sigit-code 1.6.1__tar.gz → 1.6.3__tar.gz

{sigit_code-1.6.1 → sigit_code-1.6.3}/.agents/AGENTS.md

@@ -113,9 +113,20 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
 - **`src/main.rs`** — entry point, mode dispatch, the full ACP `Agent` impl (session lifecycle:
   new/load/fork/prompt/cancel, config options, slash-command advertisement), and the `SYSTEM_PROMPT`.
   ACP session state owns its roots, conversation, and selected model even though the process has
-  one live backend; activating a thread parks and restores all three. Unknown session ids are
-  rejected instead of silently borrowing the active thread's cwd. Prompt cancellation is routed
-  outside `turn_lock`, which lets a client cancel the turn currently holding that lock. The
+  one working directory and one live backend slot; activating a thread parks and restores all
+  three. A thread on an HTTP backend keeps a backend of its own (`InferenceBackend::fresh`,
+  `SessionState::remote`), so its turn can wait on the endpoint while another thread is
+  installed. Unknown session ids are rejected instead of silently borrowing the active thread's
+  cwd. Prompt cancellation takes no lock, which lets a client cancel a turn whatever it holds.
+  `session/load` and `session/resume` share `restore_session`; the only difference is that
+  resume must not replay the history as `session/update`. `session/close` is the one place a
+  `SessionState` is dropped. It runs in two halves: `begin_close` signals the session's turn
+  from the dispatch loop (the turn holds the session's lock, so the signal cannot wait for it) and
+  marks the id in `closing_sessions`, which makes `handle_prompt` cancel a prompt that was
+  still queued; `handle_close_session` then runs under the session and workspace locks and
+  removes the state, the permission grants and the background commands
+  (`tools::kill_session_tasks`). It leaves `session_store` alone, so a closed thread still lists
+  and reopens. The
   `SYSTEM_PROMPT` bakes in smbCloud-specific context the agent should use when the repo is clearly
   smbCloud, and stay general otherwise.
 - **`src/backend.rs`** — the `InferenceBackend` trait and neutral types (`ToolSpec`, `ToolCall`,
@@ -268,10 +279,21 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   announced, because it sets the announced status: a call that will ask starts `pending`, the
   permission request carries that call's own id, and an `in_progress` update follows approval.
   That update also puts the card's title back, since the permission request overwrites it
-  with the full arguments. Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
-  serialized by `SiGitAgent::turn_lock` so the dispatch loop can route the client's permission
-  answer mid-turn — don't move them back inline, and don't await client requests from inline
-  handlers (deadlock).
+  with the full arguments. The Manual/Auto/Plan choice reaches an ACP client twice: as the
+  `sigit-permission-mode` config option, and as session `modes` with `session/set_mode`, which
+  the spec is retiring but some clients still render instead. Both are built from
+  `PERMISSION_MODES` in `main.rs` and read the same state, so whatever changes the mode has to
+  refresh both (`ConfigOptionUpdate` and `send_current_mode`). Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
+  so the dispatch loop can route the client's permission answer mid-turn — don't move them back
+  inline, and don't await client requests from inline handlers (deadlock). Two locks order them.
+  A per-session lock (`SiGitAgent::session_lock`) is held for a whole request, so requests on one
+  thread keep their order. `SiGitAgent::workspace_lock` guards what a session installs
+  process-wide (cwd, workspace roots, session MCP servers, the live backend slot, the engine's
+  conversation); lifecycle and config handlers hold it throughout, and `handle_prompt` holds it
+  through a `WorkspaceHold` that it releases while waiting on an HTTP endpoint or a permission
+  answer and retakes (reinstalling its session via `resume_workspace`) before any tool runs. An
+  on-device turn never releases it. Take the session lock first, never the other way round. Tool
+  execution, subagents included, still runs one session at a time.
 - **`src/instructions.rs`** — project instruction files, the always-on counterpart to skills.
   Reads `AGENTS.md` (the cross-tool [agents.md](https://agents.md) standard) and `CLAUDE.md`,
   walking from the session cwd up to the repo root (nearest ancestor with `.git`, never above it),
@@ -299,6 +321,23 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   every root. MCP is deliberately not on that list — `mcp::init` runs once at startup, before
   any session exists, so a second root's `.sigit/mcp.toml` has nobody to tell. (The servers a
   client names in `mcpServers` are a different thing and are per session; see `src/mcp.rs`.)
+- **`src/client_fs.rs`** — file reads and writes through the ACP client. A client that
+  advertises `fs.readTextFile` / `fs.writeTextFile` in `initialize` serves `fs/read_text_file`
+  and `fs/write_text_file` from its buffers, so `read_file` sees unsaved changes and
+  `edit_file` lands in the open buffer instead of underneath it. `tools.rs` has no access to the
+  connection, so this is a seam like the one `mcp::call_tool` gives MCP: `handle_initialize`
+  registers a `ClientFileSystem` (`AcpClientFs` in `main.rs`, holding the connection), and
+  `execute_tool_impl` asks `route_for` before it dispatches `read_file`, `create_file`,
+  `edit_file` or `multi_edit`. Each of those tools is split into a parse step and a pure
+  render/apply step (`ReadFileCall`, `CreateFileCall`, `EditCall`) that the disk path and the
+  client path share, so the model gets the same result text either way. The two capabilities are
+  independent: a client that only reads still gets its edits written to disk. The disk is the
+  fallback throughout: nothing is registered in the TUI or headless modes, a path outside the
+  session's roots is not routed, and a request the client fails or leaves unanswered for 30
+  seconds is retried on disk with a warning in the log. The client is only ever asked from
+  inside a spawned prompt turn, never from `handle_initialize` itself (deadlock, same as
+  permission requests). Existence checks and `create_file`'s parent directories still use the
+  disk. `SIGIT_CLIENT_FS=off` turns the routing off. Covered by `tests/acp_client_fs.rs`.
 - **`src/chat.rs`** — the Unix-only ratatui TUI. Loading-spinner phase then chat; uses
   `tokio::select!` to multiplex terminal events with streaming tokens.
 - **`src/headless.rs`** — non-interactive `sigit run` execution for scripts, CI, and Factory
@@ -320,6 +359,10 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   those read env vars once at init.
 - **`src/account.rs`** — siGit Code Cloud auth (`/login`, `/logout`, `/whoami`); authenticates
   against the account API and stores a session token. Performs no console I/O.
+  ACP `logout` (the editor's sign out button, shown only because `handle_initialize` advertises
+  `agentCapabilities.auth.logout`) and `/logout` both go through `SiGitAgent::sign_out` in
+  `main.rs`. The request names no session, so `leave_cloud` moves the parked threads off their
+  cloud tier along with the live one and each of them gets a fresh model picker.
 - **`src/browser_auth.rs`** — browser sign-in, the path the editor's "Sign in to siGit Code"
   button takes. sigit is a public OAuth client (client id `sigit-code-cli`, no secret, PKCE
   S256) against the authorization server at `$SIGIT_API_URL/oauth`. Two ways the code gets
@@ -363,7 +406,8 @@ verbosity with `RUST_LOG`.
 `OPENAI_BASE_URL` / `OPENAI_API_KEY` (provider override), `SIGIT_API_URL` (account API base,
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
 `SIGIT_MODEL`, `SIGIT_MAX_TOOL_ROUNDS` (1 to 500, default 24; the tool-round cap of a
-headless run or an ACP prompt turn), `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
+headless run or an ACP prompt turn), `SIGIT_MCP` (`off` disables MCP), `SIGIT_CLIENT_FS` (`off` keeps the file tools on disk even when the
+ACP client offers `fs/read_text_file` / `fs/write_text_file`), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
 smbCloud CLI server), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
 server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
 mutating tools; the escape hatch for clients without permission-request support),

