sigit-code 1.5.8__tar.gz → 1.5.9__tar.gz

{sigit_code-1.5.8 → sigit_code-1.5.9}/.agents/skills/sigit-code-release/SKILL.md

@@ -35,6 +35,7 @@ Use this skill when preparing a release for this repository.
 - The crate is published to crates.io (`release-crates.yml`) and the Homebrew tap is updated (`release-homebrew.yml`) as part of the tag-driven flow. Per the siGit release flow, Homebrew is auto-triggered — do not dispatch it manually.
 - `release-github.yml` builds the binaries, attaches them (plus a `.deb`/`.rpm` per Linux target built with nfpm from `packaging/nfpm.yaml`) to the GitHub release, then dispatches `release-homebrew`, `release-scoop`, `release-winget`, and `release-aur`. A dispatch failure in any one of those four is logged as a warning, not a hard failure — an unconfigured channel doesn't block the rest of the release. `release-nuget.yml` and `release-mcp-registry.yml`, by contrast, are tag-triggered directly like the other language-registry workflows, not dispatched from `release-github.yml`.
 - Every release asset carries a `.sha256` sidecar (not just the macOS Homebrew tarball). Scoop, winget, and the AUR PKGBUILD each consume the raw binaries plus their sidecar checksum, rather than the tarball.
+- The GitHub release body is generated, not hand-written: `release-github.yml`'s release job checks out the tag, awk-extracts the `## <version>` section from `CHANGELOG.md` (a missing section is a hard failure), appends a full-changelog link and a `sigit.si/code` footnote, and publishes it via `body_path: release_notes.md`. The only file a release-prep change needs to touch is `CHANGELOG.md` — never edit release notes in the GitHub UI, because the next tag push would overwrite them.
 - npm and NuGet publish via OIDC trusted publishing — neither has a stored token in the repo. On npm this is configured per package (each `@getsigit/*` name has a trusted publisher pointing at `release-npm.yml`), so a new package needs the same setup before its first publish will work. OIDC requires npm >= 11.5.1 and Node >= 22.14.0.
 - The NuGet package (`SiGit.Code`, `dotnet tool install --global SiGit.Code`) bundles all six platform binaries under `native/<os>-<arch>/` behind a managed shim, rather than shipping one package per platform like npm/PyPI. Watch the nuget.org 250 MB package-size limit if it ever grows.
 - The baked-in official MCP server is separately listed in the public MCP Registry as `si.sigit/sigit` (`release-mcp-registry.yml`, driven by `server.json` at the repo root). It's a remote Streamable-HTTP listing, so it's verified by a DNS TXT record on the `sigit.si` domain rather than the GitHub-OIDC scheme used for package listings.

{sigit_code-1.5.8 → sigit_code-1.5.9}/.claude/skills/sigit-code-release/SKILL.md

@@ -35,6 +35,7 @@ Use this skill when preparing a release for this repository.
 - The crate is published to crates.io (`release-crates.yml`) and the Homebrew tap is updated (`release-homebrew.yml`) as part of the tag-driven flow. Per the siGit release flow, Homebrew is auto-triggered — do not dispatch it manually.
 - `release-github.yml` builds the binaries, attaches them (plus a `.deb`/`.rpm` per Linux target built with nfpm from `packaging/nfpm.yaml`) to the GitHub release, then dispatches `release-homebrew`, `release-scoop`, `release-winget`, and `release-aur`. A dispatch failure in any one of those four is logged as a warning, not a hard failure — an unconfigured channel doesn't block the rest of the release. `release-nuget.yml` and `release-mcp-registry.yml`, by contrast, are tag-triggered directly like the other language-registry workflows, not dispatched from `release-github.yml`.
 - Every release asset carries a `.sha256` sidecar (not just the macOS Homebrew tarball). Scoop, winget, and the AUR PKGBUILD each consume the raw binaries plus their sidecar checksum, rather than the tarball.
+- The GitHub release body is generated, not hand-written: `release-github.yml`'s release job checks out the tag, awk-extracts the `## <version>` section from `CHANGELOG.md` (a missing section is a hard failure), appends a full-changelog link and a `sigit.si/code` footnote, and publishes it via `body_path: release_notes.md`. The only file a release-prep change needs to touch is `CHANGELOG.md` — never edit release notes in the GitHub UI, because the next tag push would overwrite them.
 - npm and NuGet publish via OIDC trusted publishing — neither has a stored token in the repo. On npm this is configured per package (each `@getsigit/*` name has a trusted publisher pointing at `release-npm.yml`), so a new package needs the same setup before its first publish will work. OIDC requires npm >= 11.5.1 and Node >= 22.14.0.
 - The NuGet package (`SiGit.Code`, `dotnet tool install --global SiGit.Code`) bundles all six platform binaries under `native/<os>-<arch>/` behind a managed shim, rather than shipping one package per platform like npm/PyPI. Watch the nuget.org 250 MB package-size limit if it ever grows.
 - The baked-in official MCP server is separately listed in the public MCP Registry as `si.sigit/sigit` (`release-mcp-registry.yml`, driven by `server.json` at the repo root). It's a remote Streamable-HTTP listing, so it's verified by a DNS TXT record on the `sigit.si` domain rather than the GitHub-OIDC scheme used for package listings.

{sigit_code-1.5.8 → sigit_code-1.5.9}/.github/workflows/release-github.yml

@@ -240,6 +240,41 @@ jobs:
             echo "tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
           fi
 
+      - name: Checkout tag
+        # The release job otherwise only downloads artifacts; the changelog
+        # has to be read from the tree at the tag being released.
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ steps.tag.outputs.tag }}
+
+      - name: Compose release notes
+        # The release page carries the section of CHANGELOG.md for this
+        # version, not a bare "Full changelog" default. A missing section is
+        # a hard failure: publishing a release whose notes don't match its
+        # changelog is worse than stopping the job.
+        shell: bash
+        run: |
+          version="${{ steps.tag.outputs.tag }}"
+          version="${version#v}"
+          section="$(awk -v ver="${version}" '
+            $0 == "## " ver { found = 1; next }
+            found && /^## / { exit }
+            found { print }
+          ' CHANGELOG.md)"
+          if [ -z "${section//[$' \t\n']/}" ]; then
+            echo "No ## ${version} section found in CHANGELOG.md" >&2
+            exit 1
+          fi
+          {
+            printf '%s\n' "${section}"
+            printf '\n---\n\n'
+            printf 'Full changelog: https://github.com/%s/blob/%s/CHANGELOG.md\n' \
+              "${GITHUB_REPOSITORY}" "${{ steps.tag.outputs.tag }}"
+            printf '\n---\n\n'
+            printf 'About siGit Code: [sigit.si/code](https://sigit.si/code)\n'
+          } > release_notes.md
+          cat release_notes.md
+
       - name: Download binary artifacts
         uses: actions/download-artifact@v4
         with:
@@ -258,6 +293,7 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ steps.tag.outputs.tag }}
+          body_path: release_notes.md
           files: release/*
 
       # These channels all publish somewhere outside this repo (a tap, a Scoop

{sigit_code-1.5.8 → sigit_code-1.5.9}/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 1.5.9
+
+### Fixed
+
+- **Kimi K3 tool calls no longer arrive as raw protocol text.** Kimi K3 renders
+  a call in Moonshot's XTML protocol — pipe-delimited open/sep/close tokens
+  wrapping named blocks — and when the serving stack doesn't parse that back
+  into structured tool calls, the whole block surfaced in the editor as literal
+  text and the turn ended as though the model had answered in prose. The
+  inline-call recovery now speaks that protocol alongside the legacy XML tags:
+  tools blocks are parsed into real calls (several per block, argument values
+  decoded and typed from the block's own type attribute or, when it is
+  missing, the turn's tool schemas), response blocks are unwrapped so their
+  text still renders, and think blocks are dropped as private reasoning rather
+  than shown. The streaming scanner watches all the opening markers, so a
+  block split across chunk boundaries still recovers
+- **GLM's mis-tagged calls recover too.** GLM sometimes precedes the legacy
+  block's first argument key with another tool-call opening tag instead of the
+  arg-key opening tag the format calls for, and the recovery rejected the
+  whole block when it did — the call surfaced as text and whatever it was
+  trying to do was dropped. The parser now accepts that alias for the first
+  argument only — later arguments stay strict, so text that merely resembles a
+  call cannot be recovered as one — in both the whole-blob and streaming
+  paths, and the scanner tolerates the malformed marker split across chunk
+  boundaries. Recovery in both protocols also checks the call's name against
+  the tools actually offered in the turn: a tag naming a tool that was never
+  in the turn's spec stays on screen instead of being executed
+
 ## 1.5.8
 
 ### What changed

{sigit_code-1.5.8 → sigit_code-1.5.9}/Cargo.lock

@@ -5778,7 +5778,7 @@ checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "sigit"
-version = "1.5.8"
+version = "1.5.9"
 dependencies = [
  "agent-client-protocol",
  "anyhow",

{sigit_code-1.5.8 → sigit_code-1.5.9}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sigit"
-version = "1.5.8"
+version = "1.5.9"
 edition = "2024"
 description = "siGit Code — ACP-compatible AI coding agent. Sí, git."
 documentation = "https://github.com/getsigit/sigit"

{sigit_code-1.5.8 → sigit_code-1.5.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sigit-code
-Version: 1.5.8
+Version: 1.5.9
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers