sigit-code 1.6.0__tar.gz → 1.6.2__tar.gz

{sigit_code-1.6.0 → sigit_code-1.6.2}/.agents/AGENTS.md

@@ -127,10 +127,31 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   endpoint can also fail *after* the response is open, reporting it as a `data:` frame holding
   the same envelope; that frame has no `choices`, so `consume_stream` has to check for it
   explicitly or it parses as an empty chunk and the turn ends looking like an empty answer.
+  `TurnResult::finish` carries the endpoint's `finish_reason` up to the loop, and
+  `stop_reason_for` in `main.rs` turns it into the ACP stop reason: the tool-round cap is
+  `max_turn_requests`, `length` is `max_tokens`, `content_filter` is `refusal`. ACP defines a
+  refusal as a turn the next prompt will not include, so `handle_prompt` restores the history
+  it snapshotted before the turn instead of only relabelling the response.
+  The round that reaches the cap (24, or `SIGIT_MAX_TOOL_ROUNDS`) is followed by one forced
+  text reply with no tools. The model cannot see that the tools are gone, so
+  `round_cap_note` is appended to that round's last tool result, and the turn always closes
+  with `round_cap_stop_message`. Without both, the thread stops on the model announcing a
+  step that never runs (issue #120).
   Some models write tool calls into content as text; `src/inline_tool_calls.rs` recovers the
   well-formed ones. A block that doesn't parse (or never closes) is dropped from both the reply
   and history, and `OpenAiBackend::complete` retries once with a note telling the model the call
   didn't run. Leaving the raw block in history makes the model invent `<function_results>` later.
+  Image attachments: ACP fixes `promptCapabilities.image` for the whole connection, while the
+  model can change on any turn, so the capability is always advertised and the decision is made
+  per prompt. `InferenceBackend::accepts_images` answers for the active model (on-device: no;
+  remote: `provider::model_accepts_images`, which reads the hard-coded `IMAGE_TIERS` for
+  `onde-*` ids and says yes for a user's own endpoint). `images_for_turn` in `main.rs` either
+  passes the images to `send_message_with_images` or drops them with a note to the user and a
+  bracketed note to the model. A message with images is stored in history as OpenAI content
+  parts and stays that way; `OpenAiBackend` strips the images per request (`without_images`)
+  when its model cannot read them, which is what makes a mid-thread switch to a text-only tier
+  safe. Read history text through `backend::message_text`, never `content.as_str()`.
+  `IMAGE_TIERS` mirrors onde-cloud's `IMAGE_CANDIDATES`; update both together.
 - **`src/provider.rs`** — decides *which* backend serves inference. Resolution order, first match
   wins: (1) override via `OPENAI_BASE_URL`+`OPENAI_API_KEY` or active profile in
   `~/.config/sigit/providers.toml`; (2) siGit Code Cloud when logged in; (3) on-device.
@@ -243,7 +264,11 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   overrides and the default mode from `[permissions]` in `settings.toml` (`allow`/`ask`/`deny`,
