sigit-code 1.5.9__tar.gz → 1.5.11__tar.gz

{sigit_code-1.5.9 → sigit_code-1.5.11}/.agents/AGENTS.md

@@ -111,9 +111,13 @@ The agent loop is backend-agnostic. The flow: a turn (messages + tool specs) goe
 feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete backend.
 
 - **`src/main.rs`** — entry point, mode dispatch, the full ACP `Agent` impl (session lifecycle:
-  new/load/fork/prompt/cancel, config options, slash-command advertisement), and the `SYSTEM_PROMPT`
-  (note: it bakes in smbCloud-specific context the agent should use when the repo is clearly
-  smbCloud, and stay general otherwise).
+  new/load/fork/prompt/cancel, config options, slash-command advertisement), and the `SYSTEM_PROMPT`.
+  ACP session state owns its roots, conversation, and selected model even though the process has
+  one live backend; activating a thread parks and restores all three. Unknown session ids are
+  rejected instead of silently borrowing the active thread's cwd. Prompt cancellation is routed
+  outside `turn_lock`, which lets a client cancel the turn currently holding that lock. The
+  `SYSTEM_PROMPT` bakes in smbCloud-specific context the agent should use when the repo is clearly
+  smbCloud, and stay general otherwise.
 - **`src/backend.rs`** — the `InferenceBackend` trait and neutral types (`ToolSpec`, `ToolCall`,
   `ToolResult`, `TurnResult`). Two impls: `LocalBackend` (on-device via `onde::ChatEngine`) and
   `OpenAiBackend` (any OpenAI-compatible HTTP endpoint). A `BackendError` is user-facing: the
@@ -123,6 +127,10 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   endpoint can also fail *after* the response is open, reporting it as a `data:` frame holding
   the same envelope; that frame has no `choices`, so `consume_stream` has to check for it
   explicitly or it parses as an empty chunk and the turn ends looking like an empty answer.
+  Some models write tool calls into content as text; `src/inline_tool_calls.rs` recovers the
+  well-formed ones. A block that doesn't parse (or never closes) is dropped from both the reply
+  and history, and `OpenAiBackend::complete` retries once with a note telling the model the call
+  didn't run. Leaving the raw block in history makes the model invent `<function_results>` later.
 - **`src/provider.rs`** — decides *which* backend serves inference. Resolution order, first match
   wins: (1) override via `OPENAI_BASE_URL`+`OPENAI_API_KEY` or active profile in
   `~/.config/sigit/providers.toml`; (2) siGit Code Cloud when logged in; (3) on-device.
@@ -131,7 +139,8 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   `multi_edit`, `delete_file`, `run_command`, `write_todos`, `remember`. Add a tool in both the
   spec list (`all_tools`) and the execute `match` (`execute_tool`). `run_command` also enforces
   commit attribution: when a command creates a new commit that lacks the
-  `Co-Authored-By: siGit Code` trailer (`COMMIT_CO_AUTHOR_TRAILER`), it amends the trailer in —
+  `Co-Authored-By: siGit Code` trailer (`commit_co_author_trailer()`, which reads
+  `siGit Code v<version>-<acp|tui|headless>` from the surface `main` sets via `set_surface`), it amends the trailer in —
   unless the commit already exists on a remote, which is never rewritten. Every child process it
   spawns (`spawn_shell`, the `git` helpers, and `hooks.rs`) sets `stdin` to null and never
   inherits it: in ACP mode sigit's stdin is the JSON-RPC pipe from the editor, so a command that
@@ -243,12 +252,32 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   `handle_initialize` is what makes the rest of this reachable — without it Zed keeps the first
   root, drops the others, and shows "This agent doesn't currently support multi-root workspaces".
   The process still has one working directory, so the extra roots live in a
-  process-global here and `project_dirs()` returns cwd-first, extras after. Project-local
+  process-global here and `project_dirs()` returns cwd-first, extras after.
+  One process also serves every thread the editor has open, so that global
+  (with the cwd, the backend conversation, and the background-task owner in
+  `tools.rs`) always belongs to the *live* session: `main.rs` keeps a
+  `SessionState` per session id and `activate_session` parks the live one and
+  installs the requested one before any prompt or config change runs. Don't
+  read another session's roots from the global. Project-local
   discovery reads it: skills, slash commands, subagent types, and instruction files all scan
   every root. MCP is deliberately not on that list — `mcp::init` runs once at startup, before
   any session exists, so a second root's `.sigit/mcp.toml` has nobody to tell.
 - **`src/chat.rs`** — the Unix-only ratatui TUI. Loading-spinner phase then chat; uses
   `tokio::select!` to multiplex terminal events with streaming tokens.
+- **`src/headless.rs`** — non-interactive `sigit run` execution for scripts, CI, and Factory
+  clients. The legacy `-p` form reaches the same parser. Every new run gets a UUID session id;
+  `--resume <id>` restores that session through `session_store`, and `--output jsonl` emits a
+  structured session/delta/tool/result stream while logs stay on stderr. Headless permission
+  prompts collapse to denial unless the tool was pre-approved with `--allow-tool`.
+- **`src/session_store.rs`** — durable conversations: one JSON-lines history file per session at
+  `$SIGIT_CONFIG_DIR/sessions/<id>.jsonl`, written atomically, restorable into either backend.
+  Each save also writes a `<id>.meta.json` sidecar naming the session's `cwd` and the extra roots
+  of a multi-root project. That sidecar is what makes a thread *listable*: ACP's `session/list`
+  (advertised as `sessionCapabilities.list`, handled by `handle_list_sessions` in `main.rs` — the
+  editor's "Import Threads" picker) must report an absolute `cwd` per session and may filter on
+  it, so a session without one is skipped there while still reopening by id through
+  `session/load`. Sidecars are written at save time, not at session start, so a thread nobody
+  spoke in leaves nothing behind.
 - **`src/setup.rs`** — model cache location, local model discovery, selected-model persistence.
   Must run (`setup_shared_model_cache`) *before* anything touches `ChatEngine`/`hf-hub`, since
   those read env vars once at init.

{sigit_code-1.5.9/.claude → sigit_code-1.5.11/.agents}/skills/agent-client-protocol/SKILL.md

@@ -196,6 +196,7 @@ the connection and the agent anymore. Don't reintroduce the mpsc forwarder patte
 | `NewSessionRequest` | `handle_new_session` | sets cwd, resets history, advertises commands + config options |
 | `LoadSessionRequest` | `handle_load_session` | like new_session; gated by `load_session(true)` capability |
 | `ForkSessionRequest` | `handle_fork_session` | gated by `unstable_session_fork` + `SessionForkCapabilities` |
+| `ListSessionsRequest` | `handle_list_sessions` | the editor's "Import Threads" picker; gated by `SessionListCapabilities` |
 | `PromptRequest` | `handle_prompt` | the turn: parse blocks → slash commands or tool-calling loop |
 | `SetSessionConfigOptionRequest` | `handle_set_session_config_option` | the Zed model picker — switches/downloads models |
 | `CancelNotification` | `handle_cancel` | notification, no response |
@@ -226,7 +227,8 @@ Ok(InitializeResponse::new(ProtocolVersion::V1)        // use V1, not args.proto
             .load_session(true)                        // enables LoadSessionRequest
             .session_capabilities(
                 SessionCapabilities::new()
-                    .fork(SessionForkCapabilities::new()),  // enables ForkSessionRequest
+                    .fork(SessionForkCapabilities::new())   // enables ForkSessionRequest
+                    .list(SessionListCapabilities::new()),  // enables ListSessionsRequest
             ),
     )
     .meta(initialize_meta()))                          // free-form Meta (see below)
@@ -573,6 +575,14 @@ Editor                                Agent
 12. **Store `SessionId` as `SessionId`**, not `String`, so `==` is clean.
 13. **`SetSessionConfigOptionResponse::new(config_options)`** — the response
     carries the *rebuilt* options so the picker reflects the new current value.
+14. **`session/list` needs a `cwd` per session, which history alone can't
+    supply.** `SessionInfo` requires an absolute `cwd` and the request may
+    filter on it, so `session_store` writes a `<id>.meta.json` sidecar next to
+    each saved thread; sessions without one are skipped by
+    `handle_list_sessions` rather than guessed at. Advertising
+    `SessionCapabilities::new().list(SessionListCapabilities::new())` is what
+    turns the editor's "Import Threads" picker from an error banner into a
+    list.
 
 ---
 

{sigit_code-1.5.9/.agents → sigit_code-1.5.11/.claude}/skills/agent-client-protocol/SKILL.md

@@ -196,6 +196,7 @@ the connection and the agent anymore. Don't reintroduce the mpsc forwarder patte
 | `NewSessionRequest` | `handle_new_session` | sets cwd, resets history, advertises commands + config options |
 | `LoadSessionRequest` | `handle_load_session` | like new_session; gated by `load_session(true)` capability |
 | `ForkSessionRequest` | `handle_fork_session` | gated by `unstable_session_fork` + `SessionForkCapabilities` |
+| `ListSessionsRequest` | `handle_list_sessions` | the editor's "Import Threads" picker; gated by `SessionListCapabilities` |
 | `PromptRequest` | `handle_prompt` | the turn: parse blocks → slash commands or tool-calling loop |
 | `SetSessionConfigOptionRequest` | `handle_set_session_config_option` | the Zed model picker — switches/downloads models |
 | `CancelNotification` | `handle_cancel` | notification, no response |
@@ -226,7 +227,8 @@ Ok(InitializeResponse::new(ProtocolVersion::V1)        // use V1, not args.proto
             .load_session(true)                        // enables LoadSessionRequest
             .session_capabilities(
                 SessionCapabilities::new()
-                    .fork(SessionForkCapabilities::new()),  // enables ForkSessionRequest
+                    .fork(SessionForkCapabilities::new())   // enables ForkSessionRequest
+                    .list(SessionListCapabilities::new()),  // enables ListSessionsRequest
             ),
     )
     .meta(initialize_meta()))                          // free-form Meta (see below)
@@ -573,6 +575,14 @@ Editor                                Agent
 12. **Store `SessionId` as `SessionId`**, not `String`, so `==` is clean.
 13. **`SetSessionConfigOptionResponse::new(config_options)`** — the response
     carries the *rebuilt* options so the picker reflects the new current value.
+14. **`session/list` needs a `cwd` per session, which history alone can't
+    supply.** `SessionInfo` requires an absolute `cwd` and the request may
+    filter on it, so `session_store` writes a `<id>.meta.json` sidecar next to
+    each saved thread; sessions without one are skipped by
+    `handle_list_sessions` rather than guessed at. Advertising
+    `SessionCapabilities::new().list(SessionListCapabilities::new())` is what
+    turns the editor's "Import Threads" picker from an error banner into a
+    list.
 
 ---
 

{sigit_code-1.5.9 → sigit_code-1.5.11}/AGENTS.md

@@ -111,9 +111,13 @@ The agent loop is backend-agnostic. The flow: a turn (messages + tool specs) goe
 feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete backend.
 
 - **`src/main.rs`** — entry point, mode dispatch, the full ACP `Agent` impl (session lifecycle:
-  new/load/fork/prompt/cancel, config options, slash-command advertisement), and the `SYSTEM_PROMPT`
-  (note: it bakes in smbCloud-specific context the agent should use when the repo is clearly
-  smbCloud, and stay general otherwise).
+  new/load/fork/prompt/cancel, config options, slash-command advertisement), and the `SYSTEM_PROMPT`.
+  ACP session state owns its roots, conversation, and selected model even though the process has
+  one live backend; activating a thread parks and restores all three. Unknown session ids are
+  rejected instead of silently borrowing the active thread's cwd. Prompt cancellation is routed
+  outside `turn_lock`, which lets a client cancel the turn currently holding that lock. The
+  `SYSTEM_PROMPT` bakes in smbCloud-specific context the agent should use when the repo is clearly
+  smbCloud, and stay general otherwise.
 - **`src/backend.rs`** — the `InferenceBackend` trait and neutral types (`ToolSpec`, `ToolCall`,
   `ToolResult`, `TurnResult`). Two impls: `LocalBackend` (on-device via `onde::ChatEngine`) and
   `OpenAiBackend` (any OpenAI-compatible HTTP endpoint). A `BackendError` is user-facing: the
@@ -123,6 +127,10 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   endpoint can also fail *after* the response is open, reporting it as a `data:` frame holding
   the same envelope; that frame has no `choices`, so `consume_stream` has to check for it
   explicitly or it parses as an empty chunk and the turn ends looking like an empty answer.
+  Some models write tool calls into content as text; `src/inline_tool_calls.rs` recovers the
+  well-formed ones. A block that doesn't parse (or never closes) is dropped from both the reply
+  and history, and `OpenAiBackend::complete` retries once with a note telling the model the call
+  didn't run. Leaving the raw block in history makes the model invent `<function_results>` later.
 - **`src/provider.rs`** — decides *which* backend serves inference. Resolution order, first match
   wins: (1) override via `OPENAI_BASE_URL`+`OPENAI_API_KEY` or active profile in
   `~/.config/sigit/providers.toml`; (2) siGit Code Cloud when logged in; (3) on-device.
@@ -131,7 +139,8 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   `multi_edit`, `delete_file`, `run_command`, `write_todos`, `remember`. Add a tool in both the
   spec list (`all_tools`) and the execute `match` (`execute_tool`). `run_command` also enforces
   commit attribution: when a command creates a new commit that lacks the
-  `Co-Authored-By: siGit Code` trailer (`COMMIT_CO_AUTHOR_TRAILER`), it amends the trailer in —
+  `Co-Authored-By: siGit Code` trailer (`commit_co_author_trailer()`, which reads
+  `siGit Code v<version>-<acp|tui|headless>` from the surface `main` sets via `set_surface`), it amends the trailer in —
   unless the commit already exists on a remote, which is never rewritten. Every child process it
   spawns (`spawn_shell`, the `git` helpers, and `hooks.rs`) sets `stdin` to null and never
   inherits it: in ACP mode sigit's stdin is the JSON-RPC pipe from the editor, so a command that
@@ -243,12 +252,32 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   `handle_initialize` is what makes the rest of this reachable — without it Zed keeps the first
   root, drops the others, and shows "This agent doesn't currently support multi-root workspaces".
   The process still has one working directory, so the extra roots live in a
-  process-global here and `project_dirs()` returns cwd-first, extras after. Project-local
+  process-global here and `project_dirs()` returns cwd-first, extras after.
+  One process also serves every thread the editor has open, so that global
+  (with the cwd, the backend conversation, and the background-task owner in
+  `tools.rs`) always belongs to the *live* session: `main.rs` keeps a
+  `SessionState` per session id and `activate_session` parks the live one and
+  installs the requested one before any prompt or config change runs. Don't
+  read another session's roots from the global. Project-local
   discovery reads it: skills, slash commands, subagent types, and instruction files all scan
   every root. MCP is deliberately not on that list — `mcp::init` runs once at startup, before
   any session exists, so a second root's `.sigit/mcp.toml` has nobody to tell.
 - **`src/chat.rs`** — the Unix-only ratatui TUI. Loading-spinner phase then chat; uses
   `tokio::select!` to multiplex terminal events with streaming tokens.
+- **`src/headless.rs`** — non-interactive `sigit run` execution for scripts, CI, and Factory
+  clients. The legacy `-p` form reaches the same parser. Every new run gets a UUID session id;
+  `--resume <id>` restores that session through `session_store`, and `--output jsonl` emits a
+  structured session/delta/tool/result stream while logs stay on stderr. Headless permission
+  prompts collapse to denial unless the tool was pre-approved with `--allow-tool`.
+- **`src/session_store.rs`** — durable conversations: one JSON-lines history file per session at
+  `$SIGIT_CONFIG_DIR/sessions/<id>.jsonl`, written atomically, restorable into either backend.
+  Each save also writes a `<id>.meta.json` sidecar naming the session's `cwd` and the extra roots
+  of a multi-root project. That sidecar is what makes a thread *listable*: ACP's `session/list`
+  (advertised as `sessionCapabilities.list`, handled by `handle_list_sessions` in `main.rs` — the
+  editor's "Import Threads" picker) must report an absolute `cwd` per session and may filter on
+  it, so a session without one is skipped there while still reopening by id through
+  `session/load`. Sidecars are written at save time, not at session start, so a thread nobody
+  spoke in leaves nothing behind.
 - **`src/setup.rs`** — model cache location, local model discovery, selected-model persistence.
   Must run (`setup_shared_model_cache`) *before* anything touches `ChatEngine`/`hf-hub`, since
   those read env vars once at init.

{sigit_code-1.5.9 → sigit_code-1.5.11}/CHANGELOG.md

@@ -1,5 +1,145 @@
 # Changelog
 
+## Unreleased
+
+## 1.5.11
+
+### Added
+
+- **`sigit run` drives the agent headlessly with resumable sessions.** A new
+  non-interactive subcommand runs a prompt through the same agent loop as the
+  editor and terminal surfaces, for scripts, CI, and Factory clients. Every run
+  gets a UUID session id, writes a JSON-lines history file under
+  `~/.config/sigit/sessions/`, and can be restored with `--resume <id>`.
+  `--output jsonl` emits a structured session/delta/tool/result stream on
+  stdout while logs stay on stderr, and `--allow-tool` pre-approves a tool so
+  permission prompts collapse to denial in a non-interactive context. The
+  legacy `-p` form still works. Each run also rewrites the session metadata
+  with its own cwd and extra roots, so resuming keeps multi-root projects
+
+- **Saved threads can be imported into the editor.** siGit Code now advertises
+  ACP's `sessionCapabilities.list` and answers `session/list`, so Zed's "Import
+  Threads" picker offers the conversations stored under
+  `~/.config/sigit/sessions/` instead of reporting that the agent doesn't
+  support the capability. A saved session gets a sidecar recording the project
+  directory it ran in — listing reports that `cwd`, the extra roots of a
+  multi-root project, an ISO 8601 last-activity timestamp, and a title taken
+  from the first user message — and a request may filter on `cwd` so one
+  project is never offered another's threads. Threads saved before this have no
+  sidecar and are not listed; they still reopen by id through `session/load`
+
+### Changed
+
+- **The commit trailer names the siGit Code version and surface.** Commits
+  siGit Code makes now end with
+  `Co-Authored-By: siGit Code v<version>-<surface> <noreply@sigit.si>` instead
+  of the bare name, where the surface is `acp` (an editor), `tui` (the
+  terminal UI), or `headless` (`sigit run`). The model changes from session to
+  session; the version and surface tell you which build of the agent wrote the
+  commit and how it was driven. GitHub still credits the co-author, since it
+  matches on the address. A commit that already carries a siGit Code trailer
+  from an older version is left alone
+
+- **The terminal UI's model knows which directory the project is in.** The
+  editor (ACP) and headless paths put the working directory in the system
+  prompt, but the terminal UI only added the project's instruction files, so
+  on `/init` a small on-device model invented a `AGENTS.md` path and failed.
+  All three places the terminal UI builds a prompt now go through the same
+  session context path the ACP sessions get. The cloud tier switch had also
+  been dropping the instruction files; that's fixed too
+
+- **An empty `write_todos` list clears the plan.** `write_todos` rejected an
+  empty list, so the model had no way to clear a finished checklist and the
+  last plan stayed in the editor until the session ended. An empty list now
+  returns "Task list cleared." and goes to the client as an ACP plan with no
+  entries. The tool description tells the model it can do this
+
+- **`sigit run` gives clearer usage errors.** A second positional prompt says
+  "unexpected extra argument", a bare `sigit run` says "missing prompt", and a
+  mistyped flag like `--quite` is rejected instead of becoming the prompt
+
+### Fixed
+
+- **Each ACP session keeps its own roots, conversation, and tasks.** Zed runs
+  one siGit process for every open thread, but the process had a single cwd,
+  workspace root list, backend conversation, and background task table. The
+  most recent session owned all of them, so a prompt from an older thread ran
+  against another repo with another thread's history. A `SessionState` is now
+  kept per session id; before a prompt or config change runs, the live
+  conversation is parked and the requested session's cwd, extra roots, and
+  conversation are installed, rebuilding the system prompt from its roots.
+  `new`/`load`/`fork` share a single session-opening path, and fork carries the
+  source thread's conversation. Background tasks are scoped to the session that
+  started them, opening a session no longer wipes every other session's
+  permission grants, and model selection is routed per session
+
+- **New sessions no longer carry the previous thread's history.** Opening a
+  new thread in Zed showed a `[Conversation summary]` from an earlier session.
+  The session handlers cleared the on-device engine but not the history a cloud
+  backend keeps for itself, and the startup routing to the cloud tier then
+  carried that history into the installed backend. A provider override had the
+  same leak. All session entry points now share a path that strips stale
+  history too, and unknown session ids are rejected instead of borrowing the
+  live thread's state
+
+- **Unparseable tool-call markup is hidden and retried, not shown as text.**
+  Some models write tool calls into the reply as text. Well-formed blocks were
+  already recovered and run, but a block that failed to parse or never closed
+  was printed to the editor as-is and stayed in history, so the model later
+  read back a call it had "made" with no result and began writing invented
+  `<function_results>`. The scanner now reports those blocks as malformed; the
+  backend drops them from the reply and history, and when the only tool call
+  was malformed the model gets one retry telling it the call didn't run. A
+  block that merely *mentions* a tool-call marker (a backticked `<tool_call>` or an
+  unclosed XTML `<|open|>tools`) is now kept as prose, so a reply explaining
+  the scanner no longer loses everything after the first marker. The
+  non-streamed path now strips broken blocks beside structured calls and runs
+  any inline calls that did parse, matching the streaming path
+
+- **The co-author trailer ends a conflicted merge commit.** Finishing a
+  conflicted merge with `git commit --no-edit` keeps git's `# Conflicts:` list
+  in the message, since no editor runs to strip it. When siGit Code then added
+  its trailer, the trailer went in above that list, so it was no longer the last
+  paragraph and GitHub didn't credit the co-author. The amend now drops the
+  leftover comment block and puts the trailer last. It also fixes a commit
+  that already has the trailer but still ends in that block
+
+## 1.5.10
+
+### What changed
+
+- **Xcode's context no longer buries slash commands.** Xcode sends the user's
+  prompt as the last of several text blocks, with project context in the
+  blocks before it, so `/models` and friends sat in the middle of joined text
+  and were handed to the model instead of dispatching locally. Slash-command
+  parsing now searches the prompt's text blocks from the end, so a standalone
+  command in the final user block dispatches no matter what context the client
+  prepends
+- **The nova tier is the default cloud engine.** When local inference is off
+  and no explicit provider override is set, the cloud tier now defaults to
+  `nova` (the `onde-nova` model) instead of the balanced tier, in both the
+  interactive and headless paths
+
+### Fixed
+
+- **Malformed Chinese-model tool calls are handled end-to-end in ACP.** The
+  inline-call recovery that 1.5.9 added for Kimi K3's XTML protocol and GLM's
+  mis-tagged blocks only applied to the interactive and headless surfaces;
+  the ACP path never ran it, so an editor session still surfaced raw protocol
+  text and dropped the calls. Recovery now runs in the ACP prompt loop too,
+  covered by integration tests, and the tool names are checked against the
+  turn's offered tools before anything executes
+- **Suppressed tool-call log spam is gone.** The guard that logs when a
+  structured call is dropped for arriving as forced text fired once per
+  streamed argument fragment — one malformed call could log a warning per
+  chunk. The check now fires once per turn with the count and names of what
+  was dropped, and the non-streaming path reports the same
+- **A history-replay test no longer races on the process cwd.** One ACP test
+  built its expected path from `std::env::current_dir()` while other tests
+  briefly swap that process-global cwd, so on CI it could read a temp
+  directory mid-swap and compare a truncated title against an untruncated
+  expectation. It now uses a fixed path it never needed to derive
+
 ## 1.5.9
 
 ### Fixed

{sigit_code-1.5.9 → sigit_code-1.5.11}/CLAUDE.md

@@ -111,9 +111,13 @@ The agent loop is backend-agnostic. The flow: a turn (messages + tool specs) goe
 feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete backend.
 
 - **`src/main.rs`** — entry point, mode dispatch, the full ACP `Agent` impl (session lifecycle:
-  new/load/fork/prompt/cancel, config options, slash-command advertisement), and the `SYSTEM_PROMPT`
-  (note: it bakes in smbCloud-specific context the agent should use when the repo is clearly
-  smbCloud, and stay general otherwise).
+  new/load/fork/prompt/cancel, config options, slash-command advertisement), and the `SYSTEM_PROMPT`.
+  ACP session state owns its roots, conversation, and selected model even though the process has
+  one live backend; activating a thread parks and restores all three. Unknown session ids are
+  rejected instead of silently borrowing the active thread's cwd. Prompt cancellation is routed
+  outside `turn_lock`, which lets a client cancel the turn currently holding that lock. The
+  `SYSTEM_PROMPT` bakes in smbCloud-specific context the agent should use when the repo is clearly
+  smbCloud, and stay general otherwise.
 - **`src/backend.rs`** — the `InferenceBackend` trait and neutral types (`ToolSpec`, `ToolCall`,
   `ToolResult`, `TurnResult`). Two impls: `LocalBackend` (on-device via `onde::ChatEngine`) and
   `OpenAiBackend` (any OpenAI-compatible HTTP endpoint). A `BackendError` is user-facing: the
@@ -123,6 +127,10 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   endpoint can also fail *after* the response is open, reporting it as a `data:` frame holding
   the same envelope; that frame has no `choices`, so `consume_stream` has to check for it
   explicitly or it parses as an empty chunk and the turn ends looking like an empty answer.
+  Some models write tool calls into content as text; `src/inline_tool_calls.rs` recovers the
+  well-formed ones. A block that doesn't parse (or never closes) is dropped from both the reply
+  and history, and `OpenAiBackend::complete` retries once with a note telling the model the call
+  didn't run. Leaving the raw block in history makes the model invent `<function_results>` later.
 - **`src/provider.rs`** — decides *which* backend serves inference. Resolution order, first match
   wins: (1) override via `OPENAI_BASE_URL`+`OPENAI_API_KEY` or active profile in
   `~/.config/sigit/providers.toml`; (2) siGit Code Cloud when logged in; (3) on-device.
@@ -131,7 +139,8 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   `multi_edit`, `delete_file`, `run_command`, `write_todos`, `remember`. Add a tool in both the
   spec list (`all_tools`) and the execute `match` (`execute_tool`). `run_command` also enforces
   commit attribution: when a command creates a new commit that lacks the
-  `Co-Authored-By: siGit Code` trailer (`COMMIT_CO_AUTHOR_TRAILER`), it amends the trailer in —
+  `Co-Authored-By: siGit Code` trailer (`commit_co_author_trailer()`, which reads
+  `siGit Code v<version>-<acp|tui|headless>` from the surface `main` sets via `set_surface`), it amends the trailer in —
   unless the commit already exists on a remote, which is never rewritten. Every child process it
   spawns (`spawn_shell`, the `git` helpers, and `hooks.rs`) sets `stdin` to null and never
   inherits it: in ACP mode sigit's stdin is the JSON-RPC pipe from the editor, so a command that
@@ -243,12 +252,32 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   `handle_initialize` is what makes the rest of this reachable — without it Zed keeps the first
   root, drops the others, and shows "This agent doesn't currently support multi-root workspaces".
   The process still has one working directory, so the extra roots live in a
-  process-global here and `project_dirs()` returns cwd-first, extras after. Project-local
+  process-global here and `project_dirs()` returns cwd-first, extras after.
+  One process also serves every thread the editor has open, so that global
+  (with the cwd, the backend conversation, and the background-task owner in
+  `tools.rs`) always belongs to the *live* session: `main.rs` keeps a
+  `SessionState` per session id and `activate_session` parks the live one and
+  installs the requested one before any prompt or config change runs. Don't
+  read another session's roots from the global. Project-local
   discovery reads it: skills, slash commands, subagent types, and instruction files all scan
   every root. MCP is deliberately not on that list — `mcp::init` runs once at startup, before
   any session exists, so a second root's `.sigit/mcp.toml` has nobody to tell.
 - **`src/chat.rs`** — the Unix-only ratatui TUI. Loading-spinner phase then chat; uses
   `tokio::select!` to multiplex terminal events with streaming tokens.
+- **`src/headless.rs`** — non-interactive `sigit run` execution for scripts, CI, and Factory
+  clients. The legacy `-p` form reaches the same parser. Every new run gets a UUID session id;
+  `--resume <id>` restores that session through `session_store`, and `--output jsonl` emits a
+  structured session/delta/tool/result stream while logs stay on stderr. Headless permission
+  prompts collapse to denial unless the tool was pre-approved with `--allow-tool`.
+- **`src/session_store.rs`** — durable conversations: one JSON-lines history file per session at
+  `$SIGIT_CONFIG_DIR/sessions/<id>.jsonl`, written atomically, restorable into either backend.
+  Each save also writes a `<id>.meta.json` sidecar naming the session's `cwd` and the extra roots
+  of a multi-root project. That sidecar is what makes a thread *listable*: ACP's `session/list`
+  (advertised as `sessionCapabilities.list`, handled by `handle_list_sessions` in `main.rs` — the
+  editor's "Import Threads" picker) must report an absolute `cwd` per session and may filter on
+  it, so a session without one is skipped there while still reopening by id through
+  `session/load`. Sidecars are written at save time, not at session start, so a thread nobody
+  spoke in leaves nothing behind.
 - **`src/setup.rs`** — model cache location, local model discovery, selected-model persistence.
   Must run (`setup_shared_model_cache`) *before* anything touches `ChatEngine`/`hf-hub`, since
   those read env vars once at init.

{sigit_code-1.5.9 → sigit_code-1.5.11}/Cargo.lock

@@ -5778,7 +5778,7 @@ checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "sigit"
-version = "1.5.9"
+version = "1.5.11"
 dependencies = [
  "agent-client-protocol",
  "anyhow",

{sigit_code-1.5.9 → sigit_code-1.5.11}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sigit"
-version = "1.5.9"
+version = "1.5.11"
 edition = "2024"
 description = "siGit Code — ACP-compatible AI coding agent. Sí, git."
 documentation = "https://github.com/getsigit/sigit"

{sigit_code-1.5.9 → sigit_code-1.5.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sigit-code
-Version: 1.5.9
+Version: 1.5.11
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
@@ -57,7 +57,8 @@ This installs a native `sigit` binary for your platform. You do not need a compi
 sigit
 ```
 
-That opens the local chat UI.
+That opens the local chat UI. Editors drive the same binary in ACP mode, which
+needs the `--acp` argument.
 
 ### Zed
 
@@ -68,7 +69,8 @@ siGit Code works as an [ACP-compatible](https://github.com/nicobailon/agent-clie
   "agent_servers": {
     "siGit Code": {
       "type": "custom",
-      "command": "/absolute/path/to/sigit"
+      "command": "/absolute/path/to/sigit",
+      "args": ["--acp"]
     }
   }
 }

{sigit_code-1.5.9 → sigit_code-1.5.11}/README.md

@@ -8,7 +8,8 @@
   <a href="https://github.com/getsigit/sigit/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-235843?style=flat-square&labelColor=17211D" alt="License"></a>
 </p>
 
-siGit Code is a local coding agent. It runs on your machine, not someone else's. No API keys, no cloud round-trips, no subscription.
+siGit Code is the local agent runtime for **siGit Factory**. It runs on your machine by default,
+with optional cloud inference and remote automation when you choose them.
 
 Its home is [code.sigit.si](https://code.sigit.si). You can run it yourself, as below, or use the hosted version (siGit Code Cloud) there if you would rather not run a model locally. [sigit.si](https://sigit.si) is Git hosting built for AI workflows.
 
@@ -16,9 +17,13 @@ It works in any codebase. In smbCloud repos it is more useful out of the box bec
 
 You can use it in two ways:
 
-- **ACP mode:** Zed or another ACP-compatible editor starts it over stdio
+- **ACP mode:** Zed or another ACP-compatible editor starts it over stdio with the `--acp` argument
 - **Terminal mode:** run `sigit` for the interactive chat UI
 
+Every ACP client must pass `--acp`. It takes no other arguments, and it is what
+tells the binary to speak the Agent Client Protocol instead of opening the
+terminal UI.
+
 | Platform | ACP mode | Terminal mode |
 |----------|----------|---------------|
 | macOS | ✓ | ✓ |
@@ -59,7 +64,8 @@ Add this to `~/.config/zed/settings.json`:
   "agent_servers": {
     "siGit Code": {
       "type": "custom",
-      "command": "/absolute/path/to/sigit"
+      "command": "/absolute/path/to/sigit",
+      "args": ["--acp"]
     }
   }
 }
@@ -74,8 +80,8 @@ In Xcode, open **Settings > Intelligence > Agents**, add a custom agent, and set
 - **Executable:** the absolute path to `sigit`
 - **Arguments:** `--acp`
 
-The explicit `--acp` mode is designed for Xcode: it loads the selected on-device
-model on the first prompt, so you do not need to send `/load` from the Xcode chat.
+In Xcode the `--acp` mode also loads the selected on-device model on the first
+prompt, so you do not need to send `/load` from the Xcode chat.
 
 To let siGit use Xcode's build, test, and project tools, enable **Allow external
 agents to use Xcode tools** in Xcode's Intelligence settings, keep the project
@@ -100,7 +106,7 @@ Install from the [Visual Studio Code Marketplace](https://marketplace.visualstud
     "sigit": {
       "name": "siGit (on-device)",
       "command": "sigit",
-      "args": [],
+      "args": ["--acp"],
       "env": {}
     },
   },
@@ -117,7 +123,7 @@ Install [ACP Client](https://marketplace.visualstudio.com/items?itemName=formula
   "acp.agents": {
     "siGit Code": {
       "command": "sigit",
-      "args": [],
+      "args": ["--acp"],
       "env": {}
     }
   }
@@ -130,6 +136,34 @@ Run `sigit` in a terminal and you get the same model and system prompt as the ed
 
 Terminal mode currently needs Unix terminal behavior, so it works on macOS and Linux only.
 
+## Headless and CI mode
+
+Use `sigit run` to execute the same agent from scripts, CI, or another siGit Factory client:
+
+```sh
+sigit run "Review this repository and run the focused tests" --cwd .
+```
+
+Every run receives a durable session ID. The ID is printed to stderr in text mode and included
+in every event in JSONL mode. Resume the same conversation from a later command—or import it in
+an ACP client—by passing that ID:
+
+```sh
+sigit run "Continue with the next issue" --resume <session-id>
+```
+
+For automation, JSONL output provides session, assistant-delta, tool-call, tool-result, result,
+and error events on stdout. Logs remain on stderr.
+
+```sh
+sigit run "Run the checks" --output jsonl --allow-tool run_command
+```
+
+Mutating tools still follow siGit's permission policy. Because a headless run cannot answer an
+interactive permission prompt, approve only the tools the run needs with repeatable
+`--allow-tool` flags. The legacy `sigit -p "<prompt>"` form remains supported. See the
+[headless execution reference](docs/headless.md) for the event contract and exit codes.
+
 ## Platform support
 
 | Platform | Architecture |

sigit_code-1.5.11/docs/headless.md

@@ -0,0 +1,64 @@
+# Headless execution
+
+`sigit run` exposes the siGit Code agent runtime to scripts, CI, and siGit Factory clients.
+It uses the same provider selection, project instructions, skills, tools, MCP servers, and
+permission policy as the interactive and ACP surfaces.
+
+## Run and resume
+
+```sh
+sigit run "Review this repository" --cwd /path/to/repository
+```
+
+A new run receives a UUID session ID and saves its conversation under the siGit configuration
+directory. Text mode prints the ID to stderr as `Session: <id>`. Resume it later with:
+
+```sh
+sigit run "Continue with the fixes" --resume <id>
+```
+
+The saved metadata includes the primary working directory, additional project roots, and model.
+This makes the same session discoverable through ACP `session/list` and loadable by an editor.
+Each run rewrites that metadata with its own `--cwd` and `--add-dir` values, so a resume records
+where the session last ran. Pass the same `--add-dir` flags again to keep extra roots attached.
+
+Use repeatable `--add-dir <path>` flags for multi-root workspaces. Mutating tools that would ask
+for interactive permission are denied in headless mode unless granted with
+`--allow-tool <name>`. A repeatable `--deny-tool <name>` takes precedence over grants and
+settings.
+
+## JSONL output
+
+Pass `--output jsonl` for a machine-readable stdout stream:
+
+```sh
+sigit run "Run the focused tests" --output jsonl --allow-tool run_command
+```
+
+Each line is one JSON object. Every event includes `type` and `session_id`. A run that gets as far
+as inference starts with a `session` event. A run that fails before that, because no remote
+provider is configured or the `--resume` session doesn't exist, emits a single `error` event and
+nothing else.
+
+| Type | Additional fields | Meaning |
+|---|---|---|
+| `session` | `resumed` | Identifies the run before inference starts. |
+| `assistant_delta` | `text` | One visible streamed response fragment. |
+| `tool_call` | `tool_call_id`, `name`, `arguments` | A tool requested by the model. `arguments` is the tool's JSON string. |
+| `tool_result` | `tool_call_id`, `name`, `content` | The executed result or permission denial returned to the model. |
+| `result` | `text`, `tool_rounds` | The completed turn and its final visible text. |
+| `error` | `message` | A provider, session, or inference failure. |
+
+Logs and diagnostics stay on stderr. `--quiet` applies only to text output and cannot be combined
+with JSONL output.
+
+## Exit codes
+
+| Code | Meaning |
+|---|---|
+| `0` | The turn completed, including turns where a tool was denied by policy. |
+| `1` | Provider resolution, session restoration, inference, or tool-loop failure. |
+| `2` | Invalid command-line arguments or working directories. |
+
+The earlier `sigit -p "<prompt>"` syntax remains an alias for headless execution and accepts the
+same flags.