CHANGELOG.md · sigitcodereview/sigit

Code Commits Issues Pulls Cloud Agent CI/CD

development

claude/github-issue-40-0au5ua claude/linked-issue-acp-tui-u4vvpa claude/minor-release-cut-vkugow claude/sigit-acp-local-chat-cx6380 claude/sigit-cloud-agent-expansion-reox0a claude/tool-permission-system claude/zen-feynman-0u78dk development feature/acp-cancel-request feature/acp-session-list-cursor feature/acp-v1-conformance feature/agent-tools-multiedit-glob-todos-remember feature/cargo-workspace feature/hooks feature/load-local-model-explicitly feature/sigit-agent-profile feature/sigit-code-cloud feature/xcode-mcp-server fix/acp-replay-loaded-session-history fix/acp-replay-reasoning-and-attachments fix/dsml-doubled-bar-markers main release/v1.5.10 release/v1.5.6 release/v1.6.1

md 1,208 lines 69.5 KB

Rendered Raw

1	# Changelog
2
3	## 1.6.8
4
5	### Fixed
6
7	- A bare launch of `sigit.exe` on Windows exits 0 instead of bailing. A
8	no-argument launch with a TTY stdin falls through to the non-Unix branch,
9	which has no TUI to start (the interactive client needs Unix-only fd
10	redirection). It now prints a short usage message pointing at ACP and
11	headless modes and exits 0, so winget's installer validator no longer reports
12	a `Validation-Executable-Error`.
13
14	### Changed
15
16	- winget submissions link back to their Package Request issue. The release
17	workflow scrapes the winget-pkgs PR URL from wingetcreate, opens a Package
18	Request issue on first submission, and rewrites the PR body to fill the
19	Description, tick the issue checkbox, and add `Resolves #NNN` — replacing the
20	manual per-PR edit that used to follow each release.
21	- **The winget release workflow files its Package Request issue first and uses
22	two scoped tokens.** The Package Request issue is opened before the
23	winget-pkgs PR so the PR can reference it immediately, and issue creation and
24	PR submission now use separate tokens (`WINGET_ISSUE_TOKEN` and
25	`WINGET_PR_TOKEN`) rather than one shared token.
26
27	## 1.6.7
28
29	### Fixed
30
31	- A cancel that arrives before the turn starts is no longer lost. A prompt
32	now registers for `session/cancel` as soon as it begins, not once it reaches
33	inference. A cancel that lands while the turn is queued on the workspace,
34	switching threads, loading a model, or running a slash command ends it with
35	`cancelled` instead of `end_turn`.
36	- Cancelling a turn stops the command it is running. A foreground
37	`run_command` used to run to its own end (up to two minutes) before the turn
38	noticed the cancel. A cancel or `session/close` now kills the process tree, or
39	sends `terminal/kill` when the command runs in the editor's terminal, and the
40	turn ends `cancelled` within a moment.
41	- Switching permission mode works while a turn is running. `session/set_mode`
42	and the Permissions config option queued behind the turn's session lock, so
43	choosing Auto while a permission prompt was open did nothing until the turn
44	ended. They now take no lock, are answered at once, and the pending call's
45	successors follow the new mode. Model and Inference changes still wait for
46	the turn.
47	- `authenticate` checks the method id. An id that `initialize` never offered
48	is now rejected with `invalid_params` (`-32602`) instead of starting a
49	browser sign-in. A sign-in that fails reports `-32603`, since `-32000` means
50	authentication is required before a call.
51	- A session the agent does not know is `-32002`. `session/prompt`,
52	`session/set_mode` and `session/set_config_option` answered `-32602` for an
53	unknown id; they now say resource not found, as `session/load` and
54	`session/resume` already did.
55	- A finished terminal command no longer names a released terminal. The
56	closing `tool_call_update` of a command that ran in the editor's terminal
57	re-sent the terminal id after `terminal/release`. It now leaves the content
58	alone, so the embedded terminal stays as it was, and the result still goes out
59	as `rawOutput`.
60	- `session/list` rejects a relative `cwd` filter with `-32602`, as
61	`session/new` does.
62	- An embedded binary resource is read when the model can read it. An image
63	blob becomes an image input and an audio blob an audio input. Any other blob
64	keeps its placeholder, now with its MIME type.
65	- A prompt that is only audio is answered. A clip with no text or image used
66	to end the turn at once with nothing sent to the model, even though the agent
67	advertises audio.
68
69	## 1.6.6
70
71	### Added
72
73	- A tool call carries its programmatic tool name. The `tool_call` an editor
74	gets for a running tool now includes `name` (`read_file`, `run_command`,
75	`mcp__…`) next to the human title, sent on the first report of the call only
76	as the protocol asks. A client can tell a command from a file edit without
77	parsing the title, and a replayed thread from `session/load` carries the same
78	name (#196).
79
80	### Changed
81
82	- MCP runs on `rmcp`, the official Rust SDK, through `ed-mcp`. siGit Code's
83	own JSON-RPC client for stdio and Streamable HTTP servers (about 600 lines)
84	is gone; `ed-mcp` is the layer every Onde agent shares. `mcp.toml`, the
85	baked-in `sigit` and `smbcloud` servers, tool names and `/mcp` are unchanged.
86	An HTTP server that stops answering is now reconnected and the call retried
87	once for any failure but a timeout, not only on a 404.
88
89	### Fixed
90
91	- A reply that degenerates into a repetition loop is cut off. After a tool
92	call, a model could fall into thousands of words from a tiny vocabulary
93	(`find: list: check: get: …`) with no tool call and no end, and the junk went
94	into history for the next turn. siGit Code now watches a streamed reply for a
95	window of 200 words with very few distinct ones (code blocks excepted), stops
96	reading, keeps only the text before the loop, tells you it stopped, and asks
97	the model once to make its call or answer briefly (#123).
98	- A linked selection written as `L10-L20` or `L10` reads just those lines.
99	siGit Code read the line range of a `resource_link` only as `L10:20` or
100	`L10-20`, so `L10-L20` (the GitHub style) and a single line `L10` sent the
101	whole file instead of the selection. It now reads the same forms Zed's own
102	mention parser does, and a range that starts at line 0 or runs backwards
103	counts as no range.
104
105	## 1.6.5
106
107	### Added
108
109	- An `@file` mention can carry unsaved edits. siGit Code now advertises
110	`promptCapabilities.embeddedContext`, so a client can put a resource's
111	contents in the prompt instead of sending a link to it. Before, a client
112	that follows the spec only sent `resource_link`, and siGit Code read the
113	file from disk, missing whatever the user had not saved yet (#141).
114	- A prompt can carry audio. siGit Code now advertises
115	`promptCapabilities.audio` and sends an attached clip to the model as an
116	OpenAI `input_audio` part. It works the way image attachments do: a model on
117	an endpoint you configure yourself gets the clip and decides for itself,
118	while siGit Code Cloud tiers and on-device models, none of which take audio
119	today, get a note in its place and the editor says the clip was left out
120	(#143).
121	- The README says what telemetry is sent. A new Telemetry section covers
122	the model-timing events Onde Inference can report for on-device models,
123	what they leave out, and how to turn them off with `ONDE_DISABLE_PULSE=1`.
124
125	### Changed
126
127	- A turn that cannot get its session back stops. A turn on an HTTP backend
128	gives up the process-wide working directory while it waits and reinstalls
129	its session before a tool runs. If the reinstall failed, the turn logged a
130	warning and carried on in whichever directory was current. Nothing makes it
131	fail today, since a close waits for the turn, but the turn now ends as
132	cancelled instead of depending on that.
133	- Dependencies match the rest of the Onde stack. Onde 1.2.2 to 1.3.1,
134	reqwest 0.12 to 0.13 and ratatui 0.29 to 0.30, the versions Ed, OndeCode and
135	SplitFire Agent use. ratatui is built with only its crossterm backend, which
136	drops the second copy of crossterm (0.28) from the build.
137
138	### Fixed
139
140	- Tags a model makes up no longer show in the reply. After a long run of
141	tool rounds, a model could start writing markup that looked like it came
142	from siGit Code: a `<system_warning>` block telling the user the previous
143	turn was injected and should be ignored, or a question wrapped in
144	`<Option_Picker>`. Neither tag means anything to siGit Code or the editor,
145	so both rendered as raw text. A `system_*` block is now dropped from the
146	reply and from the history, and other made-up tags are removed while the
147	text inside them stays. Code blocks are left alone. The system prompt also
148	tells the model to write plain Markdown and to list choices as plain text
149	(#122).
