CHANGELOG.md · sigitcodereview/sigit

Code Commits Issues Pulls Cloud Agent CI/CD

feature/cargo-workspace

claude/github-issue-40-0au5ua claude/linked-issue-acp-tui-u4vvpa claude/minor-release-cut-vkugow claude/sigit-acp-local-chat-cx6380 claude/sigit-cloud-agent-expansion-reox0a claude/tool-permission-system claude/zen-feynman-0u78dk development feature/acp-cancel-request feature/acp-session-list-cursor feature/acp-v1-conformance feature/agent-tools-multiedit-glob-todos-remember feature/cargo-workspace feature/hooks feature/load-local-model-explicitly feature/sigit-agent-profile feature/sigit-code-cloud feature/xcode-mcp-server fix/acp-replay-loaded-session-history fix/acp-replay-reasoning-and-attachments fix/dsml-doubled-bar-markers main release/v1.5.10 release/v1.5.6 release/v1.6.1

md 1,258 lines 72.4 KB

Rendered Raw

1	# Changelog
2
3	## 1.7.0
4
5	Finishes the Agent Client Protocol v1 surface. An editor can now delete a
6	thread, show a context meter, tell one message from the next, cancel a request
7	by its id and page through a long thread list, and a reopened thread comes back
8	with its reasoning and attachments.
9
10	### Added
11
12	- `session/delete`. A thread removed in the editor is removed from disk, so
13	it no longer comes back in "Import Threads". A turn still running on it is
14	stopped first, and deleting an id that is already gone succeeds (#192).
15	- A saved thread reports its title and time as they change. Each save sends
16	a `session_info_update` with a fresh `updatedAt`, and the title the first time
17	there is one. A new thread used to stay untitled in the sidebar until the next
18	`session/list` (#193).
19	- Context usage. A `usage_update` follows every model response, so an editor
20	can show how full the context window is. `used` is the endpoint's own token
21	count when it gives one and an estimate otherwise, which is always the case
22	on-device (#194).
23	- Message ids. Every message chunk carries a `messageId`. An inference round
24	is one message, so its reply and its reasoning share an id and the round after
25	a tool call starts a new one (#195).
26	- Sign-in through the editor. For a client that advertises URL-mode
27	elicitation, `authenticate` hands it the sign-in page instead of launching a
28	browser from the agent. The user sees where they are being sent, and sign-in
29	works where siGit Code has no browser to open (#197).
30	- The Inference switch is a toggle for a client that renders boolean config
31	options. Other clients keep the two-value select (#198).
32	- Deny for the session. A permission prompt offers "deny for this session"
33	next to "allow for this session", so a tool the user does not want is not
34	asked about again in that thread (#199).
35	- `$/cancel_request`. A client can cancel a request by its JSON-RPC id. For
36	`session/prompt` that stops the turn and the command it is running exactly as
37	`session/cancel` does, and the prompt is answered with the `cancelled` stop
38	reason. For `authenticate` it ends the wait on the browser and the request is
39	answered `-32800`. The notification used to be ignored.
40	- `session/list` is paged. A reply holds at most 100 threads and a
41	`nextCursor` when there are more. The cursor names the last thread on the
42	page instead of counting an offset, so the next page is right when a thread is
43	saved or deleted in between. A cursor the agent did not hand out is rejected
44	with `-32602`; `cursor` used to be ignored.
45
46	### Fixed
47
48	- A reopened thread shows its reasoning and attachments. `session/load`
49	replayed only the text of each message. The model's reasoning now comes back
50	as `agent_thought_chunk` under the reply's `messageId`, and the images and
51	audio clips of a user message come back as `image` and `audio` blocks.
52	- Cancelling a turn stops the command it is running. A foreground
53	`run_command` used to run to its own end (up to two minutes) before the turn
54	noticed the cancel. A cancel or `session/close` now kills the process tree, or
55	sends `terminal/kill` when the command runs in the editor's terminal, and the
56	turn ends `cancelled` within a moment.
57	- Switching permission mode works while a turn is running. `session/set_mode`
58	and the Permissions config option queued behind the turn's session lock, so
59	choosing Auto while a permission prompt was open did nothing until the turn
60	ended. They now take no lock, are answered at once, and the pending call's
61	successors follow the new mode. Model and Inference changes still wait for
62	the turn.
63	- `authenticate` checks the method id. An id that `initialize` never offered
64	is now rejected with `invalid_params` (`-32602`) instead of starting a
65	browser sign-in. A sign-in that fails reports `-32603`, since `-32000` means
66	authentication is required before a call.
67	- A session the agent does not know is `-32002`. `session/prompt`,
68	`session/set_mode` and `session/set_config_option` answered `-32602` for an
69	unknown id; they now say resource not found, as `session/load` and
70	`session/resume` already did.
71	- A finished terminal command no longer names a released terminal. The
72	closing `tool_call_update` of a command that ran in the editor's terminal
73	re-sent the terminal id after `terminal/release`. It now leaves the content
74	alone, so the embedded terminal stays as it was, and the result still goes out
75	as `rawOutput`.
76	- `session/list` rejects a relative `cwd` filter with `-32602`, as
77	`session/new` does.
78	- An embedded binary resource is read when the model can read it. An image
79	blob becomes an image input and an audio blob an audio input. Any other blob
80	keeps its placeholder, now with its MIME type.
81
82	## 1.6.8
83
84	### Fixed
85
86	- A bare launch of `sigit.exe` on Windows exits 0 instead of bailing. A
87	no-argument launch with a TTY stdin falls through to the non-Unix branch,
88	which has no TUI to start (the interactive client needs Unix-only fd
89	redirection). It now prints a short usage message pointing at ACP and
90	headless modes and exits 0, so winget's installer validator no longer reports
91	a `Validation-Executable-Error`.
92
93	### Changed
94
95	- winget submissions link back to their Package Request issue. The release
96	workflow scrapes the winget-pkgs PR URL from wingetcreate, opens a Package
97	Request issue on first submission, and rewrites the PR body to fill the
98	Description, tick the issue checkbox, and add `Resolves #NNN` — replacing the
99	manual per-PR edit that used to follow each release.
100	- **The winget release workflow files its Package Request issue first and uses
101	two scoped tokens.** The Package Request issue is opened before the
102	winget-pkgs PR so the PR can reference it immediately, and issue creation and
103	PR submission now use separate tokens (`WINGET_ISSUE_TOKEN` and
104	`WINGET_PR_TOKEN`) rather than one shared token.
105
106	## 1.6.7
107
108	### Fixed
109
110	- A cancel that arrives before the turn starts is no longer lost. A prompt
111	now registers for `session/cancel` as soon as it begins, not once it reaches
112	inference. A cancel that lands while the turn is queued on the workspace,
113	switching threads, loading a model, or running a slash command ends it with
114	`cancelled` instead of `end_turn`.
115	- A prompt that is only audio is answered. A clip with no text or image used
116	to end the turn at once with nothing sent to the model, even though the agent
117	advertises audio.
118
119	## 1.6.6
120
121	### Added
122
123	- A tool call carries its programmatic tool name. The `tool_call` an editor
124	gets for a running tool now includes `name` (`read_file`, `run_command`,
125	`mcp__…`) next to the human title, sent on the first report of the call only
126	as the protocol asks. A client can tell a command from a file edit without
127	parsing the title, and a replayed thread from `session/load` carries the same
128	name (#196).
129
130	### Changed
131
132	- MCP runs on `rmcp`, the official Rust SDK, through `ed-mcp`. siGit Code's
133	own JSON-RPC client for stdio and Streamable HTTP servers (about 600 lines)
134	is gone; `ed-mcp` is the layer every Onde agent shares. `mcp.toml`, the
135	baked-in `sigit` and `smbcloud` servers, tool names and `/mcp` are unchanged.
136	An HTTP server that stops answering is now reconnected and the call retried
137	once for any failure but a timeout, not only on a 404.
138
139	### Fixed
140
141	- A reply that degenerates into a repetition loop is cut off. After a tool
142	call, a model could fall into thousands of words from a tiny vocabulary
143	(`find: list: check: get: …`) with no tool call and no end, and the junk went
144	into history for the next turn. siGit Code now watches a streamed reply for a
145	window of 200 words with very few distinct ones (code blocks excepted), stops
146	reading, keeps only the text before the loop, tells you it stopped, and asks
147	the model once to make its call or answer briefly (#123).
148	- A linked selection written as `L10-L20` or `L10` reads just those lines.
149	siGit Code read the line range of a `resource_link` only as `L10:20` or
150	`L10-20`, so `L10-L20` (the GitHub style) and a single line `L10` sent the
151	whole file instead of the selection. It now reads the same forms Zed's own
152	mention parser does, and a range that starts at line 0 or runs backwards
153	counts as no range.
154
155	## 1.6.5
156
157	### Added
158
159	- An `@file` mention can carry unsaved edits. siGit Code now advertises
160	`promptCapabilities.embeddedContext`, so a client can put a resource's
161	contents in the prompt instead of sending a link to it. Before, a client
162	that follows the spec only sent `resource_link`, and siGit Code read the
163	file from disk, missing whatever the user had not saved yet (#141).
164	- A prompt can carry audio. siGit Code now advertises
165	`promptCapabilities.audio` and sends an attached clip to the model as an
166	OpenAI `input_audio` part. It works the way image attachments do: a model on
167	an endpoint you configure yourself gets the clip and decides for itself,
168	while siGit Code Cloud tiers and on-device models, none of which take audio
169	today, get a note in its place and the editor says the clip was left out
170	(#143).
171	- The README says what telemetry is sent. A new Telemetry section covers
172	the model-timing events Onde Inference can report for on-device models,
173	what they leave out, and how to turn them off with `ONDE_DISABLE_PULSE=1`.
174
175	### Changed
176
177	- A turn that cannot get its session back stops. A turn on an HTTP backend
178	gives up the process-wide working directory while it waits and reinstalls
179	its session before a tool runs. If the reinstall failed, the turn logged a
180	warning and carried on in whichever directory was current. Nothing makes it
181	fail today, since a close waits for the turn, but the turn now ends as
182	cancelled instead of depending on that.
183	- Dependencies match the rest of the Onde stack. Onde 1.2.2 to 1.3.1,
184	reqwest 0.12 to 0.13 and ratatui 0.29 to 0.30, the versions Ed, OndeCode and
185	SplitFire Agent use. ratatui is built with only its crossterm backend, which
186	drops the second copy of crossterm (0.28) from the build.
187
188	### Fixed
189
190	- Tags a model makes up no longer show in the reply. After a long run of
191	tool rounds, a model could start writing markup that looked like it came
192	from siGit Code: a `<system_warning>` block telling the user the previous
193	turn was injected and should be ignored, or a question wrapped in
194	`<Option_Picker>`. Neither tag means anything to siGit Code or the editor,
195	so both rendered as raw text. A `system_*` block is now dropped from the
196	reply and from the history, and other made-up tags are removed while the
197	text inside them stays. Code blocks are left alone. The system prompt also
198	tells the model to write plain Markdown and to list choices as plain text
199	(#122).
200	- Closing a thread that is waiting at a permission prompt no longer hangs.
201	`session/close` cancels the session's running turn and waits for it to end,
202	but a turn stopped at a permission prompt only went on when the client
203	answered the request. A client that closed the thread without answering
204	left the close, and every later request for that thread, waiting for good.
205	The same held for `session/cancel` with a client that did not send the
206	cancelled outcome the protocol asks for. The permission wait now ends on
207	the cancellation as well, and an approval that arrives after the turn was
208	cancelled runs nothing.
209
210	- A closed thread no longer leaves its request lock behind. The process
211	kept one lock per session id for as long as it ran, for closed threads and
212	for ids no session ever had. The entry now goes with the last request that
213	used it.
214
215	- A tool call that did not run no longer shows as completed. When policy
216	or plan mode denied a call, when the user picked Deny at the permission
217	prompt, or when the repeat guard skipped a call the model made three times,
218	the editor's card still ended `completed`. Those cards now end `failed`, the
219	same way a call cancelled at the prompt already did. A call denied at the
220	prompt also gets its own title back instead of keeping the permission
221	request's (#139).
222
223	- On-device inference no longer panics on some non-English text. siGit Code
224	now builds on Onde 1.3.1, which fixes a panic when a message longer than 100
225	bytes had a multi-byte character (an accented letter, CJK, or an emoji) at
226	byte 100. Onde 1.3 also reports Pulse events for streaming inference, which
227	is the path on-device turns take, so those turns are now reported alongside
228	model loads. `ONDE_DISABLE_PULSE=1` turns Pulse off.
229
230	## 1.6.4
231
232	### Added
233
234	- DeepSeek DSML tool calls written into the reply text are recovered. A
235	DeepSeek-family endpoint can render a tool call as literal
236	`<｜DSML｜tool_calls>` text instead of the structured `tool_calls` field,
237	which streamed the tag into the editor and ended the turn with nothing run.
238	The inline tool-call scanner that already recovered the GLM XML and Kimi K3
239	shapes now recovers the DSML shape too, including a marker split across
240	stream chunks. A block that fails to parse is still kept out of the reply
241	and the history, and the model is told the call did not run (#181).
242
243	### Fixed
244
245	- The round-cap stop message no longer carries a stray run of spaces.
246	When the tool-round cap ended a turn, the closing message could collapse a
247	space run into the wrong spot, which the editor then rendered verbatim
248	(#177).
249
250	## 1.6.3
251
252	### Added
253
254	- A client can resume a session and close one. siGit Code now advertises
255	`sessionCapabilities.resume` and `sessionCapabilities.close`.
256	`session/resume` restores a saved thread the way `session/load` does, but
257	sends none of it back: it is for a client that still has the thread on
258	screen, after an agent restart for example. `session/close` cancels the
259	session's running turn and drops what the process held for it, which is its
260	state, its permission grants and plan mode, the MCP servers the client named
261	for it, and the background commands it started. The saved history is left
262	alone, so a closed thread still lists and reopens (#149).
263
264	- The permission modes are also offered as ACP session modes. Manual, Auto
265	and Plan were only reachable as a config option, which is what the protocol
266	now recommends and what Zed reads. A client that draws the older mode
267	selector saw nothing. `session/new`, `session/load` and `session/fork` now
268	return the same three in `modes`, `session/set_mode` switches between them,
269	and a change made any other way (the config option, `/plan`, `/clear`,
270	`/reload`) is announced with `current_mode_update`. A client that reads
271	config options ignores `modes`, so nothing changes there (#148).
272
273	- An editor can sign out of siGit Code. The `initialize` reply carried an
274	empty `auth` object, so a client drew no sign out button, and typing
275	`/logout` was the only way out of an account. The reply now advertises
276	`agentCapabilities.auth.logout`, and a `logout` request ends the account
277	session through the method `/logout` calls. The request names no session,
278	so it moves every open thread that used the account, not only the live one:
279	a thread parked on a cloud tier goes on-device with the live thread instead
280	of failing to restore its tier on its next prompt, and every thread that
281	moved gets a fresh model picker. Local inference is switched back on if it
282	was off, so a thread opened after signing out asks for no cloud tier
283	(#150).
284
285	### Changed
286
287	- Two threads can run a turn at the same time. An editor runs one siGit
288	Code process for every thread it has open, and a single lock ordered every
289	turn-affecting request in it, so a second prompt waited for the first
290	thread's whole turn and two prompts never overlapped. The lock held what a
291	session installs process-wide — the working directory, the workspace roots,
292	the MCP servers the client named for it, the live backend — none of which a
293	turn touches while it waits on an HTTP endpoint, which is most of its time.
294	A session on an HTTP backend now keeps a backend of its own, so its
295	conversation is no longer swapped in and out of a shared one, and a turn
296	releases the process-wide lock while it waits on the endpoint or on a
297	permission answer and takes it back, reinstalling its session, before any
298	tool runs. On-device turns are unchanged, since the engine keeps one
299	conversation, and tool execution still runs one session at a time (#176).
300
301	### Fixed
302
303	- A prompt whose inference failed is kept through a model switch. A turn
304	that ended in an endpoint error stayed in the client's thread, but the
305	carryover into a new model dropped its trailing user message, and the error
306	path never saved the session. Only a cancelled prompt should be taken back
307	out, so cancellation now removes it from the live history, and the error
308	path persists the session (#124).
309
310	## 1.6.2
311
312	### Added
313
314	- `sigit --version` prints the release. `sigit --version` and `sigit -V`
315	print `sigit <version>` on stdout and exit 0. Before, the flag was not
316	recognized and siGit Code started a session, which left a script that asked
317	for the version waiting.
318
319	- File tools read and write through the editor when it offers to. An ACP
320	client that advertises `fs.readTextFile` or `fs.writeTextFile` serves those
321	requests from its open buffers. siGit Code always used the disk, so
322	`read_file` missed unsaved changes and `edit_file` wrote underneath a buffer
323	the user might have modified. `read_file`, `create_file`, `edit_file` and
324	`multi_edit` now go through the client for paths inside the session's roots.
325	The two capabilities are independent, and the disk is still the fallback:
326	for a path outside the roots, and for a request the client fails or leaves
327	unanswered for 30 seconds. `SIGIT_CLIENT_FS=off` keeps the file tools on
328	disk (#147).
329
330	### Fixed
331
332	- A file attached from the editor is found when its path needs escaping.
333	A `resource_link` was read by stripping `file://` and using the rest as the
334	path, so a space arrived as `%20`, a non-ASCII name failed, and a Windows
335	URI kept its leading slash. A `#` in a file name was also taken for the
336	line-range fragment. The URI is now parsed properly (#170).
337
338	## 1.6.1
339
340	### Added
341
342	- Images can be attached to a prompt in the editor. siGit Code now
343	advertises `promptCapabilities.image`, so an ACP client offers image
344	attachments. The image goes to the model when the active model reads images.
345	The model picker marks those models with "reads images". The on-device
346	models and four cloud tiers (`nova`, `orbit`, `apex`, `flux`) are text-only:
347	with one of them active the image is left out, a note in the thread says so,
348	and the model is told an image was withheld. Switching a thread that already
349	holds images to a text-only model flags that once as well. Cloud tiers need
350	siGit Code Cloud to accept image parts, which is rolling out separately
351	(#134).
352
353	- The tool-round cap of a headless run can be set. `--max-tool-rounds <n>`
354	or `SIGIT_MAX_TOOL_ROUNDS` (1 to 500) replaces the built-in 24 for
355	`sigit run` and `sigit -p`. The flag wins over the variable.
356
357	### Fixed
358
359	- A prompt turn now reports why it stopped. ACP defines five stop reasons
360	and siGit Code only ever sent `end_turn` and `cancelled`. A turn that runs
361	into the tool-round cap now ends with `max_turn_requests`, a reply cut off
362	at the token limit with `max_tokens`, and a reply the endpoint withheld
363	(`content_filter`) with `refusal`. A refused turn is also taken out of the
364	conversation, which is what the protocol tells the client to expect (#140).
365
366	- A tool call that needs approval is one card, not two. The permission
367	request carried an id of its own, so an ACP client showed an approval card
368	beside a call that already claimed to be running. The call is now announced
369	as `pending`, the permission request names that same call, and it moves to
370	`in_progress` once approved. Calls allowed by policy still start out
371	`in_progress` (#138).
372
373	- A turn that runs out of tool rounds says so. In an editor, a long task
374	could stop on a line like "Now commit:" with nothing after it. The turn had
375	used all 24 tool rounds, the model spent its last reply announcing the next
376	step, and the call behind it was dropped. siGit Code now tells the model
377	that its rounds are used up before that last reply, and ends the turn with a
378	message saying why it stopped and that "continue" picks it back up.
379	`SIGIT_MAX_TOOL_ROUNDS` now sets the cap for editor sessions too (#120).
380
381	- A headless run no longer ends silently with no final message. When the
382	last round came back empty, which is what happens when a run is cut off at
383	the tool-round cap mid-task, stdout was empty and the exit status was 0, so
384	a caller could not tell it from a run with nothing to report. siGit Code now
385	asks the model once for its final message before finishing.
386
387	## 1.6.0
388
389	### Added
390
391	- Editors can pass HTTP MCP servers to a session. siGit Code now
392	advertises `mcpCapabilities.http`, so an ACP client may list Streamable HTTP
393	servers in `mcpServers` next to stdio ones. They are connected with the URL
394	and headers the client sent and are scoped to that session, like the stdio
395	ones. SSE is still not advertised, since the MCP spec deprecated it (#151).
396
397	- The plan panel survives a failed turn. The last `write_todos` list is
398	now kept by siGit Code itself. When a turn ends in an endpoint error before
399	the model gets to call `write_todos` again, the saved list is sent to the
400	editor again, so the plan stays on screen where it used to go blank (#132).
401
402	### Changed
403
404	- The ACP Rust SDK is now 2.2 (`agent-client-protocol`, up from 1.3).
405	siGit Code still speaks ACP protocol v1 to the editor, so nothing changes on
406	the wire. The `unstable_auth_methods` feature is gone because agent auth
407	methods are stable in 2.x.
408
409	### Fixed
410
411	- MCP servers the editor passes to a session are connected. ACP clients
412	can name MCP servers in `mcpServers` when they open a session, and agents
413	are required to connect to the stdio ones. siGit Code accepted the field and
414	ignored it. The servers are now spawned when the session opens, their tools
415	are offered to that session only, and `/mcp` lists them as coming from the
416	editor. `SIGIT_MCP=off` still turns all of it off (#135).
417
418	- A relative `cwd` is rejected when a session starts. ACP requires the
419	working directory and every `additionalDirectories` entry to be absolute.
420	`session/new`, `session/load` and `session/fork` used to accept a relative
421	one and resolve it against wherever the editor spawned the process. They now
422	answer with an invalid-params error (#136).
423
424	- Loading a session that does not exist is an error. `session/load` with
425	an id that was never saved used to succeed and open an empty session under
426	that id, so the editor showed a blank thread that looked restored. It now
427	answers "not found" (`-32002`). A thread opened in the running process but
428	not spoken in yet still loads (#137).
429
430	- Compaction no longer dead-ends a long session. The summarization request
431	used to carry the whole conversation, which by then was already over the
432	model's window, so siGit Code Cloud timed out with a 504 and the session
433	stopped with "start a new thread". The transcript sent for summarizing is
434	now capped, cut from the middle so the opening request and the latest state
435	are kept. If summarizing still fails, the oldest messages are dropped until
436	the history fits, with whole tool rounds removed together. A failed attempt
437	leaves the conversation as it was (#125).
438
439	- Gateway error pages stay out of the chat. When an endpoint answers with
440	an HTML error page, the error shown is the status line, not the page's
441	markup (#125).
442
443	- Issue and pull request work no longer assumes GitHub. The system prompt
444	treated forge features as if every repository lived on GitHub, while the
445	built-in `mcp__sigit__*` tools only work for repositories hosted on
446	sigit.si. The agent now checks the remote first, uses those tools only for
447	sigit.si repositories, and reaches for the forge's own CLI (`gh`, `glab`,
448	`tea`) elsewhere (#127).
449
450	## 1.5.13
451
452	### Added
453
454	- Three more siGit Code Cloud tiers: `flare`, `zenith` and `prism`. They
455	show up in `/models` and in the editor's model picker alongside the existing
456	tiers. Selecting one needs a signed-in account, as before.
457
458	## 1.5.12
459
460	### Fixed
461
462	- **The Windows binaries start on machines without the Visual C++
463	Redistributable.** They used to import `VCRUNTIME140.dll` and the UCRT
464	`api-ms-win-crt-*` DLLs, so a clean Windows install refused to load them
465	with `STATUS_DLL_NOT_FOUND` (0xC0000135). That is what failed winget's
466	post-install check. The C runtime is now linked statically, and CI and the
467	release build fail if a Windows exe picks up that dependency again.
468
469	- Watching a slow background command no longer ends the turn early.
470	Polling `command_output` on the same task id three times tripped the
471	repeated-tool-call guard, which refused the call and dropped tools for the
472	rest of the turn. `command_output` now long-polls — it waits up to
473	`wait_seconds` (default 10, max 30) for the task to exit, then returns
474	everything printed in the meantime — and the repeat guard exempts it, since
475	polling the same task is the whole point of the tool.
476
477	- A turn that ends with no visible text says why. When the
478	repeated-tool-call guard blocked a call and the forced no-tools round came
479	back empty, sigit sent nothing more — the turn just stopped with no answer
480	and no question. When the last round of a tool-using turn produces no
481	visible text, sigit now sends a short closing message naming the repeated
482	tool and asking you to reply "continue" or redirect.
483
484	## 1.5.11
485
486	### Added
487
488	- `sigit run` drives the agent headlessly with resumable sessions. A new
489	non-interactive subcommand runs a prompt through the same agent loop as the
490	editor and terminal surfaces, for scripts, CI, and Factory clients. Every run
491	gets a UUID session id, writes a JSON-lines history file under
492	`~/.config/sigit/sessions/`, and can be restored with `--resume <id>`.
493	`--output jsonl` emits a structured session/delta/tool/result stream on
494	stdout while logs stay on stderr, and `--allow-tool` pre-approves a tool so
495	permission prompts collapse to denial in a non-interactive context. The
496	legacy `-p` form still works. Each run also rewrites the session metadata
497	with its own cwd and extra roots, so resuming keeps multi-root projects
498
499	- Saved threads can be imported into the editor. siGit Code now advertises
500	ACP's `sessionCapabilities.list` and answers `session/list`, so Zed's "Import
501	Threads" picker offers the conversations stored under
502	`~/.config/sigit/sessions/` instead of reporting that the agent doesn't
503	support the capability. A saved session gets a sidecar recording the project
504	directory it ran in — listing reports that `cwd`, the extra roots of a
505	multi-root project, an ISO 8601 last-activity timestamp, and a title taken
506	from the first user message — and a request may filter on `cwd` so one
507	project is never offered another's threads. Threads saved before this have no
508	sidecar and are not listed; they still reopen by id through `session/load`
509
510	### Changed
511
512	- The commit trailer names the siGit Code version and surface. Commits
513	siGit Code makes now end with
514	`Co-Authored-By: siGit Code v<version>-<surface> <noreply@sigit.si>` instead
515	of the bare name, where the surface is `acp` (an editor), `tui` (the
516	terminal UI), or `headless` (`sigit run`). The model changes from session to
517	session; the version and surface tell you which build of the agent wrote the
518	commit and how it was driven. GitHub still credits the co-author, since it
519	matches on the address. A commit that already carries a siGit Code trailer
520	from an older version is left alone
521
522	- The terminal UI's model knows which directory the project is in. The
523	editor (ACP) and headless paths put the working directory in the system
524	prompt, but the terminal UI only added the project's instruction files, so
525	on `/init` a small on-device model invented a `AGENTS.md` path and failed.
526	All three places the terminal UI builds a prompt now go through the same
527	session context path the ACP sessions get. The cloud tier switch had also
528	been dropping the instruction files; that's fixed too
529
530	- An empty `write_todos` list clears the plan. `write_todos` rejected an
531	empty list, so the model had no way to clear a finished checklist and the
532	last plan stayed in the editor until the session ended. An empty list now
533	returns "Task list cleared." and goes to the client as an ACP plan with no
534	entries. The tool description tells the model it can do this
535
536	- `sigit run` gives clearer usage errors. A second positional prompt says
537	"unexpected extra argument", a bare `sigit run` says "missing prompt", and a
538	mistyped flag like `--quite` is rejected instead of becoming the prompt
539
540	### Fixed
541
542	- Each ACP session keeps its own roots, conversation, and tasks. Zed runs
543	one siGit process for every open thread, but the process had a single cwd,
544	workspace root list, backend conversation, and background task table. The
545	most recent session owned all of them, so a prompt from an older thread ran
546	against another repo with another thread's history. A `SessionState` is now
547	kept per session id; before a prompt or config change runs, the live
548	conversation is parked and the requested session's cwd, extra roots, and
549	conversation are installed, rebuilding the system prompt from its roots.
550	`new`/`load`/`fork` share a single session-opening path, and fork carries the
551	source thread's conversation. Background tasks are scoped to the session that
552	started them, opening a session no longer wipes every other session's
553	permission grants, and model selection is routed per session
554
555	- New sessions no longer carry the previous thread's history. Opening a
556	new thread in Zed showed a `[Conversation summary]` from an earlier session.
557	The session handlers cleared the on-device engine but not the history a cloud
558	backend keeps for itself, and the startup routing to the cloud tier then
559	carried that history into the installed backend. A provider override had the
560	same leak. All session entry points now share a path that strips stale
561	history too, and unknown session ids are rejected instead of borrowing the
562	live thread's state
563
564	- Unparseable tool-call markup is hidden and retried, not shown as text.
565	Some models write tool calls into the reply as text. Well-formed blocks were
566	already recovered and run, but a block that failed to parse or never closed
567	was printed to the editor as-is and stayed in history, so the model later
568	read back a call it had "made" with no result and began writing invented
569	`<function_results>`. The scanner now reports those blocks as malformed; the
570	backend drops them from the reply and history, and when the only tool call
571	was malformed the model gets one retry telling it the call didn't run. A
572	block that merely mentions a tool-call marker (a backticked `<tool_call>` or an
573	unclosed XTML `<\|open\|>tools`) is now kept as prose, so a reply explaining
574	the scanner no longer loses everything after the first marker. The
575	non-streamed path now strips broken blocks beside structured calls and runs
576	any inline calls that did parse, matching the streaming path
577
578	- The co-author trailer ends a conflicted merge commit. Finishing a
579	conflicted merge with `git commit --no-edit` keeps git's `# Conflicts:` list
580	in the message, since no editor runs to strip it. When siGit Code then added
581	its trailer, the trailer went in above that list, so it was no longer the last
582	paragraph and GitHub didn't credit the co-author. The amend now drops the
583	leftover comment block and puts the trailer last. It also fixes a commit
584	that already has the trailer but still ends in that block
585
586	## 1.5.10
587
588	### What changed
589
590	- Xcode's context no longer buries slash commands. Xcode sends the user's
591	prompt as the last of several text blocks, with project context in the
592	blocks before it, so `/models` and friends sat in the middle of joined text
593	and were handed to the model instead of dispatching locally. Slash-command
594	parsing now searches the prompt's text blocks from the end, so a standalone
595	command in the final user block dispatches no matter what context the client
596	prepends
597	- The nova tier is the default cloud engine. When local inference is off
598	and no explicit provider override is set, the cloud tier now defaults to
599	`nova` (the `onde-nova` model) instead of the balanced tier, in both the
600	interactive and headless paths
601
602	### Fixed
603
604	- Malformed Chinese-model tool calls are handled end-to-end in ACP. The
605	inline-call recovery that 1.5.9 added for Kimi K3's XTML protocol and GLM's
606	mis-tagged blocks only applied to the interactive and headless surfaces;
607	the ACP path never ran it, so an editor session still surfaced raw protocol
608	text and dropped the calls. Recovery now runs in the ACP prompt loop too,
609	covered by integration tests, and the tool names are checked against the
610	turn's offered tools before anything executes
611	- Suppressed tool-call log spam is gone. The guard that logs when a
612	structured call is dropped for arriving as forced text fired once per
613	streamed argument fragment — one malformed call could log a warning per
614	chunk. The check now fires once per turn with the count and names of what
615	was dropped, and the non-streaming path reports the same
616	- A history-replay test no longer races on the process cwd. One ACP test
617	built its expected path from `std::env::current_dir()` while other tests
618	briefly swap that process-global cwd, so on CI it could read a temp
619	directory mid-swap and compare a truncated title against an untruncated
620	expectation. It now uses a fixed path it never needed to derive
621
622	## 1.5.9
623
624	### Fixed
625
626	- Kimi K3 tool calls no longer arrive as raw protocol text. Kimi K3 renders
627	a call in Moonshot's XTML protocol — pipe-delimited open/sep/close tokens
628	wrapping named blocks — and when the serving stack doesn't parse that back
629	into structured tool calls, the whole block surfaced in the editor as literal
630	text and the turn ended as though the model had answered in prose. The
631	inline-call recovery now speaks that protocol alongside the legacy XML tags:
632	tools blocks are parsed into real calls (several per block, argument values
633	decoded and typed from the block's own type attribute or, when it is
634	missing, the turn's tool schemas), response blocks are unwrapped so their
635	text still renders, and think blocks are dropped as private reasoning rather
636	than shown. The streaming scanner watches all the opening markers, so a
637	block split across chunk boundaries still recovers
638	- GLM's mis-tagged calls recover too. GLM sometimes precedes the legacy
639	block's first argument key with another tool-call opening tag instead of the
640	arg-key opening tag the format calls for, and the recovery rejected the
641	whole block when it did — the call surfaced as text and whatever it was
642	trying to do was dropped. The parser now accepts that alias for the first
643	argument only — later arguments stay strict, so text that merely resembles a
644	call cannot be recovered as one — in both the whole-blob and streaming
645	paths, and the scanner tolerates the malformed marker split across chunk
646	boundaries. Recovery in both protocols also checks the call's name against
647	the tools actually offered in the turn: a tag naming a tool that was never
648	in the turn's spec stays on screen instead of being executed
649
650	## 1.5.8
651
652	### What changed
653
654	- Editor panels can switch permission mode without a slash command. ACP
655	clients now get a Permissions selector next to the model controls with
656	Manual, Auto, and Plan choices for the current session. Manual keeps the
657	existing approval prompts, Auto lets mutating tools run unattended while
658	still respecting explicit deny rules in `settings.toml`, and Plan keeps the
659	agent in research-only mode. The selector follows `/plan` and `/clear`, and
660	it is deliberately session-scoped so a risky Auto choice does not persist
661	into the next task
662	- Tool calls in the editor are worth opening now. Zed only drew the
663	disclosure arrow on the handful of cards siGit set `content` on — the model
664	download and switch spinners — because everything else carried nothing but
665	`rawInput` and `rawOutput`, fields ACP gives clients no display guidance for.
666	Every tool call now gets a fenced content block: the pretty-printed arguments
667	while it runs, then the tool's output once it finishes, with a `(no output)`
668	placeholder for a silent command like `git add`. Cards are titled
669	`<tool> · <arg>` rather than the bare tool name, path-bearing tools set
670	`locations` so the editor can follow along, and a replayed session gets the
671	same treatment as a live one
672	- The context window is visible before compaction fires. Both model pickers
673	show each model's window, and the TUI title bar has a gauge for how much of
674	it the conversation is using. Cloud tiers report their own window instead of
675	the compaction budget — the budget is when siGit Code summarizes history, not
676	how much the model can hold, and labelling one with the other understated the
677	window by an order of magnitude
678	- `write_todos` renders as a plan, not a tool card. Zed and other clients
679	have real progress UI for `session/update` plans, so the model's todo list
680	goes there
681	- Picker changes read as status rather than chat. Switching model or
682	inference backend is UI state, so it renders as a completed think-kind tool
683	call. The sign-in prompt stays an assistant message, since it needs the user
684	to act on it
685
686	### Fixed
687
688	- A reopened thread comes back with its history. Clicking a saved thread in
689	Zed sends `session/load`, and the client draws the thread purely from the
690	`session/update` notifications the agent streams while that request is in
691	flight. siGit restored the saved history into the backend, which is what
692	makes the model remember, but sent the client nothing — so the thread opened
693	empty and looked like a brand new conversation. The snapshot is now turned
694	into updates before it is restored: user and assistant text as message chunks
695	with reasoning stripped, each tool call completed with its result folded in,
696	and `write_todos` as a plan the way it renders live. System messages stay
697	out, since they seeded the model and were never on screen
698	- Compaction no longer fails in every session that ran a tool.
699	`compact_history` asked for the summary through `complete(None, None)`, which
700	sends no tools array but left the live history in place. That history is
701	thick with assistant `tool_calls` and `role: "tool"` messages, and an
702	endpoint handed tool shapes with no schema to check them against rejects the
703	request — Anthropic answers 400. So compaction failed on every attempt in any
704	session that had run a single tool, however small the history was, and then
705	retried on every prompt and tool round while that history kept growing. The
706	conversation now goes as a flattened transcript in one user message, which
707	keeps what the summary needs and drops the shapes that only mean anything
708	next to a tool schema
709	- A tool call emitted as text is no longer dropped. Qwen 3, GLM and
710	DeepSeek write a call as `<tool_call>NAME<arg_key>…` in their chat template
711	and rely on the serving stack to parse it back into `tool_calls`. When that
712	doesn't happen the tag arrives as ordinary content, so it was rendered
713	verbatim in the editor and the turn ended as though the model had chosen to
714	answer in prose. Both the streaming and non-streaming paths now scan content
715	for those blocks and turn well-formed ones back into real calls, typing
716	argument values from the turn's own tool schemas. The streaming scanner holds
717	back only enough text to catch a tag straddling a chunk boundary, so ordinary
718	answers still stream token by token. A block that doesn't match the expected
719	shape is left in the text untouched: reissuing a `run_command` is cheap, but
720	guessing wrong at a half-parsed `edit_file` would write the wrong change to a
721	file
722	- Tool-call content survives awkward output. Whitespace-only output is
723	preserved rather than collapsed, malformed arguments no longer get a
724	misleading JSON fence, and fence language identifiers are sanitized
725
726	## 1.5.7
727
728	### What changed
729
730	- `@smbcloud/sigit` gets releases again. The npm scope moved to
731	`@getsigit` in 1.5.5 and the old package was left sitting on the registry at
732	1.5.2, so an install made before the rename went quiet — `npm update` had
733	nothing to give it and nothing said why. All seven packages now publish under
734	both scopes from the same build, so `@smbcloud/sigit` is a full install again
735	rather than a stub, with its own platform binaries and no dependency on the
736	new scope. It prints a line on stderr saying where the package moved to;
737	`SIGIT_SUPPRESS_SCOPE_NOTICE=1` turns that off. This is a migration path, not
738	a second home: `@getsigit/sigit` is what the docs, the Homebrew tap, and the
739	ACP registry entry point at, and it is the name to move to
740	- Multi-root projects now work in the editor. When a client opens several
741	directories in one project, ACP sends the extra ones as
742	`additionalDirectories` — but only to an agent that says it wants them, which
743	siGit never did, so Zed kept the first root and showed a banner saying
744	multi-root workspaces were unsupported. The capability is now advertised at
745	`initialize`, and the directories that arrive are no longer logged and thrown
746	away. All the roots are now part of the session: the model is told about each
747	one, every root's `AGENTS.md` / `CLAUDE.md` is loaded, and skills, slash
748	commands, and subagent types are discovered from all of them (primary root
749	first, so it still wins name collisions). `/status` lists the roots when
750	there is more than one, and headless runs take the same thing as repeatable
751	`--add-dir <dir>` flags. MCP servers are the exception: discovery happens
752	once at startup, before a session exists, so a second root's `.sigit/mcp.toml`
753	is not picked up
754
755	### Fixed
756
757	- A shell command can no longer wedge the editor session. Tool commands
758	inherited siGit's own stdin, which in ACP mode is the JSON-RPC pipe from the
759	editor. A command that read stdin — a signing passphrase prompt, a pager, a
760	`git` credential ask — blocked on it and consumed the client's next request
761	out of the pipe, so nothing typed afterwards ever reached the agent and the
762	session stayed dead past the command timeout. Commands, hooks, and the
763	co-author `git` helpers now run with stdin closed, so a command that wants
764	input gets EOF and reports an error instead
765	- A command that prints a lot no longer stalls for two minutes.
766	`run_command` waited for the command to exit before reading its output, so
767	anything past the pipe buffer (a build, a verbose test run) blocked writing
768	while siGit blocked waiting, until the 120-second timeout killed it. Output
769	is now drained while the command runs
770	- The command timeout now stops the whole command. It killed only the
771	shell, leaving anything that shell had started running and unreaped; it now
772	kills the process group
773	- A refused turn now shows the endpoint's own message. siGit pasted the
774	status line and the raw JSON body into the editor's error banner, so a
775	billing or allowance message arrived wrapped in
776	`endpoint returned 429 Too Many Requests: {"error":{"message":…`. The message
777	the endpoint wrote is what the banner shows now; the status is only used when
778	there is no message to show
779	- An error that arrives mid-stream is no longer silent. An endpoint that
780	fails after the response is already open reports it as a frame in the stream.
781	That frame carries no `choices`, so siGit parsed it as an empty chunk and
782	skipped it, and the turn ended as though the model had answered with nothing
783
784	## 1.5.6
785
786	### What changed
787
788	- Switching models mid-conversation no longer restarts it. Both switching
789	to a local GGUF model and picking a different cloud tier now carry the live
790	conversation history across, repairing any half-finished tool call so
791	strict OpenAI-compatible endpoints don't reject the session
792	- Long-running tools now show progress in ACP clients. Synchronous tools
793	(shell commands, file operations, `read_website`, ...) run on a blocking
794	thread pool instead of the ACP connection's own task, so a slow command's
795	`in_progress` update reaches the client — and Zed's spinner — while the
796	command is still running instead of arriving with the result
797	- Text from consecutive tool rounds no longer runs together. ACP and
798	headless clients concatenate consecutive message chunks, so a reply that
799	continued after a tool call used to glue onto the previous round's last
800	sentence with no space. A blank line now opens the next round's text
801	- New onde-cloud model tiers. The model picker (`/models` in the TUI, the
802	config panel in editors) now offers five additional siGit Code Cloud tiers —
803	`flux`, `apex`, `aura`, `orbit`, and `nova` — alongside the existing Fast,
804	Balanced, Large, Mini, Air, Pro, and KKK options. The tier list mirrors
805	onde-cloud's router catalogue, so all three sides (the picker, the router,
806	and the cloud catalogue) have to be updated together when a tier is added
807	- MCP Registry listing moved to `getsigit/si`. The `server.json` manifest
808	and its `release-mcp-registry.yml` publish workflow now live in the
809	[`getsigit/si`](https://github.com/getsigit/si) repo alongside the si CLI's
810	other code, since the registry entry describes the si platform rather than
811	the coding agent
812
813	## 1.5.5
814
815	A distribution release. siGit Code itself is unchanged. What moved is how it
816	reaches you on npm and on Windows.
817
818	### What changed
819
820	- The npm package is now `@getsigit/sigit`. The six platform packages moved
821	with it. `@smbcloud/sigit` stays on the registry but stops receiving updates,
822	so upgrading means switching names:
823	`npm uninstall -g @smbcloud/sigit && npm install -g @getsigit/sigit`. The old
824	package had been stuck at 1.5.2, so this picks up 1.5.3 and 1.5.4 as well.
825	- npm publishes over OIDC. Every `@getsigit/*` package has a trusted
826	publisher pointing at the release workflow, so no npm token is stored in the
827	repository. The release workflow moves to Node 22, which trusted publishing
828	requires.
829	- winget releases actually go out. The workflow could only update a package
830	already present in `microsoft/winget-pkgs`, and siGit Code had never been
831	submitted there, so every dispatch failed. It now submits the package the
832	first time and updates it on later releases. The identifier is
833	`getSigit.siGitCode`.
834
835	## 1.5.4
836
837	- CI: nfpm config expanded to include package version and binary path
838
839	## 1.5.3
840
841	Adds browser-based sign-in, expands distribution channels to Windows (winget,
842	Scoop), Linux (AUR, deb, rpm), and .NET (NuGet), gives ACP clients live
843	visibility into tool activity, adds the KKK and Moonshot AI cloud tiers, and
844	fixes the co-authored-by trailer email.
845
846	### What changed
847
848	- Browser sign-in: `sigit login` now opens a browser OAuth flow (PKCE S256
849	against the siGit Code Cloud authorization server) so you can sign in without
850	a password. A loopback listener catches the redirect automatically; a
851	paste-back fallback handles environments where a loopback isn't reachable.
852	`--paste` forces the paste path, `--password` keeps the old email/password
853	prompt. Zed's "Sign in to siGit Code" button uses the loopback path via ACP
854	`authenticate`
855	- New release channels: siGit Code is now published to winget
856	(`getsigit.siGitCode`), Scoop (`getsigit/scoop-bucket`), the AUR
857	(`sigit-bin`), and as `.deb`/`.rpm` packages alongside the existing
858	Homebrew, npm, PyPI, crates.io, and NuGet channels
859	- NuGet .NET tool: `dotnet tool install --global SiGit.Code` now works on
860	Windows, macOS, and Linux — the package bundles all six platform binaries and
861	a managed shim that execs the right one, leaving stdin/stdout/stderr
862	unredirected so TUI vs ACP mode detection still works
863	- New cloud tiers: the model picker (`/models` in the TUI, the config
864	panel in Zed) now offers the `onde-kkk` (KKK) and Moonshot AI (`oke`) tiers
865	alongside the existing Fast, Balanced, Large, Mini, Air, and Pro options
866	- ACP tool visibility: the agent loop now emits `ToolCall(InProgress)`
867	before each tool runs and `ToolCallUpdate(Completed/Failed)` after it
868	returns, so clients like Zed gain live visibility into tool activity between
869	inference rounds. `tool_choice: "auto"` is also sent explicitly whenever
870	tools are present, fixing models that describe actions in prose rather than
871	issuing a tool call when the field is absent
872	- Malformed tool argument logging: invalid tool argument JSON is now logged
873	at three sites (TUI pretty-printer, ACP tool-call event, permission request)
874	instead of silently falling back to a string value, making malformed payloads
875	visible in logs while preserving backward-compatible behaviour
876	- Co-authored-by trailer fix: the `Co-Authored-By` trailer email was
877	updated to `noreply@sigit.si` (platform-neutral); the commit attribution
878	check was tightened to use idiomatic ownership
879	- NuGet trusted publishing: the NuGet release workflow now exchanges a
880	GitHub OIDC token for a short-lived NuGet API key (via `NuGet/login`) instead
881	of relying on a long-lived `NUGET_API_KEY` secret, so there is no stored
882	credential to rotate or leak
883	- AUR dispatch temporarily disabled: the AUR release workflow is no longer
884	dispatched from `release-github` while new AUR account registration is
885	closed; the `sigit-bin` channel returns once registration reopens
886	- Legal and branding copy updated
887
888	## 1.5.2
889
890	Brings the latest siGit Code Cloud tiers to the picker and aligns the MCP
891	registry metadata with the server release.
892
893	### What changed
894
895	- `/models` now lists the Pro, Air, and Mini siGit Code Cloud tiers alongside
896	Fast, Balanced, and Large
897	- Updated the MCP registry manifest to version 1.2.5, matching the siGit Code
898	Cloud server release
899	- Updated the Agent Client Protocol SDK to the latest v1 release
900
901	## 1.5.1
902
903	Makes siGit Code work as an Xcode custom agent, and updates the Onde SDK.
904
905	### What changed
906
907	- Xcode can now run siGit Code as a custom agent. Point it at the binary with
908	`--acp` as the argument, and that explicit mode loads the selected on-device
909	model on the first prompt, since Xcode's chat has no equivalent of `/load`.
910	The README covers the setup, including wiring up `xcrun mcpbridge` in
911	`mcp.toml` so the agent can use Xcode's build, test, and project tools
912	- MCP calls to the `xcode` server time out after 30 seconds instead of 120, so
913	a request Xcode cannot service no longer leaves the prompt looking busy for
914	two minutes. String JSON-RPC ids from the bridge are handled too
915	- The agent stops repeating itself: a tool call made three times with identical
916	arguments now forces a text reply instead of looping
917	- Onde SDK bumped to 1.2.2
918	- The registry listing in `server.json` matches what sigit.si publishes
919
920	## 1.5.0
921
922	Opens the agent up to user extension: lifecycle hooks, custom slash commands,
923	and configurable subagent types. Also adds web search, a Repo tab in the TUI,
924	and a baked-in smbCloud MCP server.
925
926	### What changed
927
928	- Hooks let you run shell commands at three points in the agent's lifecycle:
929	`session_start`, `pre_tool_use`, and `post_tool_use`, configured under
930	`[hooks]` in `settings.toml`. Commands get context through variable
931	substitution (`{cwd}`, `{tool_name}`, `{tool_result_len}`) and run in the
932	session working directory. A hook that fails is logged and the session
933	continues; a hook that hangs is killed on a timeout, along with its whole
934	process group
935	- User-defined slash commands: drop a Markdown file in `.sigit/commands/` or
936	`.claude/commands/` (or the personal `$SIGIT_CONFIG_DIR/commands/` and
937	`~/.claude/commands/`) with optional `description` and `argument-hint`
938	frontmatter, and the body becomes a prompt template. `$ARGUMENTS` takes the
939	whole argument string and `$1`..`$9` the positional words. A subdirectory
940	namespaces the command with `:`, so `.sigit/commands/git/commit.md` becomes
941	`/git:commit`. They run as ordinary agent turns through the usual tools and
942	permission checks, and are advertised to ACP clients like Zed. `/commands`
943	lists what was discovered
944	- Configurable subagent types for the `task` tool: a Markdown file in
945	`.sigit/agents/` or `.claude/agents/` with `name`, `description`, and an
946	optional `tools:` allow-list, whose body becomes that subagent's system
947	prompt. Pass its name as `subagent_type` to swap the prompt in. The
948	`tools:` list can only narrow the subagent's read-only ceiling, never widen
949	it, so a config file cannot grant itself `edit_file` or `run_command` and
950	route around the permission system. `/agents` lists the discovered types
951	- New `web_search` tool, backed by the Brave-Search-backed search on siGit
952	Code Cloud's MCP server. It is offered only when you are signed in, and it
953	is classified read-only, so searching never triggers a permission prompt
954	- The TUI gains a Repo tab, shown when the session's `origin` remote points at
955	the sigit.si host. It lists issues and pull requests fetched through the
956	official MCP server: Up and Down select, Enter opens a scrollable detail,
957	`i`, `p`, Left and Right switch sections, `r` refreshes. The tab is hidden
958	and skipped in the cycle for any other remote
959	- The smbCloud CLI's stdio MCP server (`smb --mcp`) is now baked in, so
960	smbCloud project and deployment tools work with no `mcp.toml` setup. It is
961	added only when the `smb` binary is on `PATH`, its read-only tools (`me`,
962	`deployments`, `project_list`, `project_show`) skip permission prompts, and
963	you can opt out with `smbcloud = false` in `mcp.toml` or
964	`SIGIT_MCP_SMBCLOUD=off`
965	- siGit Code Cloud's MCP server is now listed in the public MCP Registry as
966	`si.sigit/sigit`, published from `server.json` at the repository root
967
968	### Fixes
969
970	- An explicit `deny` rule now applies to read-only first-party tools instead
971	of being skipped
972	- A subagent type whose `tools:` list resolves to an empty set is rejected
973	rather than producing a subagent with no tools
974	- Command templates render in a single substitution pass, so an argument that
975	contains something like `$1` is no longer re-substituted
976	- Frontmatter is stripped with the same leniency it is parsed with
977	- The Repo tab's detail view no longer shows stale data after a refresh
978
979	## 1.4.1
980
981	Two small fixes: correct co-author attribution and a Homebrew tap fix.
982
983	### What changed
984
985	- The `Co-Authored-By` trailer siGit Code adds to commits now uses the GitHub
986	noreply address for the [sigitc](https://github.com/sigitc) account instead
987	of `sigit@sigit.si`, so GitHub reliably attributes co-authored commits to
988	the siGit Code profile
989	- Fixed the Homebrew tap install docs to trust the tap with `brew trust`
990	instead of a `brew tap --force` flag
991
992	## 1.4.0
993
994	Adds a headless one-shot mode, fine-grained permission rules, stdio transport
995	for MCP servers, an `/init` command, and a set of TUI upgrades: tabs, a live
996	thinking display, and collapsible tool calls.
997
998	### What changed
999
1000	- New headless mode: `sigit -p "prompt"` runs one agent turn with tools and exits — 0 on a completed turn, 1 on inference errors, 2 on bad invocations. Assistant text streams to stdout while logs and tool progress stay on stderr; `--cwd` sets the working directory and `--quiet` prints only the final message. Nobody can answer a permission prompt in a headless run, so `ask` collapses to a denial: grant tools for the run with `--allow-tool`, block them with `--deny-tool`, or use `SIGIT_PERMISSIONS=allow`
1001	- Permission rules make autonomy granular: `[permissions.rules]` in `settings.toml` holds ordered `allow` and `deny` lists of `tool_name(pattern)` entries, e.g. `run_command(git )` or `edit_file(src/)`. Patterns match the command string for `run_command` and the path for file tools; deny always beats allow, and unparseable patterns fail closed, so a bad rule can only narrow access. Always-allow on a `run_command` prompt now grants that command family (its first two tokens), not the whole shell
1002	- The MCP client speaks stdio: `mcp.toml` server entries can give a `command`, `args`, and an `env` map instead of a `url`, so the stdio-first majority of published MCP servers plugs in. Same handshake, timeouts, tool namespacing, and output caps as HTTP; `/mcp` shows the command line for stdio servers
1003	- New `/init` command (TUI and ACP): runs a normal agent turn that explores the repository and writes an `AGENTS.md` — or improves an existing `AGENTS.md`/`CLAUDE.md` in place — going through the ordinary tools and permission checks
1004	- The TUI gains tabs, cycled with the Tab key: Session is the chat, History lists saved sessions (restore with Enter, delete with a confirmed double-`d`, refresh with `r`), and Cloud shows the signed-in account, inference mode, current model and engine state, permission policy, and config dir, with a live Local Inference toggle
1005	- The TUI shows model thinking: while a reply streams, the last three lines of the reasoning appear live under the spinner, dim and italic; finished replies collapse to a one-line indicator with the line count, and `/thinking` expands the full reasoning block above each reply. Display only — nothing changes in what is sent to the model, saved to sessions, or streamed over ACP
1006	- Tool calls in the TUI transcript collapse to single dim title lines (the command for `run_command`, the path for file tools, the pattern for search and glob); `/tools` expands every entry to show the pretty-printed arguments and a capped tail of the result. Permission prompts keep showing the full command, and the model still receives full outputs
1007	- When `AGENTS.md` and `CLAUDE.md` sit in the same directory, the instructions loader now prefers `AGENTS.md`, so shared content is injected once
1008
1009	## 1.3.2
1010
1011	Adds a tool permission system with plan mode, durable sessions with context
1012	compaction, background command execution, a subagent research tool, and commit
1013	co-author attribution.
1014
1015	### What changed
1016
1017	- Every tool call now passes a permission policy before executing. Read-only tools always run; mutating tools (and all MCP or unknown tools) are governed by, in order: plan mode, session grants, per-tool overrides, and a default mode from `[permissions]` in `settings.toml` (`allow`/`ask`/`deny`, default `ask`). On `ask`, editors get a native ACP permission dialog (allow once / allow for this session / deny) and the TUI pauses on a y/a/n prompt showing the tool and its arguments. `SIGIT_PERMISSIONS` overrides the default mode for headless runs and clients without permission support
1018	- New `/plan [on\|off]` command: plan mode blocks mutating tools and asks the model to present a plan while research tools keep working. `/permissions` prints the effective policy
1019	- Sessions are durable: conversation history is saved per session under `~/.config/sigit/sessions/` after every turn. ACP `session/load` actually restores it, the TUI gets `/resume`, and `/clear` deletes the saved file
1020	- Context compaction: `/compact` compresses the conversation on demand, and the agent compacts automatically once the history approaches a 24k-token budget, summarizing older turns and keeping the recent ones. The tool-round cap rises from 10 to 24 now that long sessions have a defense other than the cap
1021	- `run_command` can run work in the background: pass `run_in_background` and the tool returns a task id immediately, so builds, test suites, and dev servers are no longer killed by the 120 second foreground timeout. Poll with the new `command_output` tool (read-only, never prompts) and stop with `kill_command`
1022	- New `task` tool: delegate research to a fresh subagent conversation that only gets the read-only tools and returns its final answer, keeping the main context small. Available on OpenAI-compatible backends; on-device returns a clear fallback until onde supports a second context
1023	- Commits created by the agent are co-authored: commit messages end with `Co-Authored-By: siGit Code <sigit@sigit.si>` (the [sigitc](https://github.com/sigitc) account), which GitHub renders next to the human author. If the model forgets the trailer, siGit amends it in, never rewriting commits that already exist on a remote
1024	- ACP mode now honors the `OPENAI_BASE_URL`/`OPENAI_API_KEY` provider override at startup, matching the interactive client
1025
1026	## 1.3.1
1027
1028	Adds [Model Context Protocol](https://modelcontextprotocol.io) (MCP) client
1029	support with the official siGit Code MCP server baked in, a set of agent tools
1030	that close parity gaps in the tool layer, and refreshed branding and licensing.
1031
1032	### What changed
1033
1034	- siGit Code is now an MCP client: it connects to MCP servers over the Streamable HTTP transport (a single JSON-RPC endpoint), discovers the tools they expose, and offers them to the model alongside the built-in tools. When the model calls one, the call is forwarded to the owning server and the result fed back into the agent loop
1035	- Bakes in the official siGit Code MCP server at `https://sigit.si/api/v1/mcp` (follows `SIGIT_CLOUD_URL`). When you are signed in (`sigit login`), the cloud session token is sent as the bearer credential
1036	- Configure additional servers in `mcp.toml` — global (`~/.config/sigit/mcp.toml`) or project-local (`.sigit/mcp.toml`). Each `[[server]]` has a `name`, `url`, optional `enabled`, and optional `[server.headers]`; set `official = false` to opt out of the baked-in server
1037	- MCP tools are namespaced `mcp__<server>__<tool>` so they never collide with built-in tools or across servers; tool output is capped to protect the model's context
1038	- Discovery is best-effort at startup and bounded by a per-server timeout, so an unreachable server never blocks startup — it just contributes no tools
1039	- Added a `/mcp` slash command (TUI and ACP) that lists configured servers, their connection status, and the tools each exposes
1040	- Disable MCP entirely with `SIGIT_MCP=off`, or just the official server with `SIGIT_MCP_OFFICIAL=off`
1041	- New agent tools that close parity gaps in the tool layer: `multi_edit` (apply a batch of exact-substring edits to one file atomically — written only if every edit matches), `glob` (locate files by name pattern with `*`/``/`?`/`{a,b}`, most-recently-modified first), `write_todos` (render a live task checklist through the tool result for multi-step work), and `remember` (append durable notes to the nearest `AGENTS.md`/`CLAUDE.md`)
1042	- `edit_file` now supports `replace_all` and returns actionable failure context — naming the line whose trimmed text matches when only whitespace differs — so the model self-corrects in one round
1043	- `search_files` gained a `file_glob` filter and a `max_results` cap (default 50, hard-capped at 1000) that also bounds the directory walk
1044	- Refreshed branding and legal: updated `LICENSE`, `README`, and the npm/PyPI package descriptions
1045
1046	## 1.3.0
1047
1048	Adds a Local Inference on/off toggle, the open [Agent Skills](https://agentskills.io)
1049	format, and support for project instruction files (`AGENTS.md` and the like).
1050
1051	### What changed
1052
1053	- Added a Local Inference on/off setting that is the explicit local-vs-cloud mode switch. It is persisted in `~/.config/sigit/settings.toml` (default on, local-first) and can be overridden with `SIGIT_LOCAL_INFERENCE`
1054	- Toggle it with the `/local [on\|off]` command (TUI and ACP); ACP clients without slash-command support get an equivalent "Local Inference" On/Off control in the session config panel
1055	- `/models` now groups models by nature — Local vs siGit Code Cloud — and highlights the active mode's group while still showing the other, so the cloud tiers stay discoverable
1056	- Discovers Agent Skills (folders with a `SKILL.md`) from `.sigit/skills/` and `.claude/skills/` in the project, `~/.config/sigit/skills/`, and `~/.claude/skills/`
1057	- Follows the spec's progressive disclosure: each skill's name and description are advertised up front via a new `skill` tool, and the full instructions load only when the agent activates one
1058	- Added a `/skills` slash command (TUI and ACP) that lists the discovered skills
1059	- Reads project instruction files at session start: `AGENTS.md` (the cross-tool standard) and `CLAUDE.md`, walking from the working directory up to the repository root, plus a global file under `~/.config/sigit/`, and injects them into the session's system context so their guidance is always in force
1060	- Nested instruction files are ordered outermost-first so the closest, most specific file takes precedence; the scan never reads above the repository root
1061	- On-device models are no longer loaded implicitly. The chat UI and ACP sessions come up immediately, and the local model is brought into memory only when you run the `/load` command (or pick one in `/models`). Prompts sent before a model is loaded now return a hint instead of blocking on a multi-minute download.
1062
1063	## 1.2.2
1064
1065	Streams assistant tokens as they arrive, on-device and over the cloud.
1066
1067	### What changed
1068
1069	- Streamed assistant tokens live in the TUI and ACP sessions, both on-device and through siGit Code Cloud
1070	- On-device inference streams only when a turn offers no tools, since `onde` can't stream and detect tool calls in the same pass; tool-capable turns still resolve in one shot
1071	- Fixed the TUI so the latest message stays visible in long chats
1072	- Put the cloud model-switch confirmation on its own line in ACP
1073
1074	## 1.2.1
1075
1076	Stabilizes the Zed/ACP integration and finishes the cloud-tier wiring on top of 1.2.0.
1077
1078	### What changed
1079
1080	- Fixed a Zed crash by keeping model-picker labels ASCII in the ACP model selector
1081	- Wired ACP auth, cloud tiers, and slash commands into the Zed panel, including a `/reload` command to re-sync session state in place
1082	- Fixed the TUI so the loaded-model checkmark appears once a download completes
1083	- Synced bundled agent skills with the current code and added `CLAUDE.md`
1084
1085	## 1.2.0
1086
1087	Adds siGit Code Cloud — a hosted inference tier alongside on-device models.
1088
1089	### What changed
1090
1091	- Added siGit Code Cloud with cloud-tier routing, pointed at `sigit.si`
1092	- Added account management slash commands and surfaced cloud tiers in `/models`
1093	- Carried forward from 1.1.0: ACP SDK v0.13, refreshed dependencies and branding
1094
1095	## 1.1.0
1096
1097	Bumps the ACP SDK to v0.13 and pulls in updated dependencies.
1098
1099	### What changed
1100
1101	- Updated `agent-client-protocol` from v0.11 to v0.13
1102	- Updated `onde` to 1.1.2
1103	- Refreshed branding and skill metadata
1104
1105	## 1.0.4
1106
1107	This release tightens up the terminal experience and finishes a few release-facing cleanup items.
1108
1109	### What changed
1110
1111	- Added bold rich-text rendering in the TUI for assistant replies, so `text` now displays with terminal styling instead of raw markdown markers
1112	- Refreshed the bundled skill metadata to follow the current Agent Skills `SKILL.md` format
1113	- Synced the crate release metadata for the `1.0.4` cut
1114
1115	## 1.0.3
1116
1117	This is the cleanup release for the editor-side startup problems.
1118
1119	### What changed
1120
1121	- Fixed ACP sessions failing on the first real prompt because the server claimed the model was ready before anything had actually been loaded
1122	- Changed ACP startup so the default model loads lazily on the first non-slash prompt instead of pretending it is already in memory
1123	- Kept `initialize` and `session/new` lightweight while still sending proper progress updates once model loading begins
1124	- Updated the Onde integration to `1.0.0`
1125	- Removed a few dependencies we were no longer using
1126
1127	## 1.0.2
1128
1129	This release was supposed to fix the ACP auth breakage. It did fix the stdout pollution problem, but it turned out not to be the whole story.
1130
1131	### What changed
1132
1133	- Delayed model loading in ACP mode so startup diagnostics would not leak into protocol stdout during the auth handshake
1134	- Tightened up the ACP startup path for editor integrations
1135	- Refreshed some README wording while cutting `1.0.2`
1136
1137	## 1.0.1
1138
1139	The first patch after `1.0.0` was mostly about making model loading and model switching feel less opaque.
1140
1141	### What changed
1142
1143	- Added ToolCall-based progress UI for startup model loading and downloading
1144	- Improved model-switch progress reporting in ACP clients
1145	- Fixed model-load error handling so failed switches did not leave the UI in a weird state
1146	- Cleaned up a few status messages and docs while the release was going out
1147
1148	## 1.0.0 (2026)
1149
1150	siGit Code has been living in real smbCloud repos for a while now. At some point it stopped feeling like an experiment, so we called it 1.0.
1151
1152	### What this release is
1153
1154	siGit Code is a local coding agent. It runs a quantized model on your machine, talks to editors over ACP, and can read files, run commands, fetch web pages, and write code without sending your project to a hosted API.
1155
1156	You can install it with Cargo, pip, npm, or Homebrew and use it like any other tool on your machine.
1157
1158	### What shipped in 1.0
1159
1160	#### Editor integration
1161
1162	This is the core of the project.
1163
1164	Zed and VS Code can talk to siGit Code over ACP. Multi-turn sessions work. Tool calling works. Session forking works. Working-directory context works. That was the original goal, and it feels solid now.
1165
1166	#### Terminal UI
1167
1168	The terminal UI started as a side quest and turned out to be useful. You get a full-screen ratatui chat, streaming tokens, a spinner while the model is busy, and a model picker you can open in the middle of a session.
1169
1170	It runs on macOS and Linux. Windows gets ACP and editor mode for now. The Windows terminal UI is still unfinished.
1171
1172	#### Tool calling
1173
1174	This is the part that makes siGit Code feel like an agent instead of a chat box. The loop can run up to 10 rounds per message.
1175
1176	Available tools:
1177
1178	- `read_file` / `write_file` / `delete_file`
1179	- `list_directory` / `search_files`
1180	- `run_command`, with an optional working directory
1181	- `read_website`, which fetches a URL and strips it down to readable text
1182
1183	The model can call a tool, inspect the result, and keep going until it has a real answer.
1184
1185	#### Model support
1186
1187	The model list ended up wider than we expected for 1.0:
1188
1189	- Qwen 3 1.7B, 4B, 8B, and 14B
1190	- Qwen 2.5 1.5B and 3B
1191	- Qwen 2.5 Coder 1.5B, 3B, and 7B
1192	- DeepSeek Coder 6.7B
1193
1194	They are all GGUF models and they all come from Hugging Face on first run.
1195
1196	Qwen 3 is the interesting one. It uses extended thinking mode. The model reasons inside `<think>...</think>` blocks before answering. The TUI strips those blocks out and renders them dimmed above the reply, so you can see what happened without turning the whole conversation into noise.
1197
1198	The 8B model is the desktop default. Mobile stays on 1.7B because iOS gives apps roughly 2 to 3 GB of memory, and we learned the hard way that 3B can blow up on an iPhone 16e.
1199
1200	#### Model picker
1201
1202	The model picker shows:
1203
1204	- what is already cached locally
1205	- what can be downloaded
1206	- which models support tool calling
1207	- whether the local cache looks healthy
1208
1209	You can open it with `/models` in the TUI or through the editor config option. Switching models happens in the background and the UI stays alive while the download or load is in progress.
1210
1211	#### smbCloud context
1212
1213	siGit Code knows smbCloud repos better than a generic coding assistant does. It understands the difference between platform-user flows and tenant-app auth flows, how `Project`, `FrontendApp`, `AuthApp`, and GresIQ fit together, and why Next.js SSR deploys are not the same thing as the generic git-push path.
1214
1215	Outside smbCloud, it backs off and behaves like a normal coding agent.
1216
1217	#### Distribution
1218
1219	Distribution took an unreasonable amount of time, honestly.
1220
1221	There are prebuilt binaries for macOS, Linux, and Windows on both arm64 and x64 where relevant, plus install paths through Cargo, PyPI, npm, and Homebrew:
1222
1223	- `cargo install sigit`
1224	- `pip install sigit-code`
1225	- `npm install -g @smbcloud/sigit`
1226	- `brew install sigit`
1227
1228	Getting that whole pipeline to behave across CI, crates.io, PyPI, npm, and Homebrew was basically its own project.
1229
1230	### What still does not work
1231
1232	The Windows terminal UI is still missing.
1233
1234	ACP and editor mode work on Windows. The part that is still missing is the interactive full-screen terminal UI. The blocker is Unix-specific terminal handling that has not been abstracted cleanly yet.
1235
1236	### Changes since 0.1.2
1237
1238	- Added Qwen 3 14B support
1239	- Added Qwen 3 `<think>` block parsing and separate rendering in the TUI
1240	- Moved all TUI code into `#[cfg(unix)]`, which fixed a pile of dead-code errors on Windows CI
1241	- Added live download progress during model switches, including cancellation with Ctrl+C
1242	- Added model download and loading progress in the Zed agent config panel
1243	- Added an animated spinner during model switching
1244	- Added Qwen 2.5 Coder 7B
1245	- Added downloadable models to the picker, not just locally cached ones
1246	- Made model selection persist across restarts
1247	- Added session working-directory support
1248	- Moved model picker logic into a platform-independent module so Windows can compile without the TUI
1249	- Added the `/models N` shortcut for picking a model by number
1250	- Added the `read_website` tool
1251	- Improved `read_file` handling and empty-reply detection
1252	- Added async tool execution
1253	- Fixed CI cross-compilation for macOS, iOS, Linux, and Windows
1254	- Added npm, PyPI, and Homebrew distribution
1255
1256	---
1257
1258	© 2026 PT Sigit Mitra Bangun ([siGit Code & Deploy](https://sigit.si)), distributed by [Splitfire AB](https://5mb.app).