sigit-code 1.5.4__tar.gz → 1.5.5__tar.gz

{sigit_code-1.5.4 → sigit_code-1.5.5}/.agents/AGENTS.md

@@ -267,6 +267,12 @@ Publishing splits into two groups. **Language registries** each get their own ta
 workflow: `release-crates`, `release-npm`, `release-nuget`, `release-pypi`. The `npm/`, `nuget/`,
 and `pypi/` dirs hold their wrapper-package templates.
 
+npm and NuGet authenticate with OIDC (Trusted Publishing), so neither needs a stored token. On
+npm that is configured per package, not per org: all seven `@getsigit/*` names carry a trusted
+publisher pointing at `release-npm.yml`, and a package added later needs the same setup or its
+publish step will fail. OIDC also requires npm >= 11.5.1 and Node >= 22.14.0, which is why the
+workflow upgrades npm and why `.nvmrc` cannot drop below 22.
+
 **OS package managers** all publish somewhere outside this repo and all need checksums from the
 GitHub release, so `release-github` builds the binaries, attaches the assets, and then dispatches
 `release-homebrew`, `release-scoop`, `release-winget`, and `release-aur`. A dispatch failure in one
@@ -283,8 +289,12 @@ Three of these need credentials or a one-time manual step before they work:
 - Scoop needs a `getsigit/scoop-bucket` repo and a `SCOOP_BUCKET_TOKEN` secret, mirroring the
   Homebrew tap setup.
 - winget needs a `WINGET_TOKEN` (PAT with `public_repo`) so `wingetcreate` can fork
-  `microsoft/winget-pkgs`. The workflow only handles *updates*; the first submission has to be made
-  by hand with `wingetcreate new`, since a package must exist before it can be updated.
+  `microsoft/winget-pkgs`. It is passed as `WINGET_CREATE_GITHUB_TOKEN` rather than `--token`,
+  which wingetcreate warns can leak the token into logs. `wingetcreate update` only works on a
+  package that already exists in `microsoft/winget-pkgs`, so the workflow checks the
+  `manifests/g/getSigit/siGitCode` path first and falls back to rendering
+  `packaging/winget/*.yaml.in` and running `wingetcreate submit` for a first submission. That
+  fallback runs once, then every later release takes the `update` path.
 - The AUR needs `AUR_USERNAME`, `AUR_EMAIL`, and `AUR_SSH_PRIVATE_KEY`. It publishes `sigit-bin`
   (a prebuilt binary) so Arch users are not compiling the on-device inference stack to install a
   CLI.

{sigit_code-1.5.4/.claude → sigit_code-1.5.5/.agents}/skills/branding/SKILL.md

@@ -14,7 +14,7 @@ The short version:
 - **Product / brand name:** `siGit Code`
 - **CLI command:** `sigit`
 - **Rust crate:** `sigit`
-- **npm package:** `@smbcloud/sigit`
+- **npm package:** `@getsigit/sigit`
 - **PyPI package:** `sigit-code`
 - **Company name:** `smbCloud`
 - **LLM backend name:** `Onde Inference`
@@ -38,7 +38,7 @@ These names are case-sensitive.
 - **CLI command:** `sigit`
 - **Rust crate:** `sigit`
 - **Repository slug:** `getsigit/sigit`
-- **npm package:** `@smbcloud/sigit`
+- **npm package:** `@getsigit/sigit`
 - **PyPI package:** `sigit-code`
 - **Company:** `smbCloud`
 - **LLM backend in prose:** `Onde Inference`
@@ -73,7 +73,7 @@ When you mean something users type, install, import, or clone, use the literal l
 That means:
 
 - `sigit` for the command, crate, and repo slug
-- `@smbcloud/sigit` for npm
+- `@getsigit/sigit` for npm
 - `sigit-code` for PyPI
 - `onde` for the Rust crate
 
@@ -81,7 +81,7 @@ Examples:
 
 - Run `sigit` in a terminal.
 - Install with `cargo install sigit`.
-- Install with `npm install -g @smbcloud/sigit`.
+- Install with `npm install -g @getsigit/sigit`.
 - Install with `pip install sigit-code`.
 - The repository is `getsigit/sigit`.
 
@@ -169,7 +169,7 @@ That includes:
 - `Onde Inference`
 - `ACP`
 - `sigit`
-- `@smbcloud/sigit`
+- `@getsigit/sigit`
 - `sigit-code`
 - `onde`
 
@@ -181,7 +181,7 @@ Before you finish any doc or release-note edit, check these:
 
 1. Did you use `siGit Code` when referring to the product?
 2. Did you keep `sigit` lowercase for commands, crates, and repo references?
-3. Did you keep `@smbcloud/sigit` and `sigit-code` exact?
+3. Did you keep `@getsigit/sigit` and `sigit-code` exact?
 4. Did you keep `smbCloud` and `Onde Inference` cased correctly?
 5. In setup examples, does the visible editor label say `siGit Code` while the command stays `sigit`?
 

{sigit_code-1.5.4/.agents → sigit_code-1.5.5/.claude}/skills/branding/SKILL.md

@@ -14,7 +14,7 @@ The short version:
 - **Product / brand name:** `siGit Code`
 - **CLI command:** `sigit`
 - **Rust crate:** `sigit`
-- **npm package:** `@smbcloud/sigit`
+- **npm package:** `@getsigit/sigit`
 - **PyPI package:** `sigit-code`
 - **Company name:** `smbCloud`
 - **LLM backend name:** `Onde Inference`
@@ -38,7 +38,7 @@ These names are case-sensitive.
 - **CLI command:** `sigit`
 - **Rust crate:** `sigit`
 - **Repository slug:** `getsigit/sigit`
-- **npm package:** `@smbcloud/sigit`
+- **npm package:** `@getsigit/sigit`
 - **PyPI package:** `sigit-code`
 - **Company:** `smbCloud`
 - **LLM backend in prose:** `Onde Inference`
@@ -73,7 +73,7 @@ When you mean something users type, install, import, or clone, use the literal l
 That means:
 
 - `sigit` for the command, crate, and repo slug
-- `@smbcloud/sigit` for npm
+- `@getsigit/sigit` for npm
 - `sigit-code` for PyPI
 - `onde` for the Rust crate
 
@@ -81,7 +81,7 @@ Examples:
 
 - Run `sigit` in a terminal.
 - Install with `cargo install sigit`.
-- Install with `npm install -g @smbcloud/sigit`.
+- Install with `npm install -g @getsigit/sigit`.
 - Install with `pip install sigit-code`.
 - The repository is `getsigit/sigit`.
 
