in a single substitution pass, so an argument that |
| 420 | contains something like `$1` is no longer re-substituted |
| 421 | - Frontmatter is stripped with the same leniency it is parsed with |
| 422 | - The Repo tab's detail view no longer shows stale data after a refresh |
| 423 | |
| 424 | ## 1.4.1 |
| 425 | |
| 426 | Two small fixes: correct co-author attribution and a Homebrew tap fix. |
| 427 | |
| 428 | ### What changed |
| 429 | |
| 430 | - The `Co-Authored-By` trailer siGit Code adds to commits now uses the GitHub |
| 431 | noreply address for the [sigitc](https://github.com/sigitc) account instead |
| 432 | of `sigit@sigit.si`, so GitHub reliably attributes co-authored commits to |
| 433 | the siGit Code profile |
| 434 | - Fixed the Homebrew tap install docs to trust the tap with `brew trust` |
| 435 | instead of a `brew tap --force` flag |
| 436 | |
| 437 | ## 1.4.0 |
| 438 | |
| 439 | Adds a headless one-shot mode, fine-grained permission rules, stdio transport |
| 440 | for MCP servers, an `/init` command, and a set of TUI upgrades: tabs, a live |
| 441 | thinking display, and collapsible tool calls. |
| 442 | |
| 443 | ### What changed |
| 444 | |
| 445 | - New headless mode: `sigit -p "prompt"` runs one agent turn with tools and exits — 0 on a completed turn, 1 on inference errors, 2 on bad invocations. Assistant text streams to stdout while logs and tool progress stay on stderr; `--cwd` sets the working directory and `--quiet` prints only the final message. Nobody can answer a permission prompt in a headless run, so `ask` collapses to a denial: grant tools for the run with `--allow-tool`, block them with `--deny-tool`, or use `SIGIT_PERMISSIONS=allow` |
| 446 | - Permission rules make autonomy granular: `[permissions.rules]` in `settings.toml` holds ordered `allow` and `deny` lists of `tool_name(pattern)` entries, e.g. `run_command(git *)` or `edit_file(src/*)`. Patterns match the command string for `run_command` and the path for file tools; deny always beats allow, and unparseable patterns fail closed, so a bad rule can only narrow access. Always-allow on a `run_command` prompt now grants that command family (its first two tokens), not the whole shell |
| 447 | - The MCP client speaks stdio: `mcp.toml` server entries can give a `command`, `args`, and an `env` map instead of a `url`, so the stdio-first majority of published MCP servers plugs in. Same handshake, timeouts, tool namespacing, and output caps as HTTP; `/mcp` shows the command line for stdio servers |
| 448 | - New `/init` command (TUI and ACP): runs a normal agent turn that explores the repository and writes an `AGENTS.md` — or improves an existing `AGENTS.md`/`CLAUDE.md` in place — going through the ordinary tools and permission checks |
| 449 | - The TUI gains tabs, cycled with the Tab key: Session is the chat, History lists saved sessions (restore with Enter, delete with a confirmed double-`d`, refresh with `r`), and Cloud shows the signed-in account, inference mode, current model and engine state, permission policy, and config dir, with a live Local Inference toggle |
| 450 | - The TUI shows model thinking: while a reply streams, the last three lines of the reasoning appear live under the spinner, dim and italic; finished replies collapse to a one-line indicator with the line count, and `/thinking` expands the full reasoning block above each reply. Display only — nothing changes in what is sent to the model, saved to sessions, or streamed over ACP |
| 451 | - Tool calls in the TUI transcript collapse to single dim title lines (the command for `run_command`, the path for file tools, the pattern for search and glob); `/tools` expands every entry to show the pretty-printed arguments and a capped tail of the result. Permission prompts keep showing the full command, and the model still receives full outputs |
| 452 | - When `AGENTS.md` and `CLAUDE.md` sit in the same directory, the instructions loader now prefers `AGENTS.md`, so shared content is injected once |
| 453 | |
| 454 | ## 1.3.2 |
| 455 | |
| 456 | Adds a tool permission system with plan mode, durable sessions with context |
| 457 | compaction, background command execution, a subagent research tool, and commit |
| 458 | co-author attribution. |
| 459 | |
| 460 | ### What changed |
| 461 | |
