CHANGELOG.md · sigitcodereview/sigit

Code Commits Issues Pulls Cloud Agent CI/CD

main

claude/github-issue-40-0au5ua claude/linked-issue-acp-tui-u4vvpa claude/minor-release-cut-vkugow claude/sigit-acp-local-chat-cx6380 claude/sigit-cloud-agent-expansion-reox0a claude/tool-permission-system claude/zen-feynman-0u78dk development feature/acp-cancel-request feature/acp-session-list-cursor feature/acp-v1-conformance feature/agent-tools-multiedit-glob-todos-remember feature/cargo-workspace feature/hooks feature/load-local-model-explicitly feature/sigit-agent-profile feature/sigit-code-cloud feature/xcode-mcp-server fix/acp-replay-loaded-session-history fix/acp-replay-reasoning-and-attachments fix/dsml-doubled-bar-markers main release/v1.5.10 release/v1.5.6 release/v1.6.1

md 1,179 lines 67.6 KB

Rendered Raw

1	# Changelog
2
3	## 1.6.8
4
5	### Fixed
6
7	- A bare launch of `sigit.exe` on Windows exits 0 instead of bailing. A
8	no-argument launch with a TTY stdin falls through to the non-Unix branch,
9	which has no TUI to start (the interactive client needs Unix-only fd
10	redirection). It now prints a short usage message pointing at ACP and
11	headless modes and exits 0, so winget's installer validator no longer reports
12	a `Validation-Executable-Error`.
13
14	### Changed
15
16	- winget submissions link back to their Package Request issue. The release
17	workflow scrapes the winget-pkgs PR URL from wingetcreate, opens a Package
18	Request issue on first submission, and rewrites the PR body to fill the
19	Description, tick the issue checkbox, and add `Resolves #NNN` — replacing the
20	manual per-PR edit that used to follow each release.
21	- **The winget release workflow files its Package Request issue first and uses
22	two scoped tokens.** The Package Request issue is opened before the
23	winget-pkgs PR so the PR can reference it immediately, and issue creation and
24	PR submission now use separate tokens (`WINGET_ISSUE_TOKEN` and
25	`WINGET_PR_TOKEN`) rather than one shared token.
26
27	## 1.6.7
28
29	### Fixed
30
31	- A cancel that arrives before the turn starts is no longer lost. A prompt
32	now registers for `session/cancel` as soon as it begins, not once it reaches
33	inference. A cancel that lands while the turn is queued on the workspace,
34	switching threads, loading a model, or running a slash command ends it with
35	`cancelled` instead of `end_turn`.
36	- A prompt that is only audio is answered. A clip with no text or image used
37	to end the turn at once with nothing sent to the model, even though the agent
38	advertises audio.
39
40	## 1.6.6
41
42	### Added
43
44	- A tool call carries its programmatic tool name. The `tool_call` an editor
45	gets for a running tool now includes `name` (`read_file`, `run_command`,
46	`mcp__…`) next to the human title, sent on the first report of the call only
47	as the protocol asks. A client can tell a command from a file edit without
48	parsing the title, and a replayed thread from `session/load` carries the same
49	name (#196).
50
51	### Changed
52
53	- MCP runs on `rmcp`, the official Rust SDK, through `ed-mcp`. siGit Code's
54	own JSON-RPC client for stdio and Streamable HTTP servers (about 600 lines)
55	is gone; `ed-mcp` is the layer every Onde agent shares. `mcp.toml`, the
56	baked-in `sigit` and `smbcloud` servers, tool names and `/mcp` are unchanged.
57	An HTTP server that stops answering is now reconnected and the call retried
58	once for any failure but a timeout, not only on a 404.
59
60	### Fixed
61
62	- A reply that degenerates into a repetition loop is cut off. After a tool
63	call, a model could fall into thousands of words from a tiny vocabulary
64	(`find: list: check: get: …`) with no tool call and no end, and the junk went
65	into history for the next turn. siGit Code now watches a streamed reply for a
66	window of 200 words with very few distinct ones (code blocks excepted), stops
67	reading, keeps only the text before the loop, tells you it stopped, and asks
68	the model once to make its call or answer briefly (#123).
69	- A linked selection written as `L10-L20` or `L10` reads just those lines.
70	siGit Code read the line range of a `resource_link` only as `L10:20` or
71	`L10-20`, so `L10-L20` (the GitHub style) and a single line `L10` sent the
72	whole file instead of the selection. It now reads the same forms Zed's own
73	mention parser does, and a range that starts at line 0 or runs backwards
74	counts as no range.
75
76	## 1.6.5
77
78	### Added
79
80	- An `@file` mention can carry unsaved edits. siGit Code now advertises
81	`promptCapabilities.embeddedContext`, so a client can put a resource's
82	contents in the prompt instead of sending a link to it. Before, a client
83	that follows the spec only sent `resource_link`, and siGit Code read the
84	file from disk, missing whatever the user had not saved yet (#141).
85	- A prompt can carry audio. siGit Code now advertises
86	`promptCapabilities.audio` and sends an attached clip to the model as an
87	OpenAI `input_audio` part. It works the way image attachments do: a model on
88	an endpoint you configure yourself gets the clip and decides for itself,
89	while siGit Code Cloud tiers and on-device models, none of which take audio
90	today, get a note in its place and the editor says the clip was left out
91	(#143).
92	- The README says what telemetry is sent. A new Telemetry section covers
93	the model-timing events Onde Inference can report for on-device models,
94	what they leave out, and how to turn them off with `ONDE_DISABLE_PULSE=1`.
95
96	### Changed
97
98	- A turn that cannot get its session back stops. A turn on an HTTP backend
99	gives up the process-wide working directory while it waits and reinstalls
100	its session before a tool runs. If the reinstall failed, the turn logged a
101	warning and carried on in whichever directory was current. Nothing makes it
102	fail today, since a close waits for the turn, but the turn now ends as
103	cancelled instead of depending on that.
104	- Dependencies match the rest of the Onde stack. Onde 1.2.2 to 1.3.1,
105	reqwest 0.12 to 0.13 and ratatui 0.29 to 0.30, the versions Ed, OndeCode and
106	SplitFire Agent use. ratatui is built with only its crossterm backend, which
107	drops the second copy of crossterm (0.28) from the build.
108
109	### Fixed
110
111	- Tags a model makes up no longer show in the reply. After a long run of
112	tool rounds, a model could start writing markup that looked like it came
113	from siGit Code: a `<system_warning>` block telling the user the previous
114	turn was injected and should be ignored, or a question wrapped in
115	`<Option_Picker>`. Neither tag means anything to siGit Code or the editor,
116	so both rendered as raw text. A `system_*` block is now dropped from the
117	reply and from the history, and other made-up tags are removed while the
118	text inside them stays. Code blocks are left alone. The system prompt also
119	tells the model to write plain Markdown and to list choices as plain text
120	(#122).
121	- Closing a thread that is waiting at a permission prompt no longer hangs.
122	`session/close` cancels the session's running turn and waits for it to end,
123	but a turn stopped at a permission prompt only went on when the client
124	answered the request. A client that closed the thread without answering
125	left the close, and every later request for that thread, waiting for good.
126	The same held for `session/cancel` with a client that did not send the
127	cancelled outcome the protocol asks for. The permission wait now ends on
128	the cancellation as well, and an approval that arrives after the turn was
129	cancelled runs nothing.
130
131	- A closed thread no longer leaves its request lock behind. The process
132	kept one lock per session id for as long as it ran, for closed threads and
133	for ids no session ever had. The entry now goes with the last request that
134	used it.
135
136	- A tool call that did not run no longer shows as completed. When policy
137	or plan mode denied a call, when the user picked Deny at the permission
138	prompt, or when the repeat guard skipped a call the model made three times,
139	the editor's card still ended `completed`. Those cards now end `failed`, the
140	same way a call cancelled at the prompt already did. A call denied at the
141	prompt also gets its own title back instead of keeping the permission
142	request's (#139).
143
144	- On-device inference no longer panics on some non-English text. siGit Code
145	now builds on Onde 1.3.1, which fixes a panic when a message longer than 100
146	bytes had a multi-byte character (an accented letter, CJK, or an emoji) at
147	byte 100. Onde 1.3 also reports Pulse events for streaming inference, which
148	is the path on-device turns take, so those turns are now reported alongside
149	model loads. `ONDE_DISABLE_PULSE=1` turns Pulse off.
150
151	## 1.6.4
152
153	### Added
154
155	- DeepSeek DSML tool calls written into the reply text are recovered. A
156	DeepSeek-family endpoint can render a tool call as literal
157	`<｜DSML｜tool_calls>` text instead of the structured `tool_calls` field,
158	which streamed the tag into the editor and ended the turn with nothing run.
159	The inline tool-call scanner that already recovered the GLM XML and Kimi K3
160	shapes now recovers the DSML shape too, including a marker split across
161	stream chunks. A block that fails to parse is still kept out of the reply
162	and the history, and the model is told the call did not run (#181).
163
164	### Fixed
165
166	- The round-cap stop message no longer carries a stray run of spaces.
167	When the tool-round cap ended a turn, the closing message could collapse a
168	space run into the wrong spot, which the editor then rendered verbatim
169	(#177).
170
171	## 1.6.3
172
173	### Added
174
175	- A client can resume a session and close one. siGit Code now advertises
176	`sessionCapabilities.resume` and `sessionCapabilities.close`.
177	`session/resume` restores a saved thread the way `session/load` does, but
178	sends none of it back: it is for a client that still has the thread on
179	screen, after an agent restart for example. `session/close` cancels the
180	session's running turn and drops what the process held for it, which is its
181	state, its permission grants and plan mode, the MCP servers the client named
182	for it, and the background commands it started. The saved history is left
183	alone, so a closed thread still lists and reopens (#149).
184
185	- The permission modes are also offered as ACP session modes. Manual, Auto
186	and Plan were only reachable as a config option, which is what the protocol
187	now recommends and what Zed reads. A client that draws the older mode
188	selector saw nothing. `session/new`, `session/load` and `session/fork` now
189	return the same three in `modes`, `session/set_mode` switches between them,
190	and a change made any other way (the config option, `/plan`, `/clear`,
191	`/reload`) is announced with `current_mode_update`. A client that reads
192	config options ignores `modes`, so nothing changes there (#148).
193
194	- An editor can sign out of siGit Code. The `initialize` reply carried an
195	empty `auth` object, so a client drew no sign out button, and typing
196	`/logout` was the only way out of an account. The reply now advertises
197	`agentCapabilities.auth.logout`, and a `logout` request ends the account
198	session through the method `/logout` calls. The request names no session,
199	so it moves every open thread that used the account, not only the live one:
200	a thread parked on a cloud tier goes on-device with the live thread instead
201	of failing to restore its tier on its next prompt, and every thread that
202	moved gets a fresh model picker. Local inference is switched back on if it
203	was off, so a thread opened after signing out asks for no cloud tier
204	(#150).
205
206	### Changed
207
208	- Two threads can run a turn at the same time. An editor runs one siGit
209	Code process for every thread it has open, and a single lock ordered every
210	turn-affecting request in it, so a second prompt waited for the first
211	thread's whole turn and two prompts never overlapped. The lock held what a
212	session installs process-wide — the working directory, the workspace roots,
213	the MCP servers the client named for it, the live backend — none of which a
214	turn touches while it waits on an HTTP endpoint, which is most of its time.
215	A session on an HTTP backend now keeps a backend of its own, so its
216	conversation is no longer swapped in and out of a shared one, and a turn
217	releases the process-wide lock while it waits on the endpoint or on a
218	permission answer and takes it back, reinstalling its session, before any
219	tool runs. On-device turns are unchanged, since the engine keeps one
220	conversation, and tool execution still runs one session at a time (#176).
221
222	### Fixed
223
224	- A prompt whose inference failed is kept through a model switch. A turn
225	that ended in an endpoint error stayed in the client's thread, but the
226	carryover into a new model dropped its trailing user message, and the error
227	path never saved the session. Only a cancelled prompt should be taken back
228	out, so cancellation now removes it from the live history, and the error
229	path persists the session (#124).
230
231	## 1.6.2
232
233	### Added
234
235	- `sigit --version` prints the release. `sigit --version` and `sigit -V`
236	print `sigit <version>` on stdout and exit 0. Before, the flag was not
237	recognized and siGit Code started a session, which left a script that asked
238	for the version waiting.
239
240	- File tools read and write through the editor when it offers to. An ACP
241	client that advertises `fs.readTextFile` or `fs.writeTextFile` serves those
242	requests from its open buffers. siGit Code always used the disk, so
243	`read_file` missed unsaved changes and `edit_file` wrote underneath a buffer
244	the user might have modified. `read_file`, `create_file`, `edit_file` and
245	`multi_edit` now go through the client for paths inside the session's roots.
246	The two capabilities are independent, and the disk is still the fallback:
247	for a path outside the roots, and for a request the client fails or leaves
248	unanswered for 30 seconds. `SIGIT_CLIENT_FS=off` keeps the file tools on
249	disk (#147).
250
251	### Fixed
252
253	- A file attached from the editor is found when its path needs escaping.
254	A `resource_link` was read by stripping `file://` and using the rest as the
255	path, so a space arrived as `%20`, a non-ASCII name failed, and a Windows
256	URI kept its leading slash. A `#` in a file name was also taken for the
257	line-range fragment. The URI is now parsed properly (#170).
258
259	## 1.6.1
260
261	### Added
262
263	- Images can be attached to a prompt in the editor. siGit Code now
264	advertises `promptCapabilities.image`, so an ACP client offers image
265	attachments. The image goes to the model when the active model reads images.
266	The model picker marks those models with "reads images". The on-device
267	models and four cloud tiers (`nova`, `orbit`, `apex`, `flux`) are text-only:
268	with one of them active the image is left out, a note in the thread says so,
269	and the model is told an image was withheld. Switching a thread that already
270	holds images to a text-only model flags that once as well. Cloud tiers need
271	siGit Code Cloud to accept image parts, which is rolling out separately
272	(#134).
273
274	- The tool-round cap of a headless run can be set. `--max-tool-rounds <n>`
275	or `SIGIT_MAX_TOOL_ROUNDS` (1 to 500) replaces the built-in 24 for
276	`sigit run` and `sigit -p`. The flag wins over the variable.
277
278	### Fixed
279
280	- A prompt turn now reports why it stopped. ACP defines five stop reasons
281	and siGit Code only ever sent `end_turn` and `cancelled`. A turn that runs
282	into the tool-round cap now ends with `max_turn_requests`, a reply cut off
283	at the token limit with `max_tokens`, and a reply the endpoint withheld
284	(`content_filter`) with `refusal`. A refused turn is also taken out of the
285	conversation, which is what the protocol tells the client to expect (#140).
286
287	- A tool call that needs approval is one card, not two. The permission
288	request carried an id of its own, so an ACP client showed an approval card
289	beside a call that already claimed to be running. The call is now announced
290	as `pending`, the permission request names that same call, and it moves to
291	`in_progress` once approved. Calls allowed by policy still start out
292	`in_progress` (#138).
293
294	- A turn that runs out of tool rounds says so. In an editor, a long task
295	could stop on a line like "Now commit:" with nothing after it. The turn had
296	used all 24 tool rounds, the model spent its last reply announcing the next
297	step, and the call behind it was dropped. siGit Code now tells the model
298	that its rounds are used up before that last reply, and ends the turn with a
299	message saying why it stopped and that "continue" picks it back up.
300	`SIGIT_MAX_TOOL_ROUNDS` now sets the cap for editor sessions too (#120).
301
302	- A headless run no longer ends silently with no final message. When the
303	last round came back empty, which is what happens when a run is cut off at
304	the tool-round cap mid-task, stdout was empty and the exit status was 0, so
305	a caller could not tell it from a run with nothing to report. siGit Code now
306	asks the model once for its final message before finishing.
307
308	## 1.6.0
309
310	### Added
311
312	- Editors can pass HTTP MCP servers to a session. siGit Code now
313	advertises `mcpCapabilities.http`, so an ACP client may list Streamable HTTP
314	servers in `mcpServers` next to stdio ones. They are connected with the URL
315	and headers the client sent and are scoped to that session, like the stdio
316	ones. SSE is still not advertised, since the MCP spec deprecated it (#151).
317
318	- The plan panel survives a failed turn. The last `write_todos` list is
319	now kept by siGit Code itself. When a turn ends in an endpoint error before
320	the model gets to call `write_todos` again, the saved list is sent to the
321	editor again, so the plan stays on screen where it used to go blank (#132).
322
323	### Changed
324
325	- The ACP Rust SDK is now 2.2 (`agent-client-protocol`, up from 1.3).
326	siGit Code still speaks ACP protocol v1 to the editor, so nothing changes on
327	the wire. The `unstable_auth_methods` feature is gone because agent auth
328	methods are stable in 2.x.
329
330	### Fixed
331
332	- MCP servers the editor passes to a session are connected. ACP clients
333	can name MCP servers in `mcpServers` when they open a session, and agents
334	are required to connect to the stdio ones. siGit Code accepted the field and
335	ignored it. The servers are now spawned when the session opens, their tools
336	are offered to that session only, and `/mcp` lists them as coming from the
337	editor. `SIGIT_MCP=off` still turns all of it off (#135).
338
339	- A relative `cwd` is rejected when a session starts. ACP requires the
340	working directory and every `additionalDirectories` entry to be absolute.
341	`session/new`, `session/load` and `session/fork` used to accept a relative
342	one and resolve it against wherever the editor spawned the process. They now
343	answer with an invalid-params error (#136).
344
345	- Loading a session that does not exist is an error. `session/load` with
346	an id that was never saved used to succeed and open an empty session under
347	that id, so the editor showed a blank thread that looked restored. It now
348	answers "not found" (`-32002`). A thread opened in the running process but
349	not spoken in yet still loads (#137).
350
351	- Compaction no longer dead-ends a long session. The summarization request
352	used to carry the whole conversation, which by then was already over the
353	model's window, so siGit Code Cloud timed out with a 504 and the session
354	stopped with "start a new thread". The transcript sent for summarizing is
355	now capped, cut from the middle so the opening request and the latest state
356	are kept. If summarizing still fails, the oldest messages are dropped until
357	the history fits, with whole tool rounds removed together. A failed attempt
358	leaves the conversation as it was (#125).
359
360	- Gateway error pages stay out of the chat. When an endpoint answers with
361	an HTML error page, the error shown is the status line, not the page's
362	markup (#125).
363
364	- Issue and pull request work no longer assumes GitHub. The system prompt
365	treated forge features as if every repository lived on GitHub, while the
366	built-in `mcp__sigit__*` tools only work for repositories hosted on
367	sigit.si. The agent now checks the remote first, uses those tools only for
368	sigit.si repositories, and reaches for the forge's own CLI (`gh`, `glab`,
369	`tea`) elsewhere (#127).
370
371	## 1.5.13
372
373	### Added
374
375	- Three more siGit Code Cloud tiers: `flare`, `zenith` and `prism`. They
376	show up in `/models` and in the editor's model picker alongside the existing
377	tiers. Selecting one needs a signed-in account, as before.
378
379	## 1.5.12
380
381	### Fixed
382
383	- **The Windows binaries start on machines without the Visual C++
384	Redistributable.** They used to import `VCRUNTIME140.dll` and the UCRT
385	`api-ms-win-crt-*` DLLs, so a clean Windows install refused to load them
386	with `STATUS_DLL_NOT_FOUND` (0xC0000135). That is what failed winget's
387	post-install check. The C runtime is now linked statically, and CI and the
388	release build fail if a Windows exe picks up that dependency again.
389
390	- Watching a slow background command no longer ends the turn early.
391	Polling `command_output` on the same task id three times tripped the
392	repeated-tool-call guard, which refused the call and dropped tools for the
393	rest of the turn. `command_output` now long-polls — it waits up to
394	`wait_seconds` (default 10, max 30) for the task to exit, then returns
395	everything printed in the meantime — and the repeat guard exempts it, since
396	polling the same task is the whole point of the tool.
397
398	- A turn that ends with no visible text says why. When the
399	repeated-tool-call guard blocked a call and the forced no-tools round came
400	back empty, sigit sent nothing more — the turn just stopped with no answer
401	and no question. When the last round of a tool-using turn produces no
402	visible text, sigit now sends a short closing message naming the repeated
403	tool and asking you to reply "continue" or redirect.
404
405	## 1.5.11
406
407	### Added
408
409	- `sigit run` drives the agent headlessly with resumable sessions. A new
410	non-interactive subcommand runs a prompt through the same agent loop as the
411	editor and terminal surfaces, for scripts, CI, and Factory clients. Every run
412	gets a UUID session id, writes a JSON-lines history file under
413	`~/.config/sigit/sessions/`, and can be restored with `--resume <id>`.
414	`--output jsonl` emits a structured session/delta/tool/result stream on
415	stdout while logs stay on stderr, and `--allow-tool` pre-approves a tool so
416	permission prompts collapse to denial in a non-interactive context. The
417	legacy `-p` form still works. Each run also rewrites the session metadata
418	with its own cwd and extra roots, so resuming keeps multi-root projects
419
420	- Saved threads can be imported into the editor. siGit Code now advertises
421	ACP's `sessionCapabilities.list` and answers `session/list`, so Zed's "Import
422	Threads" picker offers the conversations stored under
423	`~/.config/sigit/sessions/` instead of reporting that the agent doesn't
424	support the capability. A saved session gets a sidecar recording the project
425	directory it ran in — listing reports that `cwd`, the extra roots of a
426	multi-root project, an ISO 8601 last-activity timestamp, and a title taken
427	from the first user message — and a request may filter on `cwd` so one
428	project is never offered another's threads. Threads saved before this have no
429	sidecar and are not listed; they still reopen by id through `session/load`
430
431	### Changed
432
433	- The commit trailer names the siGit Code version and surface. Commits
434	siGit Code makes now end with
435	`Co-Authored-By: siGit Code v<version>-<surface> <noreply@sigit.si>` instead
436	of the bare name, where the surface is `acp` (an editor), `tui` (the
437	terminal UI), or `headless` (`sigit run`). The model changes from session to
438	session; the version and surface tell you which build of the agent wrote the
439	commit and how it was driven. GitHub still credits the co-author, since it
440	matches on the address. A commit that already carries a siGit Code trailer
441	from an older version is left alone
442
443	- The terminal UI's model knows which directory the project is in. The
444	editor (ACP) and headless paths put the working directory in the system
445	prompt, but the terminal UI only added the project's instruction files, so
446	on `/init` a small on-device model invented a `AGENTS.md` path and failed.
447	All three places the terminal UI builds a prompt now go through the same
448	session context path the ACP sessions get. The cloud tier switch had also
449	been dropping the instruction files; that's fixed too
450
451	- An empty `write_todos` list clears the plan. `write_todos` rejected an
452	empty list, so the model had no way to clear a finished checklist and the
453	last plan stayed in the editor until the session ended. An empty list now
454	returns "Task list cleared." and goes to the client as an ACP plan with no
455	entries. The tool description tells the model it can do this
456
457	- `sigit run` gives clearer usage errors. A second positional prompt says
458	"unexpected extra argument", a bare `sigit run` says "missing prompt", and a
459	mistyped flag like `--quite` is rejected instead of becoming the prompt
460
461	### Fixed
462
463	- Each ACP session keeps its own roots, conversation, and tasks. Zed runs
464	one siGit process for every open thread, but the process had a single cwd,
465	workspace root list, backend conversation, and background task table. The
466	most recent session owned all of them, so a prompt from an older thread ran
467	against another repo with another thread's history. A `SessionState` is now
468	kept per session id; before a prompt or config change runs, the live
469	conversation is parked and the requested session's cwd, extra roots, and
470	conversation are installed, rebuilding the system prompt from its roots.
471	`new`/`load`/`fork` share a single session-opening path, and fork carries the
472	source thread's conversation. Background tasks are scoped to the session that
473	started them, opening a session no longer wipes every other session's
474	permission grants, and model selection is routed per session
475
476	- New sessions no longer carry the previous thread's history. Opening a
477	new thread in Zed showed a `[Conversation summary]` from an earlier session.
478	The session handlers cleared the on-device engine but not the history a cloud
479	backend keeps for itself, and the startup routing to the cloud tier then
480	carried that history into the installed backend. A provider override had the
481	same leak. All session entry points now share a path that strips stale
482	history too, and unknown session ids are rejected instead of borrowing the
483	live thread's state
484
485	- Unparseable tool-call markup is hidden and retried, not shown as text.
486	Some models write tool calls into the reply as text. Well-formed blocks were
487	already recovered and run, but a block that failed to parse or never closed
488	was printed to the editor as-is and stayed in history, so the model later
489	read back a call it had "made" with no result and began writing invented
490	`<function_results>`. The scanner now reports those blocks as malformed; the
491	backend drops them from the reply and history, and when the only tool call
492	was malformed the model gets one retry telling it the call didn't run. A
493	block that merely mentions a tool-call marker (a backticked `<tool_call>` or an
494	unclosed XTML `<\|open\|>tools`) is now kept as prose, so a reply explaining
495	the scanner no longer loses everything after the first marker. The
496	non-streamed path now strips broken blocks beside structured calls and runs
497	any inline calls that did parse, matching the streaming path
498
499	- The co-author trailer ends a conflicted merge commit. Finishing a
500	conflicted merge with `git commit --no-edit` keeps git's `# Conflicts:` list
501	in the message, since no editor runs to strip it. When siGit Code then added
502	its trailer, the trailer went in above that list, so it was no longer the last
503	paragraph and GitHub didn't credit the co-author. The amend now drops the
504	leftover comment block and puts the trailer last. It also fixes a commit
505	that already has the trailer but still ends in that block
506
507	## 1.5.10
508
509	### What changed
510
511	- Xcode's context no longer buries slash commands. Xcode sends the user's
512	prompt as the last of several text blocks, with project context in the
513	blocks before it, so `/models` and friends sat in the middle of joined text
514	and were handed to the model instead of dispatching locally. Slash-command
515	parsing now searches the prompt's text blocks from the end, so a standalone
516	command in the final user block dispatches no matter what context the client
517	prepends
518	- The nova tier is the default cloud engine. When local inference is off
519	and no explicit provider override is set, the cloud tier now defaults to
520	`nova` (the `onde-nova` model) instead of the balanced tier, in both the
521	interactive and headless paths
522
523	### Fixed
524
525	- Malformed Chinese-model tool calls are handled end-to-end in ACP. The
526	inline-call recovery that 1.5.9 added for Kimi K3's XTML protocol and GLM's
527	mis-tagged blocks only applied to the interactive and headless surfaces;
528	the ACP path never ran it, so an editor session still surfaced raw protocol
529	text and dropped the calls. Recovery now runs in the ACP prompt loop too,
530	covered by integration tests, and the tool names are checked against the
531	turn's offered tools before anything executes
532	- Suppressed tool-call log spam is gone. The guard that logs when a
533	structured call is dropped for arriving as forced text fired once per
534	streamed argument fragment — one malformed call could log a warning per
535	chunk. The check now fires once per turn with the count and names of what
536	was dropped, and the non-streaming path reports the same
537	- A history-replay test no longer races on the process cwd. One ACP test
538	built its expected path from `std::env::current_dir()` while other tests
539	briefly swap that process-global cwd, so on CI it could read a temp
540	directory mid-swap and compare a truncated title against an untruncated
541	expectation. It now uses a fixed path it never needed to derive
542
543	## 1.5.9
544
545	### Fixed
546
547	- Kimi K3 tool calls no longer arrive as raw protocol text. Kimi K3 renders
548	a call in Moonshot's XTML protocol — pipe-delimited open/sep/close tokens
549	wrapping named blocks — and when the serving stack doesn't parse that back
550	into structured tool calls, the whole block surfaced in the editor as literal
551	text and the turn ended as though the model had answered in prose. The
552	inline-call recovery now speaks that protocol alongside the legacy XML tags:
553	tools blocks are parsed into real calls (several per block, argument values
554	decoded and typed from the block's own type attribute or, when it is
555	missing, the turn's tool schemas), response blocks are unwrapped so their
556	text still renders, and think blocks are dropped as private reasoning rather
557	than shown. The streaming scanner watches all the opening markers, so a
558	block split across chunk boundaries still recovers
559	- GLM's mis-tagged calls recover too. GLM sometimes precedes the legacy
560	block's first argument key with another tool-call opening tag instead of the
561	arg-key opening tag the format calls for, and the recovery rejected the
562	whole block when it did — the call surfaced as text and whatever it was
563	trying to do was dropped. The parser now accepts that alias for the first
564	argument only — later arguments stay strict, so text that merely resembles a
565	call cannot be recovered as one — in both the whole-blob and streaming
566	paths, and the scanner tolerates the malformed marker split across chunk
567	boundaries. Recovery in both protocols also checks the call's name against
568	the tools actually offered in the turn: a tag naming a tool that was never
569	in the turn's spec stays on screen instead of being executed
570
571	## 1.5.8
572
573	### What changed
574
575	- Editor panels can switch permission mode without a slash command. ACP
576	clients now get a Permissions selector next to the model controls with
577	Manual, Auto, and Plan choices for the current session. Manual keeps the
578	existing approval prompts, Auto lets mutating tools run unattended while
579	still respecting explicit deny rules in `settings.toml`, and Plan keeps the
580	agent in research-only mode. The selector follows `/plan` and `/clear`, and
581	it is deliberately session-scoped so a risky Auto choice does not persist
582	into the next task
583	- Tool calls in the editor are worth opening now. Zed only drew the
584	disclosure arrow on the handful of cards siGit set `content` on — the model
585	download and switch spinners — because everything else carried nothing but
586	`rawInput` and `rawOutput`, fields ACP gives clients no display guidance for.
587	Every tool call now gets a fenced content block: the pretty-printed arguments
588	while it runs, then the tool's output once it finishes, with a `(no output)`
589	placeholder for a silent command like `git add`. Cards are titled
590	`<tool> · <arg>` rather than the bare tool name, path-bearing tools set
591	`locations` so the editor can follow along, and a replayed session gets the
592	same treatment as a live one
593	- The context window is visible before compaction fires. Both model pickers
594	show each model's window, and the TUI title bar has a gauge for how much of
595	it the conversation is using. Cloud tiers report their own window instead of
596	the compaction budget — the budget is when siGit Code summarizes history, not
597	how much the model can hold, and labelling one with the other understated the
598	window by an order of magnitude
599	- `write_todos` renders as a plan, not a tool card. Zed and other clients
600	have real progress UI for `session/update` plans, so the model's todo list
601	goes there
602	- Picker changes read as status rather than chat. Switching model or
603	inference backend is UI state, so it renders as a completed think-kind tool
604	call. The sign-in prompt stays an assistant message, since it needs the user
605	to act on it
606
607	### Fixed
608
609	- A reopened thread comes back with its history. Clicking a saved thread in
610	Zed sends `session/load`, and the client draws the thread purely from the
611	`session/update` notifications the agent streams while that request is in
612	flight. siGit restored the saved history into the backend, which is what
613	makes the model remember, but sent the client nothing — so the thread opened
614	empty and looked like a brand new conversation. The snapshot is now turned
615	into updates before it is restored: user and assistant text as message chunks
616	with reasoning stripped, each tool call completed with its result folded in,
617	and `write_todos` as a plan the way it renders live. System messages stay
618	out, since they seeded the model and were never on screen
619	- Compaction no longer fails in every session that ran a tool.
620	`compact_history` asked for the summary through `complete(None, None)`, which
621	sends no tools array but left the live history in place. That history is
622	thick with assistant `tool_calls` and `role: "tool"` messages, and an
623	endpoint handed tool shapes with no schema to check them against rejects the
624	request — Anthropic answers 400. So compaction failed on every attempt in any
625	session that had run a single tool, however small the history was, and then
626	retried on every prompt and tool round while that history kept growing. The
627	conversation now goes as a flattened transcript in one user message, which
628	keeps what the summary needs and drops the shapes that only mean anything
629	next to a tool schema
630	- A tool call emitted as text is no longer dropped. Qwen 3, GLM and
631	DeepSeek write a call as `<tool_call>NAME<arg_key>…` in their chat template
632	and rely on the serving stack to parse it back into `tool_calls`. When that
633	doesn't happen the tag arrives as ordinary content, so it was rendered
634	verbatim in the editor and the turn ended as though the model had chosen to
635	answer in prose. Both the streaming and non-streaming paths now scan content
636	for those blocks and turn well-formed ones back into real calls, typing
637	argument values from the turn's own tool schemas. The streaming scanner holds
638	back only enough text to catch a tag straddling a chunk boundary, so ordinary
639	answers still stream token by token. A block that doesn't match the expected
640	shape is left in the text untouched: reissuing a `run_command` is cheap, but
641	guessing wrong at a half-parsed `edit_file` would write the wrong change to a
642	file
643	- Tool-call content survives awkward output. Whitespace-only output is
644	preserved rather than collapsed, malformed arguments no longer get a
645	misleading JSON fence, and fence language identifiers are sanitized
646
647	## 1.5.7
648
649	### What changed
650
651	- `@smbcloud/sigit` gets releases again. The npm scope moved to
652	`@getsigit` in 1.5.5 and the old package was left sitting on the registry at
653	1.5.2, so an install made before the rename went quiet — `npm update` had
654	nothing to give it and nothing said why. All seven packages now publish under
655	both scopes from the same build, so `@smbcloud/sigit` is a full install again
656	rather than a stub, with its own platform binaries and no dependency on the
657	new scope. It prints a line on stderr saying where the package moved to;
658	`SIGIT_SUPPRESS_SCOPE_NOTICE=1` turns that off. This is a migration path, not
659	a second home: `@getsigit/sigit` is what the docs, the Homebrew tap, and the
660	ACP registry entry point at, and it is the name to move to
661	- Multi-root projects now work in the editor. When a client opens several
662	directories in one project, ACP sends the extra ones as
663	`additionalDirectories` — but only to an agent that says it wants them, which
664	siGit never did, so Zed kept the first root and showed a banner saying
665	multi-root workspaces were unsupported. The capability is now advertised at
666	`initialize`, and the directories that arrive are no longer logged and thrown
667	away. All the roots are now part of the session: the model is told about each
668	one, every root's `AGENTS.md` / `CLAUDE.md` is loaded, and skills, slash
669	commands, and subagent types are discovered from all of them (primary root
670	first, so it still wins name collisions). `/status` lists the roots when
671	there is more than one, and headless runs take the same thing as repeatable
672	`--add-dir <dir>` flags. MCP servers are the exception: discovery happens
673	once at startup, before a session exists, so a second root's `.sigit/mcp.toml`
674	is not picked up
675
676	### Fixed
677
678	- A shell command can no longer wedge the editor session. Tool commands
679	inherited siGit's own stdin, which in ACP mode is the JSON-RPC pipe from the
680	editor. A command that read stdin — a signing passphrase prompt, a pager, a
681	`git` credential ask — blocked on it and consumed the client's next request
682	out of the pipe, so nothing typed afterwards ever reached the agent and the
683	session stayed dead past the command timeout. Commands, hooks, and the
684	co-author `git` helpers now run with stdin closed, so a command that wants
685	input gets EOF and reports an error instead
686	- A command that prints a lot no longer stalls for two minutes.
687	`run_command` waited for the command to exit before reading its output, so
688	anything past the pipe buffer (a build, a verbose test run) blocked writing
689	while siGit blocked waiting, until the 120-second timeout killed it. Output
690	is now drained while the command runs
691	- The command timeout now stops the whole command. It killed only the
692	shell, leaving anything that shell had started running and unreaped; it now
693	kills the process group
694	- A refused turn now shows the endpoint's own message. siGit pasted the
695	status line and the raw JSON body into the editor's error banner, so a
696	billing or allowance message arrived wrapped in
697	`endpoint returned 429 Too Many Requests: {"error":{"message":…`. The message
698	the endpoint wrote is what the banner shows now; the status is only used when
699	there is no message to show
700	- An error that arrives mid-stream is no longer silent. An endpoint that
701	fails after the response is already open reports it as a frame in the stream.
702	That frame carries no `choices`, so siGit parsed it as an empty chunk and
703	skipped it, and the turn ended as though the model had answered with nothing
704
705	## 1.5.6
706
707	### What changed
708
709	- Switching models mid-conversation no longer restarts it. Both switching
710	to a local GGUF model and picking a different cloud tier now carry the live
711	conversation history across, repairing any half-finished tool call so
712	strict OpenAI-compatible endpoints don't reject the session
713	- Long-running tools now show progress in ACP clients. Synchronous tools
714	(shell commands, file operations, `read_website`, ...) run on a blocking
715	thread pool instead of the ACP connection's own task, so a slow command's
716	`in_progress` update reaches the client — and Zed's spinner — while the
717	command is still running instead of arriving with the result
718	- Text from consecutive tool rounds no longer runs together. ACP and
719	headless clients concatenate consecutive message chunks, so a reply that
720	continued after a tool call used to glue onto the previous round's last
721	sentence with no space. A blank line now opens the next round's text
722	- New onde-cloud model tiers. The model picker (`/models` in the TUI, the
723	config panel in editors) now offers five additional siGit Code Cloud tiers —
724	`flux`, `apex`, `aura`, `orbit`, and `nova` — alongside the existing Fast,
725	Balanced, Large, Mini, Air, Pro, and KKK options. The tier list mirrors
726	onde-cloud's router catalogue, so all three sides (the picker, the router,
727	and the cloud catalogue) have to be updated together when a tier is added
728	- MCP Registry listing moved to `getsigit/si`. The `server.json` manifest
729	and its `release-mcp-registry.yml` publish workflow now live in the
730	[`getsigit/si`](https://github.com/getsigit/si) repo alongside the si CLI's
731	other code, since the registry entry describes the si platform rather than
732	the coding agent
733
734	## 1.5.5
735
736	A distribution release. siGit Code itself is unchanged. What moved is how it
737	reaches you on npm and on Windows.
738
739	### What changed
740
741	- The npm package is now `@getsigit/sigit`. The six platform packages moved
742	with it. `@smbcloud/sigit` stays on the registry but stops receiving updates,
743	so upgrading means switching names:
744	`npm uninstall -g @smbcloud/sigit && npm install -g @getsigit/sigit`. The old
745	package had been stuck at 1.5.2, so this picks up 1.5.3 and 1.5.4 as well.
746	- npm publishes over OIDC. Every `@getsigit/*` package has a trusted
747	publisher pointing at the release workflow, so no npm token is stored in the
748	repository. The release workflow moves to Node 22, which trusted publishing
749	requires.
750	- winget releases actually go out. The workflow could only update a package
751	already present in `microsoft/winget-pkgs`, and siGit Code had never been
752	submitted there, so every dispatch failed. It now submits the package the
753	first time and updates it on later releases. The identifier is
754	`getSigit.siGitCode`.
755
756	## 1.5.4
757
758	- CI: nfpm config expanded to include package version and binary path
759
760	## 1.5.3
761
762	Adds browser-based sign-in, expands distribution channels to Windows (winget,
763	Scoop), Linux (AUR, deb, rpm), and .NET (NuGet), gives ACP clients live
764	visibility into tool activity, adds the KKK and Moonshot AI cloud tiers, and
765	fixes the co-authored-by trailer email.
766
767	### What changed
768
769	- Browser sign-in: `sigit login` now opens a browser OAuth flow (PKCE S256
770	against the siGit Code Cloud authorization server) so you can sign in without
771	a password. A loopback listener catches the redirect automatically; a
772	paste-back fallback handles environments where a loopback isn't reachable.
773	`--paste` forces the paste path, `--password` keeps the old email/password
774	prompt. Zed's "Sign in to siGit Code" button uses the loopback path via ACP
775	`authenticate`
776	- New release channels: siGit Code is now published to winget
777	(`getsigit.siGitCode`), Scoop (`getsigit/scoop-bucket`), the AUR
778	(`sigit-bin`), and as `.deb`/`.rpm` packages alongside the existing
779	Homebrew, npm, PyPI, crates.io, and NuGet channels
780	- NuGet .NET tool: `dotnet tool install --global SiGit.Code` now works on
781	Windows, macOS, and Linux — the package bundles all six platform binaries and
782	a managed shim that execs the right one, leaving stdin/stdout/stderr
783	unredirected so TUI vs ACP mode detection still works
784	- New cloud tiers: the model picker (`/models` in the TUI, the config
785	panel in Zed) now offers the `onde-kkk` (KKK) and Moonshot AI (`oke`) tiers
786	alongside the existing Fast, Balanced, Large, Mini, Air, and Pro options
787	- ACP tool visibility: the agent loop now emits `ToolCall(InProgress)`
788	before each tool runs and `ToolCallUpdate(Completed/Failed)` after it
789	returns, so clients like Zed gain live visibility into tool activity between
790	inference rounds. `tool_choice: "auto"` is also sent explicitly whenever
791	tools are present, fixing models that describe actions in prose rather than
792	issuing a tool call when the field is absent
793	- Malformed tool argument logging: invalid tool argument JSON is now logged
794	at three sites (TUI pretty-printer, ACP tool-call event, permission request)
795	instead of silently falling back to a string value, making malformed payloads
796	visible in logs while preserving backward-compatible behaviour
797	- Co-authored-by trailer fix: the `Co-Authored-By` trailer email was
798	updated to `noreply@sigit.si` (platform-neutral); the commit attribution
799	check was tightened to use idiomatic ownership
800	- NuGet trusted publishing: the NuGet release workflow now exchanges a
801	GitHub OIDC token for a short-lived NuGet API key (via `NuGet/login`) instead
802	of relying on a long-lived `NUGET_API_KEY` secret, so there is no stored
803	credential to rotate or leak
804	- AUR dispatch temporarily disabled: the AUR release workflow is no longer
805	dispatched from `release-github` while new AUR account registration is
806	closed; the `sigit-bin` channel returns once registration reopens
807	- Legal and branding copy updated
808
809	## 1.5.2
810
811	Brings the latest siGit Code Cloud tiers to the picker and aligns the MCP
812	registry metadata with the server release.
813
814	### What changed
815
816	- `/models` now lists the Pro, Air, and Mini siGit Code Cloud tiers alongside
817	Fast, Balanced, and Large
818	- Updated the MCP registry manifest to version 1.2.5, matching the siGit Code
819	Cloud server release
820	- Updated the Agent Client Protocol SDK to the latest v1 release
821
822	## 1.5.1
823
824	Makes siGit Code work as an Xcode custom agent, and updates the Onde SDK.
825
826	### What changed
827
828	- Xcode can now run siGit Code as a custom agent. Point it at the binary with
829	`--acp` as the argument, and that explicit mode loads the selected on-device
830	model on the first prompt, since Xcode's chat has no equivalent of `/load`.
831	The README covers the setup, including wiring up `xcrun mcpbridge` in
832	`mcp.toml` so the agent can use Xcode's build, test, and project tools
833	- MCP calls to the `xcode` server time out after 30 seconds instead of 120, so
834	a request Xcode cannot service no longer leaves the prompt looking busy for
835	two minutes. String JSON-RPC ids from the bridge are handled too
836	- The agent stops repeating itself: a tool call made three times with identical
837	arguments now forces a text reply instead of looping
838	- Onde SDK bumped to 1.2.2
839	- The registry listing in `server.json` matches what sigit.si publishes
840
841	## 1.5.0
842
843	Opens the agent up to user extension: lifecycle hooks, custom slash commands,
844	and configurable subagent types. Also adds web search, a Repo tab in the TUI,
845	and a baked-in smbCloud MCP server.
846
847	### What changed
848
849	- Hooks let you run shell commands at three points in the agent's lifecycle:
850	`session_start`, `pre_tool_use`, and `post_tool_use`, configured under
851	`[hooks]` in `settings.toml`. Commands get context through variable
852	substitution (`{cwd}`, `{tool_name}`, `{tool_result_len}`) and run in the
853	session working directory. A hook that fails is logged and the session
854	continues; a hook that hangs is killed on a timeout, along with its whole
855	process group
856	- User-defined slash commands: drop a Markdown file in `.sigit/commands/` or
857	`.claude/commands/` (or the personal `$SIGIT_CONFIG_DIR/commands/` and
858	`~/.claude/commands/`) with optional `description` and `argument-hint`
859	frontmatter, and the body becomes a prompt template. `$ARGUMENTS` takes the
860	whole argument string and `$1`..`$9` the positional words. A subdirectory
861	namespaces the command with `:`, so `.sigit/commands/git/commit.md` becomes
862	`/git:commit`. They run as ordinary agent turns through the usual tools and
863	permission checks, and are advertised to ACP clients like Zed. `/commands`
864	lists what was discovered
865	- Configurable subagent types for the `task` tool: a Markdown file in
866	`.sigit/agents/` or `.claude/agents/` with `name`, `description`, and an
867	optional `tools:` allow-list, whose body becomes that subagent's system
868	prompt. Pass its name as `subagent_type` to swap the prompt in. The
869	`tools:` list can only narrow the subagent's read-only ceiling, never widen
870	it, so a config file cannot grant itself `edit_file` or `run_command` and
871	route around the permission system. `/agents` lists the discovered types
872	- New `web_search` tool, backed by the Brave-Search-backed search on siGit
873	Code Cloud's MCP server. It is offered only when you are signed in, and it
874	is classified read-only, so searching never triggers a permission prompt
875	- The TUI gains a Repo tab, shown when the session's `origin` remote points at
876	the sigit.si host. It lists issues and pull requests fetched through the
877	official MCP server: Up and Down select, Enter opens a scrollable detail,
878	`i`, `p`, Left and Right switch sections, `r` refreshes. The tab is hidden
879	and skipped in the cycle for any other remote
880	- The smbCloud CLI's stdio MCP server (`smb --mcp`) is now baked in, so
881	smbCloud project and deployment tools work with no `mcp.toml` setup. It is
882	added only when the `smb` binary is on `PATH`, its read-only tools (`me`,
883	`deployments`, `project_list`, `project_show`) skip permission prompts, and
884	you can opt out with `smbcloud = false` in `mcp.toml` or
885	`SIGIT_MCP_SMBCLOUD=off`
886	- siGit Code Cloud's MCP server is now listed in the public MCP Registry as
887	`si.sigit/sigit`, published from `server.json` at the repository root
888
889	### Fixes
890
891	- An explicit `deny` rule now applies to read-only first-party tools instead
892	of being skipped
893	- A subagent type whose `tools:` list resolves to an empty set is rejected
894	rather than producing a subagent with no tools
895	- Command templates render in a single substitution pass, so an argument that
896	contains something like `$1` is no longer re-substituted
897	- Frontmatter is stripped with the same leniency it is parsed with
898	- The Repo tab's detail view no longer shows stale data after a refresh
899
900	## 1.4.1
901
902	Two small fixes: correct co-author attribution and a Homebrew tap fix.
903
904	### What changed
905
906	- The `Co-Authored-By` trailer siGit Code adds to commits now uses the GitHub
907	noreply address for the [sigitc](https://github.com/sigitc) account instead
908	of `sigit@sigit.si`, so GitHub reliably attributes co-authored commits to
909	the siGit Code profile
910	- Fixed the Homebrew tap install docs to trust the tap with `brew trust`
911	instead of a `brew tap --force` flag
912
913	## 1.4.0
914
915	Adds a headless one-shot mode, fine-grained permission rules, stdio transport
916	for MCP servers, an `/init` command, and a set of TUI upgrades: tabs, a live
917	thinking display, and collapsible tool calls.
918
919	### What changed
920
921	- New headless mode: `sigit -p "prompt"` runs one agent turn with tools and exits — 0 on a completed turn, 1 on inference errors, 2 on bad invocations. Assistant text streams to stdout while logs and tool progress stay on stderr; `--cwd` sets the working directory and `--quiet` prints only the final message. Nobody can answer a permission prompt in a headless run, so `ask` collapses to a denial: grant tools for the run with `--allow-tool`, block them with `--deny-tool`, or use `SIGIT_PERMISSIONS=allow`
922	- Permission rules make autonomy granular: `[permissions.rules]` in `settings.toml` holds ordered `allow` and `deny` lists of `tool_name(pattern)` entries, e.g. `run_command(git )` or `edit_file(src/)`. Patterns match the command string for `run_command` and the path for file tools; deny always beats allow, and unparseable patterns fail closed, so a bad rule can only narrow access. Always-allow on a `run_command` prompt now grants that command family (its first two tokens), not the whole shell
923	- The MCP client speaks stdio: `mcp.toml` server entries can give a `command`, `args`, and an `env` map instead of a `url`, so the stdio-first majority of published MCP servers plugs in. Same handshake, timeouts, tool namespacing, and output caps as HTTP; `/mcp` shows the command line for stdio servers
924	- New `/init` command (TUI and ACP): runs a normal agent turn that explores the repository and writes an `AGENTS.md` — or improves an existing `AGENTS.md`/`CLAUDE.md` in place — going through the ordinary tools and permission checks
925	- The TUI gains tabs, cycled with the Tab key: Session is the chat, History lists saved sessions (restore with Enter, delete with a confirmed double-`d`, refresh with `r`), and Cloud shows the signed-in account, inference mode, current model and engine state, permission policy, and config dir, with a live Local Inference toggle
926	- The TUI shows model thinking: while a reply streams, the last three lines of the reasoning appear live under the spinner, dim and italic; finished replies collapse to a one-line indicator with the line count, and `/thinking` expands the full reasoning block above each reply. Display only — nothing changes in what is sent to the model, saved to sessions, or streamed over ACP
927	- Tool calls in the TUI transcript collapse to single dim title lines (the command for `run_command`, the path for file tools, the pattern for search and glob); `/tools` expands every entry to show the pretty-printed arguments and a capped tail of the result. Permission prompts keep showing the full command, and the model still receives full outputs
928	- When `AGENTS.md` and `CLAUDE.md` sit in the same directory, the instructions loader now prefers `AGENTS.md`, so shared content is injected once
929
930	## 1.3.2
931
932	Adds a tool permission system with plan mode, durable sessions with context
933	compaction, background command execution, a subagent research tool, and commit
934	co-author attribution.
935
936	### What changed
937
938	- Every tool call now passes a permission policy before executing. Read-only tools always run; mutating tools (and all MCP or unknown tools) are governed by, in order: plan mode, session grants, per-tool overrides, and a default mode from `[permissions]` in `settings.toml` (`allow`/`ask`/`deny`, default `ask`). On `ask`, editors get a native ACP permission dialog (allow once / allow for this session / deny) and the TUI pauses on a y/a/n prompt showing the tool and its arguments. `SIGIT_PERMISSIONS` overrides the default mode for headless runs and clients without permission support
939	- New `/plan [on\|off]` command: plan mode blocks mutating tools and asks the model to present a plan while research tools keep working. `/permissions` prints the effective policy
940	- Sessions are durable: conversation history is saved per session under `~/.config/sigit/sessions/` after every turn. ACP `session/load` actually restores it, the TUI gets `/resume`, and `/clear` deletes the saved file
941	- Context compaction: `/compact` compresses the conversation on demand, and the agent compacts automatically once the history approaches a 24k-token budget, summarizing older turns and keeping the recent ones. The tool-round cap rises from 10 to 24 now that long sessions have a defense other than the cap
942	- `run_command` can run work in the background: pass `run_in_background` and the tool returns a task id immediately, so builds, test suites, and dev servers are no longer killed by the 120 second foreground timeout. Poll with the new `command_output` tool (read-only, never prompts) and stop with `kill_command`
943	- New `task` tool: delegate research to a fresh subagent conversation that only gets the read-only tools and returns its final answer, keeping the main context small. Available on OpenAI-compatible backends; on-device returns a clear fallback until onde supports a second context
944	- Commits created by the agent are co-authored: commit messages end with `Co-Authored-By: siGit Code <sigit@sigit.si>` (the [sigitc](https://github.com/sigitc) account), which GitHub renders next to the human author. If the model forgets the trailer, siGit amends it in, never rewriting commits that already exist on a remote
945	- ACP mode now honors the `OPENAI_BASE_URL`/`OPENAI_API_KEY` provider override at startup, matching the interactive client
946
947	## 1.3.1
948
949	Adds [Model Context Protocol](https://modelcontextprotocol.io) (MCP) client
950	support with the official siGit Code MCP server baked in, a set of agent tools
951	that close parity gaps in the tool layer, and refreshed branding and licensing.
952
953	### What changed
954
955	- siGit Code is now an MCP client: it connects to MCP servers over the Streamable HTTP transport (a single JSON-RPC endpoint), discovers the tools they expose, and offers them to the model alongside the built-in tools. When the model calls one, the call is forwarded to the owning server and the result fed back into the agent loop
956	- Bakes in the official siGit Code MCP server at `https://sigit.si/api/v1/mcp` (follows `SIGIT_CLOUD_URL`). When you are signed in (`sigit login`), the cloud session token is sent as the bearer credential
957	- Configure additional servers in `mcp.toml` — global (`~/.config/sigit/mcp.toml`) or project-local (`.sigit/mcp.toml`). Each `[[server]]` has a `name`, `url`, optional `enabled`, and optional `[server.headers]`; set `official = false` to opt out of the baked-in server
958	- MCP tools are namespaced `mcp__<server>__<tool>` so they never collide with built-in tools or across servers; tool output is capped to protect the model's context
959	- Discovery is best-effort at startup and bounded by a per-server timeout, so an unreachable server never blocks startup — it just contributes no tools
960	- Added a `/mcp` slash command (TUI and ACP) that lists configured servers, their connection status, and the tools each exposes
961	- Disable MCP entirely with `SIGIT_MCP=off`, or just the official server with `SIGIT_MCP_OFFICIAL=off`
962	- New agent tools that close parity gaps in the tool layer: `multi_edit` (apply a batch of exact-substring edits to one file atomically — written only if every edit matches), `glob` (locate files by name pattern with `*`/``/`?`/`{a,b}`, most-recently-modified first), `write_todos` (render a live task checklist through the tool result for multi-step work), and `remember` (append durable notes to the nearest `AGENTS.md`/`CLAUDE.md`)
963	- `edit_file` now supports `replace_all` and returns actionable failure context — naming the line whose trimmed text matches when only whitespace differs — so the model self-corrects in one round
964	- `search_files` gained a `file_glob` filter and a `max_results` cap (default 50, hard-capped at 1000) that also bounds the directory walk
965	- Refreshed branding and legal: updated `LICENSE`, `README`, and the npm/PyPI package descriptions
966
967	## 1.3.0
968
969	Adds a Local Inference on/off toggle, the open [Agent Skills](https://agentskills.io)
970	format, and support for project instruction files (`AGENTS.md` and the like).
971
972	### What changed
973
974	- Added a Local Inference on/off setting that is the explicit local-vs-cloud mode switch. It is persisted in `~/.config/sigit/settings.toml` (default on, local-first) and can be overridden with `SIGIT_LOCAL_INFERENCE`
975	- Toggle it with the `/local [on\|off]` command (TUI and ACP); ACP clients without slash-command support get an equivalent "Local Inference" On/Off control in the session config panel
976	- `/models` now groups models by nature — Local vs siGit Code Cloud — and highlights the active mode's group while still showing the other, so the cloud tiers stay discoverable
977	- Discovers Agent Skills (folders with a `SKILL.md`) from `.sigit/skills/` and `.claude/skills/` in the project, `~/.config/sigit/skills/`, and `~/.claude/skills/`
978	- Follows the spec's progressive disclosure: each skill's name and description are advertised up front via a new `skill` tool, and the full instructions load only when the agent activates one
979	- Added a `/skills` slash command (TUI and ACP) that lists the discovered skills
980	- Reads project instruction files at session start: `AGENTS.md` (the cross-tool standard) and `CLAUDE.md`, walking from the working directory up to the repository root, plus a global file under `~/.config/sigit/`, and injects them into the session's system context so their guidance is always in force
981	- Nested instruction files are ordered outermost-first so the closest, most specific file takes precedence; the scan never reads above the repository root
982	- On-device models are no longer loaded implicitly. The chat UI and ACP sessions come up immediately, and the local model is brought into memory only when you run the `/load` command (or pick one in `/models`). Prompts sent before a model is loaded now return a hint instead of blocking on a multi-minute download.
983
984	## 1.2.2
985
986	Streams assistant tokens as they arrive, on-device and over the cloud.
987
988	### What changed
989
990	- Streamed assistant tokens live in the TUI and ACP sessions, both on-device and through siGit Code Cloud
991	- On-device inference streams only when a turn offers no tools, since `onde` can't stream and detect tool calls in the same pass; tool-capable turns still resolve in one shot
992	- Fixed the TUI so the latest message stays visible in long chats
993	- Put the cloud model-switch confirmation on its own line in ACP
994
995	## 1.2.1
996
997	Stabilizes the Zed/ACP integration and finishes the cloud-tier wiring on top of 1.2.0.
998
999	### What changed
1000
1001	- Fixed a Zed crash by keeping model-picker labels ASCII in the ACP model selector
1002	- Wired ACP auth, cloud tiers, and slash commands into the Zed panel, including a `/reload` command to re-sync session state in place
1003	- Fixed the TUI so the loaded-model checkmark appears once a download completes
1004	- Synced bundled agent skills with the current code and added `CLAUDE.md`
1005
1006	## 1.2.0
1007
1008	Adds siGit Code Cloud — a hosted inference tier alongside on-device models.
1009
1010	### What changed
1011
1012	- Added siGit Code Cloud with cloud-tier routing, pointed at `sigit.si`
1013	- Added account management slash commands and surfaced cloud tiers in `/models`
1014	- Carried forward from 1.1.0: ACP SDK v0.13, refreshed dependencies and branding
1015
1016	## 1.1.0
1017
1018	Bumps the ACP SDK to v0.13 and pulls in updated dependencies.
1019
1020	### What changed
1021
1022	- Updated `agent-client-protocol` from v0.11 to v0.13
1023	- Updated `onde` to 1.1.2
1024	- Refreshed branding and skill metadata
1025
1026	## 1.0.4
1027
1028	This release tightens up the terminal experience and finishes a few release-facing cleanup items.
1029
1030	### What changed
1031
1032	- Added bold rich-text rendering in the TUI for assistant replies, so `text` now displays with terminal styling instead of raw markdown markers
1033	- Refreshed the bundled skill metadata to follow the current Agent Skills `SKILL.md` format
1034	- Synced the crate release metadata for the `1.0.4` cut
1035
1036	## 1.0.3
1037
1038	This is the cleanup release for the editor-side startup problems.
1039
1040	### What changed
1041
1042	- Fixed ACP sessions failing on the first real prompt because the server claimed the model was ready before anything had actually been loaded
1043	- Changed ACP startup so the default model loads lazily on the first non-slash prompt instead of pretending it is already in memory
1044	- Kept `initialize` and `session/new` lightweight while still sending proper progress updates once model loading begins
1045	- Updated the Onde integration to `1.0.0`
1046	- Removed a few dependencies we were no longer using
1047
1048	## 1.0.2
1049
1050	This release was supposed to fix the ACP auth breakage. It did fix the stdout pollution problem, but it turned out not to be the whole story.
1051
1052	### What changed
1053
1054	- Delayed model loading in ACP mode so startup diagnostics would not leak into protocol stdout during the auth handshake
1055	- Tightened up the ACP startup path for editor integrations
1056	- Refreshed some README wording while cutting `1.0.2`
1057
1058	## 1.0.1
1059
1060	The first patch after `1.0.0` was mostly about making model loading and model switching feel less opaque.
1061
1062	### What changed
1063
1064	- Added ToolCall-based progress UI for startup model loading and downloading
1065	- Improved model-switch progress reporting in ACP clients
1066	- Fixed model-load error handling so failed switches did not leave the UI in a weird state
1067	- Cleaned up a few status messages and docs while the release was going out
1068
1069	## 1.0.0 (2026)
1070
1071	siGit Code has been living in real smbCloud repos for a while now. At some point it stopped feeling like an experiment, so we called it 1.0.
1072
1073	### What this release is
1074
1075	siGit Code is a local coding agent. It runs a quantized model on your machine, talks to editors over ACP, and can read files, run commands, fetch web pages, and write code without sending your project to a hosted API.
1076
1077	You can install it with Cargo, pip, npm, or Homebrew and use it like any other tool on your machine.
1078
1079	### What shipped in 1.0
1080
1081	#### Editor integration
1082
1083	This is the core of the project.
1084
1085	Zed and VS Code can talk to siGit Code over ACP. Multi-turn sessions work. Tool calling works. Session forking works. Working-directory context works. That was the original goal, and it feels solid now.
1086
1087	#### Terminal UI
1088
1089	The terminal UI started as a side quest and turned out to be useful. You get a full-screen ratatui chat, streaming tokens, a spinner while the model is busy, and a model picker you can open in the middle of a session.
1090
1091	It runs on macOS and Linux. Windows gets ACP and editor mode for now. The Windows terminal UI is still unfinished.
1092
1093	#### Tool calling
1094
1095	This is the part that makes siGit Code feel like an agent instead of a chat box. The loop can run up to 10 rounds per message.
1096
1097	Available tools:
1098
1099	- `read_file` / `write_file` / `delete_file`
1100	- `list_directory` / `search_files`
1101	- `run_command`, with an optional working directory
1102	- `read_website`, which fetches a URL and strips it down to readable text
1103
1104	The model can call a tool, inspect the result, and keep going until it has a real answer.
1105
1106	#### Model support
1107
1108	The model list ended up wider than we expected for 1.0:
1109
1110	- Qwen 3 1.7B, 4B, 8B, and 14B
1111	- Qwen 2.5 1.5B and 3B
1112	- Qwen 2.5 Coder 1.5B, 3B, and 7B
1113	- DeepSeek Coder 6.7B
1114
1115	They are all GGUF models and they all come from Hugging Face on first run.
1116
1117	Qwen 3 is the interesting one. It uses extended thinking mode. The model reasons inside `<think>...</think>` blocks before answering. The TUI strips those blocks out and renders them dimmed above the reply, so you can see what happened without turning the whole conversation into noise.
1118
1119	The 8B model is the desktop default. Mobile stays on 1.7B because iOS gives apps roughly 2 to 3 GB of memory, and we learned the hard way that 3B can blow up on an iPhone 16e.
1120
1121	#### Model picker
1122
1123	The model picker shows:
1124
1125	- what is already cached locally
1126	- what can be downloaded
1127	- which models support tool calling
1128	- whether the local cache looks healthy
1129
1130	You can open it with `/models` in the TUI or through the editor config option. Switching models happens in the background and the UI stays alive while the download or load is in progress.
1131
1132	#### smbCloud context
1133
1134	siGit Code knows smbCloud repos better than a generic coding assistant does. It understands the difference between platform-user flows and tenant-app auth flows, how `Project`, `FrontendApp`, `AuthApp`, and GresIQ fit together, and why Next.js SSR deploys are not the same thing as the generic git-push path.
1135
1136	Outside smbCloud, it backs off and behaves like a normal coding agent.
1137
1138	#### Distribution
1139
1140	Distribution took an unreasonable amount of time, honestly.
1141
1142	There are prebuilt binaries for macOS, Linux, and Windows on both arm64 and x64 where relevant, plus install paths through Cargo, PyPI, npm, and Homebrew:
1143
1144	- `cargo install sigit`
1145	- `pip install sigit-code`
1146	- `npm install -g @smbcloud/sigit`
1147	- `brew install sigit`
1148
1149	Getting that whole pipeline to behave across CI, crates.io, PyPI, npm, and Homebrew was basically its own project.
1150
1151	### What still does not work
1152
1153	The Windows terminal UI is still missing.
1154
1155	ACP and editor mode work on Windows. The part that is still missing is the interactive full-screen terminal UI. The blocker is Unix-specific terminal handling that has not been abstracted cleanly yet.
1156
1157	### Changes since 0.1.2
1158
1159	- Added Qwen 3 14B support
1160	- Added Qwen 3 `<think>` block parsing and separate rendering in the TUI
1161	- Moved all TUI code into `#[cfg(unix)]`, which fixed a pile of dead-code errors on Windows CI
1162	- Added live download progress during model switches, including cancellation with Ctrl+C
1163	- Added model download and loading progress in the Zed agent config panel
1164	- Added an animated spinner during model switching
1165	- Added Qwen 2.5 Coder 7B
1166	- Added downloadable models to the picker, not just locally cached ones
1167	- Made model selection persist across restarts
1168	- Added session working-directory support
1169	- Moved model picker logic into a platform-independent module so Windows can compile without the TUI
1170	- Added the `/models N` shortcut for picking a model by number
1171	- Added the `read_website` tool
1172	- Improved `read_file` handling and empty-reply detection
1173	- Added async tool execution
1174	- Fixed CI cross-compilation for macOS, iOS, Linux, and Windows
1175	- Added npm, PyPI, and Homebrew distribution
1176
1177	---
1178
1179	© 2026 PT Sigit Mitra Bangun ([siGit Code & Deploy](https://sigit.si)), distributed by [Splitfire AB](https://5mb.app).