150	- Closing a thread that is waiting at a permission prompt no longer hangs.
151	`session/close` cancels the session's running turn and waits for it to end,
152	but a turn stopped at a permission prompt only went on when the client
153	answered the request. A client that closed the thread without answering
154	left the close, and every later request for that thread, waiting for good.
155	The same held for `session/cancel` with a client that did not send the
156	cancelled outcome the protocol asks for. The permission wait now ends on
157	the cancellation as well, and an approval that arrives after the turn was
158	cancelled runs nothing.
159
160	- A closed thread no longer leaves its request lock behind. The process
161	kept one lock per session id for as long as it ran, for closed threads and
162	for ids no session ever had. The entry now goes with the last request that
163	used it.
164
165	- A tool call that did not run no longer shows as completed. When policy
166	or plan mode denied a call, when the user picked Deny at the permission
167	prompt, or when the repeat guard skipped a call the model made three times,
168	the editor's card still ended `completed`. Those cards now end `failed`, the
169	same way a call cancelled at the prompt already did. A call denied at the
170	prompt also gets its own title back instead of keeping the permission
171	request's (#139).
172
173	- On-device inference no longer panics on some non-English text. siGit Code
174	now builds on Onde 1.3.1, which fixes a panic when a message longer than 100
175	bytes had a multi-byte character (an accented letter, CJK, or an emoji) at
176	byte 100. Onde 1.3 also reports Pulse events for streaming inference, which
177	is the path on-device turns take, so those turns are now reported alongside
178	model loads. `ONDE_DISABLE_PULSE=1` turns Pulse off.
179
180	## 1.6.4
181
182	### Added
183
184	- DeepSeek DSML tool calls written into the reply text are recovered. A
185	DeepSeek-family endpoint can render a tool call as literal
186	`<｜DSML｜tool_calls>` text instead of the structured `tool_calls` field,
187	which streamed the tag into the editor and ended the turn with nothing run.
188	The inline tool-call scanner that already recovered the GLM XML and Kimi K3
189	shapes now recovers the DSML shape too, including a marker split across
190	stream chunks. A block that fails to parse is still kept out of the reply
191	and the history, and the model is told the call did not run (#181).
192
193	### Fixed
194
195	- The round-cap stop message no longer carries a stray run of spaces.
196	When the tool-round cap ended a turn, the closing message could collapse a
197	space run into the wrong spot, which the editor then rendered verbatim
198	(#177).
199
200	## 1.6.3
201
202	### Added
203
204	- A client can resume a session and close one. siGit Code now advertises
205	`sessionCapabilities.resume` and `sessionCapabilities.close`.
206	`session/resume` restores a saved thread the way `session/load` does, but
207	sends none of it back: it is for a client that still has the thread on
208	screen, after an agent restart for example. `session/close` cancels the
209	session's running turn and drops what the process held for it, which is its
210	state, its permission grants and plan mode, the MCP servers the client named
211	for it, and the background commands it started. The saved history is left
212	alone, so a closed thread still lists and reopens (#149).
213
214	- The permission modes are also offered as ACP session modes. Manual, Auto
215	and Plan were only reachable as a config option, which is what the protocol
216	now recommends and what Zed reads. A client that draws the older mode
217	selector saw nothing. `session/new`, `session/load` and `session/fork` now
218	return the same three in `modes`, `session/set_mode` switches between them,
219	and a change made any other way (the config option, `/plan`, `/clear`,
220	`/reload`) is announced with `current_mode_update`. A client that reads
221	config options ignores `modes`, so nothing changes there (#148).
222
223	- An editor can sign out of siGit Code. The `initialize` reply carried an
224	empty `auth` object, so a client drew no sign out button, and typing
225	`/logout` was the only way out of an account. The reply now advertises
226	`agentCapabilities.auth.logout`, and a `logout` request ends the account
227	session through the method `/logout` calls. The request names no session,
228	so it moves every open thread that used the account, not only the live one:
229	a thread parked on a cloud tier goes on-device with the live thread instead
230	of failing to restore its tier on its next prompt, and every thread that
231	moved gets a fresh model picker. Local inference is switched back on if it
232	was off, so a thread opened after signing out asks for no cloud tier
233	(#150).
234
235	### Changed
236
237	- Two threads can run a turn at the same time. An editor runs one siGit
238	Code process for every thread it has open, and a single lock ordered every
239	turn-affecting request in it, so a second prompt waited for the first
240	thread's whole turn and two prompts never overlapped. The lock held what a
241	session installs process-wide — the working directory, the workspace roots,
242	the MCP servers the client named for it, the live backend — none of which a
243	turn touches while it waits on an HTTP endpoint, which is most of its time.
244	A session on an HTTP backend now keeps a backend of its own, so its
245	conversation is no longer swapped in and out of a shared one, and a turn
246	releases the process-wide lock while it waits on the endpoint or on a
247	permission answer and takes it back, reinstalling its session, before any
248	tool runs. On-device turns are unchanged, since the engine keeps one
249	conversation, and tool execution still runs one session at a time (#176).
250
251	### Fixed
252
253	- A prompt whose inference failed is kept through a model switch. A turn
254	that ended in an endpoint error stayed in the client's thread, but the
255	carryover into a new model dropped its trailing user message, and the error
256	path never saved the session. Only a cancelled prompt should be taken back
257	out, so cancellation now removes it from the live history, and the error
258	path persists the session (#124).
259
260	## 1.6.2
261
262	### Added
263
264	- `sigit --version` prints the release. `sigit --version` and `sigit -V`
265	print `sigit <version>` on stdout and exit 0. Before, the flag was not
266	recognized and siGit Code started a session, which left a script that asked
267	for the version waiting.
268
269	- File tools read and write through the editor when it offers to. An ACP
270	client that advertises `fs.readTextFile` or `fs.writeTextFile` serves those
271	requests from its open buffers. siGit Code always used the disk, so
272	`read_file` missed unsaved changes and `edit_file` wrote underneath a buffer
273	the user might have modified. `read_file`, `create_file`, `edit_file` and
274	`multi_edit` now go through the client for paths inside the session's roots.
275	The two capabilities are independent, and the disk is still the fallback:
276	for a path outside the roots, and for a request the client fails or leaves
277	unanswered for 30 seconds. `SIGIT_CLIENT_FS=off` keeps the file tools on
278	disk (#147).
279
280	### Fixed
281
282	- A file attached from the editor is found when its path needs escaping.
283	A `resource_link` was read by stripping `file://` and using the rest as the
284	path, so a space arrived as `%20`, a non-ASCII name failed, and a Windows
285	URI kept its leading slash. A `#` in a file name was also taken for the
286	line-range fragment. The URI is now parsed properly (#170).
287
288	## 1.6.1
289
290	### Added
291
292	- Images can be attached to a prompt in the editor. siGit Code now
293	advertises `promptCapabilities.image`, so an ACP client offers image
294	attachments. The image goes to the model when the active model reads images.
295	The model picker marks those models with "reads images". The on-device
296	models and four cloud tiers (`nova`, `orbit`, `apex`, `flux`) are text-only:
297	with one of them active the image is left out, a note in the thread says so,
298	and the model is told an image was withheld. Switching a thread that already
299	holds images to a text-only model flags that once as well. Cloud tiers need
300	siGit Code Cloud to accept image parts, which is rolling out separately
301	(#134).
302
303	- The tool-round cap of a headless run can be set. `--max-tool-rounds <n>`
304	or `SIGIT_MAX_TOOL_ROUNDS` (1 to 500) replaces the built-in 24 for
305	`sigit run` and `sigit -p`. The flag wins over the variable.
306
307	### Fixed
308
309	- A prompt turn now reports why it stopped. ACP defines five stop reasons
310	and siGit Code only ever sent `end_turn` and `cancelled`. A turn that runs
311	into the tool-round cap now ends with `max_turn_requests`, a reply cut off
312	at the token limit with `max_tokens`, and a reply the endpoint withheld
313	(`content_filter`) with `refusal`. A refused turn is also taken out of the
314	conversation, which is what the protocol tells the client to expect (#140).
315
316	- A tool call that needs approval is one card, not two. The permission
317	request carried an id of its own, so an ACP client showed an approval card
318	beside a call that already claimed to be running. The call is now announced
319	as `pending`, the permission request names that same call, and it moves to
320	`in_progress` once approved. Calls allowed by policy still start out
321	`in_progress` (#138).
322
323	- A turn that runs out of tool rounds says so. In an editor, a long task
324	could stop on a line like "Now commit:" with nothing after it. The turn had
325	used all 24 tool rounds, the model spent its last reply announcing the next
326	step, and the call behind it was dropped. siGit Code now tells the model
327	that its rounds are used up before that last reply, and ends the turn with a
328	message saying why it stopped and that "continue" picks it back up.
329	`SIGIT_MAX_TOOL_ROUNDS` now sets the cap for editor sessions too (#120).
330
331	- A headless run no longer ends silently with no final message. When the
332	last round came back empty, which is what happens when a run is cut off at
333	the tool-round cap mid-task, stdout was empty and the exit status was 0, so
334	a caller could not tell it from a run with nothing to report. siGit Code now
335	asks the model once for its final message before finishing.
336
337	## 1.6.0
338
339	### Added
340
341	- Editors can pass HTTP MCP servers to a session. siGit Code now
342	advertises `mcpCapabilities.http`, so an ACP client may list Streamable HTTP
343	servers in `mcpServers` next to stdio ones. They are connected with the URL
344	and headers the client sent and are scoped to that session, like the stdio
345	ones. SSE is still not advertised, since the MCP spec deprecated it (#151).
346
347	- The plan panel survives a failed turn. The last `write_todos` list is
348	now kept by siGit Code itself. When a turn ends in an endpoint error before
349	the model gets to call `write_todos` again, the saved list is sent to the
350	editor again, so the plan stays on screen where it used to go blank (#132).
351
352	### Changed
353
354	- The ACP Rust SDK is now 2.2 (`agent-client-protocol`, up from 1.3).
355	siGit Code still speaks ACP protocol v1 to the editor, so nothing changes on
356	the wire. The `unstable_auth_methods` feature is gone because agent auth
357	methods are stable in 2.x.
358
359	### Fixed
360
361	- MCP servers the editor passes to a session are connected. ACP clients
362	can name MCP servers in `mcpServers` when they open a session, and agents
363	are required to connect to the stdio ones. siGit Code accepted the field and
364	ignored it. The servers are now spawned when the session opens, their tools
365	are offered to that session only, and `/mcp` lists them as coming from the
366	editor. `SIGIT_MCP=off` still turns all of it off (#135).
367
368	- A relative `cwd` is rejected when a session starts. ACP requires the
369	working directory and every `additionalDirectories` entry to be absolute.
370	`session/new`, `session/load` and `session/fork` used to accept a relative
371	one and resolve it against wherever the editor spawned the process. They now
372	answer with an invalid-params error (#136).
373
374	- Loading a session that does not exist is an error. `session/load` with
375	an id that was never saved used to succeed and open an empty session under
376	that id, so the editor showed a blank thread that looked restored. It now
377	answers "not found" (`-32002`). A thread opened in the running process but
378	not spoken in yet still loads (#137).
379
380	- Compaction no longer dead-ends a long session. The summarization request
381	used to carry the whole conversation, which by then was already over the
382	model's window, so siGit Code Cloud timed out with a 504 and the session
383	stopped with "start a new thread". The transcript sent for summarizing is
384	now capped, cut from the middle so the opening request and the latest state
385	are kept. If summarizing still fails, the oldest messages are dropped until
386	the history fits, with whole tool rounds removed together. A failed attempt
387	leaves the conversation as it was (#125).
388
389	- Gateway error pages stay out of the chat. When an endpoint answers with
390	an HTML error page, the error shown is the status line, not the page's
391	markup (#125).
392
393	- Issue and pull request work no longer assumes GitHub. The system prompt
394	treated forge features as if every repository lived on GitHub, while the
395	built-in `mcp__sigit__*` tools only work for repositories hosted on
396	sigit.si. The agent now checks the remote first, uses those tools only for
397	sigit.si repositories, and reaches for the forge's own CLI (`gh`, `glab`,
398	`tea`) elsewhere (#127).
399
400	## 1.5.13
401
402	### Added
403
404	- Three more siGit Code Cloud tiers: `flare`, `zenith` and `prism`. They
405	show up in `/models` and in the editor's model picker alongside the existing
406	tiers. Selecting one needs a signed-in account, as before.
407
408	## 1.5.12
409
410	### Fixed
411
412	- **The Windows binaries start on machines without the Visual C++
413	Redistributable.** They used to import `VCRUNTIME140.dll` and the UCRT
414	`api-ms-win-crt-*` DLLs, so a clean Windows install refused to load them
415	with `STATUS_DLL_NOT_FOUND` (0xC0000135). That is what failed winget's
416	post-install check. The C runtime is now linked statically, and CI and the
417	release build fail if a Windows exe picks up that dependency again.
418
419	- Watching a slow background command no longer ends the turn early.
420	Polling `command_output` on the same task id three times tripped the
421	repeated-tool-call guard, which refused the call and dropped tools for the
422	rest of the turn. `command_output` now long-polls — it waits up to
423	`wait_seconds` (default 10, max 30) for the task to exit, then returns
424	everything printed in the meantime — and the repeat guard exempts it, since
425	polling the same task is the whole point of the tool.
426
427	- A turn that ends with no visible text says why. When the
428	repeated-tool-call guard blocked a call and the forced no-tools round came
429	back empty, sigit sent nothing more — the turn just stopped with no answer
430	and no question. When the last round of a tool-using turn produces no
431	visible text, sigit now sends a short closing message naming the repeated
432	tool and asking you to reply "continue" or redirect.
433
434	## 1.5.11
435
436	### Added
437
438	- `sigit run` drives the agent headlessly with resumable sessions. A new
439	non-interactive subcommand runs a prompt through the same agent loop as the
440	editor and terminal surfaces, for scripts, CI, and Factory clients. Every run
441	gets a UUID session id, writes a JSON-lines history file under
442	`~/.config/sigit/sessions/`, and can be restored with `--resume <id>`.
443	`--output jsonl` emits a structured session/delta/tool/result stream on
444	stdout while logs stay on stderr, and `--allow-tool` pre-approves a tool so
445	permission prompts collapse to denial in a non-interactive context. The
446	legacy `-p` form still works. Each run also rewrites the session metadata
447	with its own cwd and extra roots, so resuming keeps multi-root projects
448
449	- Saved threads can be imported into the editor. siGit Code now advertises
450	ACP's `sessionCapabilities.list` and answers `session/list`, so Zed's "Import
451	Threads" picker offers the conversations stored under
452	`~/.config/sigit/sessions/` instead of reporting that the agent doesn't
453	support the capability. A saved session gets a sidecar recording the project
454	directory it ran in — listing reports that `cwd`, the extra roots of a
455	multi-root project, an ISO 8601 last-activity timestamp, and a title taken
456	from the first user message — and a request may filter on `cwd` so one
457	project is never offered another's threads. Threads saved before this have no
458	sidecar and are not listed; they still reopen by id through `session/load`
459
460	### Changed
461
462	- The commit trailer names the siGit Code version and surface. Commits
463	siGit Code makes now end with
464	`Co-Authored-By: siGit Code v<version>-<surface> <noreply@sigit.si>` instead
465	of the bare name, where the surface is `acp` (an editor), `tui` (the
466	terminal UI), or `headless` (`sigit run`). The model changes from session to
467	session; the version and surface tell you which build of the agent wrote the
468	commit and how it was driven. GitHub still credits the co-author, since it
469	matches on the address. A commit that already carries a siGit Code trailer
470	from an older version is left alone
471
472	- The terminal UI's model knows which directory the project is in. The
473	editor (ACP) and headless paths put the working directory in the system
474	prompt, but the terminal UI only added the project's instruction files, so
475	on `/init` a small on-device model invented a `AGENTS.md` path and failed.
476	All three places the terminal UI builds a prompt now go through the same
477	session context path the ACP sessions get. The cloud tier switch had also
478	been dropping the instruction files; that's fixed too
479
480	- An empty `write_todos` list clears the plan. `write_todos` rejected an
481	empty list, so the model had no way to clear a finished checklist and the
482	last plan stayed in the editor until the session ended. An empty list now
483	returns "Task list cleared." and goes to the client as an ACP plan with no
484	entries. The tool description tells the model it can do this
485
486	- `sigit run` gives clearer usage errors. A second positional prompt says
487	"unexpected extra argument", a bare `sigit run` says "missing prompt", and a
488	mistyped flag like `--quite` is rejected instead of becoming the prompt
489
490	### Fixed
491
492	- Each ACP session keeps its own roots, conversation, and tasks. Zed runs
493	one siGit process for every open thread, but the process had a single cwd,
494	workspace root list, backend conversation, and background task table. The
495	most recent session owned all of them, so a prompt from an older thread ran
496	against another repo with another thread's history. A `SessionState` is now
497	kept per session id; before a prompt or config change runs, the live
498	conversation is parked and the requested session's cwd, extra roots, and
499	conversation are installed, rebuilding the system prompt from its roots.
