sigit-code 1.5.13__tar.gz → 1.6.1__tar.gz

{sigit_code-1.5.13 → sigit_code-1.6.1}/.agents/AGENTS.md

@@ -127,10 +127,31 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   endpoint can also fail *after* the response is open, reporting it as a `data:` frame holding
   the same envelope; that frame has no `choices`, so `consume_stream` has to check for it
   explicitly or it parses as an empty chunk and the turn ends looking like an empty answer.
+  `TurnResult::finish` carries the endpoint's `finish_reason` up to the loop, and
+  `stop_reason_for` in `main.rs` turns it into the ACP stop reason: the tool-round cap is
+  `max_turn_requests`, `length` is `max_tokens`, `content_filter` is `refusal`. ACP defines a
+  refusal as a turn the next prompt will not include, so `handle_prompt` restores the history
+  it snapshotted before the turn instead of only relabelling the response.
+  The round that reaches the cap (24, or `SIGIT_MAX_TOOL_ROUNDS`) is followed by one forced
+  text reply with no tools. The model cannot see that the tools are gone, so
+  `round_cap_note` is appended to that round's last tool result, and the turn always closes
+  with `round_cap_stop_message`. Without both, the thread stops on the model announcing a
+  step that never runs (issue #120).
   Some models write tool calls into content as text; `src/inline_tool_calls.rs` recovers the
   well-formed ones. A block that doesn't parse (or never closes) is dropped from both the reply
   and history, and `OpenAiBackend::complete` retries once with a note telling the model the call
   didn't run. Leaving the raw block in history makes the model invent `<function_results>` later.
+  Image attachments: ACP fixes `promptCapabilities.image` for the whole connection, while the
+  model can change on any turn, so the capability is always advertised and the decision is made
+  per prompt. `InferenceBackend::accepts_images` answers for the active model (on-device: no;
+  remote: `provider::model_accepts_images`, which reads the hard-coded `IMAGE_TIERS` for
+  `onde-*` ids and says yes for a user's own endpoint). `images_for_turn` in `main.rs` either
+  passes the images to `send_message_with_images` or drops them with a note to the user and a
+  bracketed note to the model. A message with images is stored in history as OpenAI content
+  parts and stays that way; `OpenAiBackend` strips the images per request (`without_images`)
+  when its model cannot read them, which is what makes a mid-thread switch to a text-only tier
+  safe. Read history text through `backend::message_text`, never `content.as_str()`.
+  `IMAGE_TIERS` mirrors onde-cloud's `IMAGE_CANDIDATES`; update both together.
 - **`src/provider.rs`** — decides *which* backend serves inference. Resolution order, first match
   wins: (1) override via `OPENAI_BASE_URL`+`OPENAI_API_KEY` or active profile in
   `~/.config/sigit/providers.toml`; (2) siGit Code Cloud when logged in; (3) on-device.
@@ -225,6 +246,17 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   it's a remote server, the registry's URL-match rule forces a domain namespace (`si.sigit` ↔
   `sigit.si`) verified by a DNS TXT record, not the GitHub-OIDC scheme `smbcloud-cli` uses for its
   package listing.
+  Separate from all of the above are the servers an ACP client passes in `mcpServers` on
+  `session/new`, `session/load` and `session/fork`. ACP requires agents to connect to the stdio
+  ones, and they belong to the session that named them, so they cannot live in the startup
+  global: `connect_session_servers` returns a `SessionServers` that `main.rs` keeps on
+  `SessionState` and installs with `set_session_servers` whenever a session becomes live, the
+  same way it swaps the roots. `tool_specs`, `call_tool` and `/mcp` read the startup servers and
+  then the live session's. A client-supplied server whose name is already taken by a startup
+  server is not connected, since both would claim the same `mcp__<server>__` prefix. Streamable
+  HTTP entries are connected too, with the URL and headers the client sent, because
+  `handle_initialize` advertises `mcpCapabilities.http`. SSE is not advertised (the MCP spec
+  deprecated it), so a conforming client never sends one and a stray entry is skipped.
 - **`src/permissions.rs`** — tool permission policy. Every tool call passes through
   `decision_for` before executing: read-only tools always run; mutating tools (and all
   `mcp__*`/unknown tools) are governed by, in order: per-session plan mode (`/plan` — deny all
@@ -232,7 +264,11 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   overrides and the default mode from `[permissions]` in `settings.toml` (`allow`/`ask`/`deny`,
   default `ask`; `SIGIT_PERMISSIONS` env overrides the default). On `ask`, the ACP path sends
   `session/request_permission` (allow once / allow for session / deny) and the TUI pauses the
-  inference task on a y/a/n prompt. Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
+  inference task on a y/a/n prompt. On the ACP path the decision is taken *before* the call is
+  announced, because it sets the announced status: a call that will ask starts `pending`, the
+  permission request carries that call's own id, and an `in_progress` update follows approval.
+  That update also puts the card's title back, since the permission request overwrites it
+  with the full arguments. Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
   serialized by `SiGitAgent::turn_lock` so the dispatch loop can route the client's permission
   answer mid-turn — don't move them back inline, and don't await client requests from inline
   handlers (deadlock).
@@ -261,7 +297,8 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   read another session's roots from the global. Project-local
   discovery reads it: skills, slash commands, subagent types, and instruction files all scan
   every root. MCP is deliberately not on that list — `mcp::init` runs once at startup, before
-  any session exists, so a second root's `.sigit/mcp.toml` has nobody to tell.
+  any session exists, so a second root's `.sigit/mcp.toml` has nobody to tell. (The servers a
+  client names in `mcpServers` are a different thing and are per session; see `src/mcp.rs`.)
 - **`src/chat.rs`** — the Unix-only ratatui TUI. Loading-spinner phase then chat; uses
   `tokio::select!` to multiplex terminal events with streaming tokens.
 - **`src/headless.rs`** — non-interactive `sigit run` execution for scripts, CI, and Factory
@@ -325,7 +362,8 @@ verbosity with `RUST_LOG`.
 
 `OPENAI_BASE_URL` / `OPENAI_API_KEY` (provider override), `SIGIT_API_URL` (account API base,
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
-`SIGIT_MODEL`, `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
+`SIGIT_MODEL`, `SIGIT_MAX_TOOL_ROUNDS` (1 to 500, default 24; the tool-round cap of a
+headless run or an ACP prompt turn), `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
 smbCloud CLI server), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
 server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
 mutating tools; the escape hatch for clients without permission-request support),
@@ -376,13 +414,20 @@ Three of these need credentials or a one-time manual step before they work:
 
 - Scoop needs a `getsigit/scoop-bucket` repo and a `SCOOP_BUCKET_TOKEN` secret, mirroring the
   Homebrew tap setup.
-- winget needs a `WINGET_TOKEN` (PAT with `public_repo`) so `wingetcreate` can fork
-  `microsoft/winget-pkgs`. It is passed as `WINGET_CREATE_GITHUB_TOKEN` rather than `--token`,
-  which wingetcreate warns can leak the token into logs. `wingetcreate update` only works on a
-  package that already exists in `microsoft/winget-pkgs`, so the workflow checks the
-  `manifests/g/getSigit/siGitCode` path first and falls back to rendering
-  `packaging/winget/*.yaml.in` and running `wingetcreate submit` for a first submission. That
-  fallback runs once, then every later release takes the `update` path.
+- winget needs a `WINGET_TOKEN` (PAT with `public_repo` scope) so `wingetcreate` can fork
+  `microsoft/winget-pkgs` and open the manifest PR. It is passed as
+  `WINGET_CREATE_GITHUB_TOKEN` rather than `--token`, which wingetcreate warns can leak the
+  token into logs. `wingetcreate update` only works on a package that already exists in
+  `microsoft/winget-pkgs`, so the workflow checks the `manifests/g/getSigit/siGitCode` path
+  first and falls back to rendering `packaging/winget/*.yaml.in` and running
+  `wingetcreate submit` for a first submission. That fallback runs once, then every later
+  release takes the `update` path. Two non-obvious things in the update path: the `--urls`
+  arguments carry a trailing `|x64` / `|arm64` suffix that tells wingetcreate which installer
+  entry each URL replaces — without it, wingetcreate guesses from the file name, and
+  "sigit-win-amd64.exe" is not a spelling it recognises; and the first-submission render
+  uppercases the SHA256 (`tr '[:lower:]' '[:upper:]'`) to match the community validation
+  pipeline, which writes 64-hex checksums uppercase. The update path also passes
+  `--release-date`, `--release-notes-url`, `--submit`, and `--no-open` explicitly.
 - The AUR needs `AUR_USERNAME`, `AUR_EMAIL`, and `AUR_SSH_PRIVATE_KEY`. It publishes `sigit-bin`
   (a prebuilt binary) so Arch users are not compiling the on-device inference stack to install a
   CLI.

{sigit_code-1.5.13/.claude → sigit_code-1.6.1/.agents}/skills/agent-client-protocol/SKILL.md

@@ -11,7 +11,7 @@ ACP is a JSON-RPC 2.0 protocol over **stdio** for integrating AI coding agents
 with editors (Zed, JetBrains, Neovim, etc.). The agent runs as a subprocess;
 the editor is the client. Communication is newline-delimited JSON on stdin/stdout.
 
-Crate: `agent-client-protocol = "0.13"` (siGit pins 0.13.0 in `Cargo.lock`)
+Crate: `agent-client-protocol = "2.2"` (siGit pins 2.2.0 in `Cargo.lock`)
 Docs:  https://docs.rs/agent-client-protocol
 Spec:  https://agentclientprotocol.com
 
@@ -21,6 +21,11 @@ Spec:  https://agentclientprotocol.com
 > handler receives a `ConnectionTo<Client>` (`cx`) you use to send notifications
 > and spawn tasks — so the old mpsc "circular dependency" pattern is gone.
 
+> **SDK 2.x is not protocol v2.** The 2.x crate still speaks ACP protocol v1 by
+> default, which is what siGit and Zed use (`ProtocolVersion::V1`). The draft v2
+> protocol (`Agent.v2()`, `V2ConnectionTo`) sits behind the `unstable_protocol_v2`
+> feature and siGit does not enable it.
+
 siGit's entire ACP server lives in `src/main.rs` (`run_acp_server`, the
 `SiGitAgent` struct, and its `handle_*` methods). Read it alongside this skill.
 
@@ -30,10 +35,8 @@ siGit's entire ACP server lives in `src/main.rs` (`run_acp_server`, the
 
 ```toml
 [dependencies]
-agent-client-protocol = { version = "0.13", features = [
-    "unstable_session_fork",                   # session/fork support
-    "unstable_session_additional_directories", # additional_directories on session requests
-    "unstable_auth_methods",                   # AuthMethod::Agent etc.
+agent-client-protocol = { version = "2.2", features = [
+    "unstable_session_fork", # session/fork support
 ] }
 async-trait = "0.1"
 tokio       = { version = "1", features = ["rt", "rt-multi-thread", "macros", "io-std", "io-util", "sync", "time"] }
@@ -42,9 +45,12 @@ futures     = "0.3"
 uuid        = { version = "1", features = ["v4"] }
 ```
 
-The `unstable_*` features gate real types/methods (`ForkSessionRequest`,
-`additional_directories`, `AuthMethod::Agent`). Without them the corresponding
-APIs don't exist and you'll get "no variant/method" errors.
+The `unstable_*` features gate real types/methods (`ForkSessionRequest`).
+Without them the corresponding APIs don't exist and you'll get "no
+variant/method" errors. `additional_directories` and `AuthMethod::Agent` used
+to need `unstable_session_additional_directories` and `unstable_auth_methods`;
+both are stable in 2.x and those feature names no longer exist, so listing them
+is a Cargo resolution error.
 
 ---
 
@@ -556,10 +562,9 @@ Editor                                Agent
 8. **Never write to stdout except JSON-RPC** — log to stderr; in TTY mode siGit
    redirects fds to `$TMPDIR/sigit.log`. Any stray `println!` or native library
    stdout write corrupts the wire.
-9. **Unstable features gate real types** — `unstable_session_fork`,
-   `unstable_session_additional_directories`, `unstable_auth_methods` must be on
-   in `Cargo.toml` or `ForkSessionRequest`, `additional_directories`, and
-   `AuthMethod::Agent` won't exist.
+9. **Unstable features gate real types** — `unstable_session_fork` must be on
+   in `Cargo.toml` or `ForkSessionRequest` won't exist. `additional_directories`
+   and `AuthMethod::Agent` are stable in 2.x and need no feature.
 10. **Zed re-fires the last config selection on connect** — make
     `setConfigOption` a no-op when the requested model is already active, and
     never start a model switch while a startup load is still in flight (GPU OOM).

{sigit_code-1.5.13 → sigit_code-1.6.1}/.agents/skills/sigit-code-release/SKILL.md

@@ -38,6 +38,7 @@ Use this skill when preparing a release for this repository.
 - The GitHub release body is generated, not hand-written: `release-github.yml`'s release job checks out the tag, awk-extracts the `## <version>` section from `CHANGELOG.md` (a missing section is a hard failure), appends a full-changelog link and a `sigit.si/code` footnote, and publishes it via `body_path: release_notes.md`. The only file a release-prep change needs to touch is `CHANGELOG.md` — never edit release notes in the GitHub UI, because the next tag push would overwrite them.
 - npm and NuGet publish via OIDC trusted publishing — neither has a stored token in the repo. On npm this is configured per package (each `@getsigit/*` name has a trusted publisher pointing at `release-npm.yml`), so a new package needs the same setup before its first publish will work. OIDC requires npm >= 11.5.1 and Node >= 22.14.0.
 - The NuGet package (`SiGit.Code`, `dotnet tool install --global SiGit.Code`) bundles all six platform binaries under `native/<os>-<arch>/` behind a managed shim, rather than shipping one package per platform like npm/PyPI. Watch the nuget.org 250 MB package-size limit if it ever grows.
+- The winget channel (`release-winget.yml`) needs a `WINGET_TOKEN` secret that is a **classic PAT** with `public_repo` scope — not a fine-grained PAT. wingetcreate forks `microsoft/winget-pkgs` on first use and submits a PR from that fork; a fine-grained PAT scoped to `getsigit/sigit` cannot fork a repo outside its scope and every release fails with a 403/404 on the fork step. The token is passed as `WINGET_CREATE_GITHUB_TOKEN` (not `--token`) so it doesn't leak into logs. `wingetcreate update` only works on a package that already exists in `microsoft/winget-pkgs`, so the workflow checks `manifests/g/getSigit/siGitCode` first and falls back to `wingetcreate submit` with `packaging/winget/*.yaml.in` for the first release; every later release takes the `update` path. If a winget release fails with a fork/permission error, check the `WINGET_TOKEN` secret type before re-dispatching.
 - The baked-in official MCP server is separately listed in the public MCP Registry as `si.sigit/sigit` (`release-mcp-registry.yml`, driven by `server.json` at the repo root). It's a remote Streamable-HTTP listing, so it's verified by a DNS TXT record on the `sigit.si` domain rather than the GitHub-OIDC scheme used for package listings.
 
 ## Git release flow
@@ -84,3 +85,4 @@ Pushing the `v*.*.*` tag is what fires every release workflow, so create and pus
 - Package names, install commands, and branding stay consistent across npm, PyPI, crates.io, Homebrew, NuGet, Scoop, winget, AUR, and the `.deb`/`.rpm` packages.
 - Every release asset (including the new `.deb`/`.rpm`/raw binaries consumed by Scoop, winget, and AUR) has a matching `.sha256` sidecar.
 - Any known release limitations are called out explicitly, including a dispatch failure in `release-scoop`/`release-winget`/`release-aur` (non-fatal — logged as a warning by `release-github.yml`) versus a hard failure in a directly tag-triggered workflow like `release-nuget` or `release-mcp-registry`.
+- The `WINGET_TOKEN` secret is a classic PAT with `public_repo` scope (not fine-grained), so wingetcreate can fork `microsoft/winget-pkgs`. If a winget release fails on the fork step, verify the token type before re-dispatching.

{sigit_code-1.5.13/.agents → sigit_code-1.6.1/.claude}/skills/agent-client-protocol/SKILL.md

@@ -11,7 +11,7 @@ ACP is a JSON-RPC 2.0 protocol over **stdio** for integrating AI coding agents
 with editors (Zed, JetBrains, Neovim, etc.). The agent runs as a subprocess;
 the editor is the client. Communication is newline-delimited JSON on stdin/stdout.
 
-Crate: `agent-client-protocol = "0.13"` (siGit pins 0.13.0 in `Cargo.lock`)
+Crate: `agent-client-protocol = "2.2"` (siGit pins 2.2.0 in `Cargo.lock`)
 Docs:  https://docs.rs/agent-client-protocol
 Spec:  https://agentclientprotocol.com
 
@@ -21,6 +21,11 @@ Spec:  https://agentclientprotocol.com
 > handler receives a `ConnectionTo<Client>` (`cx`) you use to send notifications
 > and spawn tasks — so the old mpsc "circular dependency" pattern is gone.
 
+> **SDK 2.x is not protocol v2.** The 2.x crate still speaks ACP protocol v1 by
+> default, which is what siGit and Zed use (`ProtocolVersion::V1`). The draft v2
+> protocol (`Agent.v2()`, `V2ConnectionTo`) sits behind the `unstable_protocol_v2`
+> feature and siGit does not enable it.
+
 siGit's entire ACP server lives in `src/main.rs` (`run_acp_server`, the
 `SiGitAgent` struct, and its `handle_*` methods). Read it alongside this skill.
 
@@ -30,10 +35,8 @@ siGit's entire ACP server lives in `src/main.rs` (`run_acp_server`, the
 
 ```toml
 [dependencies]
-agent-client-protocol = { version = "0.13", features = [
-    "unstable_session_fork",                   # session/fork support
-    "unstable_session_additional_directories", # additional_directories on session requests
-    "unstable_auth_methods",                   # AuthMethod::Agent etc.
+agent-client-protocol = { version = "2.2", features = [
+    "unstable_session_fork", # session/fork support
 ] }
 async-trait = "0.1"
 tokio       = { version = "1", features = ["rt", "rt-multi-thread", "macros", "io-std", "io-util", "sync", "time"] }
@@ -42,9 +45,12 @@ futures     = "0.3"
 uuid        = { version = "1", features = ["v4"] }
 ```
 
-The `unstable_*` features gate real types/methods (`ForkSessionRequest`,
-`additional_directories`, `AuthMethod::Agent`). Without them the corresponding
-APIs don't exist and you'll get "no variant/method" errors.
+The `unstable_*` features gate real types/methods (`ForkSessionRequest`).
+Without them the corresponding APIs don't exist and you'll get "no
+variant/method" errors. `additional_directories` and `AuthMethod::Agent` used
+to need `unstable_session_additional_directories` and `unstable_auth_methods`;
+both are stable in 2.x and those feature names no longer exist, so listing them
+is a Cargo resolution error.
 
 ---
 
@@ -556,10 +562,9 @@ Editor                                Agent
 8. **Never write to stdout except JSON-RPC** — log to stderr; in TTY mode siGit
    redirects fds to `$TMPDIR/sigit.log`. Any stray `println!` or native library
    stdout write corrupts the wire.
-9. **Unstable features gate real types** — `unstable_session_fork`,
-   `unstable_session_additional_directories`, `unstable_auth_methods` must be on
-   in `Cargo.toml` or `ForkSessionRequest`, `additional_directories`, and
-   `AuthMethod::Agent` won't exist.
+9. **Unstable features gate real types** — `unstable_session_fork` must be on
+   in `Cargo.toml` or `ForkSessionRequest` won't exist. `additional_directories`
+   and `AuthMethod::Agent` are stable in 2.x and need no feature.
 10. **Zed re-fires the last config selection on connect** — make
     `setConfigOption` a no-op when the requested model is already active, and
     never start a model switch while a startup load is still in flight (GPU OOM).

{sigit_code-1.5.13 → sigit_code-1.6.1}/.claude/skills/sigit-code-release/SKILL.md

@@ -38,6 +38,7 @@ Use this skill when preparing a release for this repository.
 - The GitHub release body is generated, not hand-written: `release-github.yml`'s release job checks out the tag, awk-extracts the `## <version>` section from `CHANGELOG.md` (a missing section is a hard failure), appends a full-changelog link and a `sigit.si/code` footnote, and publishes it via `body_path: release_notes.md`. The only file a release-prep change needs to touch is `CHANGELOG.md` — never edit release notes in the GitHub UI, because the next tag push would overwrite them.
 - npm and NuGet publish via OIDC trusted publishing — neither has a stored token in the repo. On npm this is configured per package (each `@getsigit/*` name has a trusted publisher pointing at `release-npm.yml`), so a new package needs the same setup before its first publish will work. OIDC requires npm >= 11.5.1 and Node >= 22.14.0.
 - The NuGet package (`SiGit.Code`, `dotnet tool install --global SiGit.Code`) bundles all six platform binaries under `native/<os>-<arch>/` behind a managed shim, rather than shipping one package per platform like npm/PyPI. Watch the nuget.org 250 MB package-size limit if it ever grows.
+- The winget channel (`release-winget.yml`) needs a `WINGET_TOKEN` secret that is a **classic PAT** with `public_repo` scope — not a fine-grained PAT. wingetcreate forks `microsoft/winget-pkgs` on first use and submits a PR from that fork; a fine-grained PAT scoped to `getsigit/sigit` cannot fork a repo outside its scope and every release fails with a 403/404 on the fork step. The token is passed as `WINGET_CREATE_GITHUB_TOKEN` (not `--token`) so it doesn't leak into logs. `wingetcreate update` only works on a package that already exists in `microsoft/winget-pkgs`, so the workflow checks `manifests/g/getSigit/siGitCode` first and falls back to `wingetcreate submit` with `packaging/winget/*.yaml.in` for the first release; every later release takes the `update` path. If a winget release fails with a fork/permission error, check the `WINGET_TOKEN` secret type before re-dispatching.
 - The baked-in official MCP server is separately listed in the public MCP Registry as `si.sigit/sigit` (`release-mcp-registry.yml`, driven by `server.json` at the repo root). It's a remote Streamable-HTTP listing, so it's verified by a DNS TXT record on the `sigit.si` domain rather than the GitHub-OIDC scheme used for package listings.
 
 ## Git release flow
@@ -84,3 +85,4 @@ Pushing the `v*.*.*` tag is what fires every release workflow, so create and pus
 - Package names, install commands, and branding stay consistent across npm, PyPI, crates.io, Homebrew, NuGet, Scoop, winget, AUR, and the `.deb`/`.rpm` packages.
 - Every release asset (including the new `.deb`/`.rpm`/raw binaries consumed by Scoop, winget, and AUR) has a matching `.sha256` sidecar.
 - Any known release limitations are called out explicitly, including a dispatch failure in `release-scoop`/`release-winget`/`release-aur` (non-fatal — logged as a warning by `release-github.yml`) versus a hard failure in a directly tag-triggered workflow like `release-nuget` or `release-mcp-registry`.
+- The `WINGET_TOKEN` secret is a classic PAT with `public_repo` scope (not fine-grained), so wingetcreate can fork `microsoft/winget-pkgs`. If a winget release fails on the fork step, verify the token type before re-dispatching.

sigit_code-1.6.1/.sigit/factory/config.toml

@@ -0,0 +1,62 @@
+[repo]
+owner = "getsigit"
+name = "sigit"
+slug = "getsigit-sigit"
+
+[agent]
+login = "sigit-code-review"
+display_name = "siGit Code Review"
+
+[harvest]
+state = "closed"
+limit = 50
+since = "2026-09-01"
+cadence = "weekly"
+day_of_week = "Mon"
+runs_dir = "~/.agents/skills/sigit-code-review-outer-loop/runs"
+report_format = "markdown"
+compare_previous = true
+
+[review.reviewer_skill]
+name = "sigit-code-review-outer-loop"
+version = "1.0.0"
+
+[review.author_skill]
+name = "sigit-code-review-feedbacks-response"
+version = "1.0.0"
+
+[review.repo_guidance]
+branch_rules = "{fix,feature,release}/*"
+ci_gate = "CI"
+watch_paths = ["src/**"]
+ignore_paths = ["**/*.md", "**/*.txt", "docs/**", "vendor/**", ".github/**", "*.lock"]
+
+[[guardrails.known_issues]]
+pattern = "all_zero_summary"
+source = "getsigit-sigit"
+description = "Zero findings on a large control-flow diff may be recall loss from an over-corrected prompt bar, not a clean review. Seen on stack #163 (900 additions, 0 findings)."
+action = "flag_in_report"
+
+[[guardrails.known_issues]]
+pattern = "confident_false_positives"
+source = "getsigit-sigit"
+description = "Confident declarative findings whose premise is contradicted by the cited code. Seen on stack #160 (5 of 5 findings rejected, rejected_rate 1.0). The hedge ban replaced speculative questions with confident wrong claims."
+action = "flag_in_report"
+
+[[guardrails.known_issues]]
+pattern = "approval_on_disagree"
+source = "getsigit-sigit"
+description = "Agent approves within 30-45s of an author disagreement without processing the correction. Compounds with confident false positives: wrong claim, author corrects, agent approves without re-reading."
+action = "flag_in_report"
+
+[[guardrails.known_issues]]
+pattern = "repeat_findings_high"
+source = "getsigit-sigit-si"
+description = "Repeat findings above 30% indicate the agent is re-raising issues the author already addressed."
+action = "flag_in_report"
+
+[[guardrails.known_issues]]
+pattern = "force_pushes_inflate_rounds"
+source = "smbcloudXYZ-smbcloud"
+description = "Force pushes cause one-for-one review round inflation; the agent re-reads unchanged diffs."
+action = "note_in_report"

{sigit_code-1.5.13 → sigit_code-1.6.1}/AGENTS.md

@@ -127,10 +127,31 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   endpoint can also fail *after* the response is open, reporting it as a `data:` frame holding
   the same envelope; that frame has no `choices`, so `consume_stream` has to check for it
   explicitly or it parses as an empty chunk and the turn ends looking like an empty answer.
+  `TurnResult::finish` carries the endpoint's `finish_reason` up to the loop, and
+  `stop_reason_for` in `main.rs` turns it into the ACP stop reason: the tool-round cap is
+  `max_turn_requests`, `length` is `max_tokens`, `content_filter` is `refusal`. ACP defines a
+  refusal as a turn the next prompt will not include, so `handle_prompt` restores the history
+  it snapshotted before the turn instead of only relabelling the response.
+  The round that reaches the cap (24, or `SIGIT_MAX_TOOL_ROUNDS`) is followed by one forced
+  text reply with no tools. The model cannot see that the tools are gone, so
+  `round_cap_note` is appended to that round's last tool result, and the turn always closes
+  with `round_cap_stop_message`. Without both, the thread stops on the model announcing a
+  step that never runs (issue #120).
   Some models write tool calls into content as text; `src/inline_tool_calls.rs` recovers the
   well-formed ones. A block that doesn't parse (or never closes) is dropped from both the reply
   and history, and `OpenAiBackend::complete` retries once with a note telling the model the call
   didn't run. Leaving the raw block in history makes the model invent `<function_results>` later.
+  Image attachments: ACP fixes `promptCapabilities.image` for the whole connection, while the
+  model can change on any turn, so the capability is always advertised and the decision is made
+  per prompt. `InferenceBackend::accepts_images` answers for the active model (on-device: no;
+  remote: `provider::model_accepts_images`, which reads the hard-coded `IMAGE_TIERS` for
+  `onde-*` ids and says yes for a user's own endpoint). `images_for_turn` in `main.rs` either
+  passes the images to `send_message_with_images` or drops them with a note to the user and a
+  bracketed note to the model. A message with images is stored in history as OpenAI content
+  parts and stays that way; `OpenAiBackend` strips the images per request (`without_images`)
+  when its model cannot read them, which is what makes a mid-thread switch to a text-only tier
+  safe. Read history text through `backend::message_text`, never `content.as_str()`.
+  `IMAGE_TIERS` mirrors onde-cloud's `IMAGE_CANDIDATES`; update both together.
 - **`src/provider.rs`** — decides *which* backend serves inference. Resolution order, first match
   wins: (1) override via `OPENAI_BASE_URL`+`OPENAI_API_KEY` or active profile in
   `~/.config/sigit/providers.toml`; (2) siGit Code Cloud when logged in; (3) on-device.
@@ -225,6 +246,17 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   it's a remote server, the registry's URL-match rule forces a domain namespace (`si.sigit` ↔
   `sigit.si`) verified by a DNS TXT record, not the GitHub-OIDC scheme `smbcloud-cli` uses for its
   package listing.
+  Separate from all of the above are the servers an ACP client passes in `mcpServers` on
+  `session/new`, `session/load` and `session/fork`. ACP requires agents to connect to the stdio
+  ones, and they belong to the session that named them, so they cannot live in the startup
+  global: `connect_session_servers` returns a `SessionServers` that `main.rs` keeps on
+  `SessionState` and installs with `set_session_servers` whenever a session becomes live, the
+  same way it swaps the roots. `tool_specs`, `call_tool` and `/mcp` read the startup servers and
+  then the live session's. A client-supplied server whose name is already taken by a startup
+  server is not connected, since both would claim the same `mcp__<server>__` prefix. Streamable
+  HTTP entries are connected too, with the URL and headers the client sent, because
+  `handle_initialize` advertises `mcpCapabilities.http`. SSE is not advertised (the MCP spec
+  deprecated it), so a conforming client never sends one and a stray entry is skipped.
 - **`src/permissions.rs`** — tool permission policy. Every tool call passes through
   `decision_for` before executing: read-only tools always run; mutating tools (and all
   `mcp__*`/unknown tools) are governed by, in order: per-session plan mode (`/plan` — deny all
@@ -232,7 +264,11 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   overrides and the default mode from `[permissions]` in `settings.toml` (`allow`/`ask`/`deny`,
   default `ask`; `SIGIT_PERMISSIONS` env overrides the default). On `ask`, the ACP path sends
   `session/request_permission` (allow once / allow for session / deny) and the TUI pauses the
-  inference task on a y/a/n prompt. Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
+  inference task on a y/a/n prompt. On the ACP path the decision is taken *before* the call is
+  announced, because it sets the announced status: a call that will ask starts `pending`, the
+  permission request carries that call's own id, and an `in_progress` update follows approval.
+  That update also puts the card's title back, since the permission request overwrites it
+  with the full arguments. Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
   serialized by `SiGitAgent::turn_lock` so the dispatch loop can route the client's permission
   answer mid-turn — don't move them back inline, and don't await client requests from inline
   handlers (deadlock).
@@ -261,7 +297,8 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   read another session's roots from the global. Project-local
   discovery reads it: skills, slash commands, subagent types, and instruction files all scan
   every root. MCP is deliberately not on that list — `mcp::init` runs once at startup, before
-  any session exists, so a second root's `.sigit/mcp.toml` has nobody to tell.
+  any session exists, so a second root's `.sigit/mcp.toml` has nobody to tell. (The servers a
+  client names in `mcpServers` are a different thing and are per session; see `src/mcp.rs`.)
 - **`src/chat.rs`** — the Unix-only ratatui TUI. Loading-spinner phase then chat; uses
   `tokio::select!` to multiplex terminal events with streaming tokens.
 - **`src/headless.rs`** — non-interactive `sigit run` execution for scripts, CI, and Factory
@@ -325,7 +362,8 @@ verbosity with `RUST_LOG`.
 
 `OPENAI_BASE_URL` / `OPENAI_API_KEY` (provider override), `SIGIT_API_URL` (account API base,
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
-`SIGIT_MODEL`, `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
+`SIGIT_MODEL`, `SIGIT_MAX_TOOL_ROUNDS` (1 to 500, default 24; the tool-round cap of a
+headless run or an ACP prompt turn), `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
 smbCloud CLI server), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
 server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
 mutating tools; the escape hatch for clients without permission-request support),
@@ -376,13 +414,20 @@ Three of these need credentials or a one-time manual step before they work:
 
 - Scoop needs a `getsigit/scoop-bucket` repo and a `SCOOP_BUCKET_TOKEN` secret, mirroring the
   Homebrew tap setup.
-- winget needs a `WINGET_TOKEN` (PAT with `public_repo`) so `wingetcreate` can fork
-  `microsoft/winget-pkgs`. It is passed as `WINGET_CREATE_GITHUB_TOKEN` rather than `--token`,
-  which wingetcreate warns can leak the token into logs. `wingetcreate update` only works on a
-  package that already exists in `microsoft/winget-pkgs`, so the workflow checks the
-  `manifests/g/getSigit/siGitCode` path first and falls back to rendering
-  `packaging/winget/*.yaml.in` and running `wingetcreate submit` for a first submission. That
-  fallback runs once, then every later release takes the `update` path.
+- winget needs a `WINGET_TOKEN` (PAT with `public_repo` scope) so `wingetcreate` can fork
+  `microsoft/winget-pkgs` and open the manifest PR. It is passed as
+  `WINGET_CREATE_GITHUB_TOKEN` rather than `--token`, which wingetcreate warns can leak the
+  token into logs. `wingetcreate update` only works on a package that already exists in
+  `microsoft/winget-pkgs`, so the workflow checks the `manifests/g/getSigit/siGitCode` path
+  first and falls back to rendering `packaging/winget/*.yaml.in` and running
+  `wingetcreate submit` for a first submission. That fallback runs once, then every later
+  release takes the `update` path. Two non-obvious things in the update path: the `--urls`
+  arguments carry a trailing `|x64` / `|arm64` suffix that tells wingetcreate which installer
+  entry each URL replaces — without it, wingetcreate guesses from the file name, and
+  "sigit-win-amd64.exe" is not a spelling it recognises; and the first-submission render
+  uppercases the SHA256 (`tr '[:lower:]' '[:upper:]'`) to match the community validation
+  pipeline, which writes 64-hex checksums uppercase. The update path also passes
+  `--release-date`, `--release-notes-url`, `--submit`, and `--no-open` explicitly.
 - The AUR needs `AUR_USERNAME`, `AUR_EMAIL`, and `AUR_SSH_PRIVATE_KEY`. It publishes `sigit-bin`
   (a prebuilt binary) so Arch users are not compiling the on-device inference stack to install a
   CLI.

{sigit_code-1.5.13 → sigit_code-1.6.1}/CHANGELOG.md

@@ -1,6 +1,116 @@
 # Changelog
 
-## Unreleased
+## 1.6.1
+
+### Added
+
+- **Images can be attached to a prompt in the editor.** siGit Code now
+  advertises `promptCapabilities.image`, so an ACP client offers image
+  attachments. The image goes to the model when the active model reads images.
+  The model picker marks those models with "reads images". The on-device
+  models and four cloud tiers (`nova`, `orbit`, `apex`, `flux`) are text-only:
+  with one of them active the image is left out, a note in the thread says so,
+  and the model is told an image was withheld. Switching a thread that already
+  holds images to a text-only model flags that once as well. Cloud tiers need
+  siGit Code Cloud to accept image parts, which is rolling out separately
+  (#134).
+
+- **The tool-round cap of a headless run can be set.** `--max-tool-rounds <n>`
+  or `SIGIT_MAX_TOOL_ROUNDS` (1 to 500) replaces the built-in 24 for
+  `sigit run` and `sigit -p`. The flag wins over the variable.
+
+### Fixed
+
+- **A prompt turn now reports why it stopped.** ACP defines five stop reasons
+  and siGit Code only ever sent `end_turn` and `cancelled`. A turn that runs
+  into the tool-round cap now ends with `max_turn_requests`, a reply cut off
+  at the token limit with `max_tokens`, and a reply the endpoint withheld
+  (`content_filter`) with `refusal`. A refused turn is also taken out of the
+  conversation, which is what the protocol tells the client to expect (#140).
+
+- **A tool call that needs approval is one card, not two.** The permission
+  request carried an id of its own, so an ACP client showed an approval card
+  beside a call that already claimed to be running. The call is now announced
+  as `pending`, the permission request names that same call, and it moves to
+  `in_progress` once approved. Calls allowed by policy still start out
+  `in_progress` (#138).
+
+- **A turn that runs out of tool rounds says so.** In an editor, a long task
+  could stop on a line like "Now commit:" with nothing after it. The turn had
+  used all 24 tool rounds, the model spent its last reply announcing the next
+  step, and the call behind it was dropped. siGit Code now tells the model
+  that its rounds are used up before that last reply, and ends the turn with a
+  message saying why it stopped and that "continue" picks it back up.
+  `SIGIT_MAX_TOOL_ROUNDS` now sets the cap for editor sessions too (#120).
+
+- **A headless run no longer ends silently with no final message.** When the
+  last round came back empty, which is what happens when a run is cut off at
+  the tool-round cap mid-task, stdout was empty and the exit status was 0, so
+  a caller could not tell it from a run with nothing to report. siGit Code now
+  asks the model once for its final message before finishing.
+
+## 1.6.0
+
+### Added
+
+- **Editors can pass HTTP MCP servers to a session.** siGit Code now
+  advertises `mcpCapabilities.http`, so an ACP client may list Streamable HTTP
+  servers in `mcpServers` next to stdio ones. They are connected with the URL
+  and headers the client sent and are scoped to that session, like the stdio
+  ones. SSE is still not advertised, since the MCP spec deprecated it (#151).
+
+- **The plan panel survives a failed turn.** The last `write_todos` list is
+  now kept by siGit Code itself. When a turn ends in an endpoint error before
+  the model gets to call `write_todos` again, the saved list is sent to the
+  editor again, so the plan stays on screen where it used to go blank (#132).
+
+### Changed
+
+- **The ACP Rust SDK is now 2.2** (`agent-client-protocol`, up from 1.3).
+  siGit Code still speaks ACP protocol v1 to the editor, so nothing changes on
+  the wire. The `unstable_auth_methods` feature is gone because agent auth
+  methods are stable in 2.x.
+
+### Fixed
+
+- **MCP servers the editor passes to a session are connected.** ACP clients
+  can name MCP servers in `mcpServers` when they open a session, and agents
+  are required to connect to the stdio ones. siGit Code accepted the field and
+  ignored it. The servers are now spawned when the session opens, their tools
+  are offered to that session only, and `/mcp` lists them as coming from the
+  editor. `SIGIT_MCP=off` still turns all of it off (#135).
+
+- **A relative `cwd` is rejected when a session starts.** ACP requires the
+  working directory and every `additionalDirectories` entry to be absolute.
+  `session/new`, `session/load` and `session/fork` used to accept a relative
+  one and resolve it against wherever the editor spawned the process. They now
+  answer with an invalid-params error (#136).
+
+- **Loading a session that does not exist is an error.** `session/load` with
+  an id that was never saved used to succeed and open an empty session under
+  that id, so the editor showed a blank thread that looked restored. It now
+  answers "not found" (`-32002`). A thread opened in the running process but
+  not spoken in yet still loads (#137).
+
+- **Compaction no longer dead-ends a long session.** The summarization request
+  used to carry the whole conversation, which by then was already over the
+  model's window, so siGit Code Cloud timed out with a 504 and the session
+  stopped with "start a new thread". The transcript sent for summarizing is
+  now capped, cut from the middle so the opening request and the latest state
+  are kept. If summarizing still fails, the oldest messages are dropped until
+  the history fits, with whole tool rounds removed together. A failed attempt
+  leaves the conversation as it was (#125).
+
+- **Gateway error pages stay out of the chat.** When an endpoint answers with
+  an HTML error page, the error shown is the status line, not the page's
+  markup (#125).
+
+- **Issue and pull request work no longer assumes GitHub.** The system prompt
+  treated forge features as if every repository lived on GitHub, while the
+  built-in `mcp__sigit__*` tools only work for repositories hosted on
+  sigit.si. The agent now checks the remote first, uses those tools only for
+  sigit.si repositories, and reaches for the forge's own CLI (`gh`, `glab`,
+  `tea`) elsewhere (#127).
 
 ## 1.5.13