| 462 | - Every tool call now passes a permission policy before executing. Read-only tools always run; mutating tools (and all MCP or unknown tools) are governed by, in order: plan mode, session grants, per-tool overrides, and a default mode from `[permissions]` in `settings.toml` (`allow`/`ask`/`deny`, default `ask`). On `ask`, editors get a native ACP permission dialog (allow once / allow for this session / deny) and the TUI pauses on a y/a/n prompt showing the tool and its arguments. `SIGIT_PERMISSIONS` overrides the default mode for headless runs and clients without permission support |
| 463 | - New `/plan [on|off]` command: plan mode blocks mutating tools and asks the model to present a plan while research tools keep working. `/permissions` prints the effective policy |
| 464 | - Sessions are durable: conversation history is saved per session under `~/.config/sigit/sessions/` after every turn. ACP `session/load` actually restores it, the TUI gets `/resume`, and `/clear` deletes the saved file |
| 465 | - Context compaction: `/compact` compresses the conversation on demand, and the agent compacts automatically once the history approaches a 24k-token budget, summarizing older turns and keeping the recent ones. The tool-round cap rises from 10 to 24 now that long sessions have a defense other than the cap |
| 466 | - `run_command` can run work in the background: pass `run_in_background` and the tool returns a task id immediately, so builds, test suites, and dev servers are no longer killed by the 120 second foreground timeout. Poll with the new `command_output` tool (read-only, never prompts) and stop with `kill_command` |
| 467 | - New `task` tool: delegate research to a fresh subagent conversation that only gets the read-only tools and returns its final answer, keeping the main context small. Available on OpenAI-compatible backends; on-device returns a clear fallback until onde supports a second context |
| 468 | - Commits created by the agent are co-authored: commit messages end with `Co-Authored-By: siGit Code <sigit@sigit.si>` (the [sigitc](https://github.com/sigitc) account), which GitHub renders next to the human author. If the model forgets the trailer, siGit amends it in, never rewriting commits that already exist on a remote |
| 469 | - ACP mode now honors the `OPENAI_BASE_URL`/`OPENAI_API_KEY` provider override at startup, matching the interactive client |
| 470 | |
| 471 | ## 1.3.1 |
| 472 | |
| 473 | Adds [Model Context Protocol](https://modelcontextprotocol.io) (MCP) client |
| 474 | support with the official siGit Code MCP server baked in, a set of agent tools |
| 475 | that close parity gaps in the tool layer, and refreshed branding and licensing. |
| 476 | |
| 477 | ### What changed |
| 478 | |
| 479 | - siGit Code is now an MCP client: it connects to MCP servers over the Streamable HTTP transport (a single JSON-RPC endpoint), discovers the tools they expose, and offers them to the model alongside the built-in tools. When the model calls one, the call is forwarded to the owning server and the result fed back into the agent loop |
| 480 | - Bakes in the official siGit Code MCP server at `https://sigit.si/api/v1/mcp` (follows `SIGIT_CLOUD_URL`). When you are signed in (`sigit login`), the cloud session token is sent as the bearer credential |
| 481 | - Configure additional servers in `mcp.toml` — global (`~/.config/sigit/mcp.toml`) or project-local (`.sigit/mcp.toml`). Each `[[server]]` has a `name`, `url`, optional `enabled`, and optional `[server.headers]`; set `official = false` to opt out of the baked-in server |
| 482 | - MCP tools are namespaced `mcp__<server>__<tool>` so they never collide with built-in tools or across servers; tool output is capped to protect the model's context |
| 483 | - Discovery is best-effort at startup and bounded by a per-server timeout, so an unreachable server never blocks startup — it just contributes no tools |
| 484 | - Added a `/mcp` slash command (TUI and ACP) that lists configured servers, their connection status, and the tools each exposes |
| 485 | - Disable MCP entirely with `SIGIT_MCP=off`, or just the official server with `SIGIT_MCP_OFFICIAL=off` |
| 486 | - New agent tools that close parity gaps in the tool layer: `multi_edit` (apply a batch of exact-substring edits to one file atomically — written only if every edit matches), `glob` (locate files by name pattern with `**`/`*`/`?`/`{a,b}`, most-recently-modified first), `write_todos` (render a live task checklist through the tool result for multi-step work), and `remember` (append durable notes to the nearest `AGENTS.md`/`CLAUDE.md`) |
| 487 | - `edit_file` now supports `replace_all` and returns actionable failure context — naming the line whose trimmed text matches when only whitespace differs — so the model self-corrects in one round |
| 488 | - `search_files` gained a `file_glob` filter and a `max_results` cap (default 50, hard-capped at 1000) that also bounds the directory walk |
| 489 | - Refreshed branding and legal: updated `LICENSE`, `README`, and the npm/PyPI package descriptions |
| 490 | |
| 491 | ## 1.3.0 |
| 492 | |
| 493 | Adds a Local Inference on/off toggle, the open [Agent Skills](https://agentskills.io) |
| 494 | format, and support for project instruction files (`AGENTS.md` and the like). |
| 495 | |
| 496 | ### What changed |
| 497 | |
| 498 | - Added a Local Inference on/off setting that is the explicit local-vs-cloud mode switch. It is persisted in `~/.config/sigit/settings.toml` (default on, local-first) and can be overridden with `SIGIT_LOCAL_INFERENCE` |
| 499 | - Toggle it with the `/local [on|off]` command (TUI and ACP); ACP clients without slash-command support get an equivalent "Local Inference" On/Off control in the session config panel |
| 500 | - `/models` now groups models by nature — Local vs siGit Code Cloud — and highlights the active mode's group while still showing the other, so the cloud tiers stay discoverable |
| 501 | - Discovers Agent Skills (folders with a `SKILL.md`) from `.sigit/skills/` and `.claude/skills/` in the project, `~/.config/sigit/skills/`, and `~/.claude/skills/` |
| 502 | - Follows the spec's progressive disclosure: each skill's name and description are advertised up front via a new `skill` tool, and the full instructions load only when the agent activates one |
| 503 | - Added a `/skills` slash command (TUI and ACP) that lists the discovered skills |
| 504 | - Reads project instruction files at session start: `AGENTS.md` (the cross-tool standard) and `CLAUDE.md`, walking from the working directory up to the repository root, plus a global file under `~/.config/sigit/`, and injects them into the session's system context so their guidance is always in force |
| 505 | - Nested instruction files are ordered outermost-first so the closest, most specific file takes precedence; the scan never reads above the repository root |
| 506 | - On-device models are no longer loaded implicitly. The chat UI and ACP sessions come up immediately, and the local model is brought into memory only when you run the `/load` command (or pick one in `/models`). Prompts sent before a model is loaded now return a hint instead of blocking on a multi-minute download. |
| 507 | |
| 508 | ## 1.2.2 |
| 509 | |
| 510 | Streams assistant tokens as they arrive, on-device and over the cloud. |
| 511 | |
| 512 | ### What changed |
| 513 | |
| 514 | - Streamed assistant tokens live in the TUI and ACP sessions, both on-device and through siGit Code Cloud |
| 515 | - On-device inference streams only when a turn offers no tools, since `onde` can't stream and detect tool calls in the same pass; tool-capable turns still resolve in one shot |
| 516 | - Fixed the TUI so the latest message stays visible in long chats |
| 517 | - Put the cloud model-switch confirmation on its own line in ACP |
| 518 | |
| 519 | ## 1.2.1 |
| 520 | |
| 521 | Stabilizes the Zed/ACP integration and finishes the cloud-tier wiring on top of 1.2.0. |
| 522 | |
| 523 | ### What changed |
| 524 | |
| 525 | - Fixed a Zed crash by keeping model-picker labels ASCII in the ACP model selector |
| 526 | - Wired ACP auth, cloud tiers, and slash commands into the Zed panel, including a `/reload` command to re-sync session state in place |
| 527 | - Fixed the TUI so the loaded-model checkmark appears once a download completes |
| 528 | - Synced bundled agent skills with the current code and added `CLAUDE.md` |
| 529 | |
| 530 | ## 1.2.0 |
| 531 | |
| 532 | Adds siGit Code Cloud — a hosted inference tier alongside on-device models. |
| 533 | |
| 534 | ### What changed |
| 535 | |
| 536 | - Added siGit Code Cloud with cloud-tier routing, pointed at `sigit.si` |
| 537 | - Added account management slash commands and surfaced cloud tiers in `/models` |
| 538 | - Carried forward from 1.1.0: ACP SDK v0.13, refreshed dependencies and branding |
| 539 | |
| 540 | ## 1.1.0 |
| 541 | |
| 542 | Bumps the ACP SDK to v0.13 and pulls in updated dependencies. |
| 543 | |
| 544 | ### What changed |
| 545 | |
| 546 | - Updated `agent-client-protocol` from v0.11 to v0.13 |
| 547 | - Updated `onde` to 1.1.2 |
| 548 | - Refreshed branding and skill metadata |
| 549 | |
| 550 | ## 1.0.4 |
| 551 | |
| 552 | This release tightens up the terminal experience and finishes a few release-facing cleanup items. |
| 553 | |
| 554 | ### What changed |
| 555 | |
| 556 | - Added bold rich-text rendering in the TUI for assistant replies, so `**text**` now displays with terminal styling instead of raw markdown markers |
| 557 | - Refreshed the bundled skill metadata to follow the current Agent Skills `SKILL.md` format |
| 558 | - Synced the crate release metadata for the `1.0.4` cut |
| 559 | |
| 560 | ## 1.0.3 |
| 561 | |
| 562 | This is the cleanup release for the editor-side startup problems. |
| 563 | |
| 564 | ### What changed |
| 565 | |
| 566 | - Fixed ACP sessions failing on the first real prompt because the server claimed the model was ready before anything had actually been loaded |
| 567 | - Changed ACP startup so the default model loads lazily on the first non-slash prompt instead of pretending it is already in memory |
| 568 | - Kept `initialize` and `session/new` lightweight while still sending proper progress updates once model loading begins |
| 569 | - Updated the Onde integration to `1.0.0` |
| 570 | - Removed a few dependencies we were no longer using |
| 571 | |
| 572 | ## 1.0.2 |
| 573 | |
| 574 | This release was supposed to fix the ACP auth breakage. It did fix the stdout pollution problem, but it turned out not to be the whole story. |
| 575 | |
| 576 | ### What changed |
| 577 | |
| 578 | - Delayed model loading in ACP mode so startup diagnostics would not leak into protocol stdout during the auth handshake |
| 579 | - Tightened up the ACP startup path for editor integrations |
| 580 | - Refreshed some README wording while cutting `1.0.2` |
| 581 | |
| 582 | ## 1.0.1 |
| 583 | |
| 584 | The first patch after `1.0.0` was mostly about making model loading and model switching feel less opaque. |
| 585 | |
| 586 | ### What changed |
| 587 | |
| 588 | - Added ToolCall-based progress UI for startup model loading and downloading |
| 589 | - Improved model-switch progress reporting in ACP clients |
| 590 | - Fixed model-load error handling so failed switches did not leave the UI in a weird state |
| 591 | - Cleaned up a few status messages and docs while the release was going out |
| 592 | |
| 593 | ## 1.0.0 (2026) |
| 594 | |
| 595 | siGit Code has been living in real smbCloud repos for a while now. At some point it stopped feeling like an experiment, so we called it 1.0. |
| 596 | |
| 597 | ### What this release is |
| 598 | |
| 599 | siGit Code is a local coding agent. It runs a quantized model on your machine, talks to editors over ACP, and can read files, run commands, fetch web pages, and write code without sending your project to a hosted API. |
| 600 | |
| 601 | You can install it with Cargo, pip, npm, or Homebrew and use it like any other tool on your machine. |
| 602 | |
| 603 | ### What shipped in 1.0 |
| 604 | |
| 605 | #### Editor integration |
| 606 | |
| 607 | This is the core of the project. |
| 608 | |
| 609 | Zed and VS Code can talk to siGit Code over ACP. Multi-turn sessions work. Tool calling works. Session forking works. Working-directory context works. That was the original goal, and it feels solid now. |
| 610 | |
| 611 | #### Terminal UI |
| 612 | |
| 613 | The terminal UI started as a side quest and turned out to be useful. You get a full-screen ratatui chat, streaming tokens, a spinner while the model is busy, and a model picker you can open in the middle of a session. |
| 614 | |
| 615 | It runs on macOS and Linux. Windows gets ACP and editor mode for now. The Windows terminal UI is still unfinished. |
| 616 | |
| 617 | #### Tool calling |
| 618 | |
| 619 | This is the part that makes siGit Code feel like an agent instead of a chat box. The loop can run up to 10 rounds per message. |
| 620 | |
| 621 | Available tools: |
| 622 | |
| 623 | - `read_file` / `write_file` / `delete_file` |
| 624 | - `list_directory` / `search_files` |