500	`new`/`load`/`fork` share a single session-opening path, and fork carries the
501	source thread's conversation. Background tasks are scoped to the session that
502	started them, opening a session no longer wipes every other session's
503	permission grants, and model selection is routed per session
504
505	- New sessions no longer carry the previous thread's history. Opening a
506	new thread in Zed showed a `[Conversation summary]` from an earlier session.
507	The session handlers cleared the on-device engine but not the history a cloud
508	backend keeps for itself, and the startup routing to the cloud tier then
509	carried that history into the installed backend. A provider override had the
510	same leak. All session entry points now share a path that strips stale
511	history too, and unknown session ids are rejected instead of borrowing the
512	live thread's state
513
514	- Unparseable tool-call markup is hidden and retried, not shown as text.
515	Some models write tool calls into the reply as text. Well-formed blocks were
516	already recovered and run, but a block that failed to parse or never closed
517	was printed to the editor as-is and stayed in history, so the model later
518	read back a call it had "made" with no result and began writing invented
519	`<function_results>`. The scanner now reports those blocks as malformed; the
520	backend drops them from the reply and history, and when the only tool call
521	was malformed the model gets one retry telling it the call didn't run. A
522	block that merely mentions a tool-call marker (a backticked `<tool_call>` or an
523	unclosed XTML `<\|open\|>tools`) is now kept as prose, so a reply explaining
524	the scanner no longer loses everything after the first marker. The
525	non-streamed path now strips broken blocks beside structured calls and runs
526	any inline calls that did parse, matching the streaming path
527
528	- The co-author trailer ends a conflicted merge commit. Finishing a
529	conflicted merge with `git commit --no-edit` keeps git's `# Conflicts:` list
530	in the message, since no editor runs to strip it. When siGit Code then added
531	its trailer, the trailer went in above that list, so it was no longer the last
532	paragraph and GitHub didn't credit the co-author. The amend now drops the
533	leftover comment block and puts the trailer last. It also fixes a commit
534	that already has the trailer but still ends in that block
535
536	## 1.5.10
537
538	### What changed
539
540	- Xcode's context no longer buries slash commands. Xcode sends the user's
541	prompt as the last of several text blocks, with project context in the
542	blocks before it, so `/models` and friends sat in the middle of joined text
543	and were handed to the model instead of dispatching locally. Slash-command
544	parsing now searches the prompt's text blocks from the end, so a standalone
545	command in the final user block dispatches no matter what context the client
546	prepends
547	- The nova tier is the default cloud engine. When local inference is off
548	and no explicit provider override is set, the cloud tier now defaults to
549	`nova` (the `onde-nova` model) instead of the balanced tier, in both the
550	interactive and headless paths
551
552	### Fixed
553
554	- Malformed Chinese-model tool calls are handled end-to-end in ACP. The
555	inline-call recovery that 1.5.9 added for Kimi K3's XTML protocol and GLM's
556	mis-tagged blocks only applied to the interactive and headless surfaces;
557	the ACP path never ran it, so an editor session still surfaced raw protocol
558	text and dropped the calls. Recovery now runs in the ACP prompt loop too,
559	covered by integration tests, and the tool names are checked against the
560	turn's offered tools before anything executes
561	- Suppressed tool-call log spam is gone. The guard that logs when a
562	structured call is dropped for arriving as forced text fired once per
563	streamed argument fragment — one malformed call could log a warning per
564	chunk. The check now fires once per turn with the count and names of what
565	was dropped, and the non-streaming path reports the same
566	- A history-replay test no longer races on the process cwd. One ACP test
567	built its expected path from `std::env::current_dir()` while other tests
568	briefly swap that process-global cwd, so on CI it could read a temp
569	directory mid-swap and compare a truncated title against an untruncated
570	expectation. It now uses a fixed path it never needed to derive
571
572	## 1.5.9
573
574	### Fixed
575
576	- Kimi K3 tool calls no longer arrive as raw protocol text. Kimi K3 renders
577	a call in Moonshot's XTML protocol — pipe-delimited open/sep/close tokens
578	wrapping named blocks — and when the serving stack doesn't parse that back
579	into structured tool calls, the whole block surfaced in the editor as literal
580	text and the turn ended as though the model had answered in prose. The
581	inline-call recovery now speaks that protocol alongside the legacy XML tags:
582	tools blocks are parsed into real calls (several per block, argument values
583	decoded and typed from the block's own type attribute or, when it is
584	missing, the turn's tool schemas), response blocks are unwrapped so their
585	text still renders, and think blocks are dropped as private reasoning rather
586	than shown. The streaming scanner watches all the opening markers, so a
587	block split across chunk boundaries still recovers
588	- GLM's mis-tagged calls recover too. GLM sometimes precedes the legacy
589	block's first argument key with another tool-call opening tag instead of the
590	arg-key opening tag the format calls for, and the recovery rejected the
591	whole block when it did — the call surfaced as text and whatever it was
592	trying to do was dropped. The parser now accepts that alias for the first
593	argument only — later arguments stay strict, so text that merely resembles a
594	call cannot be recovered as one — in both the whole-blob and streaming
595	paths, and the scanner tolerates the malformed marker split across chunk
596	boundaries. Recovery in both protocols also checks the call's name against
597	the tools actually offered in the turn: a tag naming a tool that was never
598	in the turn's spec stays on screen instead of being executed
599
600	## 1.5.8
601
602	### What changed
603
604	- Editor panels can switch permission mode without a slash command. ACP
605	clients now get a Permissions selector next to the model controls with
606	Manual, Auto, and Plan choices for the current session. Manual keeps the
607	existing approval prompts, Auto lets mutating tools run unattended while
608	still respecting explicit deny rules in `settings.toml`, and Plan keeps the
609	agent in research-only mode. The selector follows `/plan` and `/clear`, and
610	it is deliberately session-scoped so a risky Auto choice does not persist
611	into the next task
612	- Tool calls in the editor are worth opening now. Zed only drew the
613	disclosure arrow on the handful of cards siGit set `content` on — the model
614	download and switch spinners — because everything else carried nothing but
615	`rawInput` and `rawOutput`, fields ACP gives clients no display guidance for.
616	Every tool call now gets a fenced content block: the pretty-printed arguments
617	while it runs, then the tool's output once it finishes, with a `(no output)`
618	placeholder for a silent command like `git add`. Cards are titled
619	`<tool> · <arg>` rather than the bare tool name, path-bearing tools set
620	`locations` so the editor can follow along, and a replayed session gets the
621	same treatment as a live one
622	- The context window is visible before compaction fires. Both model pickers
623	show each model's window, and the TUI title bar has a gauge for how much of
624	it the conversation is using. Cloud tiers report their own window instead of
625	the compaction budget — the budget is when siGit Code summarizes history, not
626	how much the model can hold, and labelling one with the other understated the
627	window by an order of magnitude
628	- `write_todos` renders as a plan, not a tool card. Zed and other clients
629	have real progress UI for `session/update` plans, so the model's todo list
630	goes there
631	- Picker changes read as status rather than chat. Switching model or
632	inference backend is UI state, so it renders as a completed think-kind tool
633	call. The sign-in prompt stays an assistant message, since it needs the user
634	to act on it
635
636	### Fixed
637
638	- A reopened thread comes back with its history. Clicking a saved thread in
639	Zed sends `session/load`, and the client draws the thread purely from the
640	`session/update` notifications the agent streams while that request is in
641	flight. siGit restored the saved history into the backend, which is what
642	makes the model remember, but sent the client nothing — so the thread opened
643	empty and looked like a brand new conversation. The snapshot is now turned
644	into updates before it is restored: user and assistant text as message chunks
645	with reasoning stripped, each tool call completed with its result folded in,
646	and `write_todos` as a plan the way it renders live. System messages stay
647	out, since they seeded the model and were never on screen
648	- Compaction no longer fails in every session that ran a tool.