@@ -169,7 +169,7 @@ That includes:
 - `Onde Inference`
 - `ACP`
 - `sigit`
-- `@smbcloud/sigit`
+- `@getsigit/sigit`
 - `sigit-code`
 - `onde`
 
@@ -181,7 +181,7 @@ Before you finish any doc or release-note edit, check these:
 
 1. Did you use `siGit Code` when referring to the product?
 2. Did you keep `sigit` lowercase for commands, crates, and repo references?
-3. Did you keep `@smbcloud/sigit` and `sigit-code` exact?
+3. Did you keep `@getsigit/sigit` and `sigit-code` exact?
 4. Did you keep `smbCloud` and `Onde Inference` cased correctly?
 5. In setup examples, does the visible editor label say `siGit Code` while the command stays `sigit`?
 

{sigit_code-1.5.4 → sigit_code-1.5.5}/.github/workflows/release-npm.yml

@@ -101,9 +101,16 @@ jobs:
           node-version-file: .nvmrc
           registry-url: "https://registry.npmjs.org"
 
+      # Trusted Publishing (OIDC) needs npm >= 11.5.1. .nvmrc pins the Node
+      # version (>= 22.14.0, also an OIDC requirement); npm still needs
+      # upgrading past whatever ships with it.
+      - name: Upgrade npm for Trusted Publishing
+        shell: bash
+        run: npm install -g npm@latest
+
+      # Authentication is OIDC: each @getsigit/* package has a Trusted
+      # Publisher pointing at this workflow, so there is no token to leak.
       - name: Publish platform package to NPM
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         shell: bash
         run: |
           cd npm
@@ -150,16 +157,16 @@ jobs:
 
           cd "${node_pkg}"
 
-          npm_package_name="@smbcloud/${node_pkg}"
+          npm_package_name="@getsigit/${node_pkg}"
           if npm view "${npm_package_name}@${node_version}" version >/dev/null 2>&1; then
             echo "${npm_package_name}@${node_version} already exists on npm, skipping publish"
             exit 0
           fi
 
-          npm publish --access public --provenance
+          npm publish --access public
 
   publish-npm-base:
-    name: Publish base NPM package (@smbcloud/sigit)
+    name: Publish base NPM package (@getsigit/sigit)
     needs: publish-npm-binaries
     runs-on: ubuntu-latest
 
@@ -186,9 +193,14 @@ jobs:
           node-version-file: .nvmrc
           registry-url: "https://registry.npmjs.org"
 
+      # Trusted Publishing (OIDC) needs npm >= 11.5.1. .nvmrc pins the Node
+      # version (>= 22.14.0, also an OIDC requirement); npm still needs
+      # upgrading past whatever ships with it.
+      - name: Upgrade npm for Trusted Publishing
+        shell: bash
+        run: npm install -g npm@latest
+
       - name: Publish base package to NPM
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         shell: bash
         run: |
           cd npm/sigit
@@ -199,7 +211,7 @@ jobs:
             "./package.json" \
             "${{ env.RELEASE_VERSION }}"
 
-          npm_package_name="@smbcloud/sigit"
+          npm_package_name="@getsigit/sigit"
           npm_package_version="${{ env.RELEASE_VERSION }}"
 
           if npm view "${npm_package_name}@${npm_package_version}" version >/dev/null 2>&1; then
@@ -209,4 +221,4 @@ jobs:
 
           npm install
           npm run build
-          npm publish --access public --provenance
+          npm publish --access public

sigit_code-1.5.5/.github/workflows/release-winget.yml

@@ -0,0 +1,170 @@
+name: winget Release
+
+# Dispatched by release-github.yml once the release and its checksums exist.
+#
+# winget manifests live in microsoft/winget-pkgs, and `wingetcreate update`
+# only works on a package that is already there. So this workflow branches:
+#
+#   - package already in winget-pkgs -> `wingetcreate update`, which rewrites
+#     the URLs and re-hashes the installers for us.
+#   - package not there yet -> render the manifests in packaging/winget/ and
+#     `wingetcreate submit` them as a new package.
+#
+# The second path only runs once, but keeping it here means a first release
+# does not need someone to sit at a Windows box running `wingetcreate new`
+# interactively.
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag (e.g. v1.5.2)"
+        required: true
+
+permissions:
+  contents: read
+
+env:
+  REPO: getsigit/sigit
+  PACKAGE_IDENTIFIER: getSigit.siGitCode
+
+jobs:
+  submit-winget-manifest:
+    name: Submit winget manifest
+    # wingetcreate is a Windows-only tool.
+    runs-on: windows-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+
+      - name: Resolve tag, version and release date
+        id: release
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          TAG="${{ github.event.inputs.tag }}"
+          VERSION="${TAG#v}"
+          # wingetcreate wants ReleaseDate as YYYY-MM-DD.
+          DATE=$(gh release view "$TAG" --repo "$REPO" --json publishedAt --jq '.publishedAt[0:10]')
+
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "date=${DATE}" >> "$GITHUB_OUTPUT"
+
+      - name: Check whether the package is already in winget-pkgs
+        id: exists
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # manifests are filed under the lowercased first letter of the
+          # publisher, e.g. manifests/g/getSigit/siGitCode.
+          PUBLISHER="${PACKAGE_IDENTIFIER%%.*}"
+          NAME="${PACKAGE_IDENTIFIER#*.}"
+          FIRST=$(echo "${PUBLISHER:0:1}" | tr '[:upper:]' '[:lower:]')
+          PATH_IN_REPO="manifests/${FIRST}/${PUBLISHER}/${NAME}"
+
+          if gh api "repos/microsoft/winget-pkgs/contents/${PATH_IN_REPO}" >/dev/null 2>&1; then
+            echo "Found ${PACKAGE_IDENTIFIER} at ${PATH_IN_REPO}; submitting an update."
+            echo "found=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "No ${PACKAGE_IDENTIFIER} at ${PATH_IN_REPO}; submitting it as a new package."
+            echo "found=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Render manifests for a first submission
+        if: steps.exists.outputs.found == 'false'
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          TAG="${{ steps.release.outputs.tag }}"
+          VERSION="${{ steps.release.outputs.version }}"
+
+          mkdir -p artifacts manifests
+
+          gh release download "$TAG" \
+            --repo "$REPO" \
+            --pattern "sigit-win-*.exe.sha256" \
+            --dir artifacts/
+
+          # The schema wants 64 hex characters; the community validation
+          # pipeline writes them uppercase, so match that.
+          SHA_AMD64=$(tr -d '[:space:]' < artifacts/sigit-win-amd64.exe.sha256 | tr '[:lower:]' '[:upper:]')
+          SHA_ARM64=$(tr -d '[:space:]' < artifacts/sigit-win-arm64.exe.sha256 | tr '[:lower:]' '[:upper:]')
+
+          RELEASE_DATE="${{ steps.release.outputs.date }}"
+
+          for template in packaging/winget/*.yaml.in; do
+            out="manifests/$(basename "$template" .in)"
+            sed \
+              -e "s|@VERSION@|${VERSION}|g" \
+              -e "s|@TAG@|${TAG}|g" \
+              -e "s|@REPO@|${REPO}|g" \
+              -e "s|@SHA_AMD64@|${SHA_AMD64}|g" \
+              -e "s|@SHA_ARM64@|${SHA_ARM64}|g" \
+              -e "s|@RELEASE_DATE@|${RELEASE_DATE}|g" \
+              "$template" > "$out"
+
+            echo "--- ${out} ---"
+            cat "$out"
+          done
+
+      - name: Download wingetcreate
+        shell: pwsh
+        run: Invoke-WebRequest -Uri "https://aka.ms/wingetcreate/latest" -OutFile wingetcreate.exe
+
+      - name: Submit new package
+        if: steps.exists.outputs.found == 'false'
+        shell: pwsh
+        env:
+          # wingetcreate reads the token from this variable. Passing it as
+          # --token instead makes the tool warn that the token can end up in
+          # logs, which on a shared runner is not a warning worth ignoring.
+          WINGET_CREATE_GITHUB_TOKEN: ${{ secrets.WINGET_TOKEN }}
+        run: |
+          if (-not $env:WINGET_CREATE_GITHUB_TOKEN) {
+            Write-Error "WINGET_TOKEN is not set. It needs a PAT with public_repo scope so wingetcreate can fork microsoft/winget-pkgs and open the manifest PR."
+          }
+
+          $version = "${{ steps.release.outputs.version }}"
+
+          # --no-open because the runner has no browser to open the PR in.
+          .\wingetcreate.exe submit manifests `
+            --prtitle "New package: $env:PACKAGE_IDENTIFIER version $version" `
+            --no-open
+
+          if ($LASTEXITCODE -ne 0) {
+            Write-Error "wingetcreate submit failed with exit code $LASTEXITCODE"
+          }
+
+      - name: Submit manifest update
+        if: steps.exists.outputs.found == 'true'
+        shell: pwsh
+        env:
+          WINGET_CREATE_GITHUB_TOKEN: ${{ secrets.WINGET_TOKEN }}
+        run: |
+          if (-not $env:WINGET_CREATE_GITHUB_TOKEN) {
+            Write-Error "WINGET_TOKEN is not set. It needs a PAT with public_repo scope so wingetcreate can fork microsoft/winget-pkgs and open the manifest PR."
+          }
+
+          $tag = "${{ steps.release.outputs.tag }}"
+          $version = "${{ steps.release.outputs.version }}"
+          $base = "https://github.com/${env:REPO}/releases/download/$tag"
+
+          # The trailing |x64 and |arm64 tell wingetcreate which installer
+          # entry each URL replaces. Without them it guesses from the file
+          # name, and "sigit-win-amd64.exe" is not a spelling it recognises.
+          .\wingetcreate.exe update $env:PACKAGE_IDENTIFIER `
+            --version $version `
+            --urls "$base/sigit-win-amd64.exe|x64" "$base/sigit-win-arm64.exe|arm64" `
+            --release-notes-url "https://github.com/${env:REPO}/releases/tag/$tag" `
+            --release-date "${{ steps.release.outputs.date }}" `
+            --prtitle "Update $env:PACKAGE_IDENTIFIER to version $version" `
+            --submit `
+            --no-open
+
+          if ($LASTEXITCODE -ne 0) {
+            Write-Error "wingetcreate failed with exit code $LASTEXITCODE"
+          }

sigit_code-1.5.5/.nvmrc

@@ -0,0 +1 @@
+22

{sigit_code-1.5.4 → sigit_code-1.5.5}/AGENTS.md

@@ -267,6 +267,12 @@ Publishing splits into two groups. **Language registries** each get their own ta
 workflow: `release-crates`, `release-npm`, `release-nuget`, `release-pypi`. The `npm/`, `nuget/`,
 and `pypi/` dirs hold their wrapper-package templates.
 
+npm and NuGet authenticate with OIDC (Trusted Publishing), so neither needs a stored token. On
+npm that is configured per package, not per org: all seven `@getsigit/*` names carry a trusted
+publisher pointing at `release-npm.yml`, and a package added later needs the same setup or its
+publish step will fail. OIDC also requires npm >= 11.5.1 and Node >= 22.14.0, which is why the
+workflow upgrades npm and why `.nvmrc` cannot drop below 22.
+
 **OS package managers** all publish somewhere outside this repo and all need checksums from the
 GitHub release, so `release-github` builds the binaries, attaches the assets, and then dispatches
 `release-homebrew`, `release-scoop`, `release-winget`, and `release-aur`. A dispatch failure in one
@@ -283,8 +289,12 @@ Three of these need credentials or a one-time manual step before they work:
 - Scoop needs a `getsigit/scoop-bucket` repo and a `SCOOP_BUCKET_TOKEN` secret, mirroring the
   Homebrew tap setup.
 - winget needs a `WINGET_TOKEN` (PAT with `public_repo`) so `wingetcreate` can fork
-  `microsoft/winget-pkgs`. The workflow only handles *updates*; the first submission has to be made
-  by hand with `wingetcreate new`, since a package must exist before it can be updated.
+  `microsoft/winget-pkgs`. It is passed as `WINGET_CREATE_GITHUB_TOKEN` rather than `--token`,
+  which wingetcreate warns can leak the token into logs. `wingetcreate update` only works on a
+  package that already exists in `microsoft/winget-pkgs`, so the workflow checks the
+  `manifests/g/getSigit/siGitCode` path first and falls back to rendering
+  `packaging/winget/*.yaml.in` and running `wingetcreate submit` for a first submission. That
+  fallback runs once, then every later release takes the `update` path.
 - The AUR needs `AUR_USERNAME`, `AUR_EMAIL`, and `AUR_SSH_PRIVATE_KEY`. It publishes `sigit-bin`
   (a prebuilt binary) so Arch users are not compiling the on-device inference stack to install a
   CLI.

{sigit_code-1.5.4 → sigit_code-1.5.5}/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 1.5.5
+
+A distribution release. siGit Code itself is unchanged. What moved is how it
+reaches you on npm and on Windows.
+
+### What changed
+
+- **The npm package is now `@getsigit/sigit`.** The six platform packages moved
+  with it. `@smbcloud/sigit` stays on the registry but stops receiving updates,
+  so upgrading means switching names:
+  `npm uninstall -g @smbcloud/sigit && npm install -g @getsigit/sigit`. The old
+  package had been stuck at 1.5.2, so this picks up 1.5.3 and 1.5.4 as well.
+- **npm publishes over OIDC.** Every `@getsigit/*` package has a trusted
+  publisher pointing at the release workflow, so no npm token is stored in the
+  repository. The release workflow moves to Node 22, which trusted publishing
+  requires.
+- **winget releases actually go out.** The workflow could only update a package
+  already present in `microsoft/winget-pkgs`, and siGit Code had never been
+  submitted there, so every dispatch failed. It now submits the package the
+  first time and updates it on later releases. The identifier is
+  `getSigit.siGitCode`.
+
 ## 1.5.4
 
 - **CI**: nfpm config expanded to include package version and binary path

{sigit_code-1.5.4 → sigit_code-1.5.5}/CLAUDE.md

@@ -267,6 +267,12 @@ Publishing splits into two groups. **Language registries** each get their own ta
 workflow: `release-crates`, `release-npm`, `release-nuget`, `release-pypi`. The `npm/`, `nuget/`,
 and `pypi/` dirs hold their wrapper-package templates.
 
+npm and NuGet authenticate with OIDC (Trusted Publishing), so neither needs a stored token. On
+npm that is configured per package, not per org: all seven `@getsigit/*` names carry a trusted
+publisher pointing at `release-npm.yml`, and a package added later needs the same setup or its
+publish step will fail. OIDC also requires npm >= 11.5.1 and Node >= 22.14.0, which is why the
+workflow upgrades npm and why `.nvmrc` cannot drop below 22.
+
 **OS package managers** all publish somewhere outside this repo and all need checksums from the
 GitHub release, so `release-github` builds the binaries, attaches the assets, and then dispatches
 `release-homebrew`, `release-scoop`, `release-winget`, and `release-aur`. A dispatch failure in one
@@ -283,8 +289,12 @@ Three of these need credentials or a one-time manual step before they work:
 - Scoop needs a `getsigit/scoop-bucket` repo and a `SCOOP_BUCKET_TOKEN` secret, mirroring the
   Homebrew tap setup.
 - winget needs a `WINGET_TOKEN` (PAT with `public_repo`) so `wingetcreate` can fork
-  `microsoft/winget-pkgs`. The workflow only handles *updates*; the first submission has to be made
-  by hand with `wingetcreate new`, since a package must exist before it can be updated.
+  `microsoft/winget-pkgs`. It is passed as `WINGET_CREATE_GITHUB_TOKEN` rather than `--token`,
+  which wingetcreate warns can leak the token into logs. `wingetcreate update` only works on a
+  package that already exists in `microsoft/winget-pkgs`, so the workflow checks the
+  `manifests/g/getSigit/siGitCode` path first and falls back to rendering
+  `packaging/winget/*.yaml.in` and running `wingetcreate submit` for a first submission. That
+  fallback runs once, then every later release takes the `update` path.
 - The AUR needs `AUR_USERNAME`, `AUR_EMAIL`, and `AUR_SSH_PRIVATE_KEY`. It publishes `sigit-bin`
   (a prebuilt binary) so Arch users are not compiling the on-device inference stack to install a
   CLI.