| 625 | - `run_command`, with an optional working directory |
| 626 | - `read_website`, which fetches a URL and strips it down to readable text |
| 627 | |
| 628 | The model can call a tool, inspect the result, and keep going until it has a real answer. |
| 629 | |
| 630 | #### Model support |
| 631 | |
| 632 | The model list ended up wider than we expected for 1.0: |
| 633 | |
| 634 | - Qwen 3 1.7B, 4B, 8B, and 14B |
| 635 | - Qwen 2.5 1.5B and 3B |
| 636 | - Qwen 2.5 Coder 1.5B, 3B, and 7B |
| 637 | - DeepSeek Coder 6.7B |
| 638 | |
| 639 | They are all GGUF models and they all come from Hugging Face on first run. |
| 640 | |
| 641 | Qwen 3 is the interesting one. It uses extended thinking mode. The model reasons inside `<think>...</think>` blocks before answering. The TUI strips those blocks out and renders them dimmed above the reply, so you can see what happened without turning the whole conversation into noise. |
| 642 | |
| 643 | The 8B model is the desktop default. Mobile stays on 1.7B because iOS gives apps roughly 2 to 3 GB of memory, and we learned the hard way that 3B can blow up on an iPhone 16e. |
| 644 | |
| 645 | #### Model picker |
| 646 | |
| 647 | The model picker shows: |
| 648 | |
| 649 | - what is already cached locally |
| 650 | - what can be downloaded |
| 651 | - which models support tool calling |
| 652 | - whether the local cache looks healthy |
| 653 | |
| 654 | You can open it with `/models` in the TUI or through the editor config option. Switching models happens in the background and the UI stays alive while the download or load is in progress. |
| 655 | |
| 656 | #### smbCloud context |
| 657 | |
| 658 | siGit Code knows smbCloud repos better than a generic coding assistant does. It understands the difference between platform-user flows and tenant-app auth flows, how `Project`, `FrontendApp`, `AuthApp`, and GresIQ fit together, and why Next.js SSR deploys are not the same thing as the generic git-push path. |
| 659 | |
| 660 | Outside smbCloud, it backs off and behaves like a normal coding agent. |
| 661 | |
| 662 | #### Distribution |
| 663 | |
| 664 | Distribution took an unreasonable amount of time, honestly. |
| 665 | |
| 666 | There are prebuilt binaries for macOS, Linux, and Windows on both arm64 and x64 where relevant, plus install paths through Cargo, PyPI, npm, and Homebrew: |
| 667 | |
| 668 | - `cargo install sigit` |
| 669 | - `pip install sigit-code` |
| 670 | - `npm install -g @smbcloud/sigit` |
| 671 | - `brew install sigit` |
| 672 | |
| 673 | Getting that whole pipeline to behave across CI, crates.io, PyPI, npm, and Homebrew was basically its own project. |
| 674 | |
| 675 | ### What still does not work |
| 676 | |
| 677 | The Windows terminal UI is still missing. |
| 678 | |
| 679 | ACP and editor mode work on Windows. The part that is still missing is the interactive full-screen terminal UI. The blocker is Unix-specific terminal handling that has not been abstracted cleanly yet. |
| 680 | |
| 681 | ### Changes since 0.1.2 |
| 682 | |
| 683 | - Added Qwen 3 14B support |
| 684 | - Added Qwen 3 `<think>` block parsing and separate rendering in the TUI |
| 685 | - Moved all TUI code into `#[cfg(unix)]`, which fixed a pile of dead-code errors on Windows CI |
| 686 | - Added live download progress during model switches, including cancellation with Ctrl+C |
| 687 | - Added model download and loading progress in the Zed agent config panel |
| 688 | - Added an animated spinner during model switching |
| 689 | - Added Qwen 2.5 Coder 7B |
| 690 | - Added downloadable models to the picker, not just locally cached ones |
| 691 | - Made model selection persist across restarts |
| 692 | - Added session working-directory support |
| 693 | - Moved model picker logic into a platform-independent module so Windows can compile without the TUI |
| 694 | - Added the `/models N` shortcut for picking a model by number |
| 695 | - Added the `read_website` tool |
| 696 | - Improved `read_file` handling and empty-reply detection |
| 697 | - Added async tool execution |
| 698 | - Fixed CI cross-compilation for macOS, iOS, Linux, and Windows |
| 699 | - Added npm, PyPI, and Homebrew distribution |
| 700 | |
| 701 | --- |
| 702 | |
| 703 | *© 2026 PT Sigit Mitra Bangun ([siGit Code & Deploy](https://sigit.si)), distributed by [Splitfire AB](https://5mb.app).* |