649	`compact_history` asked for the summary through `complete(None, None)`, which
650	sends no tools array but left the live history in place. That history is
651	thick with assistant `tool_calls` and `role: "tool"` messages, and an
652	endpoint handed tool shapes with no schema to check them against rejects the
653	request — Anthropic answers 400. So compaction failed on every attempt in any
654	session that had run a single tool, however small the history was, and then
655	retried on every prompt and tool round while that history kept growing. The
656	conversation now goes as a flattened transcript in one user message, which
657	keeps what the summary needs and drops the shapes that only mean anything
658	next to a tool schema
659	- A tool call emitted as text is no longer dropped. Qwen 3, GLM and
660	DeepSeek write a call as `<tool_call>NAME<arg_key>…` in their chat template
661	and rely on the serving stack to parse it back into `tool_calls`. When that
662	doesn't happen the tag arrives as ordinary content, so it was rendered
663	verbatim in the editor and the turn ended as though the model had chosen to
664	answer in prose. Both the streaming and non-streaming paths now scan content
665	for those blocks and turn well-formed ones back into real calls, typing
666	argument values from the turn's own tool schemas. The streaming scanner holds
667	back only enough text to catch a tag straddling a chunk boundary, so ordinary
668	answers still stream token by token. A block that doesn't match the expected
669	shape is left in the text untouched: reissuing a `run_command` is cheap, but
670	guessing wrong at a half-parsed `edit_file` would write the wrong change to a
671	file
672	- Tool-call content survives awkward output. Whitespace-only output is
673	preserved rather than collapsed, malformed arguments no longer get a
674	misleading JSON fence, and fence language identifiers are sanitized
675
676	## 1.5.7
677
678	### What changed
679
680	- `@smbcloud/sigit` gets releases again. The npm scope moved to
681	`@getsigit` in 1.5.5 and the old package was left sitting on the registry at
682	1.5.2, so an install made before the rename went quiet — `npm update` had
683	nothing to give it and nothing said why. All seven packages now publish under
684	both scopes from the same build, so `@smbcloud/sigit` is a full install again
685	rather than a stub, with its own platform binaries and no dependency on the
686	new scope. It prints a line on stderr saying where the package moved to;
687	`SIGIT_SUPPRESS_SCOPE_NOTICE=1` turns that off. This is a migration path, not
688	a second home: `@getsigit/sigit` is what the docs, the Homebrew tap, and the
689	ACP registry entry point at, and it is the name to move to
690	- Multi-root projects now work in the editor. When a client opens several
691	directories in one project, ACP sends the extra ones as
692	`additionalDirectories` — but only to an agent that says it wants them, which
693	siGit never did, so Zed kept the first root and showed a banner saying
694	multi-root workspaces were unsupported. The capability is now advertised at
695	`initialize`, and the directories that arrive are no longer logged and thrown
696	away. All the roots are now part of the session: the model is told about each
697	one, every root's `AGENTS.md` / `CLAUDE.md` is loaded, and skills, slash
698	commands, and subagent types are discovered from all of them (primary root
699	first, so it still wins name collisions). `/status` lists the roots when
700	there is more than one, and headless runs take the same thing as repeatable
701	`--add-dir <dir>` flags. MCP servers are the exception: discovery happens
702	once at startup, before a session exists, so a second root's `.sigit/mcp.toml`
703	is not picked up
704
705	### Fixed
706
707	- A shell command can no longer wedge the editor session. Tool commands
708	inherited siGit's own stdin, which in ACP mode is the JSON-RPC pipe from the
709	editor. A command that read stdin — a signing passphrase prompt, a pager, a
710	`git` credential ask — blocked on it and consumed the client's next request
711	out of the pipe, so nothing typed afterwards ever reached the agent and the
712	session stayed dead past the command timeout. Commands, hooks, and the
713	co-author `git` helpers now run with stdin closed, so a command that wants
714	input gets EOF and reports an error instead
715	- A command that prints a lot no longer stalls for two minutes.
716	`run_command` waited for the command to exit before reading its output, so
717	anything past the pipe buffer (a build, a verbose test run) blocked writing
718	while siGit blocked waiting, until the 120-second timeout killed it. Output
719	is now drained while the command runs
720	- The command timeout now stops the whole command. It killed only the
721	shell, leaving anything that shell had started running and unreaped; it now
722	kills the process group
723	- A refused turn now shows the endpoint's own message. siGit pasted the
724	status line and the raw JSON body into the editor's error banner, so a
725	billing or allowance message arrived wrapped in
726	`endpoint returned 429 Too Many Requests: {"error":{"message":…`. The message
727	the endpoint wrote is what the banner shows now; the status is only used when
728	there is no message to show
729	- An error that arrives mid-stream is no longer silent. An endpoint that
730	fails after the response is already open reports it as a frame in the stream.
731	That frame carries no `choices`, so siGit parsed it as an empty chunk and
732	skipped it, and the turn ended as though the model had answered with nothing
733
734	## 1.5.6
735
736	### What changed
737
738	- Switching models mid-conversation no longer restarts it. Both switching
739	to a local GGUF model and picking a different cloud tier now carry the live
740	conversation history across, repairing any half-finished tool call so
741	strict OpenAI-compatible endpoints don't reject the session
742	- Long-running tools now show progress in ACP clients. Synchronous tools
743	(shell commands, file operations, `read_website`, ...) run on a blocking
744	thread pool instead of the ACP connection's own task, so a slow command's
745	`in_progress` update reaches the client — and Zed's spinner — while the
746	command is still running instead of arriving with the result
747	- Text from consecutive tool rounds no longer runs together. ACP and
748	headless clients concatenate consecutive message chunks, so a reply that
749	continued after a tool call used to glue onto the previous round's last
750	sentence with no space. A blank line now opens the next round's text
751	- New onde-cloud model tiers. The model picker (`/models` in the TUI, the
752	config panel in editors) now offers five additional siGit Code Cloud tiers —
753	`flux`, `apex`, `aura`, `orbit`, and `nova` — alongside the existing Fast,
754	Balanced, Large, Mini, Air, Pro, and KKK options. The tier list mirrors
755	onde-cloud's router catalogue, so all three sides (the picker, the router,
756	and the cloud catalogue) have to be updated together when a tier is added
757	- MCP Registry listing moved to `getsigit/si`. The `server.json` manifest
758	and its `release-mcp-registry.yml` publish workflow now live in the
759	[`getsigit/si`](https://github.com/getsigit/si) repo alongside the si CLI's
760	other code, since the registry entry describes the si platform rather than
761	the coding agent
762
763	## 1.5.5
764
765	A distribution release. siGit Code itself is unchanged. What moved is how it
766	reaches you on npm and on Windows.
767
768	### What changed
769
770	- The npm package is now `@getsigit/sigit`. The six platform packages moved
771	with it. `@smbcloud/sigit` stays on the registry but stops receiving updates,
772	so upgrading means switching names:
773	`npm uninstall -g @smbcloud/sigit && npm install -g @getsigit/sigit`. The old
774	package had been stuck at 1.5.2, so this picks up 1.5.3 and 1.5.4 as well.
775	- npm publishes over OIDC. Every `@getsigit/*` package has a trusted
776	publisher pointing at the release workflow, so no npm token is stored in the
777	repository. The release workflow moves to Node 22, which trusted publishing
778	requires.
779	- winget releases actually go out. The workflow could only update a package
780	already present in `microsoft/winget-pkgs`, and siGit Code had never been
781	submitted there, so every dispatch failed. It now submits the package the
782	first time and updates it on later releases. The identifier is
783	`getSigit.siGitCode`.
784
785	## 1.5.4
786
787	- CI: nfpm config expanded to include package version and binary path
788
789	## 1.5.3
790
791	Adds browser-based sign-in, expands distribution channels to Windows (winget,
792	Scoop), Linux (AUR, deb, rpm), and .NET (NuGet), gives ACP clients live
793	visibility into tool activity, adds the KKK and Moonshot AI cloud tiers, and
794	fixes the co-authored-by trailer email.
795
796	### What changed
797
798	- Browser sign-in: `sigit login` now opens a browser OAuth flow (PKCE S256
799	against the siGit Code Cloud authorization server) so you can sign in without
800	a password. A loopback listener catches the redirect automatically; a
801	paste-back fallback handles environments where a loopback isn't reachable.
802	`--paste` forces the paste path, `--password` keeps the old email/password
803	prompt. Zed's "Sign in to siGit Code" button uses the loopback path via ACP
804	`authenticate`
805	- New release channels: siGit Code is now published to winget
806	(`getsigit.siGitCode`), Scoop (`getsigit/scoop-bucket`), the AUR
807	(`sigit-bin`), and as `.deb`/`.rpm` packages alongside the existing
808	Homebrew, npm, PyPI, crates.io, and NuGet channels
809	- NuGet .NET tool: `dotnet tool install --global SiGit.Code` now works on
810	Windows, macOS, and Linux — the package bundles all six platform binaries and
811	a managed shim that execs the right one, leaving stdin/stdout/stderr
812	unredirected so TUI vs ACP mode detection still works
813	- New cloud tiers: the model picker (`/models` in the TUI, the config
814	panel in Zed) now offers the `onde-kkk` (KKK) and Moonshot AI (`oke`) tiers
815	alongside the existing Fast, Balanced, Large, Mini, Air, and Pro options
816	- ACP tool visibility: the agent loop now emits `ToolCall(InProgress)`
817	before each tool runs and `ToolCallUpdate(Completed/Failed)` after it
818	returns, so clients like Zed gain live visibility into tool activity between
819	inference rounds. `tool_choice: "auto"` is also sent explicitly whenever
820	tools are present, fixing models that describe actions in prose rather than
821	issuing a tool call when the field is absent
822	- Malformed tool argument logging: invalid tool argument JSON is now logged
823	at three sites (TUI pretty-printer, ACP tool-call event, permission request)
824	instead of silently falling back to a string value, making malformed payloads
825	visible in logs while preserving backward-compatible behaviour
826	- Co-authored-by trailer fix: the `Co-Authored-By` trailer email was
827	updated to `noreply@sigit.si` (platform-neutral); the commit attribution
828	check was tightened to use idiomatic ownership
829	- NuGet trusted publishing: the NuGet release workflow now exchanges a
830	GitHub OIDC token for a short-lived NuGet API key (via `NuGet/login`) instead
831	of relying on a long-lived `NUGET_API_KEY` secret, so there is no stored
832	credential to rotate or leak
833	- AUR dispatch temporarily disabled: the AUR release workflow is no longer
834	dispatched from `release-github` while new AUR account registration is
835	closed; the `sigit-bin` channel returns once registration reopens
836	- Legal and branding copy updated
837
838	## 1.5.2
839
840	Brings the latest siGit Code Cloud tiers to the picker and aligns the MCP
841	registry metadata with the server release.
842
843	### What changed
844
845	- `/models` now lists the Pro, Air, and Mini siGit Code Cloud tiers alongside
846	Fast, Balanced, and Large
847	- Updated the MCP registry manifest to version 1.2.5, matching the siGit Code
848	Cloud server release
849	- Updated the Agent Client Protocol SDK to the latest v1 release
850
851	## 1.5.1
852
853	Makes siGit Code work as an Xcode custom agent, and updates the Onde SDK.
854
855	### What changed
856
857	- Xcode can now run siGit Code as a custom agent. Point it at the binary with
858	`--acp` as the argument, and that explicit mode loads the selected on-device
859	model on the first prompt, since Xcode's chat has no equivalent of `/load`.
860	The README covers the setup, including wiring up `xcrun mcpbridge` in
861	`mcp.toml` so the agent can use Xcode's build, test, and project tools
862	- MCP calls to the `xcode` server time out after 30 seconds instead of 120, so
863	a request Xcode cannot service no longer leaves the prompt looking busy for
864	two minutes. String JSON-RPC ids from the bridge are handled too
865	- The agent stops repeating itself: a tool call made three times with identical
866	arguments now forces a text reply instead of looping
867	- Onde SDK bumped to 1.2.2
868	- The registry listing in `server.json` matches what sigit.si publishes
869
870	## 1.5.0
871
872	Opens the agent up to user extension: lifecycle hooks, custom slash commands,
873	and configurable subagent types. Also adds web search, a Repo tab in the TUI,
874	and a baked-in smbCloud MCP server.
875
876	### What changed
877
878	- Hooks let you run shell commands at three points in the agent's lifecycle:
879	`session_start`, `pre_tool_use`, and `post_tool_use`, configured under
880	`[hooks]` in `settings.toml`. Commands get context through variable
881	substitution (`{cwd}`, `{tool_name}`, `{tool_result_len}`) and run in the
882	session working directory. A hook that fails is logged and the session
883	continues; a hook that hangs is killed on a timeout, along with its whole
884	process group
885	- User-defined slash commands: drop a Markdown file in `.sigit/commands/` or
886	`.claude/commands/` (or the personal `$SIGIT_CONFIG_DIR/commands/` and
887	`~/.claude/commands/`) with optional `description` and `argument-hint`
888	frontmatter, and the body becomes a prompt template. `$ARGUMENTS` takes the
889	whole argument string and `$1`..`$9` the positional words. A subdirectory
890	namespaces the command with `:`, so `.sigit/commands/git/commit.md` becomes
891	`/git:commit`. They run as ordinary agent turns through the usual tools and
892	permission checks, and are advertised to ACP clients like Zed. `/commands`
893	lists what was discovered
894	- Configurable subagent types for the `task` tool: a Markdown file in
895	`.sigit/agents/` or `.claude/agents/` with `name`, `description`, and an
896	optional `tools:` allow-list, whose body becomes that subagent's system
897	prompt. Pass its name as `subagent_type` to swap the prompt in. The
898	`tools:` list can only narrow the subagent's read-only ceiling, never widen
899	it, so a config file cannot grant itself `edit_file` or `run_command` and
900	route around the permission system. `/agents` lists the discovered types
901	- New `web_search` tool, backed by the Brave-Search-backed search on siGit
902	Code Cloud's MCP server. It is offered only when you are signed in, and it
903	is classified read-only, so searching never triggers a permission prompt
904	- The TUI gains a Repo tab, shown when the session's `origin` remote points at
905	the sigit.si host. It lists issues and pull requests fetched through the
906	official MCP server: Up and Down select, Enter opens a scrollable detail,
907	`i`, `p`, Left and Right switch sections, `r` refreshes. The tab is hidden
908	and skipped in the cycle for any other remote
909	- The smbCloud CLI's stdio MCP server (`smb --mcp`) is now baked in, so
910	smbCloud project and deployment tools work with no `mcp.toml` setup. It is
911	added only when the `smb` binary is on `PATH`, its read-only tools (`me`,
912	`deployments`, `project_list`, `project_show`) skip permission prompts, and
913	you can opt out with `smbcloud = false` in `mcp.toml` or
914	`SIGIT_MCP_SMBCLOUD=off`
915	- siGit Code Cloud's MCP server is now listed in the public MCP Registry as
916	`si.sigit/sigit`, published from `server.json` at the repository root
917
918	### Fixes
919
920	- An explicit `deny` rule now applies to read-only first-party tools instead
921	of being skipped
922	- A subagent type whose `tools:` list resolves to an empty set is rejected
923	rather than producing a subagent with no tools
924	- Command templates render in a single substitution pass, so an argument that
925	contains something like `$1` is no longer re-substituted
926	- Frontmatter is stripped with the same leniency it is parsed with
927	- The Repo tab's detail view no longer shows stale data after a refresh
928
929	## 1.4.1
930
931	Two small fixes: correct co-author attribution and a Homebrew tap fix.
932
933	### What changed
934
935	- The `Co-Authored-By` trailer siGit Code adds to commits now uses the GitHub
936	noreply address for the [sigitc](https://github.com/sigitc) account instead
937	of `sigit@sigit.si`, so GitHub reliably attributes co-authored commits to
938	the siGit Code profile
939	- Fixed the Homebrew tap install docs to trust the tap with `brew trust`
940	instead of a `brew tap --force` flag
941
942	## 1.4.0
943
944	Adds a headless one-shot mode, fine-grained permission rules, stdio transport
945	for MCP servers, an `/init` command, and a set of TUI upgrades: tabs, a live
946	thinking display, and collapsible tool calls.
947
948	### What changed
949
950	- New headless mode: `sigit -p "prompt"` runs one agent turn with tools and exits — 0 on a completed turn, 1 on inference errors, 2 on bad invocations. Assistant text streams to stdout while logs and tool progress stay on stderr; `--cwd` sets the working directory and `--quiet` prints only the final message. Nobody can answer a permission prompt in a headless run, so `ask` collapses to a denial: grant tools for the run with `--allow-tool`, block them with `--deny-tool`, or use `SIGIT_PERMISSIONS=allow`
951	- Permission rules make autonomy granular: `[permissions.rules]` in `settings.toml` holds ordered `allow` and `deny` lists of `tool_name(pattern)` entries, e.g. `run_command(git )` or `edit_file(src/)`. Patterns match the command string for `run_command` and the path for file tools; deny always beats allow, and unparseable patterns fail closed, so a bad rule can only narrow access. Always-allow on a `run_command` prompt now grants that command family (its first two tokens), not the whole shell
952	- The MCP client speaks stdio: `mcp.toml` server entries can give a `command`, `args`, and an `env` map instead of a `url`, so the stdio-first majority of published MCP servers plugs in. Same handshake, timeouts, tool namespacing, and output caps as HTTP; `/mcp` shows the command line for stdio servers
953	- New `/init` command (TUI and ACP): runs a normal agent turn that explores the repository and writes an `AGENTS.md` — or improves an existing `AGENTS.md`/`CLAUDE.md` in place — going through the ordinary tools and permission checks
954	- The TUI gains tabs, cycled with the Tab key: Session is the chat, History lists saved sessions (restore with Enter, delete with a confirmed double-`d`, refresh with `r`), and Cloud shows the signed-in account, inference mode, current model and engine state, permission policy, and config dir, with a live Local Inference toggle
955	- The TUI shows model thinking: while a reply streams, the last three lines of the reasoning appear live under the spinner, dim and italic; finished replies collapse to a one-line indicator with the line count, and `/thinking` expands the full reasoning block above each reply. Display only — nothing changes in what is sent to the model, saved to sessions, or streamed over ACP
956	- Tool calls in the TUI transcript collapse to single dim title lines (the command for `run_command`, the path for file tools, the pattern for search and glob); `/tools` expands every entry to show the pretty-printed arguments and a capped tail of the result. Permission prompts keep showing the full command, and the model still receives full outputs
957	- When `AGENTS.md` and `CLAUDE.md` sit in the same directory, the instructions loader now prefers `AGENTS.md`, so shared content is injected once
958
959	## 1.3.2
960
961	Adds a tool permission system with plan mode, durable sessions with context
962	compaction, background command execution, a subagent research tool, and commit
963	co-author attribution.
964
965	### What changed
966
967	- Every tool call now passes a permission policy before executing. Read-only tools always run; mutating tools (and all MCP or unknown tools) are governed by, in order: plan mode, session grants, per-tool overrides, and a default mode from `[permissions]` in `settings.toml` (`allow`/`ask`/`deny`, default `ask`). On `ask`, editors get a native ACP permission dialog (allow once / allow for this session / deny) and the TUI pauses on a y/a/n prompt showing the tool and its arguments. `SIGIT_PERMISSIONS` overrides the default mode for headless runs and clients without permission support
968	- New `/plan [on\|off]` command: plan mode blocks mutating tools and asks the model to present a plan while research tools keep working. `/permissions` prints the effective policy
969	- Sessions are durable: conversation history is saved per session under `~/.config/sigit/sessions/` after every turn. ACP `session/load` actually restores it, the TUI gets `/resume`, and `/clear` deletes the saved file
970	- Context compaction: `/compact` compresses the conversation on demand, and the agent compacts automatically once the history approaches a 24k-token budget, summarizing older turns and keeping the recent ones. The tool-round cap rises from 10 to 24 now that long sessions have a defense other than the cap
971	- `run_command` can run work in the background: pass `run_in_background` and the tool returns a task id immediately, so builds, test suites, and dev servers are no longer killed by the 120 second foreground timeout. Poll with the new `command_output` tool (read-only, never prompts) and stop with `kill_command`
972	- New `task` tool: delegate research to a fresh subagent conversation that only gets the read-only tools and returns its final answer, keeping the main context small. Available on OpenAI-compatible backends; on-device returns a clear fallback until onde supports a second context
973	- Commits created by the agent are co-authored: commit messages end with `Co-Authored-By: siGit Code <sigit@sigit.si>` (the [sigitc](https://github.com/sigitc) account), which GitHub renders next to the human author. If the model forgets the trailer, siGit amends it in, never rewriting commits that already exist on a remote
974	- ACP mode now honors the `OPENAI_BASE_URL`/`OPENAI_API_KEY` provider override at startup, matching the interactive client
975
976	## 1.3.1
977
978	Adds [Model Context Protocol](https://modelcontextprotocol.io) (MCP) client
979	support with the official siGit Code MCP server baked in, a set of agent tools
980	that close parity gaps in the tool layer, and refreshed branding and licensing.
981
982	### What changed
983
984	- siGit Code is now an MCP client: it connects to MCP servers over the Streamable HTTP transport (a single JSON-RPC endpoint), discovers the tools they expose, and offers them to the model alongside the built-in tools. When the model calls one, the call is forwarded to the owning server and the result fed back into the agent loop
985	- Bakes in the official siGit Code MCP server at `https://sigit.si/api/v1/mcp` (follows `SIGIT_CLOUD_URL`). When you are signed in (`sigit login`), the cloud session token is sent as the bearer credential
986	- Configure additional servers in `mcp.toml` — global (`~/.config/sigit/mcp.toml`) or project-local (`.sigit/mcp.toml`). Each `[[server]]` has a `name`, `url`, optional `enabled`, and optional `[server.headers]`; set `official = false` to opt out of the baked-in server
987	- MCP tools are namespaced `mcp__<server>__<tool>` so they never collide with built-in tools or across servers; tool output is capped to protect the model's context
988	- Discovery is best-effort at startup and bounded by a per-server timeout, so an unreachable server never blocks startup — it just contributes no tools
989	- Added a `/mcp` slash command (TUI and ACP) that lists configured servers, their connection status, and the tools each exposes
990	- Disable MCP entirely with `SIGIT_MCP=off`, or just the official server with `SIGIT_MCP_OFFICIAL=off`
991	- New agent tools that close parity gaps in the tool layer: `multi_edit` (apply a batch of exact-substring edits to one file atomically — written only if every edit matches), `glob` (locate files by name pattern with `*`/``/`?`/`{a,b}`, most-recently-modified first), `write_todos` (render a live task checklist through the tool result for multi-step work), and `remember` (append durable notes to the nearest `AGENTS.md`/`CLAUDE.md`)
992	- `edit_file` now supports `replace_all` and returns actionable failure context — naming the line whose trimmed text matches when only whitespace differs — so the model self-corrects in one round
993	- `search_files` gained a `file_glob` filter and a `max_results` cap (default 50, hard-capped at 1000) that also bounds the directory walk
994	- Refreshed branding and legal: updated `LICENSE`, `README`, and the npm/PyPI package descriptions
995
996	## 1.3.0
997
998	Adds a Local Inference on/off toggle, the open [Agent Skills](https://agentskills.io)
999	format, and support for project instruction files (`AGENTS.md` and the like).
1000
1001	### What changed
1002
1003	- Added a Local Inference on/off setting that is the explicit local-vs-cloud mode switch. It is persisted in `~/.config/sigit/settings.toml` (default on, local-first) and can be overridden with `SIGIT_LOCAL_INFERENCE`
1004	- Toggle it with the `/local [on\|off]` command (TUI and ACP); ACP clients without slash-command support get an equivalent "Local Inference" On/Off control in the session config panel
1005	- `/models` now groups models by nature — Local vs siGit Code Cloud — and highlights the active mode's group while still showing the other, so the cloud tiers stay discoverable
1006	- Discovers Agent Skills (folders with a `SKILL.md`) from `.sigit/skills/` and `.claude/skills/` in the project, `~/.config/sigit/skills/`, and `~/.claude/skills/`
1007	- Follows the spec's progressive disclosure: each skill's name and description are advertised up front via a new `skill` tool, and the full instructions load only when the agent activates one
1008	- Added a `/skills` slash command (TUI and ACP) that lists the discovered skills
1009	- Reads project instruction files at session start: `AGENTS.md` (the cross-tool standard) and `CLAUDE.md`, walking from the working directory up to the repository root, plus a global file under `~/.config/sigit/`, and injects them into the session's system context so their guidance is always in force
1010	- Nested instruction files are ordered outermost-first so the closest, most specific file takes precedence; the scan never reads above the repository root
1011	- On-device models are no longer loaded implicitly. The chat UI and ACP sessions come up immediately, and the local model is brought into memory only when you run the `/load` command (or pick one in `/models`). Prompts sent before a model is loaded now return a hint instead of blocking on a multi-minute download.
1012
1013	## 1.2.2
1014
1015	Streams assistant tokens as they arrive, on-device and over the cloud.
1016
1017	### What changed
1018
1019	- Streamed assistant tokens live in the TUI and ACP sessions, both on-device and through siGit Code Cloud
1020	- On-device inference streams only when a turn offers no tools, since `onde` can't stream and detect tool calls in the same pass; tool-capable turns still resolve in one shot
1021	- Fixed the TUI so the latest message stays visible in long chats
1022	- Put the cloud model-switch confirmation on its own line in ACP
1023
1024	## 1.2.1
1025
1026	Stabilizes the Zed/ACP integration and finishes the cloud-tier wiring on top of 1.2.0.
1027
1028	### What changed
1029
1030	- Fixed a Zed crash by keeping model-picker labels ASCII in the ACP model selector
1031	- Wired ACP auth, cloud tiers, and slash commands into the Zed panel, including a `/reload` command to re-sync session state in place
1032	- Fixed the TUI so the loaded-model checkmark appears once a download completes
1033	- Synced bundled agent skills with the current code and added `CLAUDE.md`
1034
1035	## 1.2.0
1036
1037	Adds siGit Code Cloud — a hosted inference tier alongside on-device models.
1038
1039	### What changed
1040
1041	- Added siGit Code Cloud with cloud-tier routing, pointed at `sigit.si`
1042	- Added account management slash commands and surfaced cloud tiers in `/models`
1043	- Carried forward from 1.1.0: ACP SDK v0.13, refreshed dependencies and branding
1044
1045	## 1.1.0
1046
1047	Bumps the ACP SDK to v0.13 and pulls in updated dependencies.
1048
1049	### What changed
1050
1051	- Updated `agent-client-protocol` from v0.11 to v0.13
1052	- Updated `onde` to 1.1.2
1053	- Refreshed branding and skill metadata
1054
1055	## 1.0.4
1056
1057	This release tightens up the terminal experience and finishes a few release-facing cleanup items.
1058
1059	### What changed
1060
1061	- Added bold rich-text rendering in the TUI for assistant replies, so `text` now displays with terminal styling instead of raw markdown markers
1062	- Refreshed the bundled skill metadata to follow the current Agent Skills `SKILL.md` format
1063	- Synced the crate release metadata for the `1.0.4` cut
1064
1065	## 1.0.3
1066
1067	This is the cleanup release for the editor-side startup problems.
1068
1069	### What changed
1070
1071	- Fixed ACP sessions failing on the first real prompt because the server claimed the model was ready before anything had actually been loaded
1072	- Changed ACP startup so the default model loads lazily on the first non-slash prompt instead of pretending it is already in memory
1073	- Kept `initialize` and `session/new` lightweight while still sending proper progress updates once model loading begins
1074	- Updated the Onde integration to `1.0.0`
1075	- Removed a few dependencies we were no longer using
1076
1077	## 1.0.2
1078
1079	This release was supposed to fix the ACP auth breakage. It did fix the stdout pollution problem, but it turned out not to be the whole story.
1080
1081	### What changed
1082
1083	- Delayed model loading in ACP mode so startup diagnostics would not leak into protocol stdout during the auth handshake
1084	- Tightened up the ACP startup path for editor integrations
1085	- Refreshed some README wording while cutting `1.0.2`
1086
1087	## 1.0.1
1088
1089	The first patch after `1.0.0` was mostly about making model loading and model switching feel less opaque.
1090
1091	### What changed
1092
1093	- Added ToolCall-based progress UI for startup model loading and downloading
1094	- Improved model-switch progress reporting in ACP clients
1095	- Fixed model-load error handling so failed switches did not leave the UI in a weird state
1096	- Cleaned up a few status messages and docs while the release was going out
1097
1098	## 1.0.0 (2026)
1099
1100	siGit Code has been living in real smbCloud repos for a while now. At some point it stopped feeling like an experiment, so we called it 1.0.
1101
1102	### What this release is
1103
1104	siGit Code is a local coding agent. It runs a quantized model on your machine, talks to editors over ACP, and can read files, run commands, fetch web pages, and write code without sending your project to a hosted API.
1105
1106	You can install it with Cargo, pip, npm, or Homebrew and use it like any other tool on your machine.
1107
1108	### What shipped in 1.0
1109
1110	#### Editor integration
1111
1112	This is the core of the project.
1113
1114	Zed and VS Code can talk to siGit Code over ACP. Multi-turn sessions work. Tool calling works. Session forking works. Working-directory context works. That was the original goal, and it feels solid now.
1115
1116	#### Terminal UI
1117
1118	The terminal UI started as a side quest and turned out to be useful. You get a full-screen ratatui chat, streaming tokens, a spinner while the model is busy, and a model picker you can open in the middle of a session.
1119
1120	It runs on macOS and Linux. Windows gets ACP and editor mode for now. The Windows terminal UI is still unfinished.
1121
1122	#### Tool calling
1123
1124	This is the part that makes siGit Code feel like an agent instead of a chat box. The loop can run up to 10 rounds per message.
1125
1126	Available tools:
1127
1128	- `read_file` / `write_file` / `delete_file`
1129	- `list_directory` / `search_files`
1130	- `run_command`, with an optional working directory
1131	- `read_website`, which fetches a URL and strips it down to readable text
1132
1133	The model can call a tool, inspect the result, and keep going until it has a real answer.
1134
1135	#### Model support
1136
1137	The model list ended up wider than we expected for 1.0:
1138
1139	- Qwen 3 1.7B, 4B, 8B, and 14B
1140	- Qwen 2.5 1.5B and 3B
1141	- Qwen 2.5 Coder 1.5B, 3B, and 7B
1142	- DeepSeek Coder 6.7B
1143
1144	They are all GGUF models and they all come from Hugging Face on first run.
1145
1146	Qwen 3 is the interesting one. It uses extended thinking mode. The model reasons inside `<think>...</think>` blocks before answering. The TUI strips those blocks out and renders them dimmed above the reply, so you can see what happened without turning the whole conversation into noise.
1147
1148	The 8B model is the desktop default. Mobile stays on 1.7B because iOS gives apps roughly 2 to 3 GB of memory, and we learned the hard way that 3B can blow up on an iPhone 16e.
1149
1150	#### Model picker
1151
1152	The model picker shows:
1153
1154	- what is already cached locally
1155	- what can be downloaded
1156	- which models support tool calling
1157	- whether the local cache looks healthy
1158
1159	You can open it with `/models` in the TUI or through the editor config option. Switching models happens in the background and the UI stays alive while the download or load is in progress.
1160
1161	#### smbCloud context
1162
1163	siGit Code knows smbCloud repos better than a generic coding assistant does. It understands the difference between platform-user flows and tenant-app auth flows, how `Project`, `FrontendApp`, `AuthApp`, and GresIQ fit together, and why Next.js SSR deploys are not the same thing as the generic git-push path.
1164
1165	Outside smbCloud, it backs off and behaves like a normal coding agent.
1166
1167	#### Distribution
1168
1169	Distribution took an unreasonable amount of time, honestly.
1170
1171	There are prebuilt binaries for macOS, Linux, and Windows on both arm64 and x64 where relevant, plus install paths through Cargo, PyPI, npm, and Homebrew:
1172
1173	- `cargo install sigit`
1174	- `pip install sigit-code`
1175	- `npm install -g @smbcloud/sigit`
1176	- `brew install sigit`
1177
1178	Getting that whole pipeline to behave across CI, crates.io, PyPI, npm, and Homebrew was basically its own project.
1179
1180	### What still does not work
1181
1182	The Windows terminal UI is still missing.
1183
1184	ACP and editor mode work on Windows. The part that is still missing is the interactive full-screen terminal UI. The blocker is Unix-specific terminal handling that has not been abstracted cleanly yet.
1185
1186	### Changes since 0.1.2
1187
1188	- Added Qwen 3 14B support
1189	- Added Qwen 3 `<think>` block parsing and separate rendering in the TUI
1190	- Moved all TUI code into `#[cfg(unix)]`, which fixed a pile of dead-code errors on Windows CI
1191	- Added live download progress during model switches, including cancellation with Ctrl+C
1192	- Added model download and loading progress in the Zed agent config panel
1193	- Added an animated spinner during model switching
1194	- Added Qwen 2.5 Coder 7B
1195	- Added downloadable models to the picker, not just locally cached ones
1196	- Made model selection persist across restarts
1197	- Added session working-directory support
1198	- Moved model picker logic into a platform-independent module so Windows can compile without the TUI
1199	- Added the `/models N` shortcut for picking a model by number
1200	- Added the `read_website` tool
1201	- Improved `read_file` handling and empty-reply detection
1202	- Added async tool execution
1203	- Fixed CI cross-compilation for macOS, iOS, Linux, and Windows
1204	- Added npm, PyPI, and Homebrew distribution
1205
1206	---
1207
1208	© 2026 PT Sigit Mitra Bangun ([siGit Code & Deploy](https://sigit.si)), distributed by [Splitfire AB](https://5mb.app).