   default `ask`; `SIGIT_PERMISSIONS` env overrides the default). On `ask`, the ACP path sends
   `session/request_permission` (allow once / allow for session / deny) and the TUI pauses the
-  inference task on a y/a/n prompt. Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
+  inference task on a y/a/n prompt. On the ACP path the decision is taken *before* the call is
+  announced, because it sets the announced status: a call that will ask starts `pending`, the
+  permission request carries that call's own id, and an `in_progress` update follows approval.
+  That update also puts the card's title back, since the permission request overwrites it
+  with the full arguments. Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
   serialized by `SiGitAgent::turn_lock` so the dispatch loop can route the client's permission
   answer mid-turn — don't move them back inline, and don't await client requests from inline
   handlers (deadlock).
@@ -274,6 +299,23 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   every root. MCP is deliberately not on that list — `mcp::init` runs once at startup, before
   any session exists, so a second root's `.sigit/mcp.toml` has nobody to tell. (The servers a
   client names in `mcpServers` are a different thing and are per session; see `src/mcp.rs`.)
+- **`src/client_fs.rs`** — file reads and writes through the ACP client. A client that
+  advertises `fs.readTextFile` / `fs.writeTextFile` in `initialize` serves `fs/read_text_file`
+  and `fs/write_text_file` from its buffers, so `read_file` sees unsaved changes and
+  `edit_file` lands in the open buffer instead of underneath it. `tools.rs` has no access to the
+  connection, so this is a seam like the one `mcp::call_tool` gives MCP: `handle_initialize`
+  registers a `ClientFileSystem` (`AcpClientFs` in `main.rs`, holding the connection), and
+  `execute_tool_impl` asks `route_for` before it dispatches `read_file`, `create_file`,
+  `edit_file` or `multi_edit`. Each of those tools is split into a parse step and a pure
+  render/apply step (`ReadFileCall`, `CreateFileCall`, `EditCall`) that the disk path and the
+  client path share, so the model gets the same result text either way. The two capabilities are
+  independent: a client that only reads still gets its edits written to disk. The disk is the
+  fallback throughout: nothing is registered in the TUI or headless modes, a path outside the
+  session's roots is not routed, and a request the client fails or leaves unanswered for 30
+  seconds is retried on disk with a warning in the log. The client is only ever asked from
+  inside a spawned prompt turn, never from `handle_initialize` itself (deadlock, same as
+  permission requests). Existence checks and `create_file`'s parent directories still use the
+  disk. `SIGIT_CLIENT_FS=off` turns the routing off. Covered by `tests/acp_client_fs.rs`.
 - **`src/chat.rs`** — the Unix-only ratatui TUI. Loading-spinner phase then chat; uses
   `tokio::select!` to multiplex terminal events with streaming tokens.
 - **`src/headless.rs`** — non-interactive `sigit run` execution for scripts, CI, and Factory
@@ -337,7 +379,9 @@ verbosity with `RUST_LOG`.
 
 `OPENAI_BASE_URL` / `OPENAI_API_KEY` (provider override), `SIGIT_API_URL` (account API base,
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
-`SIGIT_MODEL`, `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
+`SIGIT_MODEL`, `SIGIT_MAX_TOOL_ROUNDS` (1 to 500, default 24; the tool-round cap of a
+headless run or an ACP prompt turn), `SIGIT_MCP` (`off` disables MCP), `SIGIT_CLIENT_FS` (`off` keeps the file tools on disk even when the
+ACP client offers `fs/read_text_file` / `fs/write_text_file`), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
 smbCloud CLI server), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
 server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
 mutating tools; the escape hatch for clients without permission-request support),

sigit_code-1.6.2/.sigit/factory/config.toml

@@ -0,0 +1,62 @@
+[repo]
+owner = "getsigit"
+name = "sigit"
+slug = "getsigit-sigit"
+
+[agent]
+login = "sigit-code-review"
+display_name = "siGit Code Review"
+
+[harvest]
+state = "closed"
+limit = 50
+since = "2026-09-01"
+cadence = "weekly"
+day_of_week = "Mon"
+runs_dir = "~/.agents/skills/sigit-code-review-outer-loop/runs"
+report_format = "markdown"
+compare_previous = true
+
+[review.reviewer_skill]
+name = "sigit-code-review-outer-loop"
+version = "1.0.0"
+
+[review.author_skill]
+name = "sigit-code-review-feedbacks-response"
+version = "1.0.0"
+
+[review.repo_guidance]
+branch_rules = "{fix,feature,release}/*"
+ci_gate = "CI"
+watch_paths = ["src/**"]
+ignore_paths = ["**/*.md", "**/*.txt", "docs/**", "vendor/**", ".github/**", "*.lock"]
+
+[[guardrails.known_issues]]
+pattern = "all_zero_summary"
+source = "getsigit-sigit"
+description = "Zero findings on a large control-flow diff may be recall loss from an over-corrected prompt bar, not a clean review. Seen on stack #163 (900 additions, 0 findings)."
+action = "flag_in_report"
+
+[[guardrails.known_issues]]
+pattern = "confident_false_positives"
+source = "getsigit-sigit"
+description = "Confident declarative findings whose premise is contradicted by the cited code. Seen on stack #160 (5 of 5 findings rejected, rejected_rate 1.0). The hedge ban replaced speculative questions with confident wrong claims."
+action = "flag_in_report"
+
+[[guardrails.known_issues]]
+pattern = "approval_on_disagree"
+source = "getsigit-sigit"
+description = "Agent approves within 30-45s of an author disagreement without processing the correction. Compounds with confident false positives: wrong claim, author corrects, agent approves without re-reading."
+action = "flag_in_report"
+
+[[guardrails.known_issues]]
+pattern = "repeat_findings_high"
+source = "getsigit-sigit-si"
+description = "Repeat findings above 30% indicate the agent is re-raising issues the author already addressed."
+action = "flag_in_report"
+
+[[guardrails.known_issues]]
+pattern = "force_pushes_inflate_rounds"
+source = "smbcloudXYZ-smbcloud"
+description = "Force pushes cause one-for-one review round inflation; the agent re-reads unchanged diffs."
+action = "note_in_report"

{sigit_code-1.6.0 → sigit_code-1.6.2}/AGENTS.md

@@ -127,10 +127,31 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   endpoint can also fail *after* the response is open, reporting it as a `data:` frame holding
   the same envelope; that frame has no `choices`, so `consume_stream` has to check for it
   explicitly or it parses as an empty chunk and the turn ends looking like an empty answer.
+  `TurnResult::finish` carries the endpoint's `finish_reason` up to the loop, and
+  `stop_reason_for` in `main.rs` turns it into the ACP stop reason: the tool-round cap is
+  `max_turn_requests`, `length` is `max_tokens`, `content_filter` is `refusal`. ACP defines a
+  refusal as a turn the next prompt will not include, so `handle_prompt` restores the history
+  it snapshotted before the turn instead of only relabelling the response.
+  The round that reaches the cap (24, or `SIGIT_MAX_TOOL_ROUNDS`) is followed by one forced
+  text reply with no tools. The model cannot see that the tools are gone, so
+  `round_cap_note` is appended to that round's last tool result, and the turn always closes
+  with `round_cap_stop_message`. Without both, the thread stops on the model announcing a
+  step that never runs (issue #120).
   Some models write tool calls into content as text; `src/inline_tool_calls.rs` recovers the
   well-formed ones. A block that doesn't parse (or never closes) is dropped from both the reply
   and history, and `OpenAiBackend::complete` retries once with a note telling the model the call
   didn't run. Leaving the raw block in history makes the model invent `<function_results>` later.
+  Image attachments: ACP fixes `promptCapabilities.image` for the whole connection, while the
+  model can change on any turn, so the capability is always advertised and the decision is made
+  per prompt. `InferenceBackend::accepts_images` answers for the active model (on-device: no;
+  remote: `provider::model_accepts_images`, which reads the hard-coded `IMAGE_TIERS` for
+  `onde-*` ids and says yes for a user's own endpoint). `images_for_turn` in `main.rs` either
+  passes the images to `send_message_with_images` or drops them with a note to the user and a
+  bracketed note to the model. A message with images is stored in history as OpenAI content
+  parts and stays that way; `OpenAiBackend` strips the images per request (`without_images`)
+  when its model cannot read them, which is what makes a mid-thread switch to a text-only tier
+  safe. Read history text through `backend::message_text`, never `content.as_str()`.
+  `IMAGE_TIERS` mirrors onde-cloud's `IMAGE_CANDIDATES`; update both together.
 - **`src/provider.rs`** — decides *which* backend serves inference. Resolution order, first match
   wins: (1) override via `OPENAI_BASE_URL`+`OPENAI_API_KEY` or active profile in
   `~/.config/sigit/providers.toml`; (2) siGit Code Cloud when logged in; (3) on-device.
@@ -243,7 +264,11 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   overrides and the default mode from `[permissions]` in `settings.toml` (`allow`/`ask`/`deny`,
   default `ask`; `SIGIT_PERMISSIONS` env overrides the default). On `ask`, the ACP path sends
   `session/request_permission` (allow once / allow for session / deny) and the TUI pauses the
-  inference task on a y/a/n prompt. Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
+  inference task on a y/a/n prompt. On the ACP path the decision is taken *before* the call is
+  announced, because it sets the announced status: a call that will ask starts `pending`, the
+  permission request carries that call's own id, and an `in_progress` update follows approval.
+  That update also puts the card's title back, since the permission request overwrites it
+  with the full arguments. Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
   serialized by `SiGitAgent::turn_lock` so the dispatch loop can route the client's permission
   answer mid-turn — don't move them back inline, and don't await client requests from inline
   handlers (deadlock).
@@ -274,6 +299,23 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   every root. MCP is deliberately not on that list — `mcp::init` runs once at startup, before
   any session exists, so a second root's `.sigit/mcp.toml` has nobody to tell. (The servers a
   client names in `mcpServers` are a different thing and are per session; see `src/mcp.rs`.)
+- **`src/client_fs.rs`** — file reads and writes through the ACP client. A client that
+  advertises `fs.readTextFile` / `fs.writeTextFile` in `initialize` serves `fs/read_text_file`
+  and `fs/write_text_file` from its buffers, so `read_file` sees unsaved changes and
+  `edit_file` lands in the open buffer instead of underneath it. `tools.rs` has no access to the
+  connection, so this is a seam like the one `mcp::call_tool` gives MCP: `handle_initialize`
+  registers a `ClientFileSystem` (`AcpClientFs` in `main.rs`, holding the connection), and
+  `execute_tool_impl` asks `route_for` before it dispatches `read_file`, `create_file`,
+  `edit_file` or `multi_edit`. Each of those tools is split into a parse step and a pure
+  render/apply step (`ReadFileCall`, `CreateFileCall`, `EditCall`) that the disk path and the
+  client path share, so the model gets the same result text either way. The two capabilities are
+  independent: a client that only reads still gets its edits written to disk. The disk is the
+  fallback throughout: nothing is registered in the TUI or headless modes, a path outside the
+  session's roots is not routed, and a request the client fails or leaves unanswered for 30
+  seconds is retried on disk with a warning in the log. The client is only ever asked from
+  inside a spawned prompt turn, never from `handle_initialize` itself (deadlock, same as
+  permission requests). Existence checks and `create_file`'s parent directories still use the
+  disk. `SIGIT_CLIENT_FS=off` turns the routing off. Covered by `tests/acp_client_fs.rs`.
 - **`src/chat.rs`** — the Unix-only ratatui TUI. Loading-spinner phase then chat; uses
   `tokio::select!` to multiplex terminal events with streaming tokens.
 - **`src/headless.rs`** — non-interactive `sigit run` execution for scripts, CI, and Factory
@@ -337,7 +379,9 @@ verbosity with `RUST_LOG`.
 
 `OPENAI_BASE_URL` / `OPENAI_API_KEY` (provider override), `SIGIT_API_URL` (account API base,
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
-`SIGIT_MODEL`, `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
+`SIGIT_MODEL`, `SIGIT_MAX_TOOL_ROUNDS` (1 to 500, default 24; the tool-round cap of a
+headless run or an ACP prompt turn), `SIGIT_MCP` (`off` disables MCP), `SIGIT_CLIENT_FS` (`off` keeps the file tools on disk even when the
+ACP client offers `fs/read_text_file` / `fs/write_text_file`), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
 smbCloud CLI server), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
 server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
 mutating tools; the escape hatch for clients without permission-request support),

{sigit_code-1.6.0 → sigit_code-1.6.2}/CHANGELOG.md

@@ -1,5 +1,82 @@
 # Changelog
 
+## 1.6.2
+
+### Added
+
+- **`sigit --version` prints the release.** `sigit --version` and `sigit -V`
+  print `sigit <version>` on stdout and exit 0. Before, the flag was not
+  recognized and siGit Code started a session, which left a script that asked
+  for the version waiting.
+
+- **File tools read and write through the editor when it offers to.** An ACP
+  client that advertises `fs.readTextFile` or `fs.writeTextFile` serves those
+  requests from its open buffers. siGit Code always used the disk, so
+  `read_file` missed unsaved changes and `edit_file` wrote underneath a buffer
+  the user might have modified. `read_file`, `create_file`, `edit_file` and
+  `multi_edit` now go through the client for paths inside the session's roots.
+  The two capabilities are independent, and the disk is still the fallback:
+  for a path outside the roots, and for a request the client fails or leaves
+  unanswered for 30 seconds. `SIGIT_CLIENT_FS=off` keeps the file tools on
+  disk (#147).
+
+### Fixed
+
+- **A file attached from the editor is found when its path needs escaping.**
+  A `resource_link` was read by stripping `file://` and using the rest as the
+  path, so a space arrived as `%20`, a non-ASCII name failed, and a Windows
+  URI kept its leading slash. A `#` in a file name was also taken for the
+  line-range fragment. The URI is now parsed properly (#170).
+
+## 1.6.1
+
+### Added
+
+- **Images can be attached to a prompt in the editor.** siGit Code now
+  advertises `promptCapabilities.image`, so an ACP client offers image
+  attachments. The image goes to the model when the active model reads images.
+  The model picker marks those models with "reads images". The on-device
+  models and four cloud tiers (`nova`, `orbit`, `apex`, `flux`) are text-only:
+  with one of them active the image is left out, a note in the thread says so,
+  and the model is told an image was withheld. Switching a thread that already
+  holds images to a text-only model flags that once as well. Cloud tiers need
+  siGit Code Cloud to accept image parts, which is rolling out separately
+  (#134).
+
+- **The tool-round cap of a headless run can be set.** `--max-tool-rounds <n>`
+  or `SIGIT_MAX_TOOL_ROUNDS` (1 to 500) replaces the built-in 24 for
+  `sigit run` and `sigit -p`. The flag wins over the variable.
+
+### Fixed
+
+- **A prompt turn now reports why it stopped.** ACP defines five stop reasons
+  and siGit Code only ever sent `end_turn` and `cancelled`. A turn that runs
+  into the tool-round cap now ends with `max_turn_requests`, a reply cut off
+  at the token limit with `max_tokens`, and a reply the endpoint withheld
+  (`content_filter`) with `refusal`. A refused turn is also taken out of the
+  conversation, which is what the protocol tells the client to expect (#140).
+
+- **A tool call that needs approval is one card, not two.** The permission
+  request carried an id of its own, so an ACP client showed an approval card
+  beside a call that already claimed to be running. The call is now announced
+  as `pending`, the permission request names that same call, and it moves to
+  `in_progress` once approved. Calls allowed by policy still start out
+  `in_progress` (#138).
+
+- **A turn that runs out of tool rounds says so.** In an editor, a long task
+  could stop on a line like "Now commit:" with nothing after it. The turn had
+  used all 24 tool rounds, the model spent its last reply announcing the next
+  step, and the call behind it was dropped. siGit Code now tells the model
+  that its rounds are used up before that last reply, and ends the turn with a
+  message saying why it stopped and that "continue" picks it back up.
+  `SIGIT_MAX_TOOL_ROUNDS` now sets the cap for editor sessions too (#120).
+
+- **A headless run no longer ends silently with no final message.** When the
+  last round came back empty, which is what happens when a run is cut off at
+  the tool-round cap mid-task, stdout was empty and the exit status was 0, so
+  a caller could not tell it from a run with nothing to report. siGit Code now
+  asks the model once for its final message before finishing.
+
 ## 1.6.0
 