{sigit_code-1.6.1/.claude → sigit_code-1.6.3/.agents}/skills/agent-client-protocol/SKILL.md

@@ -205,6 +205,7 @@ the connection and the agent anymore. Don't reintroduce the mpsc forwarder patte
 | `ListSessionsRequest` | `handle_list_sessions` | the editor's "Import Threads" picker; gated by `SessionListCapabilities` |
 | `PromptRequest` | `handle_prompt` | the turn: parse blocks → slash commands or tool-calling loop |
 | `SetSessionConfigOptionRequest` | `handle_set_session_config_option` | the Zed model picker — switches/downloads models |
+| `SetSessionModeRequest` | `handle_set_session_mode` | legacy mode selector; same Manual/Auto/Plan state as the Permissions config option |
 | `CancelNotification` | `handle_cancel` | notification, no response |
 
 Everything else is left to the SDK default (method not found).

{sigit_code-1.6.1/.agents → sigit_code-1.6.3/.claude}/skills/agent-client-protocol/SKILL.md

@@ -205,6 +205,7 @@ the connection and the agent anymore. Don't reintroduce the mpsc forwarder patte
 | `ListSessionsRequest` | `handle_list_sessions` | the editor's "Import Threads" picker; gated by `SessionListCapabilities` |
 | `PromptRequest` | `handle_prompt` | the turn: parse blocks → slash commands or tool-calling loop |
 | `SetSessionConfigOptionRequest` | `handle_set_session_config_option` | the Zed model picker — switches/downloads models |
+| `SetSessionModeRequest` | `handle_set_session_mode` | legacy mode selector; same Manual/Auto/Plan state as the Permissions config option |
 | `CancelNotification` | `handle_cancel` | notification, no response |
 
 Everything else is left to the SDK default (method not found).

{sigit_code-1.6.1 → sigit_code-1.6.3}/AGENTS.md

@@ -113,9 +113,20 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
 - **`src/main.rs`** — entry point, mode dispatch, the full ACP `Agent` impl (session lifecycle:
   new/load/fork/prompt/cancel, config options, slash-command advertisement), and the `SYSTEM_PROMPT`.
   ACP session state owns its roots, conversation, and selected model even though the process has
-  one live backend; activating a thread parks and restores all three. Unknown session ids are
-  rejected instead of silently borrowing the active thread's cwd. Prompt cancellation is routed
-  outside `turn_lock`, which lets a client cancel the turn currently holding that lock. The
+  one working directory and one live backend slot; activating a thread parks and restores all
+  three. A thread on an HTTP backend keeps a backend of its own (`InferenceBackend::fresh`,
+  `SessionState::remote`), so its turn can wait on the endpoint while another thread is
+  installed. Unknown session ids are rejected instead of silently borrowing the active thread's
+  cwd. Prompt cancellation takes no lock, which lets a client cancel a turn whatever it holds.
+  `session/load` and `session/resume` share `restore_session`; the only difference is that
+  resume must not replay the history as `session/update`. `session/close` is the one place a
+  `SessionState` is dropped. It runs in two halves: `begin_close` signals the session's turn
+  from the dispatch loop (the turn holds the session's lock, so the signal cannot wait for it) and
+  marks the id in `closing_sessions`, which makes `handle_prompt` cancel a prompt that was
+  still queued; `handle_close_session` then runs under the session and workspace locks and
+  removes the state, the permission grants and the background commands
+  (`tools::kill_session_tasks`). It leaves `session_store` alone, so a closed thread still lists
+  and reopens. The
   `SYSTEM_PROMPT` bakes in smbCloud-specific context the agent should use when the repo is clearly
   smbCloud, and stay general otherwise.
 - **`src/backend.rs`** — the `InferenceBackend` trait and neutral types (`ToolSpec`, `ToolCall`,
@@ -268,10 +279,21 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   announced, because it sets the announced status: a call that will ask starts `pending`, the
   permission request carries that call's own id, and an `in_progress` update follows approval.
   That update also puts the card's title back, since the permission request overwrites it
-  with the full arguments. Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
-  serialized by `SiGitAgent::turn_lock` so the dispatch loop can route the client's permission
-  answer mid-turn — don't move them back inline, and don't await client requests from inline
-  handlers (deadlock).
+  with the full arguments. The Manual/Auto/Plan choice reaches an ACP client twice: as the
+  `sigit-permission-mode` config option, and as session `modes` with `session/set_mode`, which
+  the spec is retiring but some clients still render instead. Both are built from
+  `PERMISSION_MODES` in `main.rs` and read the same state, so whatever changes the mode has to
+  refresh both (`ConfigOptionUpdate` and `send_current_mode`). Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
+  so the dispatch loop can route the client's permission answer mid-turn — don't move them back
+  inline, and don't await client requests from inline handlers (deadlock). Two locks order them.
+  A per-session lock (`SiGitAgent::session_lock`) is held for a whole request, so requests on one
+  thread keep their order. `SiGitAgent::workspace_lock` guards what a session installs
+  process-wide (cwd, workspace roots, session MCP servers, the live backend slot, the engine's
+  conversation); lifecycle and config handlers hold it throughout, and `handle_prompt` holds it
+  through a `WorkspaceHold` that it releases while waiting on an HTTP endpoint or a permission
+  answer and retakes (reinstalling its session via `resume_workspace`) before any tool runs. An
+  on-device turn never releases it. Take the session lock first, never the other way round. Tool
+  execution, subagents included, still runs one session at a time.
 - **`src/instructions.rs`** — project instruction files, the always-on counterpart to skills.
   Reads `AGENTS.md` (the cross-tool [agents.md](https://agents.md) standard) and `CLAUDE.md`,
   walking from the session cwd up to the repo root (nearest ancestor with `.git`, never above it),
@@ -299,6 +321,23 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   every root. MCP is deliberately not on that list — `mcp::init` runs once at startup, before
   any session exists, so a second root's `.sigit/mcp.toml` has nobody to tell. (The servers a
   client names in `mcpServers` are a different thing and are per session; see `src/mcp.rs`.)
+- **`src/client_fs.rs`** — file reads and writes through the ACP client. A client that
+  advertises `fs.readTextFile` / `fs.writeTextFile` in `initialize` serves `fs/read_text_file`
+  and `fs/write_text_file` from its buffers, so `read_file` sees unsaved changes and
+  `edit_file` lands in the open buffer instead of underneath it. `tools.rs` has no access to the
+  connection, so this is a seam like the one `mcp::call_tool` gives MCP: `handle_initialize`
+  registers a `ClientFileSystem` (`AcpClientFs` in `main.rs`, holding the connection), and
+  `execute_tool_impl` asks `route_for` before it dispatches `read_file`, `create_file`,
+  `edit_file` or `multi_edit`. Each of those tools is split into a parse step and a pure
+  render/apply step (`ReadFileCall`, `CreateFileCall`, `EditCall`) that the disk path and the
+  client path share, so the model gets the same result text either way. The two capabilities are
+  independent: a client that only reads still gets its edits written to disk. The disk is the
+  fallback throughout: nothing is registered in the TUI or headless modes, a path outside the
+  session's roots is not routed, and a request the client fails or leaves unanswered for 30
+  seconds is retried on disk with a warning in the log. The client is only ever asked from
+  inside a spawned prompt turn, never from `handle_initialize` itself (deadlock, same as
+  permission requests). Existence checks and `create_file`'s parent directories still use the
+  disk. `SIGIT_CLIENT_FS=off` turns the routing off. Covered by `tests/acp_client_fs.rs`.
 - **`src/chat.rs`** — the Unix-only ratatui TUI. Loading-spinner phase then chat; uses
   `tokio::select!` to multiplex terminal events with streaming tokens.
 - **`src/headless.rs`** — non-interactive `sigit run` execution for scripts, CI, and Factory
@@ -320,6 +359,10 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   those read env vars once at init.
 - **`src/account.rs`** — siGit Code Cloud auth (`/login`, `/logout`, `/whoami`); authenticates
   against the account API and stores a session token. Performs no console I/O.
+  ACP `logout` (the editor's sign out button, shown only because `handle_initialize` advertises
+  `agentCapabilities.auth.logout`) and `/logout` both go through `SiGitAgent::sign_out` in
+  `main.rs`. The request names no session, so `leave_cloud` moves the parked threads off their
+  cloud tier along with the live one and each of them gets a fresh model picker.
 - **`src/browser_auth.rs`** — browser sign-in, the path the editor's "Sign in to siGit Code"
   button takes. sigit is a public OAuth client (client id `sigit-code-cli`, no secret, PKCE
   S256) against the authorization server at `$SIGIT_API_URL/oauth`. Two ways the code gets
@@ -363,7 +406,8 @@ verbosity with `RUST_LOG`.
 `OPENAI_BASE_URL` / `OPENAI_API_KEY` (provider override), `SIGIT_API_URL` (account API base,
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
 `SIGIT_MODEL`, `SIGIT_MAX_TOOL_ROUNDS` (1 to 500, default 24; the tool-round cap of a
-headless run or an ACP prompt turn), `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
+headless run or an ACP prompt turn), `SIGIT_MCP` (`off` disables MCP), `SIGIT_CLIENT_FS` (`off` keeps the file tools on disk even when the
+ACP client offers `fs/read_text_file` / `fs/write_text_file`), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
 smbCloud CLI server), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
 server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
 mutating tools; the escape hatch for clients without permission-request support),

{sigit_code-1.6.1 → sigit_code-1.6.3}/CHANGELOG.md

@@ -1,5 +1,93 @@
 # Changelog
 
+## 1.6.3
+
+### Added
+
+- **A client can resume a session and close one.** siGit Code now advertises
+  `sessionCapabilities.resume` and `sessionCapabilities.close`.
+  `session/resume` restores a saved thread the way `session/load` does, but
+  sends none of it back: it is for a client that still has the thread on
+  screen, after an agent restart for example. `session/close` cancels the
+  session's running turn and drops what the process held for it, which is its
+  state, its permission grants and plan mode, the MCP servers the client named
+  for it, and the background commands it started. The saved history is left
+  alone, so a closed thread still lists and reopens (#149).
+
+- **The permission modes are also offered as ACP session modes.** Manual, Auto
+  and Plan were only reachable as a config option, which is what the protocol
+  now recommends and what Zed reads. A client that draws the older mode
+  selector saw nothing. `session/new`, `session/load` and `session/fork` now
+  return the same three in `modes`, `session/set_mode` switches between them,
+  and a change made any other way (the config option, `/plan`, `/clear`,
+  `/reload`) is announced with `current_mode_update`. A client that reads
+  config options ignores `modes`, so nothing changes there (#148).
+
+- **An editor can sign out of siGit Code.** The `initialize` reply carried an
+  empty `auth` object, so a client drew no sign out button, and typing
+  `/logout` was the only way out of an account. The reply now advertises
+  `agentCapabilities.auth.logout`, and a `logout` request ends the account
+  session through the method `/logout` calls. The request names no session,
+  so it moves every open thread that used the account, not only the live one:
+  a thread parked on a cloud tier goes on-device with the live thread instead
+  of failing to restore its tier on its next prompt, and every thread that
+  moved gets a fresh model picker. Local inference is switched back on if it
+  was off, so a thread opened after signing out asks for no cloud tier
+  (#150).
+
+### Changed
+
+- **Two threads can run a turn at the same time.** An editor runs one siGit
+  Code process for every thread it has open, and a single lock ordered every
+  turn-affecting request in it, so a second prompt waited for the first
+  thread's whole turn and two prompts never overlapped. The lock held what a
+  session installs process-wide — the working directory, the workspace roots,
+  the MCP servers the client named for it, the live backend — none of which a
+  turn touches while it waits on an HTTP endpoint, which is most of its time.
+  A session on an HTTP backend now keeps a backend of its own, so its
+  conversation is no longer swapped in and out of a shared one, and a turn
+  releases the process-wide lock while it waits on the endpoint or on a
+  permission answer and takes it back, reinstalling its session, before any
+  tool runs. On-device turns are unchanged, since the engine keeps one
+  conversation, and tool execution still runs one session at a time (#176).
+
+### Fixed
+
+- **A prompt whose inference failed is kept through a model switch.** A turn
+  that ended in an endpoint error stayed in the client's thread, but the
+  carryover into a new model dropped its trailing user message, and the error
+  path never saved the session. Only a cancelled prompt should be taken back
+  out, so cancellation now removes it from the live history, and the error
+  path persists the session (#124).
+
+## 1.6.2
+
+### Added
+
+- **`sigit --version` prints the release.** `sigit --version` and `sigit -V`
+  print `sigit <version>` on stdout and exit 0. Before, the flag was not
+  recognized and siGit Code started a session, which left a script that asked
+  for the version waiting.
+
+- **File tools read and write through the editor when it offers to.** An ACP
+  client that advertises `fs.readTextFile` or `fs.writeTextFile` serves those
+  requests from its open buffers. siGit Code always used the disk, so
+  `read_file` missed unsaved changes and `edit_file` wrote underneath a buffer
+  the user might have modified. `read_file`, `create_file`, `edit_file` and
+  `multi_edit` now go through the client for paths inside the session's roots.
+  The two capabilities are independent, and the disk is still the fallback:
+  for a path outside the roots, and for a request the client fails or leaves
+  unanswered for 30 seconds. `SIGIT_CLIENT_FS=off` keeps the file tools on
+  disk (#147).
+
+### Fixed
+
+- **A file attached from the editor is found when its path needs escaping.**
+  A `resource_link` was read by stripping `file://` and using the rest as the
+  path, so a space arrived as `%20`, a non-ASCII name failed, and a Windows
+  URI kept its leading slash. A `#` in a file name was also taken for the
+  line-range fragment. The URI is now parsed properly (#170).
+
 ## 1.6.1
 
 ### Added

{sigit_code-1.6.1 → sigit_code-1.6.3}/CLAUDE.md

@@ -113,9 +113,20 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
 - **`src/main.rs`** — entry point, mode dispatch, the full ACP `Agent` impl (session lifecycle:
   new/load/fork/prompt/cancel, config options, slash-command advertisement), and the `SYSTEM_PROMPT`.
   ACP session state owns its roots, conversation, and selected model even though the process has
-  one live backend; activating a thread parks and restores all three. Unknown session ids are
-  rejected instead of silently borrowing the active thread's cwd. Prompt cancellation is routed
-  outside `turn_lock`, which lets a client cancel the turn currently holding that lock. The
+  one working directory and one live backend slot; activating a thread parks and restores all
+  three. A thread on an HTTP backend keeps a backend of its own (`InferenceBackend::fresh`,
+  `SessionState::remote`), so its turn can wait on the endpoint while another thread is
+  installed. Unknown session ids are rejected instead of silently borrowing the active thread's
+  cwd. Prompt cancellation takes no lock, which lets a client cancel a turn whatever it holds.
+  `session/load` and `session/resume` share `restore_session`; the only difference is that
+  resume must not replay the history as `session/update`. `session/close` is the one place a
+  `SessionState` is dropped. It runs in two halves: `begin_close` signals the session's turn
+  from the dispatch loop (the turn holds the session's lock, so the signal cannot wait for it) and
+  marks the id in `closing_sessions`, which makes `handle_prompt` cancel a prompt that was
+  still queued; `handle_close_session` then runs under the session and workspace locks and
+  removes the state, the permission grants and the background commands
+  (`tools::kill_session_tasks`). It leaves `session_store` alone, so a closed thread still lists
+  and reopens. The
   `SYSTEM_PROMPT` bakes in smbCloud-specific context the agent should use when the repo is clearly
   smbCloud, and stay general otherwise.
 - **`src/backend.rs`** — the `InferenceBackend` trait and neutral types (`ToolSpec`, `ToolCall`,
@@ -268,10 +279,21 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   announced, because it sets the announced status: a call that will ask starts `pending`, the
   permission request carries that call's own id, and an `in_progress` update follows approval.
   That update also puts the card's title back, since the permission request overwrites it
-  with the full arguments. Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
-  serialized by `SiGitAgent::turn_lock` so the dispatch loop can route the client's permission
-  answer mid-turn — don't move them back inline, and don't await client requests from inline
-  handlers (deadlock).
+  with the full arguments. The Manual/Auto/Plan choice reaches an ACP client twice: as the
+  `sigit-permission-mode` config option, and as session `modes` with `session/set_mode`, which
+  the spec is retiring but some clients still render instead. Both are built from
+  `PERMISSION_MODES` in `main.rs` and read the same state, so whatever changes the mode has to
+  refresh both (`ConfigOptionUpdate` and `send_current_mode`). Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
+  so the dispatch loop can route the client's permission answer mid-turn — don't move them back
+  inline, and don't await client requests from inline handlers (deadlock). Two locks order them.
+  A per-session lock (`SiGitAgent::session_lock`) is held for a whole request, so requests on one
+  thread keep their order. `SiGitAgent::workspace_lock` guards what a session installs
+  process-wide (cwd, workspace roots, session MCP servers, the live backend slot, the engine's
+  conversation); lifecycle and config handlers hold it throughout, and `handle_prompt` holds it
+  through a `WorkspaceHold` that it releases while waiting on an HTTP endpoint or a permission
+  answer and retakes (reinstalling its session via `resume_workspace`) before any tool runs. An
+  on-device turn never releases it. Take the session lock first, never the other way round. Tool
+  execution, subagents included, still runs one session at a time.
 - **`src/instructions.rs`** — project instruction files, the always-on counterpart to skills.
   Reads `AGENTS.md` (the cross-tool [agents.md](https://agents.md) standard) and `CLAUDE.md`,
   walking from the session cwd up to the repo root (nearest ancestor with `.git`, never above it),
@@ -299,6 +321,23 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   every root. MCP is deliberately not on that list — `mcp::init` runs once at startup, before
   any session exists, so a second root's `.sigit/mcp.toml` has nobody to tell. (The servers a
   client names in `mcpServers` are a different thing and are per session; see `src/mcp.rs`.)
+- **`src/client_fs.rs`** — file reads and writes through the ACP client. A client that
+  advertises `fs.readTextFile` / `fs.writeTextFile` in `initialize` serves `fs/read_text_file`
+  and `fs/write_text_file` from its buffers, so `read_file` sees unsaved changes and
+  `edit_file` lands in the open buffer instead of underneath it. `tools.rs` has no access to the
+  connection, so this is a seam like the one `mcp::call_tool` gives MCP: `handle_initialize`
+  registers a `ClientFileSystem` (`AcpClientFs` in `main.rs`, holding the connection), and
+  `execute_tool_impl` asks `route_for` before it dispatches `read_file`, `create_file`,
+  `edit_file` or `multi_edit`. Each of those tools is split into a parse step and a pure
+  render/apply step (`ReadFileCall`, `CreateFileCall`, `EditCall`) that the disk path and the
+  client path share, so the model gets the same result text either way. The two capabilities are
+  independent: a client that only reads still gets its edits written to disk. The disk is the
+  fallback throughout: nothing is registered in the TUI or headless modes, a path outside the
+  session's roots is not routed, and a request the client fails or leaves unanswered for 30
+  seconds is retried on disk with a warning in the log. The client is only ever asked from
+  inside a spawned prompt turn, never from `handle_initialize` itself (deadlock, same as
+  permission requests). Existence checks and `create_file`'s parent directories still use the
+  disk. `SIGIT_CLIENT_FS=off` turns the routing off. Covered by `tests/acp_client_fs.rs`.
 - **`src/chat.rs`** — the Unix-only ratatui TUI. Loading-spinner phase then chat; uses
   `tokio::select!` to multiplex terminal events with streaming tokens.
 - **`src/headless.rs`** — non-interactive `sigit run` execution for scripts, CI, and Factory
@@ -320,6 +359,10 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   those read env vars once at init.
 - **`src/account.rs`** — siGit Code Cloud auth (`/login`, `/logout`, `/whoami`); authenticates
   against the account API and stores a session token. Performs no console I/O.
+  ACP `logout` (the editor's sign out button, shown only because `handle_initialize` advertises
+  `agentCapabilities.auth.logout`) and `/logout` both go through `SiGitAgent::sign_out` in
+  `main.rs`. The request names no session, so `leave_cloud` moves the parked threads off their
+  cloud tier along with the live one and each of them gets a fresh model picker.
 - **`src/browser_auth.rs`** — browser sign-in, the path the editor's "Sign in to siGit Code"
   button takes. sigit is a public OAuth client (client id `sigit-code-cli`, no secret, PKCE
   S256) against the authorization server at `$SIGIT_API_URL/oauth`. Two ways the code gets
@@ -363,7 +406,8 @@ verbosity with `RUST_LOG`.
 `OPENAI_BASE_URL` / `OPENAI_API_KEY` (provider override), `SIGIT_API_URL` (account API base,
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
 `SIGIT_MODEL`, `SIGIT_MAX_TOOL_ROUNDS` (1 to 500, default 24; the tool-round cap of a
-headless run or an ACP prompt turn), `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
+headless run or an ACP prompt turn), `SIGIT_MCP` (`off` disables MCP), `SIGIT_CLIENT_FS` (`off` keeps the file tools on disk even when the
+ACP client offers `fs/read_text_file` / `fs/write_text_file`), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
 smbCloud CLI server), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
 server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
 mutating tools; the escape hatch for clients without permission-request support),

{sigit_code-1.6.1 → sigit_code-1.6.3}/Cargo.lock

@@ -5778,7 +5778,7 @@ checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "sigit"
-version = "1.6.1"
+version = "1.6.3"
 dependencies = [
  "agent-client-protocol",
  "anyhow",
@@ -5801,6 +5801,7 @@ dependencies = [
  "tokio-util",
  "toml 0.8.23",
  "tracing-subscriber",
+ "url",
  "uuid 1.26.0",
 ]
 

{sigit_code-1.6.1 → sigit_code-1.6.3}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sigit"
-version = "1.6.1"
+version = "1.6.3"
 edition = "2024"
 description = "siGit Code — ACP-compatible AI coding agent. Sí, git."
 documentation = "https://github.com/getsigit/sigit"
@@ -60,6 +60,11 @@ base64 = "0.22"
 rand = "0.9"
 sha2 = "0.10"
 
+# ACP `resource_link` blocks carry file URIs. Parsing them with `url` decodes
+# percent escapes and maps Windows drive paths, which hand-stripping `file://`
+# did not. Already in the graph through reqwest.
+url = "2"
+
 # Release binaries ship to five registries, and the NuGet package bundles all
 # six targets in a single archive, so binary size is a distribution constraint
 # rather than a nicety. Stripping symbols takes the macOS arm64 binary from

{sigit_code-1.6.1 → sigit_code-1.6.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sigit-code
-Version: 1.6.1
+Version: 1.6.3
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers

{sigit_code-1.6.1 → sigit_code-1.6.3}/src/backend.rs

@@ -445,6 +445,15 @@ pub trait InferenceBackend: Send + Sync {
     /// local model while requests actually go to the cloud.
     fn is_remote(&self) -> bool;
 
+    /// A backend for the same endpoint and model with an empty conversation,
+    /// or `None` when the conversation cannot be separated from the backend
+    /// (on-device, the engine holds it). An editor keeps several threads open
+    /// in one process; this is what lets each of them own its history instead
+    /// of taking turns on a shared one.
+    fn fresh(&self) -> Option<Arc<dyn InferenceBackend>> {
+        None
+    }
+
     /// A serializable snapshot of the conversation history, one JSON object per
     /// message (`{"role": ..., "content": ...}` at minimum). The snapshot is
     /// what the session store persists; it includes any seeded system message
@@ -1554,6 +1563,19 @@ impl InferenceBackend for OpenAiBackend {
         true
     }
 
+    fn fresh(&self) -> Option<Arc<dyn InferenceBackend>> {
+        Some(Arc::new(Self {
+            base_url: self.base_url.clone(),
+            api_key: self.api_key.clone(),
+            model: self.model.clone(),
+            // The client is a handle on one connection pool; sharing it keeps
+            // connections to the endpoint warm across sessions.
+            http: self.http.clone(),
+            history: Mutex::new(Vec::new()),
+            accepts_images: self.accepts_images,
+        }))
+    }
+
     async fn history_snapshot(&self) -> Vec<serde_json::Value> {
         self.history.lock().await.clone()
     }
@@ -1944,18 +1966,25 @@ pub fn carryover_history(snapshot: Vec<serde_json::Value>) -> Vec<serde_json::Va
         }
     }
 
-    // Session switches happen only after the serialized turn has ended. A
-    // trailing user message therefore belongs to a cancelled/failed inference
-    // request with no answer; carrying it would make the next activation feed
-    // the model an orphaned prompt that the client considers cancelled.
-    while carried
+    carried
+}
+
+/// Take a cancelled prompt's user message back out of the live history.
+///
+/// The client drops a cancelled prompt from its thread, so the model must not
+/// keep answering it. Only the first inference round can cancel with the user
+/// message as the last entry; later rounds end on tool or assistant output.
+/// A prompt that fails with an error is not taken back: the client keeps it,
+/// so the history keeps it too and a model switch carries it over.
+pub async fn forget_trailing_user_message(backend: &dyn InferenceBackend) {
+    let mut history = backend.history_snapshot().await;
+    if history
         .last()
         .is_some_and(|message| message["role"] == "user")
     {
-        carried.pop();
+        history.pop();
+        backend.restore_history(history).await;
     }
-
-    carried
 }
 
 /// Replay `carried` (from [`carryover_history`]) into `backend`, on top of the
@@ -2161,16 +2190,39 @@ mod tests {
     }
 
     #[test]
-    fn carryover_drops_a_cancelled_trailing_user_message() {
+    fn carryover_keeps_a_trailing_user_message_from_a_failed_turn() {
+        // The client keeps a prompt whose inference errored, so a switch must
+        // not drop it (issue #124).
         let carried = carryover_history(vec![
             serde_json::json!({ "role": "system", "content": "prompt" }),
             serde_json::json!({ "role": "user", "content": "completed question" }),
             serde_json::json!({ "role": "assistant", "content": "completed answer" }),
-            serde_json::json!({ "role": "user", "content": "cancelled question" }),
+            serde_json::json!({ "role": "user", "content": "failed question" }),
         ]);
 
-        assert_eq!(carried.len(), 2, "{carried:#?}");
-        assert_eq!(carried.last().unwrap()["content"], "completed answer");
+        assert_eq!(carried.len(), 3, "{carried:#?}");
+        assert_eq!(carried.last().unwrap()["content"], "failed question");
+    }
+
+    #[tokio::test]
+    async fn forget_trailing_user_message_drops_only_a_cancelled_prompt() {
+        let backend = OpenAiBackend::new("http://localhost", "", "m", None);
+        backend
+            .restore_history(vec![
+                serde_json::json!({ "role": "user", "content": "completed question" }),
+                serde_json::json!({ "role": "assistant", "content": "completed answer" }),
+                serde_json::json!({ "role": "user", "content": "cancelled question" }),
+            ])
+            .await;
+
+        forget_trailing_user_message(&backend).await;
+
+        let history = backend.history_snapshot().await;
+        assert_eq!(history.len(), 2, "{history:#?}");
+        assert_eq!(history[1]["content"], "completed answer");
+
+        forget_trailing_user_message(&backend).await;
+        assert_eq!(backend.history_snapshot().await.len(), 2);
     }
 
     #[test]