{sigit_code-1.5.4 → sigit_code-1.5.5}/Cargo.lock

@@ -5778,7 +5778,7 @@ checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "sigit"
-version = "1.5.4"
+version = "1.5.5"
 dependencies = [
  "agent-client-protocol",
  "anyhow",

{sigit_code-1.5.4 → sigit_code-1.5.5}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sigit"
-version = "1.5.4"
+version = "1.5.5"
 edition = "2024"
 description = "siGit Code — ACP-compatible AI coding agent. Sí, git."
 documentation = "https://github.com/getsigit/sigit"

{sigit_code-1.5.4 → sigit_code-1.5.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sigit-code
-Version: 1.5.4
+Version: 1.5.5
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
@@ -35,7 +35,7 @@ Project-URL: Repository, https://github.com/getsigit/sigit
 <p align="center">
   <a href="https://pypi.org/project/sigit-code/"><img src="https://img.shields.io/pypi/v/sigit-code?style=flat-square&labelColor=17211D&color=235843" alt="PyPI"></a>
   <a href="https://crates.io/crates/sigit"><img src="https://img.shields.io/crates/v/sigit?style=flat-square&labelColor=17211D&color=235843" alt="Crates.io"></a>
-  <a href="https://www.npmjs.com/package/@smbcloud/sigit"><img src="https://img.shields.io/npm/v/@smbcloud/sigit?style=flat-square&labelColor=17211D&color=235843" alt="npm"></a>
+  <a href="https://www.npmjs.com/package/@getsigit/sigit"><img src="https://img.shields.io/npm/v/@getsigit/sigit?style=flat-square&labelColor=17211D&color=235843" alt="npm"></a>
   <a href="https://smbcloud.xyz"><img src="https://img.shields.io/badge/smbcloud.xyz-235843?style=flat-square&labelColor=17211D" alt="Website"></a>
   <a href="https://github.com/getsigit/sigit/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-235843?style=flat-square&labelColor=17211D" alt="License"></a>
 </p>
@@ -80,7 +80,7 @@ Then pick **siGit Code** in the assistant panel.
 
 | Method | Command |
 |--------|---------|
-| npm | `npm install -g @smbcloud/sigit` |
+| npm | `npm install -g @getsigit/sigit` |
 | Homebrew | `brew tap getsigit/tap && brew trust --tap getsigit/tap && brew install sigit` |
 | Cargo | `cargo install sigit` |
 

{sigit_code-1.5.4 → sigit_code-1.5.5}/README.md

@@ -3,7 +3,7 @@
 <p align="center">
   <a href="https://crates.io/crates/sigit"><img src="https://img.shields.io/crates/v/sigit?style=flat-square&labelColor=17211D&color=235843" alt="Crates.io"></a>
   <a href="https://pypi.org/project/sigit-code/"><img src="https://img.shields.io/pypi/v/sigit-code?style=flat-square&labelColor=17211D&color=235843" alt="PyPI"></a>
-  <a href="https://www.npmjs.com/package/@smbcloud/sigit"><img src="https://img.shields.io/npm/v/@smbcloud/sigit?style=flat-square&labelColor=17211D&color=235843" alt="npm"></a>
+  <a href="https://www.npmjs.com/package/@getsigit/sigit"><img src="https://img.shields.io/npm/v/@getsigit/sigit?style=flat-square&labelColor=17211D&color=235843" alt="npm"></a>
   <a href="https://smbcloud.xyz"><img src="https://img.shields.io/badge/smbcloud.xyz-235843?style=flat-square&labelColor=17211D" alt="Website"></a>
   <a href="https://github.com/getsigit/sigit/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-235843?style=flat-square&labelColor=17211D" alt="License"></a>
 </p>
@@ -36,7 +36,7 @@ cargo install sigit
 | Homebrew | `brew tap getsigit/tap && brew trust --tap getsigit/tap && brew install sigit` |
 | pip | `pip install sigit-code` |
 | uv | `uvx --from sigit-code sigit` |
-| npm | `npm install -g @smbcloud/sigit` |
+| npm | `npm install -g @getsigit/sigit` |
 | NuGet | `dotnet tool install --global SiGit.Code` |
 | winget | `winget install smbCloud.siGitCode` |
 | Scoop | `scoop bucket add getsigit https://github.com/getsigit/scoop-bucket && scoop install sigit` |

{sigit_code-1.5.4 → sigit_code-1.5.5}/npm/README.md.tmpl

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="https://www.npmjs.com/package/@smbcloud/sigit"><img src="https://img.shields.io/npm/v/@smbcloud/sigit?style=flat-square&labelColor=17211D&color=235843" alt="npm"></a>
+  <a href="https://www.npmjs.com/package/@getsigit/sigit"><img src="https://img.shields.io/npm/v/@getsigit/sigit?style=flat-square&labelColor=17211D&color=235843" alt="npm"></a>
   <a href="https://crates.io/crates/sigit"><img src="https://img.shields.io/crates/v/sigit?style=flat-square&labelColor=17211D&color=235843" alt="crates.io"></a>
   <a href="https://pypi.org/project/sigit-code/"><img src="https://img.shields.io/pypi/v/sigit-code?style=flat-square&labelColor=17211D&color=235843" alt="PyPI"></a>
   <a href="https://smbcloud.xyz"><img src="https://img.shields.io/badge/smbcloud.xyz-235843?style=flat-square&labelColor=17211D" alt="Website"></a>
@@ -15,19 +15,19 @@
 
 ## `${node_pkg}`
 
-This package is one of the platform-specific binaries behind [`@smbcloud/sigit`](https://www.npmjs.com/package/@smbcloud/sigit). You usually do not need to install it directly.
+This package is one of the platform-specific binaries behind [`@getsigit/sigit`](https://www.npmjs.com/package/@getsigit/sigit). You usually do not need to install it directly.
 
 Install the main package and npm will pull in the right binary for your OS and architecture:
 
 ```sh
-npm install -g @smbcloud/sigit
+npm install -g @getsigit/sigit
 ```
 
 ## Other install methods
 
 | Channel | Command |
 |---------|---------|
-| npm | `npm install -g @smbcloud/sigit` |
+| npm | `npm install -g @getsigit/sigit` |
 | Homebrew | `brew tap getsigit/tap && brew trust --tap getsigit/tap && brew install sigit` |
 | pip | `pip install sigit-code` |
 | uv | `uvx --from sigit-code sigit` |
@@ -37,12 +37,12 @@ npm install -g @smbcloud/sigit
 
 | Platform | Architecture | Package |
 |----------|--------------|---------|
-| macOS | Apple Silicon (arm64) | [`@smbcloud/sigit-darwin-arm64`](https://www.npmjs.com/package/@smbcloud/sigit-darwin-arm64) |
-| macOS | Intel (x64) | [`@smbcloud/sigit-darwin-x64`](https://www.npmjs.com/package/@smbcloud/sigit-darwin-x64) |
-| Linux | x64 | [`@smbcloud/sigit-linux-x64`](https://www.npmjs.com/package/@smbcloud/sigit-linux-x64) |
-| Linux | arm64 | [`@smbcloud/sigit-linux-arm64`](https://www.npmjs.com/package/@smbcloud/sigit-linux-arm64) |
-| Windows | x64 | [`@smbcloud/sigit-windows-x64`](https://www.npmjs.com/package/@smbcloud/sigit-windows-x64) |
-| Windows | arm64 | [`@smbcloud/sigit-windows-arm64`](https://www.npmjs.com/package/@smbcloud/sigit-windows-arm64) |
+| macOS | Apple Silicon (arm64) | [`@getsigit/sigit-darwin-arm64`](https://www.npmjs.com/package/@getsigit/sigit-darwin-arm64) |
+| macOS | Intel (x64) | [`@getsigit/sigit-darwin-x64`](https://www.npmjs.com/package/@getsigit/sigit-darwin-x64) |
+| Linux | x64 | [`@getsigit/sigit-linux-x64`](https://www.npmjs.com/package/@getsigit/sigit-linux-x64) |
+| Linux | arm64 | [`@getsigit/sigit-linux-arm64`](https://www.npmjs.com/package/@getsigit/sigit-linux-arm64) |
+| Windows | x64 | [`@getsigit/sigit-windows-x64`](https://www.npmjs.com/package/@getsigit/sigit-windows-x64) |
+| Windows | arm64 | [`@getsigit/sigit-windows-arm64`](https://www.npmjs.com/package/@getsigit/sigit-windows-arm64) |
 
 ## Links
 

{sigit_code-1.5.4 → sigit_code-1.5.5}/npm/package-main.json.tmpl

@@ -1,5 +1,5 @@
 {
-    "name": "@smbcloud/sigit",
+    "name": "@getsigit/sigit",
     "version": "${release_version}",
     "keywords": [
         "sigit",
@@ -31,11 +31,11 @@
         "typescript": "^5.0.0"
     },
     "optionalDependencies": {
-        "@smbcloud/sigit-darwin-arm64": "${release_version}",
-        "@smbcloud/sigit-darwin-x64": "${release_version}",
-        "@smbcloud/sigit-linux-arm64": "${release_version}",
-        "@smbcloud/sigit-linux-x64": "${release_version}",
-        "@smbcloud/sigit-windows-arm64": "${release_version}",
-        "@smbcloud/sigit-windows-x64": "${release_version}"
+        "@getsigit/sigit-darwin-arm64": "${release_version}",
+        "@getsigit/sigit-darwin-x64": "${release_version}",
+        "@getsigit/sigit-linux-arm64": "${release_version}",
+        "@getsigit/sigit-linux-x64": "${release_version}",
+        "@getsigit/sigit-windows-arm64": "${release_version}",
+        "@getsigit/sigit-windows-x64": "${release_version}"
     }
 }

{sigit_code-1.5.4 → sigit_code-1.5.5}/npm/package.json.tmpl

@@ -1,5 +1,5 @@
 {
-  "name": "@smbcloud/${node_pkg}",
+  "name": "@getsigit/${node_pkg}",
   "version": "${node_version}",
   "description": "Platform binary for siGit Code.",
   "license": "Apache-2.0",

{sigit_code-1.5.4 → sigit_code-1.5.5}/npm/sigit/README.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="https://www.npmjs.com/package/@smbcloud/sigit"><img src="https://img.shields.io/npm/v/@smbcloud/sigit?style=flat-square&labelColor=17211D&color=235843" alt="npm"></a>
+  <a href="https://www.npmjs.com/package/@getsigit/sigit"><img src="https://img.shields.io/npm/v/@getsigit/sigit?style=flat-square&labelColor=17211D&color=235843" alt="npm"></a>
   <a href="https://crates.io/crates/sigit"><img src="https://img.shields.io/crates/v/sigit?style=flat-square&labelColor=17211D&color=235843" alt="Crates.io"></a>
   <a href="https://pypi.org/project/sigit-code/"><img src="https://img.shields.io/pypi/v/sigit-code?style=flat-square&labelColor=17211D&color=235843" alt="PyPI"></a>
   <a href="https://smbcloud.xyz"><img src="https://img.shields.io/badge/smbcloud.xyz-235843?style=flat-square&labelColor=17211D" alt="Website"></a>
@@ -16,7 +16,7 @@
 ## Install
 
 ```sh
-npm install -g @smbcloud/sigit
+npm install -g @getsigit/sigit
 ```
 
 npm pulls in the right binary for your platform automatically.
@@ -81,12 +81,12 @@ Install [ACP Client](https://marketplace.visualstudio.com/items?itemName=formula
 
 | Platform | Architecture | Package |
 |---|---|---|
-| macOS | Apple Silicon (arm64) | [`@smbcloud/sigit-darwin-arm64`](https://www.npmjs.com/package/@smbcloud/sigit-darwin-arm64) |
-| macOS | Intel (x64) | [`@smbcloud/sigit-darwin-x64`](https://www.npmjs.com/package/@smbcloud/sigit-darwin-x64) |
-| Linux | x64 | [`@smbcloud/sigit-linux-x64`](https://www.npmjs.com/package/@smbcloud/sigit-linux-x64) |
-| Linux | arm64 | [`@smbcloud/sigit-linux-arm64`](https://www.npmjs.com/package/@smbcloud/sigit-linux-arm64) |
-| Windows | x64 | [`@smbcloud/sigit-windows-x64`](https://www.npmjs.com/package/@smbcloud/sigit-windows-x64) |
-| Windows | arm64 | [`@smbcloud/sigit-windows-arm64`](https://www.npmjs.com/package/@smbcloud/sigit-windows-arm64) |
+| macOS | Apple Silicon (arm64) | [`@getsigit/sigit-darwin-arm64`](https://www.npmjs.com/package/@getsigit/sigit-darwin-arm64) |
+| macOS | Intel (x64) | [`@getsigit/sigit-darwin-x64`](https://www.npmjs.com/package/@getsigit/sigit-darwin-x64) |
+| Linux | x64 | [`@getsigit/sigit-linux-x64`](https://www.npmjs.com/package/@getsigit/sigit-linux-x64) |
+| Linux | arm64 | [`@getsigit/sigit-linux-arm64`](https://www.npmjs.com/package/@getsigit/sigit-linux-arm64) |
+| Windows | x64 | [`@getsigit/sigit-windows-x64`](https://www.npmjs.com/package/@getsigit/sigit-windows-x64) |
+| Windows | arm64 | [`@getsigit/sigit-windows-arm64`](https://www.npmjs.com/package/@getsigit/sigit-windows-arm64) |
 
 ## Links
 

{sigit_code-1.5.4 → sigit_code-1.5.5}/npm/sigit/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "@smbcloud/sigit",
+  "name": "@getsigit/sigit",
   "version": "0.0.0-dev",
   "keywords": [
     "sigit",
@@ -34,11 +34,11 @@
     "typescript": "^5.0.0"
   },
   "optionalDependencies": {
-    "@smbcloud/sigit-darwin-arm64": "0.0.0-dev",
-    "@smbcloud/sigit-darwin-x64": "0.0.0-dev",
-    "@smbcloud/sigit-linux-arm64": "0.0.0-dev",
-    "@smbcloud/sigit-linux-x64": "0.0.0-dev",
-    "@smbcloud/sigit-windows-arm64": "0.0.0-dev",
-    "@smbcloud/sigit-windows-x64": "0.0.0-dev"
+    "@getsigit/sigit-darwin-arm64": "0.0.0-dev",
+    "@getsigit/sigit-darwin-x64": "0.0.0-dev",
+    "@getsigit/sigit-linux-arm64": "0.0.0-dev",
+    "@getsigit/sigit-linux-x64": "0.0.0-dev",
+    "@getsigit/sigit-windows-arm64": "0.0.0-dev",
+    "@getsigit/sigit-windows-x64": "0.0.0-dev"
   }
 }

{sigit_code-1.5.4 → sigit_code-1.5.5}/npm/sigit/src/index.ts

@@ -22,7 +22,7 @@ function getExePath() {
   try {
     // Since the binary will be located inside node_modules, we can simply call require.resolve
     return require.resolve(
-      `@smbcloud/sigit-${os}-${arch}/bin/sigit${extension}`,
+      `@getsigit/sigit-${os}-${arch}/bin/sigit${extension}`,
     );
   } catch (e) {
     throw new Error(

{sigit_code-1.5.4 → sigit_code-1.5.5}/nuget/sigit/README.md

@@ -45,7 +45,7 @@ npm, and PyPI packages each download only the binary for your platform.
 ## Other installation methods
 
 - Cargo: `cargo install sigit`
-- npm: `npm install -g @smbcloud/sigit`
+- npm: `npm install -g @getsigit/sigit`
 - pip: `pip install sigit-code`
 - Homebrew: `brew tap getsigit/tap && brew trust --tap getsigit/tap && brew install sigit`
 - GitHub Releases: <https://github.com/getsigit/sigit/releases>

sigit_code-1.5.5/packaging/winget/getSigit.siGitCode.installer.yaml.in

@@ -0,0 +1,18 @@
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.6.0.schema.json
+PackageIdentifier: getSigit.siGitCode
+PackageVersion: @VERSION@
+InstallerType: portable
+# `Commands` is what winget names the shim it drops on PATH. The release
+# assets are sigit-win-<arch>.exe, but the command has to be `sigit`.
+Commands:
+  - sigit
+ReleaseDate: "@RELEASE_DATE@"
+Installers:
+  - Architecture: x64
+    InstallerUrl: https://github.com/@REPO@/releases/download/@TAG@/sigit-win-amd64.exe
+    InstallerSha256: @SHA_AMD64@
+  - Architecture: arm64
+    InstallerUrl: https://github.com/@REPO@/releases/download/@TAG@/sigit-win-arm64.exe
+    InstallerSha256: @SHA_ARM64@
+ManifestType: installer
+ManifestVersion: 1.6.0

sigit_code-1.5.5/packaging/winget/getSigit.siGitCode.locale.en-US.yaml.in

@@ -0,0 +1,40 @@
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.6.0.schema.json
+PackageIdentifier: getSigit.siGitCode
+PackageVersion: @VERSION@
+PackageLocale: en-US
+Publisher: getSigit
+PublisherUrl: https://sigit.si/
+PublisherSupportUrl: https://github.com/@REPO@/issues
+PackageName: siGit Code
+PackageUrl: https://code.sigit.si
+License: Apache-2.0
+LicenseUrl: https://github.com/@REPO@/blob/main/LICENSE
+Copyright: Copyright 2026 PT Sigit Mitra Bangun
+ShortDescription: siGit Code, an AI coding agent that runs on your machine.
+Description: |-
+  siGit Code is a local coding agent. It runs on your machine, not someone
+  else's. No API keys, no cloud round-trips, no subscription.
+
+  It works two ways from the same binary. Zed and other ACP-compatible
+  editors start it over stdio and talk the Agent Client Protocol to it. Run
+  it from a terminal and you get an interactive chat UI instead. On Windows
+  it speaks ACP; the full-screen terminal UI is Unix-only.
+
+  Inference runs on-device against a GGUF model, or against siGit Code Cloud
+  or any OpenAI-compatible endpoint you point it at.
+Moniker: sigit
+Tags:
+  - acp
+  - agent
+  - ai
+  - cli
+  - coding-agent
+  - developer-tools
+  - llm
+  - terminal
+ReleaseNotesUrl: https://github.com/@REPO@/releases/tag/@TAG@
+Documentations:
+  - DocumentLabel: Readme
+    DocumentUrl: https://github.com/@REPO@/blob/main/README.md
+ManifestType: defaultLocale
+ManifestVersion: 1.6.0

sigit_code-1.5.5/packaging/winget/getSigit.siGitCode.yaml.in

@@ -0,0 +1,6 @@
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.version.1.6.0.schema.json
+PackageIdentifier: getSigit.siGitCode
+PackageVersion: @VERSION@
+DefaultLocale: en-US
+ManifestType: version
+ManifestVersion: 1.6.0

{sigit_code-1.5.4 → sigit_code-1.5.5}/pypi/README.md

@@ -8,7 +8,7 @@
 <p align="center">
   <a href="https://pypi.org/project/sigit-code/"><img src="https://img.shields.io/pypi/v/sigit-code?style=flat-square&labelColor=17211D&color=235843" alt="PyPI"></a>
   <a href="https://crates.io/crates/sigit"><img src="https://img.shields.io/crates/v/sigit?style=flat-square&labelColor=17211D&color=235843" alt="Crates.io"></a>
-  <a href="https://www.npmjs.com/package/@smbcloud/sigit"><img src="https://img.shields.io/npm/v/@smbcloud/sigit?style=flat-square&labelColor=17211D&color=235843" alt="npm"></a>
+  <a href="https://www.npmjs.com/package/@getsigit/sigit"><img src="https://img.shields.io/npm/v/@getsigit/sigit?style=flat-square&labelColor=17211D&color=235843" alt="npm"></a>
   <a href="https://smbcloud.xyz"><img src="https://img.shields.io/badge/smbcloud.xyz-235843?style=flat-square&labelColor=17211D" alt="Website"></a>
   <a href="https://github.com/getsigit/sigit/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-235843?style=flat-square&labelColor=17211D" alt="License"></a>
 </p>
@@ -53,7 +53,7 @@ Then pick **siGit Code** in the assistant panel.
 
 | Method | Command |
 |--------|---------|
-| npm | `npm install -g @smbcloud/sigit` |
+| npm | `npm install -g @getsigit/sigit` |
 | Homebrew | `brew tap getsigit/tap && brew trust --tap getsigit/tap && brew install sigit` |
 | Cargo | `cargo install sigit` |
 

sigit_code-1.5.4/.github/workflows/release-winget.yml

@@ -1,71 +0,0 @@
-name: winget Release
-
-# Dispatched by release-github.yml once the release and its checksums exist.
-#
-# This workflow only handles *updates*. winget manifests live in
-# microsoft/winget-pkgs, and a package has to exist there before it can be
-# updated, so the very first submission is a one-time manual step:
-#
-#   wingetcreate new https://github.com/getsigit/sigit/releases/download/vX.Y.Z/sigit-win-amd64.exe
-#
-# answering `portable` for the installer type and `smbCloud.siGitCode` for the
-# package identifier. Every release after that is automated here.
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "Release tag (e.g. v1.5.2)"
-        required: true
-
-permissions:
-  contents: read
-
-env:
-  REPO: getsigit/sigit
-  PACKAGE_IDENTIFIER: smbCloud.siGitCode
-
-jobs:
-  submit-winget-manifest:
-    name: Submit winget manifest
-    # wingetcreate is a Windows-only tool.
-    runs-on: windows-latest
-
-    steps:
-      - name: Resolve tag and version
-        id: release
-        shell: bash
-        run: |
-          TAG="${{ github.event.inputs.tag }}"
-          VERSION="${TAG#v}"
-
-          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-
-      - name: Submit manifest update
-        shell: pwsh
-        env:
-          WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}
-        run: |
-          if (-not $env:WINGET_TOKEN) {
-            Write-Error "WINGET_TOKEN is not set. It needs a PAT with public_repo scope so wingetcreate can fork microsoft/winget-pkgs and open the manifest PR."
-          }
-
-          $tag = "${{ steps.release.outputs.tag }}"
-          $version = "${{ steps.release.outputs.version }}"
-          $base = "https://github.com/${env:REPO}/releases/download/$tag"
-
-          Invoke-WebRequest -Uri "https://aka.ms/wingetcreate/latest" -OutFile wingetcreate.exe
-
-          # The trailing |x64 and |arm64 tell wingetcreate which installer
-          # entry each URL replaces. Without them it guesses from the file
-          # name, and "sigit-win-amd64.exe" is not a spelling it recognises.
-          .\wingetcreate.exe update $env:PACKAGE_IDENTIFIER `
-            --version $version `
-            --urls "$base/sigit-win-amd64.exe|x64" "$base/sigit-win-arm64.exe|arm64" `
-            --release-notes-url "https://github.com/${env:REPO}/releases/tag/$tag" `
-            --submit `
-            --token $env:WINGET_TOKEN
-
-          if ($LASTEXITCODE -ne 0) {
-            Write-Error "wingetcreate failed with exit code $LASTEXITCODE"
-          }

sigit_code-1.5.4/.nvmrc

@@ -1 +0,0 @@
-20