sigit-code 1.5.12__tar.gz → 1.6.0__tar.gz

{sigit_code-1.5.12 → sigit_code-1.6.0}/.agents/AGENTS.md

@@ -225,6 +225,17 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   it's a remote server, the registry's URL-match rule forces a domain namespace (`si.sigit` ↔
   `sigit.si`) verified by a DNS TXT record, not the GitHub-OIDC scheme `smbcloud-cli` uses for its
   package listing.
+  Separate from all of the above are the servers an ACP client passes in `mcpServers` on
+  `session/new`, `session/load` and `session/fork`. ACP requires agents to connect to the stdio
+  ones, and they belong to the session that named them, so they cannot live in the startup
+  global: `connect_session_servers` returns a `SessionServers` that `main.rs` keeps on
+  `SessionState` and installs with `set_session_servers` whenever a session becomes live, the
+  same way it swaps the roots. `tool_specs`, `call_tool` and `/mcp` read the startup servers and
+  then the live session's. A client-supplied server whose name is already taken by a startup
+  server is not connected, since both would claim the same `mcp__<server>__` prefix. Streamable
+  HTTP entries are connected too, with the URL and headers the client sent, because
+  `handle_initialize` advertises `mcpCapabilities.http`. SSE is not advertised (the MCP spec
+  deprecated it), so a conforming client never sends one and a stray entry is skipped.
 - **`src/permissions.rs`** — tool permission policy. Every tool call passes through
   `decision_for` before executing: read-only tools always run; mutating tools (and all
   `mcp__*`/unknown tools) are governed by, in order: per-session plan mode (`/plan` — deny all
@@ -261,7 +272,8 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   read another session's roots from the global. Project-local
   discovery reads it: skills, slash commands, subagent types, and instruction files all scan
   every root. MCP is deliberately not on that list — `mcp::init` runs once at startup, before
-  any session exists, so a second root's `.sigit/mcp.toml` has nobody to tell.
+  any session exists, so a second root's `.sigit/mcp.toml` has nobody to tell. (The servers a
+  client names in `mcpServers` are a different thing and are per session; see `src/mcp.rs`.)
 - **`src/chat.rs`** — the Unix-only ratatui TUI. Loading-spinner phase then chat; uses
   `tokio::select!` to multiplex terminal events with streaming tokens.
 - **`src/headless.rs`** — non-interactive `sigit run` execution for scripts, CI, and Factory
@@ -376,13 +388,20 @@ Three of these need credentials or a one-time manual step before they work:
 
 - Scoop needs a `getsigit/scoop-bucket` repo and a `SCOOP_BUCKET_TOKEN` secret, mirroring the
   Homebrew tap setup.
-- winget needs a `WINGET_TOKEN` (PAT with `public_repo`) so `wingetcreate` can fork
-  `microsoft/winget-pkgs`. It is passed as `WINGET_CREATE_GITHUB_TOKEN` rather than `--token`,
-  which wingetcreate warns can leak the token into logs. `wingetcreate update` only works on a
-  package that already exists in `microsoft/winget-pkgs`, so the workflow checks the
-  `manifests/g/getSigit/siGitCode` path first and falls back to rendering
-  `packaging/winget/*.yaml.in` and running `wingetcreate submit` for a first submission. That
-  fallback runs once, then every later release takes the `update` path.
+- winget needs a `WINGET_TOKEN` (PAT with `public_repo` scope) so `wingetcreate` can fork
+  `microsoft/winget-pkgs` and open the manifest PR. It is passed as
+  `WINGET_CREATE_GITHUB_TOKEN` rather than `--token`, which wingetcreate warns can leak the
+  token into logs. `wingetcreate update` only works on a package that already exists in
+  `microsoft/winget-pkgs`, so the workflow checks the `manifests/g/getSigit/siGitCode` path
+  first and falls back to rendering `packaging/winget/*.yaml.in` and running
+  `wingetcreate submit` for a first submission. That fallback runs once, then every later
+  release takes the `update` path. Two non-obvious things in the update path: the `--urls`
+  arguments carry a trailing `|x64` / `|arm64` suffix that tells wingetcreate which installer
+  entry each URL replaces — without it, wingetcreate guesses from the file name, and
+  "sigit-win-amd64.exe" is not a spelling it recognises; and the first-submission render
+  uppercases the SHA256 (`tr '[:lower:]' '[:upper:]'`) to match the community validation
+  pipeline, which writes 64-hex checksums uppercase. The update path also passes
+  `--release-date`, `--release-notes-url`, `--submit`, and `--no-open` explicitly.
 - The AUR needs `AUR_USERNAME`, `AUR_EMAIL`, and `AUR_SSH_PRIVATE_KEY`. It publishes `sigit-bin`
   (a prebuilt binary) so Arch users are not compiling the on-device inference stack to install a
   CLI.

{sigit_code-1.5.12/.claude → sigit_code-1.6.0/.agents}/skills/agent-client-protocol/SKILL.md

@@ -11,7 +11,7 @@ ACP is a JSON-RPC 2.0 protocol over **stdio** for integrating AI coding agents
 with editors (Zed, JetBrains, Neovim, etc.). The agent runs as a subprocess;
 the editor is the client. Communication is newline-delimited JSON on stdin/stdout.
 
-Crate: `agent-client-protocol = "0.13"` (siGit pins 0.13.0 in `Cargo.lock`)
+Crate: `agent-client-protocol = "2.2"` (siGit pins 2.2.0 in `Cargo.lock`)
 Docs:  https://docs.rs/agent-client-protocol
 Spec:  https://agentclientprotocol.com
 
@@ -21,6 +21,11 @@ Spec:  https://agentclientprotocol.com
 > handler receives a `ConnectionTo<Client>` (`cx`) you use to send notifications
 > and spawn tasks — so the old mpsc "circular dependency" pattern is gone.
 
+> **SDK 2.x is not protocol v2.** The 2.x crate still speaks ACP protocol v1 by
+> default, which is what siGit and Zed use (`ProtocolVersion::V1`). The draft v2
+> protocol (`Agent.v2()`, `V2ConnectionTo`) sits behind the `unstable_protocol_v2`
+> feature and siGit does not enable it.
+
 siGit's entire ACP server lives in `src/main.rs` (`run_acp_server`, the
 `SiGitAgent` struct, and its `handle_*` methods). Read it alongside this skill.
 
@@ -30,10 +35,8 @@ siGit's entire ACP server lives in `src/main.rs` (`run_acp_server`, the
 
 ```toml
 [dependencies]
-agent-client-protocol = { version = "0.13", features = [
-    "unstable_session_fork",                   # session/fork support
-    "unstable_session_additional_directories", # additional_directories on session requests
-    "unstable_auth_methods",                   # AuthMethod::Agent etc.
+agent-client-protocol = { version = "2.2", features = [
+    "unstable_session_fork", # session/fork support
 ] }
 async-trait = "0.1"
 tokio       = { version = "1", features = ["rt", "rt-multi-thread", "macros", "io-std", "io-util", "sync", "time"] }
@@ -42,9 +45,12 @@ futures     = "0.3"
 uuid        = { version = "1", features = ["v4"] }
 ```
 
-The `unstable_*` features gate real types/methods (`ForkSessionRequest`,
-`additional_directories`, `AuthMethod::Agent`). Without them the corresponding
-APIs don't exist and you'll get "no variant/method" errors.
+The `unstable_*` features gate real types/methods (`ForkSessionRequest`).
+Without them the corresponding APIs don't exist and you'll get "no
+variant/method" errors. `additional_directories` and `AuthMethod::Agent` used
+to need `unstable_session_additional_directories` and `unstable_auth_methods`;
+both are stable in 2.x and those feature names no longer exist, so listing them
+is a Cargo resolution error.
 
 ---
 
@@ -556,10 +562,9 @@ Editor                                Agent
 8. **Never write to stdout except JSON-RPC** — log to stderr; in TTY mode siGit
    redirects fds to `$TMPDIR/sigit.log`. Any stray `println!` or native library
    stdout write corrupts the wire.
-9. **Unstable features gate real types** — `unstable_session_fork`,
-   `unstable_session_additional_directories`, `unstable_auth_methods` must be on
-   in `Cargo.toml` or `ForkSessionRequest`, `additional_directories`, and
-   `AuthMethod::Agent` won't exist.
+9. **Unstable features gate real types** — `unstable_session_fork` must be on
+   in `Cargo.toml` or `ForkSessionRequest` won't exist. `additional_directories`
+   and `AuthMethod::Agent` are stable in 2.x and need no feature.
 10. **Zed re-fires the last config selection on connect** — make
     `setConfigOption` a no-op when the requested model is already active, and
     never start a model switch while a startup load is still in flight (GPU OOM).

{sigit_code-1.5.12 → sigit_code-1.6.0}/.agents/skills/sigit-code-release/SKILL.md

@@ -38,6 +38,7 @@ Use this skill when preparing a release for this repository.
 - The GitHub release body is generated, not hand-written: `release-github.yml`'s release job checks out the tag, awk-extracts the `## <version>` section from `CHANGELOG.md` (a missing section is a hard failure), appends a full-changelog link and a `sigit.si/code` footnote, and publishes it via `body_path: release_notes.md`. The only file a release-prep change needs to touch is `CHANGELOG.md` — never edit release notes in the GitHub UI, because the next tag push would overwrite them.
 - npm and NuGet publish via OIDC trusted publishing — neither has a stored token in the repo. On npm this is configured per package (each `@getsigit/*` name has a trusted publisher pointing at `release-npm.yml`), so a new package needs the same setup before its first publish will work. OIDC requires npm >= 11.5.1 and Node >= 22.14.0.
 - The NuGet package (`SiGit.Code`, `dotnet tool install --global SiGit.Code`) bundles all six platform binaries under `native/<os>-<arch>/` behind a managed shim, rather than shipping one package per platform like npm/PyPI. Watch the nuget.org 250 MB package-size limit if it ever grows.
+- The winget channel (`release-winget.yml`) needs a `WINGET_TOKEN` secret that is a **classic PAT** with `public_repo` scope — not a fine-grained PAT. wingetcreate forks `microsoft/winget-pkgs` on first use and submits a PR from that fork; a fine-grained PAT scoped to `getsigit/sigit` cannot fork a repo outside its scope and every release fails with a 403/404 on the fork step. The token is passed as `WINGET_CREATE_GITHUB_TOKEN` (not `--token`) so it doesn't leak into logs. `wingetcreate update` only works on a package that already exists in `microsoft/winget-pkgs`, so the workflow checks `manifests/g/getSigit/siGitCode` first and falls back to `wingetcreate submit` with `packaging/winget/*.yaml.in` for the first release; every later release takes the `update` path. If a winget release fails with a fork/permission error, check the `WINGET_TOKEN` secret type before re-dispatching.
 - The baked-in official MCP server is separately listed in the public MCP Registry as `si.sigit/sigit` (`release-mcp-registry.yml`, driven by `server.json` at the repo root). It's a remote Streamable-HTTP listing, so it's verified by a DNS TXT record on the `sigit.si` domain rather than the GitHub-OIDC scheme used for package listings.
 
 ## Git release flow
@@ -84,3 +85,4 @@ Pushing the `v*.*.*` tag is what fires every release workflow, so create and pus
 - Package names, install commands, and branding stay consistent across npm, PyPI, crates.io, Homebrew, NuGet, Scoop, winget, AUR, and the `.deb`/`.rpm` packages.
 - Every release asset (including the new `.deb`/`.rpm`/raw binaries consumed by Scoop, winget, and AUR) has a matching `.sha256` sidecar.
 - Any known release limitations are called out explicitly, including a dispatch failure in `release-scoop`/`release-winget`/`release-aur` (non-fatal — logged as a warning by `release-github.yml`) versus a hard failure in a directly tag-triggered workflow like `release-nuget` or `release-mcp-registry`.
+- The `WINGET_TOKEN` secret is a classic PAT with `public_repo` scope (not fine-grained), so wingetcreate can fork `microsoft/winget-pkgs`. If a winget release fails on the fork step, verify the token type before re-dispatching.

{sigit_code-1.5.12/.agents → sigit_code-1.6.0/.claude}/skills/agent-client-protocol/SKILL.md

@@ -11,7 +11,7 @@ ACP is a JSON-RPC 2.0 protocol over **stdio** for integrating AI coding agents
 with editors (Zed, JetBrains, Neovim, etc.). The agent runs as a subprocess;
 the editor is the client. Communication is newline-delimited JSON on stdin/stdout.
 
-Crate: `agent-client-protocol = "0.13"` (siGit pins 0.13.0 in `Cargo.lock`)
+Crate: `agent-client-protocol = "2.2"` (siGit pins 2.2.0 in `Cargo.lock`)
 Docs:  https://docs.rs/agent-client-protocol
 Spec:  https://agentclientprotocol.com
 
@@ -21,6 +21,11 @@ Spec:  https://agentclientprotocol.com
 > handler receives a `ConnectionTo<Client>` (`cx`) you use to send notifications
 > and spawn tasks — so the old mpsc "circular dependency" pattern is gone.
 
+> **SDK 2.x is not protocol v2.** The 2.x crate still speaks ACP protocol v1 by
+> default, which is what siGit and Zed use (`ProtocolVersion::V1`). The draft v2
+> protocol (`Agent.v2()`, `V2ConnectionTo`) sits behind the `unstable_protocol_v2`
+> feature and siGit does not enable it.
+
 siGit's entire ACP server lives in `src/main.rs` (`run_acp_server`, the
 `SiGitAgent` struct, and its `handle_*` methods). Read it alongside this skill.
 
@@ -30,10 +35,8 @@ siGit's entire ACP server lives in `src/main.rs` (`run_acp_server`, the
 
 ```toml
 [dependencies]
-agent-client-protocol = { version = "0.13", features = [
-    "unstable_session_fork",                   # session/fork support
-    "unstable_session_additional_directories", # additional_directories on session requests
-    "unstable_auth_methods",                   # AuthMethod::Agent etc.
+agent-client-protocol = { version = "2.2", features = [
+    "unstable_session_fork", # session/fork support
 ] }
 async-trait = "0.1"
 tokio       = { version = "1", features = ["rt", "rt-multi-thread", "macros", "io-std", "io-util", "sync", "time"] }
@@ -42,9 +45,12 @@ futures     = "0.3"
 uuid        = { version = "1", features = ["v4"] }
 ```
 
-The `unstable_*` features gate real types/methods (`ForkSessionRequest`,
-`additional_directories`, `AuthMethod::Agent`). Without them the corresponding
-APIs don't exist and you'll get "no variant/method" errors.
+The `unstable_*` features gate real types/methods (`ForkSessionRequest`).
+Without them the corresponding APIs don't exist and you'll get "no
+variant/method" errors. `additional_directories` and `AuthMethod::Agent` used
+to need `unstable_session_additional_directories` and `unstable_auth_methods`;
+both are stable in 2.x and those feature names no longer exist, so listing them
+is a Cargo resolution error.
 
 ---
 
@@ -556,10 +562,9 @@ Editor                                Agent
 8. **Never write to stdout except JSON-RPC** — log to stderr; in TTY mode siGit
    redirects fds to `$TMPDIR/sigit.log`. Any stray `println!` or native library
    stdout write corrupts the wire.
-9. **Unstable features gate real types** — `unstable_session_fork`,
-   `unstable_session_additional_directories`, `unstable_auth_methods` must be on
-   in `Cargo.toml` or `ForkSessionRequest`, `additional_directories`, and
-   `AuthMethod::Agent` won't exist.
+9. **Unstable features gate real types** — `unstable_session_fork` must be on
+   in `Cargo.toml` or `ForkSessionRequest` won't exist. `additional_directories`
+   and `AuthMethod::Agent` are stable in 2.x and need no feature.
 10. **Zed re-fires the last config selection on connect** — make
     `setConfigOption` a no-op when the requested model is already active, and
     never start a model switch while a startup load is still in flight (GPU OOM).

{sigit_code-1.5.12 → sigit_code-1.6.0}/.claude/skills/sigit-code-release/SKILL.md

@@ -38,6 +38,7 @@ Use this skill when preparing a release for this repository.
 - The GitHub release body is generated, not hand-written: `release-github.yml`'s release job checks out the tag, awk-extracts the `## <version>` section from `CHANGELOG.md` (a missing section is a hard failure), appends a full-changelog link and a `sigit.si/code` footnote, and publishes it via `body_path: release_notes.md`. The only file a release-prep change needs to touch is `CHANGELOG.md` — never edit release notes in the GitHub UI, because the next tag push would overwrite them.
 - npm and NuGet publish via OIDC trusted publishing — neither has a stored token in the repo. On npm this is configured per package (each `@getsigit/*` name has a trusted publisher pointing at `release-npm.yml`), so a new package needs the same setup before its first publish will work. OIDC requires npm >= 11.5.1 and Node >= 22.14.0.
 - The NuGet package (`SiGit.Code`, `dotnet tool install --global SiGit.Code`) bundles all six platform binaries under `native/<os>-<arch>/` behind a managed shim, rather than shipping one package per platform like npm/PyPI. Watch the nuget.org 250 MB package-size limit if it ever grows.
+- The winget channel (`release-winget.yml`) needs a `WINGET_TOKEN` secret that is a **classic PAT** with `public_repo` scope — not a fine-grained PAT. wingetcreate forks `microsoft/winget-pkgs` on first use and submits a PR from that fork; a fine-grained PAT scoped to `getsigit/sigit` cannot fork a repo outside its scope and every release fails with a 403/404 on the fork step. The token is passed as `WINGET_CREATE_GITHUB_TOKEN` (not `--token`) so it doesn't leak into logs. `wingetcreate update` only works on a package that already exists in `microsoft/winget-pkgs`, so the workflow checks `manifests/g/getSigit/siGitCode` first and falls back to `wingetcreate submit` with `packaging/winget/*.yaml.in` for the first release; every later release takes the `update` path. If a winget release fails with a fork/permission error, check the `WINGET_TOKEN` secret type before re-dispatching.
 - The baked-in official MCP server is separately listed in the public MCP Registry as `si.sigit/sigit` (`release-mcp-registry.yml`, driven by `server.json` at the repo root). It's a remote Streamable-HTTP listing, so it's verified by a DNS TXT record on the `sigit.si` domain rather than the GitHub-OIDC scheme used for package listings.
 
 ## Git release flow
@@ -84,3 +85,4 @@ Pushing the `v*.*.*` tag is what fires every release workflow, so create and pus
 - Package names, install commands, and branding stay consistent across npm, PyPI, crates.io, Homebrew, NuGet, Scoop, winget, AUR, and the `.deb`/`.rpm` packages.
 - Every release asset (including the new `.deb`/`.rpm`/raw binaries consumed by Scoop, winget, and AUR) has a matching `.sha256` sidecar.
 - Any known release limitations are called out explicitly, including a dispatch failure in `release-scoop`/`release-winget`/`release-aur` (non-fatal — logged as a warning by `release-github.yml`) versus a hard failure in a directly tag-triggered workflow like `release-nuget` or `release-mcp-registry`.
+- The `WINGET_TOKEN` secret is a classic PAT with `public_repo` scope (not fine-grained), so wingetcreate can fork `microsoft/winget-pkgs`. If a winget release fails on the fork step, verify the token type before re-dispatching.

{sigit_code-1.5.12 → sigit_code-1.6.0}/AGENTS.md

@@ -225,6 +225,17 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   it's a remote server, the registry's URL-match rule forces a domain namespace (`si.sigit` ↔
   `sigit.si`) verified by a DNS TXT record, not the GitHub-OIDC scheme `smbcloud-cli` uses for its
   package listing.
+  Separate from all of the above are the servers an ACP client passes in `mcpServers` on
+  `session/new`, `session/load` and `session/fork`. ACP requires agents to connect to the stdio
+  ones, and they belong to the session that named them, so they cannot live in the startup
+  global: `connect_session_servers` returns a `SessionServers` that `main.rs` keeps on
+  `SessionState` and installs with `set_session_servers` whenever a session becomes live, the
+  same way it swaps the roots. `tool_specs`, `call_tool` and `/mcp` read the startup servers and
+  then the live session's. A client-supplied server whose name is already taken by a startup
+  server is not connected, since both would claim the same `mcp__<server>__` prefix. Streamable
+  HTTP entries are connected too, with the URL and headers the client sent, because
+  `handle_initialize` advertises `mcpCapabilities.http`. SSE is not advertised (the MCP spec
+  deprecated it), so a conforming client never sends one and a stray entry is skipped.
 - **`src/permissions.rs`** — tool permission policy. Every tool call passes through
   `decision_for` before executing: read-only tools always run; mutating tools (and all
   `mcp__*`/unknown tools) are governed by, in order: per-session plan mode (`/plan` — deny all
@@ -261,7 +272,8 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   read another session's roots from the global. Project-local
   discovery reads it: skills, slash commands, subagent types, and instruction files all scan
   every root. MCP is deliberately not on that list — `mcp::init` runs once at startup, before
-  any session exists, so a second root's `.sigit/mcp.toml` has nobody to tell.
+  any session exists, so a second root's `.sigit/mcp.toml` has nobody to tell. (The servers a
+  client names in `mcpServers` are a different thing and are per session; see `src/mcp.rs`.)
 - **`src/chat.rs`** — the Unix-only ratatui TUI. Loading-spinner phase then chat; uses
   `tokio::select!` to multiplex terminal events with streaming tokens.
 - **`src/headless.rs`** — non-interactive `sigit run` execution for scripts, CI, and Factory
@@ -376,13 +388,20 @@ Three of these need credentials or a one-time manual step before they work:
 
 - Scoop needs a `getsigit/scoop-bucket` repo and a `SCOOP_BUCKET_TOKEN` secret, mirroring the
   Homebrew tap setup.
-- winget needs a `WINGET_TOKEN` (PAT with `public_repo`) so `wingetcreate` can fork
-  `microsoft/winget-pkgs`. It is passed as `WINGET_CREATE_GITHUB_TOKEN` rather than `--token`,
-  which wingetcreate warns can leak the token into logs. `wingetcreate update` only works on a
-  package that already exists in `microsoft/winget-pkgs`, so the workflow checks the
-  `manifests/g/getSigit/siGitCode` path first and falls back to rendering
-  `packaging/winget/*.yaml.in` and running `wingetcreate submit` for a first submission. That
-  fallback runs once, then every later release takes the `update` path.
+- winget needs a `WINGET_TOKEN` (PAT with `public_repo` scope) so `wingetcreate` can fork
+  `microsoft/winget-pkgs` and open the manifest PR. It is passed as
+  `WINGET_CREATE_GITHUB_TOKEN` rather than `--token`, which wingetcreate warns can leak the
+  token into logs. `wingetcreate update` only works on a package that already exists in
+  `microsoft/winget-pkgs`, so the workflow checks the `manifests/g/getSigit/siGitCode` path
+  first and falls back to rendering `packaging/winget/*.yaml.in` and running
+  `wingetcreate submit` for a first submission. That fallback runs once, then every later
+  release takes the `update` path. Two non-obvious things in the update path: the `--urls`
+  arguments carry a trailing `|x64` / `|arm64` suffix that tells wingetcreate which installer
+  entry each URL replaces — without it, wingetcreate guesses from the file name, and
+  "sigit-win-amd64.exe" is not a spelling it recognises; and the first-submission render
+  uppercases the SHA256 (`tr '[:lower:]' '[:upper:]'`) to match the community validation
+  pipeline, which writes 64-hex checksums uppercase. The update path also passes
+  `--release-date`, `--release-notes-url`, `--submit`, and `--no-open` explicitly.
 - The AUR needs `AUR_USERNAME`, `AUR_EMAIL`, and `AUR_SSH_PRIVATE_KEY`. It publishes `sigit-bin`
   (a prebuilt binary) so Arch users are not compiling the on-device inference stack to install a
   CLI.

{sigit_code-1.5.12 → sigit_code-1.6.0}/CHANGELOG.md

@@ -1,5 +1,76 @@
 # Changelog
 
+## 1.6.0
+
+### Added
+
+- **Editors can pass HTTP MCP servers to a session.** siGit Code now
+  advertises `mcpCapabilities.http`, so an ACP client may list Streamable HTTP
+  servers in `mcpServers` next to stdio ones. They are connected with the URL
+  and headers the client sent and are scoped to that session, like the stdio
+  ones. SSE is still not advertised, since the MCP spec deprecated it (#151).
+
+- **The plan panel survives a failed turn.** The last `write_todos` list is
+  now kept by siGit Code itself. When a turn ends in an endpoint error before
+  the model gets to call `write_todos` again, the saved list is sent to the
+  editor again, so the plan stays on screen where it used to go blank (#132).
+
+### Changed
+
+- **The ACP Rust SDK is now 2.2** (`agent-client-protocol`, up from 1.3).
+  siGit Code still speaks ACP protocol v1 to the editor, so nothing changes on
+  the wire. The `unstable_auth_methods` feature is gone because agent auth
+  methods are stable in 2.x.
+
+### Fixed
+
+- **MCP servers the editor passes to a session are connected.** ACP clients
+  can name MCP servers in `mcpServers` when they open a session, and agents
+  are required to connect to the stdio ones. siGit Code accepted the field and
+  ignored it. The servers are now spawned when the session opens, their tools
+  are offered to that session only, and `/mcp` lists them as coming from the
+  editor. `SIGIT_MCP=off` still turns all of it off (#135).
+
+- **A relative `cwd` is rejected when a session starts.** ACP requires the
+  working directory and every `additionalDirectories` entry to be absolute.
+  `session/new`, `session/load` and `session/fork` used to accept a relative
+  one and resolve it against wherever the editor spawned the process. They now
+  answer with an invalid-params error (#136).
+
+- **Loading a session that does not exist is an error.** `session/load` with
+  an id that was never saved used to succeed and open an empty session under
+  that id, so the editor showed a blank thread that looked restored. It now
+  answers "not found" (`-32002`). A thread opened in the running process but
+  not spoken in yet still loads (#137).
+
+- **Compaction no longer dead-ends a long session.** The summarization request
+  used to carry the whole conversation, which by then was already over the
+  model's window, so siGit Code Cloud timed out with a 504 and the session
+  stopped with "start a new thread". The transcript sent for summarizing is
+  now capped, cut from the middle so the opening request and the latest state
+  are kept. If summarizing still fails, the oldest messages are dropped until
+  the history fits, with whole tool rounds removed together. A failed attempt
+  leaves the conversation as it was (#125).
+
+- **Gateway error pages stay out of the chat.** When an endpoint answers with
+  an HTML error page, the error shown is the status line, not the page's
+  markup (#125).
+
+- **Issue and pull request work no longer assumes GitHub.** The system prompt
+  treated forge features as if every repository lived on GitHub, while the
+  built-in `mcp__sigit__*` tools only work for repositories hosted on
+  sigit.si. The agent now checks the remote first, uses those tools only for
+  sigit.si repositories, and reaches for the forge's own CLI (`gh`, `glab`,
+  `tea`) elsewhere (#127).
+
+## 1.5.13
+
+### Added
+
+- **Three more siGit Code Cloud tiers: `flare`, `zenith` and `prism`.** They
+  show up in `/models` and in the editor's model picker alongside the existing
+  tiers. Selecting one needs a signed-in account, as before.
+
 ## 1.5.12
 
 ### Fixed

{sigit_code-1.5.12 → sigit_code-1.6.0}/CLAUDE.md

@@ -225,6 +225,17 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   it's a remote server, the registry's URL-match rule forces a domain namespace (`si.sigit` ↔
   `sigit.si`) verified by a DNS TXT record, not the GitHub-OIDC scheme `smbcloud-cli` uses for its
   package listing.
+  Separate from all of the above are the servers an ACP client passes in `mcpServers` on
+  `session/new`, `session/load` and `session/fork`. ACP requires agents to connect to the stdio
+  ones, and they belong to the session that named them, so they cannot live in the startup
+  global: `connect_session_servers` returns a `SessionServers` that `main.rs` keeps on
+  `SessionState` and installs with `set_session_servers` whenever a session becomes live, the
+  same way it swaps the roots. `tool_specs`, `call_tool` and `/mcp` read the startup servers and
+  then the live session's. A client-supplied server whose name is already taken by a startup
+  server is not connected, since both would claim the same `mcp__<server>__` prefix. Streamable
+  HTTP entries are connected too, with the URL and headers the client sent, because
+  `handle_initialize` advertises `mcpCapabilities.http`. SSE is not advertised (the MCP spec
+  deprecated it), so a conforming client never sends one and a stray entry is skipped.
 - **`src/permissions.rs`** — tool permission policy. Every tool call passes through
   `decision_for` before executing: read-only tools always run; mutating tools (and all
   `mcp__*`/unknown tools) are governed by, in order: per-session plan mode (`/plan` — deny all
@@ -261,7 +272,8 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   read another session's roots from the global. Project-local
   discovery reads it: skills, slash commands, subagent types, and instruction files all scan
   every root. MCP is deliberately not on that list — `mcp::init` runs once at startup, before
-  any session exists, so a second root's `.sigit/mcp.toml` has nobody to tell.
+  any session exists, so a second root's `.sigit/mcp.toml` has nobody to tell. (The servers a
+  client names in `mcpServers` are a different thing and are per session; see `src/mcp.rs`.)
 - **`src/chat.rs`** — the Unix-only ratatui TUI. Loading-spinner phase then chat; uses
   `tokio::select!` to multiplex terminal events with streaming tokens.
 - **`src/headless.rs`** — non-interactive `sigit run` execution for scripts, CI, and Factory
@@ -376,13 +388,20 @@ Three of these need credentials or a one-time manual step before they work:
 
 - Scoop needs a `getsigit/scoop-bucket` repo and a `SCOOP_BUCKET_TOKEN` secret, mirroring the
   Homebrew tap setup.
-- winget needs a `WINGET_TOKEN` (PAT with `public_repo`) so `wingetcreate` can fork
-  `microsoft/winget-pkgs`. It is passed as `WINGET_CREATE_GITHUB_TOKEN` rather than `--token`,
-  which wingetcreate warns can leak the token into logs. `wingetcreate update` only works on a
-  package that already exists in `microsoft/winget-pkgs`, so the workflow checks the
-  `manifests/g/getSigit/siGitCode` path first and falls back to rendering
-  `packaging/winget/*.yaml.in` and running `wingetcreate submit` for a first submission. That
-  fallback runs once, then every later release takes the `update` path.
+- winget needs a `WINGET_TOKEN` (PAT with `public_repo` scope) so `wingetcreate` can fork
+  `microsoft/winget-pkgs` and open the manifest PR. It is passed as
+  `WINGET_CREATE_GITHUB_TOKEN` rather than `--token`, which wingetcreate warns can leak the
+  token into logs. `wingetcreate update` only works on a package that already exists in
+  `microsoft/winget-pkgs`, so the workflow checks the `manifests/g/getSigit/siGitCode` path
+  first and falls back to rendering `packaging/winget/*.yaml.in` and running
+  `wingetcreate submit` for a first submission. That fallback runs once, then every later
+  release takes the `update` path. Two non-obvious things in the update path: the `--urls`
+  arguments carry a trailing `|x64` / `|arm64` suffix that tells wingetcreate which installer
+  entry each URL replaces — without it, wingetcreate guesses from the file name, and
+  "sigit-win-amd64.exe" is not a spelling it recognises; and the first-submission render
+  uppercases the SHA256 (`tr '[:lower:]' '[:upper:]'`) to match the community validation
+  pipeline, which writes 64-hex checksums uppercase. The update path also passes
+  `--release-date`, `--release-notes-url`, `--submit`, and `--no-open` explicitly.
 - The AUR needs `AUR_USERNAME`, `AUR_EMAIL`, and `AUR_SSH_PRIVATE_KEY`. It publishes `sigit-bin`
   (a prebuilt binary) so Arch users are not compiling the on-device inference stack to install a
   CLI.

{sigit_code-1.5.12 → sigit_code-1.6.0}/Cargo.lock

@@ -20,9 +20,9 @@ checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
 [[package]]
 name = "agent-client-protocol"
-version = "1.3.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d386d6a58f4dbe0ebfa98e915caa54005dabdefd419de3d4678b28cd5752444"
+checksum = "13f780597b2c88ab83d02509bcc3e86366751f86fa12114005e35c55ed691763"
 dependencies = [
  "agent-client-protocol-derive",
  "agent-client-protocol-schema",
@@ -44,19 +44,19 @@ dependencies = [
 
 [[package]]
 name = "agent-client-protocol-derive"
-version = "1.3.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97b94934d118a69e921d14e94d4af5b3076563318c52662c89a0ecb3f139e1da"
+checksum = "f4893bfb11e0e193aa5a64611a126ee87567acb1879556519c902722899229de"
 dependencies = [
  "quote",
- "syn 2.0.119",
+ "syn 3.0.4",
 ]
 
 [[package]]
 name = "agent-client-protocol-schema"
-version = "1.4.0"
+version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06679e1542356341f4550ccfb16338b64f37f6af70de2105446ef6fbb078234c"
+checksum = "1d595a79e1665d02c91c7dd1bedd118501e75cc0a3d5b1651b5150ec4c5c1e0d"
 dependencies = [
  "anyhow",
  "derive_more",
@@ -5778,7 +5778,7 @@ checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "sigit"
-version = "1.5.12"
+version = "1.6.0"
 dependencies = [
  "agent-client-protocol",
  "anyhow",

{sigit_code-1.5.12 → sigit_code-1.6.0}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sigit"
-version = "1.5.12"
+version = "1.6.0"
 edition = "2024"
 description = "siGit Code — ACP-compatible AI coding agent. Sí, git."
 documentation = "https://github.com/getsigit/sigit"
@@ -23,7 +23,7 @@ path = "src/main.rs"
 
 [dependencies]
 # ACP protocol SDK
-agent-client-protocol = { version = "1.3", features = ["unstable_session_fork", "unstable_auth_methods"] }
+agent-client-protocol = { version = "2.2", features = ["unstable_session_fork"] }
 
 # Onde Inference engine (local LLM)
 # onde = { path = "../onde" }

{sigit_code-1.5.12 → sigit_code-1.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sigit-code
-Version: 1.5.12
+Version: 1.6.0
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers