sigit-code 1.4.0__tar.gz → 1.5.0__tar.gz

{sigit_code-1.4.0 → sigit_code-1.5.0}/.agents/AGENTS.md

@@ -110,7 +110,23 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   spec list (`all_tools`) and the execute `match` (`execute_tool`). `run_command` also enforces
   commit attribution: when a command creates a new commit that lacks the
   `Co-Authored-By: siGit Code` trailer (`COMMIT_CO_AUTHOR_TRAILER`), it amends the trailer in —
-  unless the commit already exists on a remote, which is never rewritten.
+  unless the commit already exists on a remote, which is never rewritten. Also owns the `task`
+  tool: a nested agent loop in a fresh conversation, offered only when `subagent_available()`
+  (a subagent factory is registered — see `register_subagent_factory_for` in `main.rs`; on-device
+  registers a `None`-returning factory since onde has a single shared history). A subagent's
+  toolset is a hard-gated read-only allow-list (`SUBAGENT_TOOL_NAMES`) that is never expanded by a
+  configurable subagent type (see `src/subagents.rs`) — only ever narrowed — so a `.sigit/agents/*.md`
+  file can't grant itself `edit_file`/`run_command` and bypass the permission system. Also owns
+  `web_search`: a thin native wrapper around the official MCP server's Brave-Search-backed
+  `web_search` tool (`mcp__sigit__web_search`, implemented server-side in `sigit-si`'s
+  `WebSearchService` + `Mcp::Tools::WebSearch`), offered only when that MCP tool was actually
+  discovered (i.e. the user is signed in to siGit Code Cloud — see `web_search_available`).
+  Wrapping it natively rather than leaving it as a raw `mcp__*` tool matters for two reasons:
+  `permissions::classify` treats every `mcp__*` tool as mutating (an "ask" prompt on every call),
+  while `web_search` is read-only like `read_website`; and the raw delegate name is filtered out
+  of the assembled tool list (`is_web_search_delegate`) so the model sees one clean option, not
+  two names for the same tool. Execution still forwards verbatim to `mcp::call_tool` — no second
+  HTTP/JSON-RPC implementation.
 - **`src/skills.rs`** — [Agent Skills](https://agentskills.io) support. Discovers skill
   folders (each with a `SKILL.md`: YAML frontmatter `name` + `description`, then Markdown
   instructions) from `.sigit/skills/` and `.claude/skills/` in the cwd, `$SIGIT_CONFIG_DIR/skills/`,
@@ -119,6 +135,31 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   calls `skill` with a name) loads the full `SKILL.md` body. The `skill` tool is appended in the
   `*_as_specs`/`build_tool_specs` layer (not in `all_tools()`) so its description can be dynamic,
   and only when at least one skill exists.
+- **`src/commands.rs`** — user-defined slash commands. Discovers Markdown files (each an
+  optional YAML frontmatter block — `description`, `argument-hint` — followed by a prompt-template
+  body) from `.sigit/commands/` and `.claude/commands/` in the cwd, `$SIGIT_CONFIG_DIR/commands/`,
+  and `~/.claude/commands/`. A subdirectory namespaces the command with `:`
+  (`.sigit/commands/git/commit.md` → `/git:commit`). Unlike skills there's no tool-call
+  indirection: invoking one works exactly like the built-in `/init` — `commands::render`
+  substitutes `$ARGUMENTS`/`$1..$9` in the body against whatever followed the command on the
+  input line, and the result is fed to the model as a normal turn through the ordinary tools and
+  permission checks. Resolution happens where each surface (`main.rs`/`chat.rs`) already
+  special-cases `/init`: an unrecognized slash command is tried against `commands::resolve_command`
+  before falling back to "unknown command". A custom command sharing a name with a built-in is
+  unreachable (built-ins match first in `parse_slash`) and is skipped when advertised to ACP
+  clients, with a warning logged.
+- **`src/subagents.rs`** — configurable subagent types for the `task` tool. Discovers Markdown
+  files (YAML frontmatter `name` + `description`, optional comma-separated `tools:` allow-list,
+  then a Markdown body that becomes the subagent's system prompt) from `.sigit/agents/` and
+  `.claude/agents/` in the cwd, `$SIGIT_CONFIG_DIR/agents/`, and `~/.claude/agents/`. Passing a
+  type's `name` as `task`'s `subagent_type` argument swaps in that system prompt and, if `tools:`
+  is set, narrows the offered toolset to its *intersection* with `SUBAGENT_TOOL_NAMES` — the
+  security-relevant narrowing logic lives in `tools.rs` next to that constant, not here; this
+  module only discovers and parses files. `SubagentFactory` (in `tools.rs`) takes the resolved
+  system prompt per call rather than baking one in at registration, so a single registered
+  factory serves both the default research subagent and every configured type.
+- **`src/frontmatter.rs`** — shared "YAML frontmatter + Markdown body" parsing used by both
+  `src/skills.rs` (`SKILL.md`) and `src/commands.rs` (`.sigit/commands/*.md`).
 - **`src/mcp.rs`** — [Model Context Protocol](https://modelcontextprotocol.io) *client*. Two
   transports: **Streamable HTTP** (one JSON-RPC POST endpoint, `url` in `mcp.toml`; replies are
   `application/json` or SSE) and **stdio** (`command` + optional `args`/`[server.env]` in
@@ -131,12 +172,20 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   both read it; `/reload` does *not* re-run it, so config changes need a restart. stdio children
   live for the process; a dead child fails calls with an in-band error string (no auto-restart).
   Tools are namespaced `mcp__<server>__<tool>`, appended in the `*_as_specs`/`build_tool_specs`
-  layer and routed in `tools::execute_tool` via `mcp::is_mcp_tool`. The official server
-  (`<cloud>/mcp`, default `https://sigit.si/api/v1/mcp`) is baked in (always HTTP) and authed
-  with the cloud session token; extra servers live in `mcp.toml` (global
+  layer and routed in `tools::execute_tool` via `mcp::is_mcp_tool`. Two servers are baked in:
+  the official server (`<cloud>/mcp`, default `https://sigit.si/api/v1/mcp`, always HTTP, authed
+  with the cloud session token) and the smbCloud CLI server (`smb --mcp`, stdio, added only when
+  the `smb` binary is on `PATH`; opt out with `smbcloud = false` in `mcp.toml` or
+  `SIGIT_MCP_SMBCLOUD=off`). A user-defined entry named `sigit` or `smbcloud` overrides the
+  corresponding baked-in one. Extra servers live in `mcp.toml` (global
   `$SIGIT_CONFIG_DIR/mcp.toml` and project-local `.sigit/mcp.toml`). The stdio path is covered by
   `tests/mcp_stdio.rs`, driven by the test-only `src/bin/mcp_stdio_stub.rs` helper binary
-  (excluded from the published crate via `exclude` in `Cargo.toml`).
+  (excluded from the published crate via `exclude` in `Cargo.toml`). The baked-in official
+  server is *also* listed in the public MCP Registry as `si.sigit/sigit` — a **remote**
+  Streamable-HTTP listing (`server.json` at the repo root, published by
+  `release-mcp-registry.yml`). Because it's a remote server, the registry's URL-match rule
+  forces a domain namespace (`si.sigit` ↔ `sigit.si`) verified by a DNS TXT record, not the
+  GitHub-OIDC scheme `smbcloud-cli` uses for its package listing.
 - **`src/permissions.rs`** — tool permission policy. Every tool call passes through
   `decision_for` before executing: read-only tools always run; mutating tools (and all
   `mcp__*`/unknown tools) are governed by, in order: per-session plan mode (`/plan` — deny all
@@ -165,12 +214,14 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
 - **`src/credentials.rs`** — local session-token store (TOML, `0600` on Unix).
 - **`src/models.rs`** — model-picker types shared across platforms.
 
-Slash commands (`/help`, `/models`, `/skills`, `/mcp`, `/login`, `/logout`, `/whoami`, `/reload`,
-`/plan`, `/permissions`, `/init`, `/clear`, `/status`) are advertised via `advertise_commands` in
-`main.rs` and handled in both the TUI and ACP sessions. `/init` is special: instead of replying
-directly it substitutes `instructions::INIT_PROMPT` for the user text and runs a normal agent
-turn that explores the repo and writes (or improves) `AGENTS.md` through the ordinary tools and
-permission checks.
+Slash commands (`/help`, `/models`, `/skills`, `/agents`, `/commands`, `/mcp`, `/login`, `/logout`,
+`/whoami`, `/reload`, `/plan`, `/permissions`, `/init`, `/clear`, `/status`) are advertised via
+`advertise_commands` in `main.rs` and handled in both the TUI and ACP sessions. `/init` is
+special: instead of replying directly it substitutes `instructions::INIT_PROMPT` for the user
+text and runs a normal agent turn that explores the repo and writes (or improves) `AGENTS.md`
+through the ordinary tools and permission checks. User-defined commands (see `src/commands.rs`)
+get the same treatment via the `SlashCommand::Unknown` fallback path, so anyone can add their own
+`/name` commands without touching the built-in command list.
 
 ## Model cache (macOS)
 
@@ -190,7 +241,8 @@ verbosity with `RUST_LOG`.
 
 `OPENAI_BASE_URL` / `OPENAI_API_KEY` (provider override), `SIGIT_API_URL` (account API base,
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
-`SIGIT_MODEL`, `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
+`SIGIT_MODEL`, `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
+smbCloud CLI server), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
 server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
 mutating tools; the escape hatch for clients without permission-request support),
 `HF_HOME` / `HF_HUB_CACHE`, `RUST_LOG`.

sigit_code-1.5.0/.github/workflows/release-mcp-registry.yml

@@ -0,0 +1,79 @@
+name: MCP Registry Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Override the version in server.json (e.g. 0.2.0); leave blank to publish as-is"
+        required: false
+
+# A remote server proves namespace ownership through domain (DNS) verification,
+# not GitHub OIDC: the registry checks a v=MCPv1 TXT record on sigit.si against
+# a request signed with the matching Ed25519 private key. See the MCP Registry
+# doc in the sigit-si repo for the one-time key/DNS setup.
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    name: Publish server.json to the MCP Registry
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Optionally override the version in server.json
+        shell: bash
+        run: |
+          version="${{ github.event.inputs.version }}"
+          if [ -n "${version}" ]; then
+            jq --arg v "${version}" '.version = $v' server.json > server.tmp
+            mv server.tmp server.json
+          fi
+          cat server.json
+
+      - name: Check the remote URL matches the namespace domain
+        shell: bash
+        run: |
+          # The registry rejects a remote server whose URL isn't under the
+          # namespace's domain. si.sigit -> sigit.si, so every listed remote
+          # must live on sigit.si (or a subdomain).
+          server_name="$(jq -r '.name' server.json)"
+          domain="$(echo "${server_name%%/*}" | awk -F. '{ for (i=NF; i>=1; i--) printf "%s%s", $i, (i>1 ? "." : "") }')"
+          echo "Server: ${server_name}  Domain: ${domain}"
+
+          bad="$(jq -r --arg d "${domain}" '
+            .remotes // []
+            | map(.url | sub("^[a-z]+://"; "") | sub("/.*$"; ""))
+            | map(select(. != $d and (endswith("." + $d) | not)))
+            | .[]' server.json)"
+          if [ -n "${bad}" ]; then
+            echo "Remote URL host(s) not under ${domain}: ${bad}" >&2
+            exit 1
+          fi
+
+      - name: Install mcp-publisher
+        shell: bash
+        run: |
+          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
+
+      - name: Authenticate to the MCP Registry
+        shell: bash
+        env:
+          MCP_REGISTRY_DNS_PRIVATE_KEY: ${{ secrets.MCP_REGISTRY_DNS_PRIVATE_KEY }}
+        run: |
+          if [ -z "${MCP_REGISTRY_DNS_PRIVATE_KEY}" ]; then
+            echo "MCP_REGISTRY_DNS_PRIVATE_KEY secret is not set. See the MCP Registry doc in the sigit-si repo." >&2
+            exit 1
+          fi
+          ./mcp-publisher login dns --domain=sigit.si --private-key="${MCP_REGISTRY_DNS_PRIVATE_KEY}"
+
+      - name: Publish
+        shell: bash
+        run: ./mcp-publisher publish
+
+      - name: Verify the server is listed
+        shell: bash
+        run: |
+          server_name="$(jq -r '.name' server.json)"
+          curl -fsSL "https://registry.modelcontextprotocol.io/v0.1/servers?search=${server_name}" | jq .

{sigit_code-1.4.0 → sigit_code-1.5.0}/AGENTS.md

@@ -110,7 +110,23 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   spec list (`all_tools`) and the execute `match` (`execute_tool`). `run_command` also enforces
   commit attribution: when a command creates a new commit that lacks the
   `Co-Authored-By: siGit Code` trailer (`COMMIT_CO_AUTHOR_TRAILER`), it amends the trailer in —
-  unless the commit already exists on a remote, which is never rewritten.
+  unless the commit already exists on a remote, which is never rewritten. Also owns the `task`
+  tool: a nested agent loop in a fresh conversation, offered only when `subagent_available()`
+  (a subagent factory is registered — see `register_subagent_factory_for` in `main.rs`; on-device
+  registers a `None`-returning factory since onde has a single shared history). A subagent's
+  toolset is a hard-gated read-only allow-list (`SUBAGENT_TOOL_NAMES`) that is never expanded by a
+  configurable subagent type (see `src/subagents.rs`) — only ever narrowed — so a `.sigit/agents/*.md`
+  file can't grant itself `edit_file`/`run_command` and bypass the permission system. Also owns
+  `web_search`: a thin native wrapper around the official MCP server's Brave-Search-backed
+  `web_search` tool (`mcp__sigit__web_search`, implemented server-side in `sigit-si`'s
+  `WebSearchService` + `Mcp::Tools::WebSearch`), offered only when that MCP tool was actually
+  discovered (i.e. the user is signed in to siGit Code Cloud — see `web_search_available`).
+  Wrapping it natively rather than leaving it as a raw `mcp__*` tool matters for two reasons:
+  `permissions::classify` treats every `mcp__*` tool as mutating (an "ask" prompt on every call),
+  while `web_search` is read-only like `read_website`; and the raw delegate name is filtered out
+  of the assembled tool list (`is_web_search_delegate`) so the model sees one clean option, not
+  two names for the same tool. Execution still forwards verbatim to `mcp::call_tool` — no second
+  HTTP/JSON-RPC implementation.
 - **`src/skills.rs`** — [Agent Skills](https://agentskills.io) support. Discovers skill
   folders (each with a `SKILL.md`: YAML frontmatter `name` + `description`, then Markdown
   instructions) from `.sigit/skills/` and `.claude/skills/` in the cwd, `$SIGIT_CONFIG_DIR/skills/`,
@@ -119,6 +135,31 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   calls `skill` with a name) loads the full `SKILL.md` body. The `skill` tool is appended in the
   `*_as_specs`/`build_tool_specs` layer (not in `all_tools()`) so its description can be dynamic,
   and only when at least one skill exists.
+- **`src/commands.rs`** — user-defined slash commands. Discovers Markdown files (each an
+  optional YAML frontmatter block — `description`, `argument-hint` — followed by a prompt-template
+  body) from `.sigit/commands/` and `.claude/commands/` in the cwd, `$SIGIT_CONFIG_DIR/commands/`,
+  and `~/.claude/commands/`. A subdirectory namespaces the command with `:`
+  (`.sigit/commands/git/commit.md` → `/git:commit`). Unlike skills there's no tool-call
+  indirection: invoking one works exactly like the built-in `/init` — `commands::render`
+  substitutes `$ARGUMENTS`/`$1..$9` in the body against whatever followed the command on the
+  input line, and the result is fed to the model as a normal turn through the ordinary tools and
+  permission checks. Resolution happens where each surface (`main.rs`/`chat.rs`) already
+  special-cases `/init`: an unrecognized slash command is tried against `commands::resolve_command`
+  before falling back to "unknown command". A custom command sharing a name with a built-in is
+  unreachable (built-ins match first in `parse_slash`) and is skipped when advertised to ACP
+  clients, with a warning logged.
+- **`src/subagents.rs`** — configurable subagent types for the `task` tool. Discovers Markdown
+  files (YAML frontmatter `name` + `description`, optional comma-separated `tools:` allow-list,
+  then a Markdown body that becomes the subagent's system prompt) from `.sigit/agents/` and
+  `.claude/agents/` in the cwd, `$SIGIT_CONFIG_DIR/agents/`, and `~/.claude/agents/`. Passing a
+  type's `name` as `task`'s `subagent_type` argument swaps in that system prompt and, if `tools:`
+  is set, narrows the offered toolset to its *intersection* with `SUBAGENT_TOOL_NAMES` — the
+  security-relevant narrowing logic lives in `tools.rs` next to that constant, not here; this
+  module only discovers and parses files. `SubagentFactory` (in `tools.rs`) takes the resolved
+  system prompt per call rather than baking one in at registration, so a single registered
+  factory serves both the default research subagent and every configured type.
+- **`src/frontmatter.rs`** — shared "YAML frontmatter + Markdown body" parsing used by both
+  `src/skills.rs` (`SKILL.md`) and `src/commands.rs` (`.sigit/commands/*.md`).
 - **`src/mcp.rs`** — [Model Context Protocol](https://modelcontextprotocol.io) *client*. Two
   transports: **Streamable HTTP** (one JSON-RPC POST endpoint, `url` in `mcp.toml`; replies are
   `application/json` or SSE) and **stdio** (`command` + optional `args`/`[server.env]` in
@@ -131,12 +172,20 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   both read it; `/reload` does *not* re-run it, so config changes need a restart. stdio children
   live for the process; a dead child fails calls with an in-band error string (no auto-restart).
   Tools are namespaced `mcp__<server>__<tool>`, appended in the `*_as_specs`/`build_tool_specs`
-  layer and routed in `tools::execute_tool` via `mcp::is_mcp_tool`. The official server
-  (`<cloud>/mcp`, default `https://sigit.si/api/v1/mcp`) is baked in (always HTTP) and authed
-  with the cloud session token; extra servers live in `mcp.toml` (global
+  layer and routed in `tools::execute_tool` via `mcp::is_mcp_tool`. Two servers are baked in:
+  the official server (`<cloud>/mcp`, default `https://sigit.si/api/v1/mcp`, always HTTP, authed
+  with the cloud session token) and the smbCloud CLI server (`smb --mcp`, stdio, added only when
+  the `smb` binary is on `PATH`; opt out with `smbcloud = false` in `mcp.toml` or
+  `SIGIT_MCP_SMBCLOUD=off`). A user-defined entry named `sigit` or `smbcloud` overrides the
+  corresponding baked-in one. Extra servers live in `mcp.toml` (global
   `$SIGIT_CONFIG_DIR/mcp.toml` and project-local `.sigit/mcp.toml`). The stdio path is covered by
   `tests/mcp_stdio.rs`, driven by the test-only `src/bin/mcp_stdio_stub.rs` helper binary
-  (excluded from the published crate via `exclude` in `Cargo.toml`).
+  (excluded from the published crate via `exclude` in `Cargo.toml`). The baked-in official
+  server is *also* listed in the public MCP Registry as `si.sigit/sigit` — a **remote**
+  Streamable-HTTP listing (`server.json` at the repo root, published by
+  `release-mcp-registry.yml`). Because it's a remote server, the registry's URL-match rule
+  forces a domain namespace (`si.sigit` ↔ `sigit.si`) verified by a DNS TXT record, not the
+  GitHub-OIDC scheme `smbcloud-cli` uses for its package listing.
 - **`src/permissions.rs`** — tool permission policy. Every tool call passes through
   `decision_for` before executing: read-only tools always run; mutating tools (and all
   `mcp__*`/unknown tools) are governed by, in order: per-session plan mode (`/plan` — deny all
@@ -165,12 +214,14 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
 - **`src/credentials.rs`** — local session-token store (TOML, `0600` on Unix).
 - **`src/models.rs`** — model-picker types shared across platforms.
 
-Slash commands (`/help`, `/models`, `/skills`, `/mcp`, `/login`, `/logout`, `/whoami`, `/reload`,
-`/plan`, `/permissions`, `/init`, `/clear`, `/status`) are advertised via `advertise_commands` in
-`main.rs` and handled in both the TUI and ACP sessions. `/init` is special: instead of replying
-directly it substitutes `instructions::INIT_PROMPT` for the user text and runs a normal agent
-turn that explores the repo and writes (or improves) `AGENTS.md` through the ordinary tools and
-permission checks.
+Slash commands (`/help`, `/models`, `/skills`, `/agents`, `/commands`, `/mcp`, `/login`, `/logout`,
+`/whoami`, `/reload`, `/plan`, `/permissions`, `/init`, `/clear`, `/status`) are advertised via
+`advertise_commands` in `main.rs` and handled in both the TUI and ACP sessions. `/init` is
+special: instead of replying directly it substitutes `instructions::INIT_PROMPT` for the user
+text and runs a normal agent turn that explores the repo and writes (or improves) `AGENTS.md`
+through the ordinary tools and permission checks. User-defined commands (see `src/commands.rs`)
+get the same treatment via the `SlashCommand::Unknown` fallback path, so anyone can add their own
+`/name` commands without touching the built-in command list.
 
 ## Model cache (macOS)
 
@@ -190,7 +241,8 @@ verbosity with `RUST_LOG`.
 
 `OPENAI_BASE_URL` / `OPENAI_API_KEY` (provider override), `SIGIT_API_URL` (account API base,
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
-`SIGIT_MODEL`, `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
+`SIGIT_MODEL`, `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
+smbCloud CLI server), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
 server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
 mutating tools; the escape hatch for clients without permission-request support),
 `HF_HOME` / `HF_HUB_CACHE`, `RUST_LOG`.

{sigit_code-1.4.0 → sigit_code-1.5.0}/CHANGELOG.md

@@ -1,5 +1,77 @@
 # Changelog
 
+## 1.5.0
+
+Opens the agent up to user extension: lifecycle hooks, custom slash commands,
+and configurable subagent types. Also adds web search, a Repo tab in the TUI,
+and a baked-in smbCloud MCP server.
+
+### What changed
+
+- Hooks let you run shell commands at three points in the agent's lifecycle:
+  `session_start`, `pre_tool_use`, and `post_tool_use`, configured under
+  `[hooks]` in `settings.toml`. Commands get context through variable
+  substitution (`{cwd}`, `{tool_name}`, `{tool_result_len}`) and run in the
+  session working directory. A hook that fails is logged and the session
+  continues; a hook that hangs is killed on a timeout, along with its whole
+  process group
+- User-defined slash commands: drop a Markdown file in `.sigit/commands/` or
+  `.claude/commands/` (or the personal `$SIGIT_CONFIG_DIR/commands/` and
+  `~/.claude/commands/`) with optional `description` and `argument-hint`
+  frontmatter, and the body becomes a prompt template. `$ARGUMENTS` takes the
+  whole argument string and `$1`..`$9` the positional words. A subdirectory
+  namespaces the command with `:`, so `.sigit/commands/git/commit.md` becomes
+  `/git:commit`. They run as ordinary agent turns through the usual tools and
+  permission checks, and are advertised to ACP clients like Zed. `/commands`
+  lists what was discovered
+- Configurable subagent types for the `task` tool: a Markdown file in
+  `.sigit/agents/` or `.claude/agents/` with `name`, `description`, and an
+  optional `tools:` allow-list, whose body becomes that subagent's system
+  prompt. Pass its name as `subagent_type` to swap the prompt in. The
+  `tools:` list can only narrow the subagent's read-only ceiling, never widen
+  it, so a config file cannot grant itself `edit_file` or `run_command` and
+  route around the permission system. `/agents` lists the discovered types
+- New `web_search` tool, backed by the Brave-Search-backed search on siGit
+  Code Cloud's MCP server. It is offered only when you are signed in, and it
+  is classified read-only, so searching never triggers a permission prompt
+- The TUI gains a Repo tab, shown when the session's `origin` remote points at
+  the sigit.si host. It lists issues and pull requests fetched through the
+  official MCP server: Up and Down select, Enter opens a scrollable detail,
+  `i`, `p`, Left and Right switch sections, `r` refreshes. The tab is hidden
+  and skipped in the cycle for any other remote
+- The smbCloud CLI's stdio MCP server (`smb --mcp`) is now baked in, so
+  smbCloud project and deployment tools work with no `mcp.toml` setup. It is
+  added only when the `smb` binary is on `PATH`, its read-only tools (`me`,
+  `deployments`, `project_list`, `project_show`) skip permission prompts, and
+  you can opt out with `smbcloud = false` in `mcp.toml` or
+  `SIGIT_MCP_SMBCLOUD=off`
+- siGit Code Cloud's MCP server is now listed in the public MCP Registry as
+  `si.sigit/sigit`, published from `server.json` at the repository root
+
+### Fixes
+
+- An explicit `deny` rule now applies to read-only first-party tools instead
+  of being skipped
+- A subagent type whose `tools:` list resolves to an empty set is rejected
+  rather than producing a subagent with no tools
+- Command templates render in a single substitution pass, so an argument that
+  contains something like `$1` is no longer re-substituted
+- Frontmatter is stripped with the same leniency it is parsed with
+- The Repo tab's detail view no longer shows stale data after a refresh
+
+## 1.4.1
+
+Two small fixes: correct co-author attribution and a Homebrew tap fix.
+
+### What changed
+
+- The `Co-Authored-By` trailer siGit Code adds to commits now uses the GitHub
+  noreply address for the [sigitc](https://github.com/sigitc) account instead
+  of `sigit@sigit.si`, so GitHub reliably attributes co-authored commits to
+  the siGit Code profile
+- Fixed the Homebrew tap install docs to trust the tap with `brew trust`
+  instead of a `brew tap --force` flag
+
 ## 1.4.0
 
 Adds a headless one-shot mode, fine-grained permission rules, stdio transport

{sigit_code-1.4.0 → sigit_code-1.5.0}/CLAUDE.md

@@ -110,7 +110,23 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   spec list (`all_tools`) and the execute `match` (`execute_tool`). `run_command` also enforces
   commit attribution: when a command creates a new commit that lacks the
   `Co-Authored-By: siGit Code` trailer (`COMMIT_CO_AUTHOR_TRAILER`), it amends the trailer in —
-  unless the commit already exists on a remote, which is never rewritten.
+  unless the commit already exists on a remote, which is never rewritten. Also owns the `task`
+  tool: a nested agent loop in a fresh conversation, offered only when `subagent_available()`
+  (a subagent factory is registered — see `register_subagent_factory_for` in `main.rs`; on-device
+  registers a `None`-returning factory since onde has a single shared history). A subagent's
+  toolset is a hard-gated read-only allow-list (`SUBAGENT_TOOL_NAMES`) that is never expanded by a
+  configurable subagent type (see `src/subagents.rs`) — only ever narrowed — so a `.sigit/agents/*.md`
+  file can't grant itself `edit_file`/`run_command` and bypass the permission system. Also owns
+  `web_search`: a thin native wrapper around the official MCP server's Brave-Search-backed
+  `web_search` tool (`mcp__sigit__web_search`, implemented server-side in `sigit-si`'s
+  `WebSearchService` + `Mcp::Tools::WebSearch`), offered only when that MCP tool was actually
+  discovered (i.e. the user is signed in to siGit Code Cloud — see `web_search_available`).
+  Wrapping it natively rather than leaving it as a raw `mcp__*` tool matters for two reasons:
+  `permissions::classify` treats every `mcp__*` tool as mutating (an "ask" prompt on every call),
+  while `web_search` is read-only like `read_website`; and the raw delegate name is filtered out
+  of the assembled tool list (`is_web_search_delegate`) so the model sees one clean option, not
+  two names for the same tool. Execution still forwards verbatim to `mcp::call_tool` — no second
+  HTTP/JSON-RPC implementation.
 - **`src/skills.rs`** — [Agent Skills](https://agentskills.io) support. Discovers skill
   folders (each with a `SKILL.md`: YAML frontmatter `name` + `description`, then Markdown
   instructions) from `.sigit/skills/` and `.claude/skills/` in the cwd, `$SIGIT_CONFIG_DIR/skills/`,
@@ -119,6 +135,31 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   calls `skill` with a name) loads the full `SKILL.md` body. The `skill` tool is appended in the
   `*_as_specs`/`build_tool_specs` layer (not in `all_tools()`) so its description can be dynamic,
   and only when at least one skill exists.
+- **`src/commands.rs`** — user-defined slash commands. Discovers Markdown files (each an
+  optional YAML frontmatter block — `description`, `argument-hint` — followed by a prompt-template
+  body) from `.sigit/commands/` and `.claude/commands/` in the cwd, `$SIGIT_CONFIG_DIR/commands/`,
+  and `~/.claude/commands/`. A subdirectory namespaces the command with `:`
+  (`.sigit/commands/git/commit.md` → `/git:commit`). Unlike skills there's no tool-call
+  indirection: invoking one works exactly like the built-in `/init` — `commands::render`
+  substitutes `$ARGUMENTS`/`$1..$9` in the body against whatever followed the command on the
+  input line, and the result is fed to the model as a normal turn through the ordinary tools and
+  permission checks. Resolution happens where each surface (`main.rs`/`chat.rs`) already
+  special-cases `/init`: an unrecognized slash command is tried against `commands::resolve_command`
+  before falling back to "unknown command". A custom command sharing a name with a built-in is
+  unreachable (built-ins match first in `parse_slash`) and is skipped when advertised to ACP
+  clients, with a warning logged.
+- **`src/subagents.rs`** — configurable subagent types for the `task` tool. Discovers Markdown
+  files (YAML frontmatter `name` + `description`, optional comma-separated `tools:` allow-list,
+  then a Markdown body that becomes the subagent's system prompt) from `.sigit/agents/` and
+  `.claude/agents/` in the cwd, `$SIGIT_CONFIG_DIR/agents/`, and `~/.claude/agents/`. Passing a
+  type's `name` as `task`'s `subagent_type` argument swaps in that system prompt and, if `tools:`
+  is set, narrows the offered toolset to its *intersection* with `SUBAGENT_TOOL_NAMES` — the
+  security-relevant narrowing logic lives in `tools.rs` next to that constant, not here; this
+  module only discovers and parses files. `SubagentFactory` (in `tools.rs`) takes the resolved
+  system prompt per call rather than baking one in at registration, so a single registered
+  factory serves both the default research subagent and every configured type.
+- **`src/frontmatter.rs`** — shared "YAML frontmatter + Markdown body" parsing used by both
+  `src/skills.rs` (`SKILL.md`) and `src/commands.rs` (`.sigit/commands/*.md`).
 - **`src/mcp.rs`** — [Model Context Protocol](https://modelcontextprotocol.io) *client*. Two
   transports: **Streamable HTTP** (one JSON-RPC POST endpoint, `url` in `mcp.toml`; replies are
   `application/json` or SSE) and **stdio** (`command` + optional `args`/`[server.env]` in
@@ -131,12 +172,20 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   both read it; `/reload` does *not* re-run it, so config changes need a restart. stdio children
   live for the process; a dead child fails calls with an in-band error string (no auto-restart).
   Tools are namespaced `mcp__<server>__<tool>`, appended in the `*_as_specs`/`build_tool_specs`
-  layer and routed in `tools::execute_tool` via `mcp::is_mcp_tool`. The official server
-  (`<cloud>/mcp`, default `https://sigit.si/api/v1/mcp`) is baked in (always HTTP) and authed
-  with the cloud session token; extra servers live in `mcp.toml` (global
+  layer and routed in `tools::execute_tool` via `mcp::is_mcp_tool`. Two servers are baked in:
+  the official server (`<cloud>/mcp`, default `https://sigit.si/api/v1/mcp`, always HTTP, authed
+  with the cloud session token) and the smbCloud CLI server (`smb --mcp`, stdio, added only when
+  the `smb` binary is on `PATH`; opt out with `smbcloud = false` in `mcp.toml` or
+  `SIGIT_MCP_SMBCLOUD=off`). A user-defined entry named `sigit` or `smbcloud` overrides the
+  corresponding baked-in one. Extra servers live in `mcp.toml` (global
   `$SIGIT_CONFIG_DIR/mcp.toml` and project-local `.sigit/mcp.toml`). The stdio path is covered by
   `tests/mcp_stdio.rs`, driven by the test-only `src/bin/mcp_stdio_stub.rs` helper binary
-  (excluded from the published crate via `exclude` in `Cargo.toml`).
+  (excluded from the published crate via `exclude` in `Cargo.toml`). The baked-in official
+  server is *also* listed in the public MCP Registry as `si.sigit/sigit` — a **remote**
+  Streamable-HTTP listing (`server.json` at the repo root, published by
+  `release-mcp-registry.yml`). Because it's a remote server, the registry's URL-match rule
+  forces a domain namespace (`si.sigit` ↔ `sigit.si`) verified by a DNS TXT record, not the
+  GitHub-OIDC scheme `smbcloud-cli` uses for its package listing.
 - **`src/permissions.rs`** — tool permission policy. Every tool call passes through
   `decision_for` before executing: read-only tools always run; mutating tools (and all
   `mcp__*`/unknown tools) are governed by, in order: per-session plan mode (`/plan` — deny all
@@ -165,12 +214,14 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
 - **`src/credentials.rs`** — local session-token store (TOML, `0600` on Unix).
 - **`src/models.rs`** — model-picker types shared across platforms.
 
-Slash commands (`/help`, `/models`, `/skills`, `/mcp`, `/login`, `/logout`, `/whoami`, `/reload`,
-`/plan`, `/permissions`, `/init`, `/clear`, `/status`) are advertised via `advertise_commands` in
-`main.rs` and handled in both the TUI and ACP sessions. `/init` is special: instead of replying
-directly it substitutes `instructions::INIT_PROMPT` for the user text and runs a normal agent
-turn that explores the repo and writes (or improves) `AGENTS.md` through the ordinary tools and
-permission checks.
+Slash commands (`/help`, `/models`, `/skills`, `/agents`, `/commands`, `/mcp`, `/login`, `/logout`,
+`/whoami`, `/reload`, `/plan`, `/permissions`, `/init`, `/clear`, `/status`) are advertised via
+`advertise_commands` in `main.rs` and handled in both the TUI and ACP sessions. `/init` is
+special: instead of replying directly it substitutes `instructions::INIT_PROMPT` for the user
+text and runs a normal agent turn that explores the repo and writes (or improves) `AGENTS.md`
+through the ordinary tools and permission checks. User-defined commands (see `src/commands.rs`)
+get the same treatment via the `SlashCommand::Unknown` fallback path, so anyone can add their own
+`/name` commands without touching the built-in command list.
 
 ## Model cache (macOS)
 
@@ -190,7 +241,8 @@ verbosity with `RUST_LOG`.
 
 `OPENAI_BASE_URL` / `OPENAI_API_KEY` (provider override), `SIGIT_API_URL` (account API base,
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
-`SIGIT_MODEL`, `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
+`SIGIT_MODEL`, `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
+smbCloud CLI server), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
 server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
 mutating tools; the escape hatch for clients without permission-request support),
 `HF_HOME` / `HF_HUB_CACHE`, `RUST_LOG`.

{sigit_code-1.4.0 → sigit_code-1.5.0}/Cargo.lock

@@ -5200,7 +5200,7 @@ checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "sigit"
-version = "1.4.0"
+version = "1.5.0"
 dependencies = [
  "agent-client-protocol",
  "anyhow",

{sigit_code-1.4.0 → sigit_code-1.5.0}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sigit"
-version = "1.4.0"
+version = "1.5.0"
 edition = "2024"
 description = "siGit Code — ACP-compatible AI coding agent. Sí, git."
 documentation = "https://github.com/getsigit/sigit"

{sigit_code-1.4.0 → sigit_code-1.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sigit-code
-Version: 1.4.0
+Version: 1.5.0
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
@@ -81,7 +81,7 @@ Then pick **siGit Code** in the assistant panel.
 | Method | Command |
 |--------|---------|
 | npm | `npm install -g @smbcloud/sigit` |
-| Homebrew | `brew tap getsigit/tap && brew install sigit` |
+| Homebrew | `brew tap getsigit/tap && brew trust --tap getsigit/tap && brew install sigit` |
 | Cargo | `cargo install sigit` |
 
 ### From source

{sigit_code-1.4.0 → sigit_code-1.5.0}/README.md

@@ -33,7 +33,7 @@ cargo install sigit
 
 | Method | Command |
 |--------|---------|
-| Homebrew | `brew tap getsigit/tap && brew install sigit` |
+| Homebrew | `brew tap getsigit/tap && brew trust --tap getsigit/tap && brew install sigit` |
 | pip | `pip install sigit-code` |
 | uv | `uvx --from sigit-code sigit` |
 | npm | `npm install -g @smbcloud/sigit` |

sigit_code-1.5.0/docs/hooks.md

@@ -0,0 +1,92 @@
+# siGit Code Hooks
+
+Hooks allow you to run custom scripts at key moments in the agent lifecycle:
+- **SessionStart**: When a session begins (new/load/fork)
+- **PreToolUse**: Before a tool is executed
+- **PostToolUse**: After a tool is executed
+
+## Configuration
+
+Hooks are configured in `~/.config/sigit/settings.toml` under the `[hooks]` section:
+
+```toml
+[hooks]
+session_start = ["echo 'Starting siGit in {cwd}'"]
+pre_tool_use = ["echo 'About to run {tool_name} with {tool_args_len} bytes of args'"]
+post_tool_use = ["echo 'Finished {tool_name}, result was {tool_result_len} bytes'"]
+```
+
+Each hook is a list of shell commands. Commands run in the session working directory and inherit the environment.
+
+## Variable Substitution
+
+Hooks support substitution for context variables:
+
+### SessionStart
+- `{cwd}` - The session working directory
+- `{session_id}` - The unique session identifier
+
+### PreToolUse
+- `{tool_name}` - The name of the tool being called
+- `{tool_args_len}` - Length of the tool arguments in bytes
+- `{cwd}` - The session working directory
+
+### PostToolUse
+- `{tool_name}` - The name of the tool that ran
+- `{tool_result_len}` - Length of the tool result in bytes
+- `{cwd}` - The session working directory
+
+Every `{var}` value is quote-escaped for the platform shell before it's spliced
+into the command line, so a directory name or an MCP-server-supplied tool name
+that happens to contain shell metacharacters is always treated as literal text,
+never executed. Windows `cmd.exe` quoting is best-effort (`cmd` has no fully
+safe quoting story); the same values are also exported as environment
+variables — `SIGIT_HOOK_CWD`, `SIGIT_HOOK_SESSION_ID`, `SIGIT_HOOK_TOOL_NAME`,
+`SIGIT_HOOK_TOOL_ARGS_LEN`, `SIGIT_HOOK_TOOL_RESULT_LEN` — and reading those
+in your script instead of `{var}` sidesteps quoting entirely on any platform.
+
+## Examples
+
+### Log all tool usage to a file
+
+```toml
+[hooks]
+pre_tool_use = ["echo '[{tool_name}]' >> /tmp/sigit-tools.log"]
+post_tool_use = ["echo '  → {tool_result_len} bytes' >> /tmp/sigit-tools.log"]
+```
+
+### Send notifications
+
+```toml
+[hooks]
+session_start = ["notify-send 'siGit started in {cwd}'"]
+```
+
+### Build on session start
+
+```toml
+[hooks]
+session_start = ["cd {cwd} && cargo build"]
+```
+
+### Track metrics
+
+```toml
+[hooks]
+pre_tool_use = ["echo {tool_name} | tee -a ~/.sigit/tool_usage.txt"]
+post_tool_use = ["wc -c <<< {tool_result_len} >> ~/.sigit/result_sizes.txt"]
+```
+
+## Notes
+
+- Hooks are optional. When none are configured, each tool call still does one
+  lightweight settings-file read to check for that; there is no shell process
+  spawned and no other measurable overhead.
+- Hook failures (non-zero exit codes) are logged as warnings but do not interrupt the session.
+- Hooks are run synchronously, so slow hooks will impact agent responsiveness — this applies
+  in the interactive TUI too, not just ACP/headless mode.
+- `PreToolUse` and `PostToolUse` hooks fire in every mode (TUI, ACP, headless) and for every
+  call to the shared tool-execution path — including tool calls made by a `task` subagent, not
+  just the top-level agent.
+- `SessionStart` hooks currently only fire on ACP session lifecycle events (new/load/fork
+  session). The interactive TUI does not have an equivalent session-start hook point yet.