 ### Added

{sigit_code-1.6.0 → sigit_code-1.6.2}/CLAUDE.md

@@ -127,10 +127,31 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   endpoint can also fail *after* the response is open, reporting it as a `data:` frame holding
   the same envelope; that frame has no `choices`, so `consume_stream` has to check for it
   explicitly or it parses as an empty chunk and the turn ends looking like an empty answer.
+  `TurnResult::finish` carries the endpoint's `finish_reason` up to the loop, and
+  `stop_reason_for` in `main.rs` turns it into the ACP stop reason: the tool-round cap is
+  `max_turn_requests`, `length` is `max_tokens`, `content_filter` is `refusal`. ACP defines a
+  refusal as a turn the next prompt will not include, so `handle_prompt` restores the history
+  it snapshotted before the turn instead of only relabelling the response.
+  The round that reaches the cap (24, or `SIGIT_MAX_TOOL_ROUNDS`) is followed by one forced
+  text reply with no tools. The model cannot see that the tools are gone, so
+  `round_cap_note` is appended to that round's last tool result, and the turn always closes
+  with `round_cap_stop_message`. Without both, the thread stops on the model announcing a
+  step that never runs (issue #120).
   Some models write tool calls into content as text; `src/inline_tool_calls.rs` recovers the
   well-formed ones. A block that doesn't parse (or never closes) is dropped from both the reply
   and history, and `OpenAiBackend::complete` retries once with a note telling the model the call
   didn't run. Leaving the raw block in history makes the model invent `<function_results>` later.
+  Image attachments: ACP fixes `promptCapabilities.image` for the whole connection, while the
+  model can change on any turn, so the capability is always advertised and the decision is made
+  per prompt. `InferenceBackend::accepts_images` answers for the active model (on-device: no;
+  remote: `provider::model_accepts_images`, which reads the hard-coded `IMAGE_TIERS` for
+  `onde-*` ids and says yes for a user's own endpoint). `images_for_turn` in `main.rs` either
+  passes the images to `send_message_with_images` or drops them with a note to the user and a
+  bracketed note to the model. A message with images is stored in history as OpenAI content
+  parts and stays that way; `OpenAiBackend` strips the images per request (`without_images`)
+  when its model cannot read them, which is what makes a mid-thread switch to a text-only tier
+  safe. Read history text through `backend::message_text`, never `content.as_str()`.
+  `IMAGE_TIERS` mirrors onde-cloud's `IMAGE_CANDIDATES`; update both together.
 - **`src/provider.rs`** — decides *which* backend serves inference. Resolution order, first match
   wins: (1) override via `OPENAI_BASE_URL`+`OPENAI_API_KEY` or active profile in
   `~/.config/sigit/providers.toml`; (2) siGit Code Cloud when logged in; (3) on-device.
@@ -243,7 +264,11 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   overrides and the default mode from `[permissions]` in `settings.toml` (`allow`/`ask`/`deny`,
   default `ask`; `SIGIT_PERMISSIONS` env overrides the default). On `ask`, the ACP path sends
   `session/request_permission` (allow once / allow for session / deny) and the TUI pauses the
-  inference task on a y/a/n prompt. Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
+  inference task on a y/a/n prompt. On the ACP path the decision is taken *before* the call is
+  announced, because it sets the announced status: a call that will ask starts `pending`, the
+  permission request carries that call's own id, and an `in_progress` update follows approval.
+  That update also puts the card's title back, since the permission request overwrites it
+  with the full arguments. Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
   serialized by `SiGitAgent::turn_lock` so the dispatch loop can route the client's permission
   answer mid-turn — don't move them back inline, and don't await client requests from inline
   handlers (deadlock).
@@ -274,6 +299,23 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   every root. MCP is deliberately not on that list — `mcp::init` runs once at startup, before
   any session exists, so a second root's `.sigit/mcp.toml` has nobody to tell. (The servers a
   client names in `mcpServers` are a different thing and are per session; see `src/mcp.rs`.)
+- **`src/client_fs.rs`** — file reads and writes through the ACP client. A client that
+  advertises `fs.readTextFile` / `fs.writeTextFile` in `initialize` serves `fs/read_text_file`
+  and `fs/write_text_file` from its buffers, so `read_file` sees unsaved changes and
+  `edit_file` lands in the open buffer instead of underneath it. `tools.rs` has no access to the
+  connection, so this is a seam like the one `mcp::call_tool` gives MCP: `handle_initialize`
+  registers a `ClientFileSystem` (`AcpClientFs` in `main.rs`, holding the connection), and
+  `execute_tool_impl` asks `route_for` before it dispatches `read_file`, `create_file`,
+  `edit_file` or `multi_edit`. Each of those tools is split into a parse step and a pure
+  render/apply step (`ReadFileCall`, `CreateFileCall`, `EditCall`) that the disk path and the
+  client path share, so the model gets the same result text either way. The two capabilities are
+  independent: a client that only reads still gets its edits written to disk. The disk is the
+  fallback throughout: nothing is registered in the TUI or headless modes, a path outside the
+  session's roots is not routed, and a request the client fails or leaves unanswered for 30
+  seconds is retried on disk with a warning in the log. The client is only ever asked from
+  inside a spawned prompt turn, never from `handle_initialize` itself (deadlock, same as
+  permission requests). Existence checks and `create_file`'s parent directories still use the
+  disk. `SIGIT_CLIENT_FS=off` turns the routing off. Covered by `tests/acp_client_fs.rs`.
 - **`src/chat.rs`** — the Unix-only ratatui TUI. Loading-spinner phase then chat; uses
   `tokio::select!` to multiplex terminal events with streaming tokens.
 - **`src/headless.rs`** — non-interactive `sigit run` execution for scripts, CI, and Factory
@@ -337,7 +379,9 @@ verbosity with `RUST_LOG`.
 
 `OPENAI_BASE_URL` / `OPENAI_API_KEY` (provider override), `SIGIT_API_URL` (account API base,
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
-`SIGIT_MODEL`, `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
+`SIGIT_MODEL`, `SIGIT_MAX_TOOL_ROUNDS` (1 to 500, default 24; the tool-round cap of a
+headless run or an ACP prompt turn), `SIGIT_MCP` (`off` disables MCP), `SIGIT_CLIENT_FS` (`off` keeps the file tools on disk even when the
+ACP client offers `fs/read_text_file` / `fs/write_text_file`), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
 smbCloud CLI server), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
 server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
 mutating tools; the escape hatch for clients without permission-request support),

{sigit_code-1.6.0 → sigit_code-1.6.2}/Cargo.lock

@@ -5778,7 +5778,7 @@ checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "sigit"
-version = "1.6.0"
+version = "1.6.2"
 dependencies = [
  "agent-client-protocol",
  "anyhow",
@@ -5801,6 +5801,7 @@ dependencies = [
  "tokio-util",
  "toml 0.8.23",
  "tracing-subscriber",
+ "url",
  "uuid 1.26.0",
 ]
 

{sigit_code-1.6.0 → sigit_code-1.6.2}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sigit"
-version = "1.6.0"
+version = "1.6.2"
 edition = "2024"
 description = "siGit Code — ACP-compatible AI coding agent. Sí, git."
 documentation = "https://github.com/getsigit/sigit"
@@ -60,6 +60,11 @@ base64 = "0.22"
 rand = "0.9"
 sha2 = "0.10"
 
+# ACP `resource_link` blocks carry file URIs. Parsing them with `url` decodes
+# percent escapes and maps Windows drive paths, which hand-stripping `file://`
+# did not. Already in the graph through reqwest.
+url = "2"
+
 # Release binaries ship to five registries, and the NuGet package bundles all
 # six targets in a single archive, so binary size is a distribution constraint
 # rather than a nicety. Stripping symbols takes the macOS arm64 binary from

{sigit_code-1.6.0 → sigit_code-1.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sigit-code
-Version: 1.6.0
+Version: 1.6.2
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers

{sigit_code-1.6.0 → sigit_code-1.6.2}/docs/headless.md

@@ -27,6 +27,11 @@ for interactive permission are denied in headless mode unless granted with
 `--allow-tool <name>`. A repeatable `--deny-tool <name>` takes precedence over grants and
 settings.
 
+A run makes at most 24 rounds of tool calls. `--max-tool-rounds <n>`, or the
+`SIGIT_MAX_TOOL_ROUNDS` environment variable, sets a different cap from 1 to 500; the flag wins.
+When the cap is reached, or the model otherwise ends without saying anything, siGit Code asks it
+once for a final message, so stdout is not left empty by a run that was cut off mid-task.
+
 ## JSONL output
 
 Pass `--output jsonl` for a machine-readable stdout stream: