sigit-code 1.4.1__tar.gz → 1.5.1__tar.gz

{sigit_code-1.4.1 → sigit_code-1.5.1}/.agents/AGENTS.md

@@ -110,7 +110,23 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   spec list (`all_tools`) and the execute `match` (`execute_tool`). `run_command` also enforces
   commit attribution: when a command creates a new commit that lacks the
   `Co-Authored-By: siGit Code` trailer (`COMMIT_CO_AUTHOR_TRAILER`), it amends the trailer in —
-  unless the commit already exists on a remote, which is never rewritten.
+  unless the commit already exists on a remote, which is never rewritten. Also owns the `task`
+  tool: a nested agent loop in a fresh conversation, offered only when `subagent_available()`
+  (a subagent factory is registered — see `register_subagent_factory_for` in `main.rs`; on-device
+  registers a `None`-returning factory since onde has a single shared history). A subagent's
+  toolset is a hard-gated read-only allow-list (`SUBAGENT_TOOL_NAMES`) that is never expanded by a
+  configurable subagent type (see `src/subagents.rs`) — only ever narrowed — so a `.sigit/agents/*.md`
+  file can't grant itself `edit_file`/`run_command` and bypass the permission system. Also owns
+  `web_search`: a thin native wrapper around the official MCP server's Brave-Search-backed
+  `web_search` tool (`mcp__sigit__web_search`, implemented server-side in `sigit-si`'s
+  `WebSearchService` + `Mcp::Tools::WebSearch`), offered only when that MCP tool was actually
+  discovered (i.e. the user is signed in to siGit Code Cloud — see `web_search_available`).
+  Wrapping it natively rather than leaving it as a raw `mcp__*` tool matters for two reasons:
+  `permissions::classify` treats every `mcp__*` tool as mutating (an "ask" prompt on every call),
+  while `web_search` is read-only like `read_website`; and the raw delegate name is filtered out
+  of the assembled tool list (`is_web_search_delegate`) so the model sees one clean option, not
+  two names for the same tool. Execution still forwards verbatim to `mcp::call_tool` — no second
+  HTTP/JSON-RPC implementation.
 - **`src/skills.rs`** — [Agent Skills](https://agentskills.io) support. Discovers skill
   folders (each with a `SKILL.md`: YAML frontmatter `name` + `description`, then Markdown
   instructions) from `.sigit/skills/` and `.claude/skills/` in the cwd, `$SIGIT_CONFIG_DIR/skills/`,
@@ -119,6 +135,31 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   calls `skill` with a name) loads the full `SKILL.md` body. The `skill` tool is appended in the
   `*_as_specs`/`build_tool_specs` layer (not in `all_tools()`) so its description can be dynamic,
   and only when at least one skill exists.
+- **`src/commands.rs`** — user-defined slash commands. Discovers Markdown files (each an
+  optional YAML frontmatter block — `description`, `argument-hint` — followed by a prompt-template
+  body) from `.sigit/commands/` and `.claude/commands/` in the cwd, `$SIGIT_CONFIG_DIR/commands/`,
+  and `~/.claude/commands/`. A subdirectory namespaces the command with `:`
+  (`.sigit/commands/git/commit.md` → `/git:commit`). Unlike skills there's no tool-call
+  indirection: invoking one works exactly like the built-in `/init` — `commands::render`
+  substitutes `$ARGUMENTS`/`$1..$9` in the body against whatever followed the command on the
+  input line, and the result is fed to the model as a normal turn through the ordinary tools and
+  permission checks. Resolution happens where each surface (`main.rs`/`chat.rs`) already
+  special-cases `/init`: an unrecognized slash command is tried against `commands::resolve_command`
+  before falling back to "unknown command". A custom command sharing a name with a built-in is
+  unreachable (built-ins match first in `parse_slash`) and is skipped when advertised to ACP
+  clients, with a warning logged.
+- **`src/subagents.rs`** — configurable subagent types for the `task` tool. Discovers Markdown
+  files (YAML frontmatter `name` + `description`, optional comma-separated `tools:` allow-list,
+  then a Markdown body that becomes the subagent's system prompt) from `.sigit/agents/` and
+  `.claude/agents/` in the cwd, `$SIGIT_CONFIG_DIR/agents/`, and `~/.claude/agents/`. Passing a
+  type's `name` as `task`'s `subagent_type` argument swaps in that system prompt and, if `tools:`
+  is set, narrows the offered toolset to its *intersection* with `SUBAGENT_TOOL_NAMES` — the
+  security-relevant narrowing logic lives in `tools.rs` next to that constant, not here; this
+  module only discovers and parses files. `SubagentFactory` (in `tools.rs`) takes the resolved
+  system prompt per call rather than baking one in at registration, so a single registered
+  factory serves both the default research subagent and every configured type.
+- **`src/frontmatter.rs`** — shared "YAML frontmatter + Markdown body" parsing used by both
+  `src/skills.rs` (`SKILL.md`) and `src/commands.rs` (`.sigit/commands/*.md`).
 - **`src/mcp.rs`** — [Model Context Protocol](https://modelcontextprotocol.io) *client*. Two
   transports: **Streamable HTTP** (one JSON-RPC POST endpoint, `url` in `mcp.toml`; replies are
   `application/json` or SSE) and **stdio** (`command` + optional `args`/`[server.env]` in
@@ -131,12 +172,20 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   both read it; `/reload` does *not* re-run it, so config changes need a restart. stdio children
   live for the process; a dead child fails calls with an in-band error string (no auto-restart).
   Tools are namespaced `mcp__<server>__<tool>`, appended in the `*_as_specs`/`build_tool_specs`
-  layer and routed in `tools::execute_tool` via `mcp::is_mcp_tool`. The official server
-  (`<cloud>/mcp`, default `https://sigit.si/api/v1/mcp`) is baked in (always HTTP) and authed
-  with the cloud session token; extra servers live in `mcp.toml` (global
+  layer and routed in `tools::execute_tool` via `mcp::is_mcp_tool`. Two servers are baked in:
+  the official server (`<cloud>/mcp`, default `https://sigit.si/api/v1/mcp`, always HTTP, authed
+  with the cloud session token) and the smbCloud CLI server (`smb --mcp`, stdio, added only when
+  the `smb` binary is on `PATH`; opt out with `smbcloud = false` in `mcp.toml` or
+  `SIGIT_MCP_SMBCLOUD=off`). A user-defined entry named `sigit` or `smbcloud` overrides the
+  corresponding baked-in one. Extra servers live in `mcp.toml` (global
   `$SIGIT_CONFIG_DIR/mcp.toml` and project-local `.sigit/mcp.toml`). The stdio path is covered by
   `tests/mcp_stdio.rs`, driven by the test-only `src/bin/mcp_stdio_stub.rs` helper binary
-  (excluded from the published crate via `exclude` in `Cargo.toml`).
+  (excluded from the published crate via `exclude` in `Cargo.toml`). The baked-in official
+  server is *also* listed in the public MCP Registry as `si.sigit/sigit` — a **remote**
+  Streamable-HTTP listing (`server.json` at the repo root, published by
+  `release-mcp-registry.yml`). Because it's a remote server, the registry's URL-match rule
+  forces a domain namespace (`si.sigit` ↔ `sigit.si`) verified by a DNS TXT record, not the
+  GitHub-OIDC scheme `smbcloud-cli` uses for its package listing.
 - **`src/permissions.rs`** — tool permission policy. Every tool call passes through
   `decision_for` before executing: read-only tools always run; mutating tools (and all
   `mcp__*`/unknown tools) are governed by, in order: per-session plan mode (`/plan` — deny all
@@ -165,12 +214,14 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
 - **`src/credentials.rs`** — local session-token store (TOML, `0600` on Unix).
 - **`src/models.rs`** — model-picker types shared across platforms.
 
-Slash commands (`/help`, `/models`, `/skills`, `/mcp`, `/login`, `/logout`, `/whoami`, `/reload`,
-`/plan`, `/permissions`, `/init`, `/clear`, `/status`) are advertised via `advertise_commands` in
-`main.rs` and handled in both the TUI and ACP sessions. `/init` is special: instead of replying
-directly it substitutes `instructions::INIT_PROMPT` for the user text and runs a normal agent
-turn that explores the repo and writes (or improves) `AGENTS.md` through the ordinary tools and
-permission checks.
+Slash commands (`/help`, `/models`, `/skills`, `/agents`, `/commands`, `/mcp`, `/login`, `/logout`,
+`/whoami`, `/reload`, `/plan`, `/permissions`, `/init`, `/clear`, `/status`) are advertised via
+`advertise_commands` in `main.rs` and handled in both the TUI and ACP sessions. `/init` is
+special: instead of replying directly it substitutes `instructions::INIT_PROMPT` for the user
+text and runs a normal agent turn that explores the repo and writes (or improves) `AGENTS.md`
+through the ordinary tools and permission checks. User-defined commands (see `src/commands.rs`)
+get the same treatment via the `SlashCommand::Unknown` fallback path, so anyone can add their own
+`/name` commands without touching the built-in command list.
 
 ## Model cache (macOS)
 
@@ -190,7 +241,8 @@ verbosity with `RUST_LOG`.
 
 `OPENAI_BASE_URL` / `OPENAI_API_KEY` (provider override), `SIGIT_API_URL` (account API base,
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
-`SIGIT_MODEL`, `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
+`SIGIT_MODEL`, `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
+smbCloud CLI server), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
 server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
 mutating tools; the escape hatch for clients without permission-request support),
 `HF_HOME` / `HF_HUB_CACHE`, `RUST_LOG`.

{sigit_code-1.4.1 → sigit_code-1.5.1}/.github/workflows/ci.yml

@@ -9,6 +9,10 @@ on:
   pull_request:
   workflow_dispatch:
 
+concurrency:
+  group: ci
+  cancel-in-progress: true
+
 env:
   CARGO_TERM_COLOR: always
 

sigit_code-1.5.1/.github/workflows/release-mcp-registry.yml

@@ -0,0 +1,79 @@
+name: MCP Registry Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Override the version in server.json (e.g. 0.2.0); leave blank to publish as-is"
+        required: false
+
+# A remote server proves namespace ownership through domain (DNS) verification,
+# not GitHub OIDC: the registry checks a v=MCPv1 TXT record on sigit.si against
+# a request signed with the matching Ed25519 private key. See the MCP Registry
+# doc in the sigit-si repo for the one-time key/DNS setup.
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    name: Publish server.json to the MCP Registry
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Optionally override the version in server.json
+        shell: bash
+        run: |
+          version="${{ github.event.inputs.version }}"
+          if [ -n "${version}" ]; then
+            jq --arg v "${version}" '.version = $v' server.json > server.tmp
+            mv server.tmp server.json
+          fi
+          cat server.json
+
+      - name: Check the remote URL matches the namespace domain
+        shell: bash
+        run: |
+          # The registry rejects a remote server whose URL isn't under the
+          # namespace's domain. si.sigit -> sigit.si, so every listed remote
+          # must live on sigit.si (or a subdomain).
+          server_name="$(jq -r '.name' server.json)"
+          domain="$(echo "${server_name%%/*}" | awk -F. '{ for (i=NF; i>=1; i--) printf "%s%s", $i, (i>1 ? "." : "") }')"
+          echo "Server: ${server_name}  Domain: ${domain}"
+
+          bad="$(jq -r --arg d "${domain}" '
+            .remotes // []
+            | map(.url | sub("^[a-z]+://"; "") | sub("/.*$"; ""))
+            | map(select(. != $d and (endswith("." + $d) | not)))
+            | .[]' server.json)"
+          if [ -n "${bad}" ]; then
+            echo "Remote URL host(s) not under ${domain}: ${bad}" >&2
+            exit 1
+          fi
+
+      - name: Install mcp-publisher
+        shell: bash
+        run: |
+          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
+
+      - name: Authenticate to the MCP Registry
+        shell: bash
+        env:
+          MCP_REGISTRY_DNS_PRIVATE_KEY: ${{ secrets.MCP_REGISTRY_DNS_PRIVATE_KEY }}
+        run: |
+          if [ -z "${MCP_REGISTRY_DNS_PRIVATE_KEY}" ]; then
+            echo "MCP_REGISTRY_DNS_PRIVATE_KEY secret is not set. See the MCP Registry doc in the sigit-si repo." >&2
+            exit 1
+          fi
+          ./mcp-publisher login dns --domain=sigit.si --private-key="${MCP_REGISTRY_DNS_PRIVATE_KEY}"
+
+      - name: Publish
+        shell: bash
+        run: ./mcp-publisher publish
+
+      - name: Verify the server is listed
+        shell: bash
+        run: |
+          server_name="$(jq -r '.name' server.json)"
+          curl -fsSL "https://registry.modelcontextprotocol.io/v0.1/servers?search=${server_name}" | jq .

{sigit_code-1.4.1 → sigit_code-1.5.1}/AGENTS.md

@@ -110,7 +110,23 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   spec list (`all_tools`) and the execute `match` (`execute_tool`). `run_command` also enforces
   commit attribution: when a command creates a new commit that lacks the
   `Co-Authored-By: siGit Code` trailer (`COMMIT_CO_AUTHOR_TRAILER`), it amends the trailer in —
-  unless the commit already exists on a remote, which is never rewritten.
+  unless the commit already exists on a remote, which is never rewritten. Also owns the `task`
+  tool: a nested agent loop in a fresh conversation, offered only when `subagent_available()`
+  (a subagent factory is registered — see `register_subagent_factory_for` in `main.rs`; on-device
+  registers a `None`-returning factory since onde has a single shared history). A subagent's
+  toolset is a hard-gated read-only allow-list (`SUBAGENT_TOOL_NAMES`) that is never expanded by a
+  configurable subagent type (see `src/subagents.rs`) — only ever narrowed — so a `.sigit/agents/*.md`
+  file can't grant itself `edit_file`/`run_command` and bypass the permission system. Also owns
+  `web_search`: a thin native wrapper around the official MCP server's Brave-Search-backed
+  `web_search` tool (`mcp__sigit__web_search`, implemented server-side in `sigit-si`'s
+  `WebSearchService` + `Mcp::Tools::WebSearch`), offered only when that MCP tool was actually
+  discovered (i.e. the user is signed in to siGit Code Cloud — see `web_search_available`).
+  Wrapping it natively rather than leaving it as a raw `mcp__*` tool matters for two reasons:
+  `permissions::classify` treats every `mcp__*` tool as mutating (an "ask" prompt on every call),
+  while `web_search` is read-only like `read_website`; and the raw delegate name is filtered out
+  of the assembled tool list (`is_web_search_delegate`) so the model sees one clean option, not
+  two names for the same tool. Execution still forwards verbatim to `mcp::call_tool` — no second
+  HTTP/JSON-RPC implementation.
 - **`src/skills.rs`** — [Agent Skills](https://agentskills.io) support. Discovers skill
   folders (each with a `SKILL.md`: YAML frontmatter `name` + `description`, then Markdown
   instructions) from `.sigit/skills/` and `.claude/skills/` in the cwd, `$SIGIT_CONFIG_DIR/skills/`,
@@ -119,6 +135,31 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   calls `skill` with a name) loads the full `SKILL.md` body. The `skill` tool is appended in the
   `*_as_specs`/`build_tool_specs` layer (not in `all_tools()`) so its description can be dynamic,
   and only when at least one skill exists.
+- **`src/commands.rs`** — user-defined slash commands. Discovers Markdown files (each an
+  optional YAML frontmatter block — `description`, `argument-hint` — followed by a prompt-template
+  body) from `.sigit/commands/` and `.claude/commands/` in the cwd, `$SIGIT_CONFIG_DIR/commands/`,
+  and `~/.claude/commands/`. A subdirectory namespaces the command with `:`
+  (`.sigit/commands/git/commit.md` → `/git:commit`). Unlike skills there's no tool-call
+  indirection: invoking one works exactly like the built-in `/init` — `commands::render`
+  substitutes `$ARGUMENTS`/`$1..$9` in the body against whatever followed the command on the
+  input line, and the result is fed to the model as a normal turn through the ordinary tools and
+  permission checks. Resolution happens where each surface (`main.rs`/`chat.rs`) already
+  special-cases `/init`: an unrecognized slash command is tried against `commands::resolve_command`
+  before falling back to "unknown command". A custom command sharing a name with a built-in is
+  unreachable (built-ins match first in `parse_slash`) and is skipped when advertised to ACP
+  clients, with a warning logged.
+- **`src/subagents.rs`** — configurable subagent types for the `task` tool. Discovers Markdown
+  files (YAML frontmatter `name` + `description`, optional comma-separated `tools:` allow-list,
+  then a Markdown body that becomes the subagent's system prompt) from `.sigit/agents/` and
+  `.claude/agents/` in the cwd, `$SIGIT_CONFIG_DIR/agents/`, and `~/.claude/agents/`. Passing a
+  type's `name` as `task`'s `subagent_type` argument swaps in that system prompt and, if `tools:`
+  is set, narrows the offered toolset to its *intersection* with `SUBAGENT_TOOL_NAMES` — the
+  security-relevant narrowing logic lives in `tools.rs` next to that constant, not here; this
+  module only discovers and parses files. `SubagentFactory` (in `tools.rs`) takes the resolved
+  system prompt per call rather than baking one in at registration, so a single registered
+  factory serves both the default research subagent and every configured type.
+- **`src/frontmatter.rs`** — shared "YAML frontmatter + Markdown body" parsing used by both
+  `src/skills.rs` (`SKILL.md`) and `src/commands.rs` (`.sigit/commands/*.md`).
 - **`src/mcp.rs`** — [Model Context Protocol](https://modelcontextprotocol.io) *client*. Two
   transports: **Streamable HTTP** (one JSON-RPC POST endpoint, `url` in `mcp.toml`; replies are
   `application/json` or SSE) and **stdio** (`command` + optional `args`/`[server.env]` in
@@ -131,12 +172,20 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   both read it; `/reload` does *not* re-run it, so config changes need a restart. stdio children
   live for the process; a dead child fails calls with an in-band error string (no auto-restart).
   Tools are namespaced `mcp__<server>__<tool>`, appended in the `*_as_specs`/`build_tool_specs`
-  layer and routed in `tools::execute_tool` via `mcp::is_mcp_tool`. The official server
-  (`<cloud>/mcp`, default `https://sigit.si/api/v1/mcp`) is baked in (always HTTP) and authed
-  with the cloud session token; extra servers live in `mcp.toml` (global
+  layer and routed in `tools::execute_tool` via `mcp::is_mcp_tool`. Two servers are baked in:
+  the official server (`<cloud>/mcp`, default `https://sigit.si/api/v1/mcp`, always HTTP, authed
+  with the cloud session token) and the smbCloud CLI server (`smb --mcp`, stdio, added only when
+  the `smb` binary is on `PATH`; opt out with `smbcloud = false` in `mcp.toml` or
+  `SIGIT_MCP_SMBCLOUD=off`). A user-defined entry named `sigit` or `smbcloud` overrides the
+  corresponding baked-in one. Extra servers live in `mcp.toml` (global
   `$SIGIT_CONFIG_DIR/mcp.toml` and project-local `.sigit/mcp.toml`). The stdio path is covered by
   `tests/mcp_stdio.rs`, driven by the test-only `src/bin/mcp_stdio_stub.rs` helper binary
-  (excluded from the published crate via `exclude` in `Cargo.toml`).
+  (excluded from the published crate via `exclude` in `Cargo.toml`). The baked-in official
+  server is *also* listed in the public MCP Registry as `si.sigit/sigit` — a **remote**
+  Streamable-HTTP listing (`server.json` at the repo root, published by
+  `release-mcp-registry.yml`). Because it's a remote server, the registry's URL-match rule
+  forces a domain namespace (`si.sigit` ↔ `sigit.si`) verified by a DNS TXT record, not the
+  GitHub-OIDC scheme `smbcloud-cli` uses for its package listing.
 - **`src/permissions.rs`** — tool permission policy. Every tool call passes through
   `decision_for` before executing: read-only tools always run; mutating tools (and all
   `mcp__*`/unknown tools) are governed by, in order: per-session plan mode (`/plan` — deny all
@@ -165,12 +214,14 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
 - **`src/credentials.rs`** — local session-token store (TOML, `0600` on Unix).
 - **`src/models.rs`** — model-picker types shared across platforms.
 
-Slash commands (`/help`, `/models`, `/skills`, `/mcp`, `/login`, `/logout`, `/whoami`, `/reload`,
-`/plan`, `/permissions`, `/init`, `/clear`, `/status`) are advertised via `advertise_commands` in
-`main.rs` and handled in both the TUI and ACP sessions. `/init` is special: instead of replying
-directly it substitutes `instructions::INIT_PROMPT` for the user text and runs a normal agent
-turn that explores the repo and writes (or improves) `AGENTS.md` through the ordinary tools and
-permission checks.
+Slash commands (`/help`, `/models`, `/skills`, `/agents`, `/commands`, `/mcp`, `/login`, `/logout`,
+`/whoami`, `/reload`, `/plan`, `/permissions`, `/init`, `/clear`, `/status`) are advertised via
+`advertise_commands` in `main.rs` and handled in both the TUI and ACP sessions. `/init` is
+special: instead of replying directly it substitutes `instructions::INIT_PROMPT` for the user
+text and runs a normal agent turn that explores the repo and writes (or improves) `AGENTS.md`
+through the ordinary tools and permission checks. User-defined commands (see `src/commands.rs`)
+get the same treatment via the `SlashCommand::Unknown` fallback path, so anyone can add their own
+`/name` commands without touching the built-in command list.
 
 ## Model cache (macOS)
 
@@ -190,7 +241,8 @@ verbosity with `RUST_LOG`.
 
 `OPENAI_BASE_URL` / `OPENAI_API_KEY` (provider override), `SIGIT_API_URL` (account API base,
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
-`SIGIT_MODEL`, `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
+`SIGIT_MODEL`, `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
+smbCloud CLI server), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
 server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
 mutating tools; the escape hatch for clients without permission-request support),
 `HF_HOME` / `HF_HUB_CACHE`, `RUST_LOG`.

{sigit_code-1.4.1 → sigit_code-1.5.1}/CHANGELOG.md

@@ -1,5 +1,83 @@
 # Changelog
 
+## 1.5.1
+
+Makes siGit Code work as an Xcode custom agent, and updates the Onde SDK.
+
+### What changed
+
+- Xcode can now run siGit Code as a custom agent. Point it at the binary with
+  `--acp` as the argument, and that explicit mode loads the selected on-device
+  model on the first prompt, since Xcode's chat has no equivalent of `/load`.
+  The README covers the setup, including wiring up `xcrun mcpbridge` in
+  `mcp.toml` so the agent can use Xcode's build, test, and project tools
+- MCP calls to the `xcode` server time out after 30 seconds instead of 120, so
+  a request Xcode cannot service no longer leaves the prompt looking busy for
+  two minutes. String JSON-RPC ids from the bridge are handled too
+- The agent stops repeating itself: a tool call made three times with identical
+  arguments now forces a text reply instead of looping
+- Onde SDK bumped to 1.2.2
+- The registry listing in `server.json` matches what sigit.si publishes
+
+## 1.5.0
+
+Opens the agent up to user extension: lifecycle hooks, custom slash commands,
+and configurable subagent types. Also adds web search, a Repo tab in the TUI,
+and a baked-in smbCloud MCP server.
+
+### What changed
+
+- Hooks let you run shell commands at three points in the agent's lifecycle:
+  `session_start`, `pre_tool_use`, and `post_tool_use`, configured under
+  `[hooks]` in `settings.toml`. Commands get context through variable
+  substitution (`{cwd}`, `{tool_name}`, `{tool_result_len}`) and run in the
+  session working directory. A hook that fails is logged and the session
+  continues; a hook that hangs is killed on a timeout, along with its whole
+  process group
+- User-defined slash commands: drop a Markdown file in `.sigit/commands/` or
+  `.claude/commands/` (or the personal `$SIGIT_CONFIG_DIR/commands/` and
+  `~/.claude/commands/`) with optional `description` and `argument-hint`
+  frontmatter, and the body becomes a prompt template. `$ARGUMENTS` takes the
+  whole argument string and `$1`..`$9` the positional words. A subdirectory
+  namespaces the command with `:`, so `.sigit/commands/git/commit.md` becomes
+  `/git:commit`. They run as ordinary agent turns through the usual tools and
+  permission checks, and are advertised to ACP clients like Zed. `/commands`
+  lists what was discovered
+- Configurable subagent types for the `task` tool: a Markdown file in
+  `.sigit/agents/` or `.claude/agents/` with `name`, `description`, and an
+  optional `tools:` allow-list, whose body becomes that subagent's system
+  prompt. Pass its name as `subagent_type` to swap the prompt in. The
+  `tools:` list can only narrow the subagent's read-only ceiling, never widen
+  it, so a config file cannot grant itself `edit_file` or `run_command` and
+  route around the permission system. `/agents` lists the discovered types
+- New `web_search` tool, backed by the Brave-Search-backed search on siGit
+  Code Cloud's MCP server. It is offered only when you are signed in, and it
+  is classified read-only, so searching never triggers a permission prompt
+- The TUI gains a Repo tab, shown when the session's `origin` remote points at
+  the sigit.si host. It lists issues and pull requests fetched through the
+  official MCP server: Up and Down select, Enter opens a scrollable detail,
+  `i`, `p`, Left and Right switch sections, `r` refreshes. The tab is hidden
+  and skipped in the cycle for any other remote
+- The smbCloud CLI's stdio MCP server (`smb --mcp`) is now baked in, so
+  smbCloud project and deployment tools work with no `mcp.toml` setup. It is
+  added only when the `smb` binary is on `PATH`, its read-only tools (`me`,
+  `deployments`, `project_list`, `project_show`) skip permission prompts, and
+  you can opt out with `smbcloud = false` in `mcp.toml` or
+  `SIGIT_MCP_SMBCLOUD=off`
+- siGit Code Cloud's MCP server is now listed in the public MCP Registry as
+  `si.sigit/sigit`, published from `server.json` at the repository root
+
+### Fixes
+
+- An explicit `deny` rule now applies to read-only first-party tools instead
+  of being skipped
+- A subagent type whose `tools:` list resolves to an empty set is rejected
+  rather than producing a subagent with no tools
+- Command templates render in a single substitution pass, so an argument that
+  contains something like `$1` is no longer re-substituted
+- Frontmatter is stripped with the same leniency it is parsed with
+- The Repo tab's detail view no longer shows stale data after a refresh
+
 ## 1.4.1
 
 Two small fixes: correct co-author attribution and a Homebrew tap fix.

{sigit_code-1.4.1 → sigit_code-1.5.1}/CLAUDE.md

@@ -110,7 +110,23 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   spec list (`all_tools`) and the execute `match` (`execute_tool`). `run_command` also enforces
   commit attribution: when a command creates a new commit that lacks the
   `Co-Authored-By: siGit Code` trailer (`COMMIT_CO_AUTHOR_TRAILER`), it amends the trailer in —
-  unless the commit already exists on a remote, which is never rewritten.
+  unless the commit already exists on a remote, which is never rewritten. Also owns the `task`
+  tool: a nested agent loop in a fresh conversation, offered only when `subagent_available()`
+  (a subagent factory is registered — see `register_subagent_factory_for` in `main.rs`; on-device
+  registers a `None`-returning factory since onde has a single shared history). A subagent's
+  toolset is a hard-gated read-only allow-list (`SUBAGENT_TOOL_NAMES`) that is never expanded by a
+  configurable subagent type (see `src/subagents.rs`) — only ever narrowed — so a `.sigit/agents/*.md`
+  file can't grant itself `edit_file`/`run_command` and bypass the permission system. Also owns
+  `web_search`: a thin native wrapper around the official MCP server's Brave-Search-backed
+  `web_search` tool (`mcp__sigit__web_search`, implemented server-side in `sigit-si`'s
+  `WebSearchService` + `Mcp::Tools::WebSearch`), offered only when that MCP tool was actually
+  discovered (i.e. the user is signed in to siGit Code Cloud — see `web_search_available`).
+  Wrapping it natively rather than leaving it as a raw `mcp__*` tool matters for two reasons:
+  `permissions::classify` treats every `mcp__*` tool as mutating (an "ask" prompt on every call),
+  while `web_search` is read-only like `read_website`; and the raw delegate name is filtered out
+  of the assembled tool list (`is_web_search_delegate`) so the model sees one clean option, not
+  two names for the same tool. Execution still forwards verbatim to `mcp::call_tool` — no second
+  HTTP/JSON-RPC implementation.
 - **`src/skills.rs`** — [Agent Skills](https://agentskills.io) support. Discovers skill
   folders (each with a `SKILL.md`: YAML frontmatter `name` + `description`, then Markdown
   instructions) from `.sigit/skills/` and `.claude/skills/` in the cwd, `$SIGIT_CONFIG_DIR/skills/`,
@@ -119,6 +135,31 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   calls `skill` with a name) loads the full `SKILL.md` body. The `skill` tool is appended in the
   `*_as_specs`/`build_tool_specs` layer (not in `all_tools()`) so its description can be dynamic,
   and only when at least one skill exists.
+- **`src/commands.rs`** — user-defined slash commands. Discovers Markdown files (each an
+  optional YAML frontmatter block — `description`, `argument-hint` — followed by a prompt-template
+  body) from `.sigit/commands/` and `.claude/commands/` in the cwd, `$SIGIT_CONFIG_DIR/commands/`,
+  and `~/.claude/commands/`. A subdirectory namespaces the command with `:`
+  (`.sigit/commands/git/commit.md` → `/git:commit`). Unlike skills there's no tool-call
+  indirection: invoking one works exactly like the built-in `/init` — `commands::render`
+  substitutes `$ARGUMENTS`/`$1..$9` in the body against whatever followed the command on the
+  input line, and the result is fed to the model as a normal turn through the ordinary tools and
+  permission checks. Resolution happens where each surface (`main.rs`/`chat.rs`) already
+  special-cases `/init`: an unrecognized slash command is tried against `commands::resolve_command`
+  before falling back to "unknown command". A custom command sharing a name with a built-in is
+  unreachable (built-ins match first in `parse_slash`) and is skipped when advertised to ACP
+  clients, with a warning logged.
+- **`src/subagents.rs`** — configurable subagent types for the `task` tool. Discovers Markdown
+  files (YAML frontmatter `name` + `description`, optional comma-separated `tools:` allow-list,
+  then a Markdown body that becomes the subagent's system prompt) from `.sigit/agents/` and
+  `.claude/agents/` in the cwd, `$SIGIT_CONFIG_DIR/agents/`, and `~/.claude/agents/`. Passing a
+  type's `name` as `task`'s `subagent_type` argument swaps in that system prompt and, if `tools:`
+  is set, narrows the offered toolset to its *intersection* with `SUBAGENT_TOOL_NAMES` — the
+  security-relevant narrowing logic lives in `tools.rs` next to that constant, not here; this
+  module only discovers and parses files. `SubagentFactory` (in `tools.rs`) takes the resolved
+  system prompt per call rather than baking one in at registration, so a single registered
+  factory serves both the default research subagent and every configured type.
+- **`src/frontmatter.rs`** — shared "YAML frontmatter + Markdown body" parsing used by both
+  `src/skills.rs` (`SKILL.md`) and `src/commands.rs` (`.sigit/commands/*.md`).
 - **`src/mcp.rs`** — [Model Context Protocol](https://modelcontextprotocol.io) *client*. Two
   transports: **Streamable HTTP** (one JSON-RPC POST endpoint, `url` in `mcp.toml`; replies are
   `application/json` or SSE) and **stdio** (`command` + optional `args`/`[server.env]` in
@@ -131,12 +172,20 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   both read it; `/reload` does *not* re-run it, so config changes need a restart. stdio children
   live for the process; a dead child fails calls with an in-band error string (no auto-restart).
   Tools are namespaced `mcp__<server>__<tool>`, appended in the `*_as_specs`/`build_tool_specs`
-  layer and routed in `tools::execute_tool` via `mcp::is_mcp_tool`. The official server
-  (`<cloud>/mcp`, default `https://sigit.si/api/v1/mcp`) is baked in (always HTTP) and authed
-  with the cloud session token; extra servers live in `mcp.toml` (global
+  layer and routed in `tools::execute_tool` via `mcp::is_mcp_tool`. Two servers are baked in:
+  the official server (`<cloud>/mcp`, default `https://sigit.si/api/v1/mcp`, always HTTP, authed
+  with the cloud session token) and the smbCloud CLI server (`smb --mcp`, stdio, added only when
+  the `smb` binary is on `PATH`; opt out with `smbcloud = false` in `mcp.toml` or
+  `SIGIT_MCP_SMBCLOUD=off`). A user-defined entry named `sigit` or `smbcloud` overrides the
+  corresponding baked-in one. Extra servers live in `mcp.toml` (global
   `$SIGIT_CONFIG_DIR/mcp.toml` and project-local `.sigit/mcp.toml`). The stdio path is covered by
   `tests/mcp_stdio.rs`, driven by the test-only `src/bin/mcp_stdio_stub.rs` helper binary
-  (excluded from the published crate via `exclude` in `Cargo.toml`).
+  (excluded from the published crate via `exclude` in `Cargo.toml`). The baked-in official
+  server is *also* listed in the public MCP Registry as `si.sigit/sigit` — a **remote**
+  Streamable-HTTP listing (`server.json` at the repo root, published by
+  `release-mcp-registry.yml`). Because it's a remote server, the registry's URL-match rule
+  forces a domain namespace (`si.sigit` ↔ `sigit.si`) verified by a DNS TXT record, not the
+  GitHub-OIDC scheme `smbcloud-cli` uses for its package listing.
 - **`src/permissions.rs`** — tool permission policy. Every tool call passes through
   `decision_for` before executing: read-only tools always run; mutating tools (and all
   `mcp__*`/unknown tools) are governed by, in order: per-session plan mode (`/plan` — deny all
@@ -165,12 +214,14 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
 - **`src/credentials.rs`** — local session-token store (TOML, `0600` on Unix).
 - **`src/models.rs`** — model-picker types shared across platforms.
 
-Slash commands (`/help`, `/models`, `/skills`, `/mcp`, `/login`, `/logout`, `/whoami`, `/reload`,
-`/plan`, `/permissions`, `/init`, `/clear`, `/status`) are advertised via `advertise_commands` in
-`main.rs` and handled in both the TUI and ACP sessions. `/init` is special: instead of replying
-directly it substitutes `instructions::INIT_PROMPT` for the user text and runs a normal agent
-turn that explores the repo and writes (or improves) `AGENTS.md` through the ordinary tools and
-permission checks.
+Slash commands (`/help`, `/models`, `/skills`, `/agents`, `/commands`, `/mcp`, `/login`, `/logout`,
+`/whoami`, `/reload`, `/plan`, `/permissions`, `/init`, `/clear`, `/status`) are advertised via
+`advertise_commands` in `main.rs` and handled in both the TUI and ACP sessions. `/init` is
+special: instead of replying directly it substitutes `instructions::INIT_PROMPT` for the user
+text and runs a normal agent turn that explores the repo and writes (or improves) `AGENTS.md`
+through the ordinary tools and permission checks. User-defined commands (see `src/commands.rs`)
+get the same treatment via the `SlashCommand::Unknown` fallback path, so anyone can add their own
+`/name` commands without touching the built-in command list.
 
 ## Model cache (macOS)
 
@@ -190,7 +241,8 @@ verbosity with `RUST_LOG`.
 
 `OPENAI_BASE_URL` / `OPENAI_API_KEY` (provider override), `SIGIT_API_URL` (account API base,
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
-`SIGIT_MODEL`, `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
+`SIGIT_MODEL`, `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
+smbCloud CLI server), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
 server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
 mutating tools; the escape hatch for clients without permission-request support),
 `HF_HOME` / `HF_HUB_CACHE`, `RUST_LOG`.