sigit-code 1.6.3__tar.gz → 1.6.5__tar.gz

{sigit_code-1.6.3 → sigit_code-1.6.5}/.agents/AGENTS.md

@@ -152,6 +152,13 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   well-formed ones. A block that doesn't parse (or never closes) is dropped from both the reply
   and history, and `OpenAiBackend::complete` retries once with a note telling the model the call
   didn't run. Leaving the raw block in history makes the model invent `<function_results>` later.
+  What that scanner lets through then goes through `src/harness_markup.rs`, which removes
+  markup the model makes up in the harness's shape (issue #122): a `<system_warning>`-style
+  block (any `system_*`/`system-*` tag) is dropped whole, from the reply and the history, and
+  other underscore-named tags like `<Option_Picker>` lose the tags but keep their text. Code is
+  never touched, and an opening tag only counts at the start of a line, since prose writes
+  placeholders like `<repo_url>` the same way. It has to run after the inline-call scanner,
+  because `<tool_call>` matches its underscore rule.
   Image attachments: ACP fixes `promptCapabilities.image` for the whole connection, while the
   model can change on any turn, so the capability is always advertised and the decision is made
   per prompt. `InferenceBackend::accepts_images` answers for the active model (on-device: no;
@@ -163,6 +170,11 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   when its model cannot read them, which is what makes a mid-thread switch to a text-only tier
   safe. Read history text through `backend::message_text`, never `content.as_str()`.
   `IMAGE_TIERS` mirrors onde-cloud's `IMAGE_CANDIDATES`; update both together.
+  Audio attachments take the same path (`promptCapabilities.audio`, `accepts_audio`,
+  `audio_for_turn`, `without_audio`), sent as OpenAI `input_audio` parts. No cloud tier
+  takes audio, because onde-cloud drops `input_audio` parts when it parses a request, so
+  `provider::model_accepts_audio` says no for every `onde-*` id and yes for a user's own
+  endpoint. If onde-cloud ever routes audio, give it a tier table like `IMAGE_TIERS`.
 - **`src/provider.rs`** — decides *which* backend serves inference. Resolution order, first match
   wins: (1) override via `OPENAI_BASE_URL`+`OPENAI_API_KEY` or active profile in
   `~/.config/sigit/providers.toml`; (2) siGit Code Cloud when logged in; (3) on-device.
@@ -330,7 +342,11 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   `execute_tool_impl` asks `route_for` before it dispatches `read_file`, `create_file`,
   `edit_file` or `multi_edit`. Each of those tools is split into a parse step and a pure
   render/apply step (`ReadFileCall`, `CreateFileCall`, `EditCall`) that the disk path and the
-  client path share, so the model gets the same result text either way. The two capabilities are
+  client path share, so the model gets the same result text either way. The writing tools also
+  hand back the file before and after (`tools::FileChange`, via `execute_tool_with_change`), which
+  `handle_prompt` sends as ACP `diff` content ahead of the result text. A permission request for
+  one of them carries the same diff, worked out by `preview_file_change` without writing anything
+  and before the workspace is released, since a relative path resolves against the session's cwd. The two capabilities are
   independent: a client that only reads still gets its edits written to disk. The disk is the
   fallback throughout: nothing is registered in the TUI or headless modes, a path outside the
   session's roots is not routed, and a request the client fails or leaves unanswered for 30
@@ -338,6 +354,23 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   inside a spawned prompt turn, never from `handle_initialize` itself (deadlock, same as
   permission requests). Existence checks and `create_file`'s parent directories still use the
   disk. `SIGIT_CLIENT_FS=off` turns the routing off. Covered by `tests/acp_client_fs.rs`.
+- **`src/client_terminal.rs`** — `run_command` in the ACP client's terminal. A client that
+  advertises `terminal` in `initialize` runs a foreground command itself (`terminal/create`, with
+  the platform shell as `command` and the whole command line as one argument), and
+  `exec_run_command_via_client` embeds the terminal in the tool call as `terminal` content, so the
+  user watches the output live and can stop the command from the editor. The seam is
+  `client_fs`'s: `handle_initialize` registers `AcpClientTerminal`, and `execute_tool_impl` asks
+  `client_terminal_route` before the blocking path. Embedding needs the tool call's id, which is
+  why `execute_tool_with_change` takes one. What `run_command` promises stays put: the 120 s
+  timeout ends in `terminal/kill`, the output is capped, and `CommitWatch` still amends the
+  co-author trailer, checking HEAD on disk before and after. Background commands stay local
+  (`command_output` and `kill_command` read their pipes), and so does a command whose directory
+  is outside the session's roots, since nothing says the editor's machine can see it. A
+  `terminal/create` the client fails means nothing ran, so the command runs locally; a failure
+  after that is reported as the tool's error instead, because running it again could repeat its
+  effects. The finished card keeps the terminal and drops the result text, which still goes out
+  as `raw_output`. `SIGIT_CLIENT_TERMINAL=off` turns the routing off. Covered by
+  `tests/acp_client_terminal.rs`.
 - **`src/chat.rs`** — the Unix-only ratatui TUI. Loading-spinner phase then chat; uses
   `tokio::select!` to multiplex terminal events with streaming tokens.
 - **`src/headless.rs`** — non-interactive `sigit run` execution for scripts, CI, and Factory
@@ -407,7 +440,8 @@ verbosity with `RUST_LOG`.
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
 `SIGIT_MODEL`, `SIGIT_MAX_TOOL_ROUNDS` (1 to 500, default 24; the tool-round cap of a
 headless run or an ACP prompt turn), `SIGIT_MCP` (`off` disables MCP), `SIGIT_CLIENT_FS` (`off` keeps the file tools on disk even when the
-ACP client offers `fs/read_text_file` / `fs/write_text_file`), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
+ACP client offers `fs/read_text_file` / `fs/write_text_file`), `SIGIT_CLIENT_TERMINAL` (`off` runs
+`run_command` locally even when the ACP client offers a terminal), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
 smbCloud CLI server), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
 server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
 mutating tools; the escape hatch for clients without permission-request support),

sigit_code-1.6.5/.sigit/code-cloud-agent/config.toml

@@ -0,0 +1,6 @@
+[pull_request]
+base = "development"
+branch_prefix = "feature"
+
+[agent]
+max_tool_rounds = 60

sigit_code-1.6.5/.sigit/code-review/config.toml

@@ -0,0 +1,3 @@
+[review.reviewer_skill]
+name = "sigit-code-review-inner-loop"
+version = "1.0.0"

{sigit_code-1.6.3 → sigit_code-1.6.5}/AGENTS.md

@@ -152,6 +152,13 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   well-formed ones. A block that doesn't parse (or never closes) is dropped from both the reply
   and history, and `OpenAiBackend::complete` retries once with a note telling the model the call
   didn't run. Leaving the raw block in history makes the model invent `<function_results>` later.
+  What that scanner lets through then goes through `src/harness_markup.rs`, which removes
+  markup the model makes up in the harness's shape (issue #122): a `<system_warning>`-style
+  block (any `system_*`/`system-*` tag) is dropped whole, from the reply and the history, and
+  other underscore-named tags like `<Option_Picker>` lose the tags but keep their text. Code is
+  never touched, and an opening tag only counts at the start of a line, since prose writes
+  placeholders like `<repo_url>` the same way. It has to run after the inline-call scanner,
+  because `<tool_call>` matches its underscore rule.
   Image attachments: ACP fixes `promptCapabilities.image` for the whole connection, while the
   model can change on any turn, so the capability is always advertised and the decision is made
   per prompt. `InferenceBackend::accepts_images` answers for the active model (on-device: no;
@@ -163,6 +170,11 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   when its model cannot read them, which is what makes a mid-thread switch to a text-only tier
   safe. Read history text through `backend::message_text`, never `content.as_str()`.
   `IMAGE_TIERS` mirrors onde-cloud's `IMAGE_CANDIDATES`; update both together.
+  Audio attachments take the same path (`promptCapabilities.audio`, `accepts_audio`,
+  `audio_for_turn`, `without_audio`), sent as OpenAI `input_audio` parts. No cloud tier
+  takes audio, because onde-cloud drops `input_audio` parts when it parses a request, so
+  `provider::model_accepts_audio` says no for every `onde-*` id and yes for a user's own
+  endpoint. If onde-cloud ever routes audio, give it a tier table like `IMAGE_TIERS`.
 - **`src/provider.rs`** — decides *which* backend serves inference. Resolution order, first match
   wins: (1) override via `OPENAI_BASE_URL`+`OPENAI_API_KEY` or active profile in
   `~/.config/sigit/providers.toml`; (2) siGit Code Cloud when logged in; (3) on-device.
@@ -330,7 +342,11 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   `execute_tool_impl` asks `route_for` before it dispatches `read_file`, `create_file`,
   `edit_file` or `multi_edit`. Each of those tools is split into a parse step and a pure
   render/apply step (`ReadFileCall`, `CreateFileCall`, `EditCall`) that the disk path and the
-  client path share, so the model gets the same result text either way. The two capabilities are
+  client path share, so the model gets the same result text either way. The writing tools also
+  hand back the file before and after (`tools::FileChange`, via `execute_tool_with_change`), which
+  `handle_prompt` sends as ACP `diff` content ahead of the result text. A permission request for
+  one of them carries the same diff, worked out by `preview_file_change` without writing anything
+  and before the workspace is released, since a relative path resolves against the session's cwd. The two capabilities are
   independent: a client that only reads still gets its edits written to disk. The disk is the
   fallback throughout: nothing is registered in the TUI or headless modes, a path outside the
   session's roots is not routed, and a request the client fails or leaves unanswered for 30
@@ -338,6 +354,23 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   inside a spawned prompt turn, never from `handle_initialize` itself (deadlock, same as
   permission requests). Existence checks and `create_file`'s parent directories still use the
   disk. `SIGIT_CLIENT_FS=off` turns the routing off. Covered by `tests/acp_client_fs.rs`.
+- **`src/client_terminal.rs`** — `run_command` in the ACP client's terminal. A client that
+  advertises `terminal` in `initialize` runs a foreground command itself (`terminal/create`, with
+  the platform shell as `command` and the whole command line as one argument), and
+  `exec_run_command_via_client` embeds the terminal in the tool call as `terminal` content, so the
+  user watches the output live and can stop the command from the editor. The seam is
+  `client_fs`'s: `handle_initialize` registers `AcpClientTerminal`, and `execute_tool_impl` asks
+  `client_terminal_route` before the blocking path. Embedding needs the tool call's id, which is
+  why `execute_tool_with_change` takes one. What `run_command` promises stays put: the 120 s
+  timeout ends in `terminal/kill`, the output is capped, and `CommitWatch` still amends the
+  co-author trailer, checking HEAD on disk before and after. Background commands stay local
+  (`command_output` and `kill_command` read their pipes), and so does a command whose directory
+  is outside the session's roots, since nothing says the editor's machine can see it. A
+  `terminal/create` the client fails means nothing ran, so the command runs locally; a failure
+  after that is reported as the tool's error instead, because running it again could repeat its
+  effects. The finished card keeps the terminal and drops the result text, which still goes out
+  as `raw_output`. `SIGIT_CLIENT_TERMINAL=off` turns the routing off. Covered by
+  `tests/acp_client_terminal.rs`.
 - **`src/chat.rs`** — the Unix-only ratatui TUI. Loading-spinner phase then chat; uses
   `tokio::select!` to multiplex terminal events with streaming tokens.
 - **`src/headless.rs`** — non-interactive `sigit run` execution for scripts, CI, and Factory
@@ -407,7 +440,8 @@ verbosity with `RUST_LOG`.
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
 `SIGIT_MODEL`, `SIGIT_MAX_TOOL_ROUNDS` (1 to 500, default 24; the tool-round cap of a
 headless run or an ACP prompt turn), `SIGIT_MCP` (`off` disables MCP), `SIGIT_CLIENT_FS` (`off` keeps the file tools on disk even when the
-ACP client offers `fs/read_text_file` / `fs/write_text_file`), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
+ACP client offers `fs/read_text_file` / `fs/write_text_file`), `SIGIT_CLIENT_TERMINAL` (`off` runs
+`run_command` locally even when the ACP client offers a terminal), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
 smbCloud CLI server), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
 server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
 mutating tools; the escape hatch for clients without permission-request support),

{sigit_code-1.6.3 → sigit_code-1.6.5}/CHANGELOG.md

@@ -1,5 +1,101 @@
 # Changelog
 
+## 1.6.5
+
+### Added
+
+- **An `@file` mention can carry unsaved edits.** siGit Code now advertises
+  `promptCapabilities.embeddedContext`, so a client can put a resource's
+  contents in the prompt instead of sending a link to it. Before, a client
+  that follows the spec only sent `resource_link`, and siGit Code read the
+  file from disk, missing whatever the user had not saved yet (#141).
+- **A prompt can carry audio.** siGit Code now advertises
+  `promptCapabilities.audio` and sends an attached clip to the model as an
+  OpenAI `input_audio` part. It works the way image attachments do: a model on
+  an endpoint you configure yourself gets the clip and decides for itself,
+  while siGit Code Cloud tiers and on-device models, none of which take audio
+  today, get a note in its place and the editor says the clip was left out
+  (#143).
+- **The README says what telemetry is sent.** A new Telemetry section covers
+  the model-timing events Onde Inference can report for on-device models,
+  what they leave out, and how to turn them off with `ONDE_DISABLE_PULSE=1`.
+
+### Changed
+
+- **A turn that cannot get its session back stops.** A turn on an HTTP backend
+  gives up the process-wide working directory while it waits and reinstalls
+  its session before a tool runs. If the reinstall failed, the turn logged a
+  warning and carried on in whichever directory was current. Nothing makes it
+  fail today, since a close waits for the turn, but the turn now ends as
+  cancelled instead of depending on that.
+- **Dependencies match the rest of the Onde stack.** Onde 1.2.2 to 1.3.1,
+  reqwest 0.12 to 0.13 and ratatui 0.29 to 0.30, the versions Ed, OndeCode and
+  SplitFire Agent use. ratatui is built with only its crossterm backend, which
+  drops the second copy of crossterm (0.28) from the build.
+
+### Fixed
+
+- **Tags a model makes up no longer show in the reply.** After a long run of
+  tool rounds, a model could start writing markup that looked like it came
+  from siGit Code: a `<system_warning>` block telling the user the previous
+  turn was injected and should be ignored, or a question wrapped in
+  `<Option_Picker>`. Neither tag means anything to siGit Code or the editor,
+  so both rendered as raw text. A `system_*` block is now dropped from the
+  reply and from the history, and other made-up tags are removed while the
+  text inside them stays. Code blocks are left alone. The system prompt also
+  tells the model to write plain Markdown and to list choices as plain text
+  (#122).
+
+- **Closing a thread that is waiting at a permission prompt no longer hangs.**
+  `session/close` cancels the session's running turn and waits for it to end,
+  but a turn stopped at a permission prompt only went on when the client
+  answered the request. A client that closed the thread without answering
+  left the close, and every later request for that thread, waiting for good.
+  The same held for `session/cancel` with a client that did not send the
+  cancelled outcome the protocol asks for. The permission wait now ends on
+  the cancellation as well, and an approval that arrives after the turn was
+  cancelled runs nothing.
+
+- **A closed thread no longer leaves its request lock behind.** The process
+  kept one lock per session id for as long as it ran, for closed threads and
+  for ids no session ever had. The entry now goes with the last request that
+  used it.
+
+- **A tool call that did not run no longer shows as completed.** When policy
+  or plan mode denied a call, when the user picked Deny at the permission
+  prompt, or when the repeat guard skipped a call the model made three times,
+  the editor's card still ended `completed`. Those cards now end `failed`, the
+  same way a call cancelled at the prompt already did. A call denied at the
+  prompt also gets its own title back instead of keeping the permission
+  request's (#139).
+
+- **On-device inference no longer panics on some non-English text.** siGit Code
+  now builds on Onde 1.3.1, which fixes a panic when a message longer than 100
+  bytes had a multi-byte character (an accented letter, CJK, or an emoji) at
+  byte 100. Onde 1.3 also reports Pulse events for streaming inference, which
+  is the path on-device turns take, so those turns are now reported alongside
+  model loads. `ONDE_DISABLE_PULSE=1` turns Pulse off.
+
+## 1.6.4
+
+### Added
+
+- **DeepSeek DSML tool calls written into the reply text are recovered.** A
+  DeepSeek-family endpoint can render a tool call as literal
+  `<｜DSML｜tool_calls>` text instead of the structured `tool_calls` field,
+  which streamed the tag into the editor and ended the turn with nothing run.
+  The inline tool-call scanner that already recovered the GLM XML and Kimi K3
+  shapes now recovers the DSML shape too, including a marker split across
+  stream chunks. A block that fails to parse is still kept out of the reply
+  and the history, and the model is told the call did not run (#181).
+
+### Fixed
+
+- **The round-cap stop message no longer carries a stray run of spaces.**
+  When the tool-round cap ended a turn, the closing message could collapse a
+  space run into the wrong spot, which the editor then rendered verbatim
+  (#177).
+
 ## 1.6.3
 
 ### Added

{sigit_code-1.6.3 → sigit_code-1.6.5}/CLAUDE.md

@@ -152,6 +152,13 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   well-formed ones. A block that doesn't parse (or never closes) is dropped from both the reply
   and history, and `OpenAiBackend::complete` retries once with a note telling the model the call
   didn't run. Leaving the raw block in history makes the model invent `<function_results>` later.
+  What that scanner lets through then goes through `src/harness_markup.rs`, which removes
+  markup the model makes up in the harness's shape (issue #122): a `<system_warning>`-style
+  block (any `system_*`/`system-*` tag) is dropped whole, from the reply and the history, and
+  other underscore-named tags like `<Option_Picker>` lose the tags but keep their text. Code is
+  never touched, and an opening tag only counts at the start of a line, since prose writes
+  placeholders like `<repo_url>` the same way. It has to run after the inline-call scanner,
+  because `<tool_call>` matches its underscore rule.
   Image attachments: ACP fixes `promptCapabilities.image` for the whole connection, while the
   model can change on any turn, so the capability is always advertised and the decision is made
   per prompt. `InferenceBackend::accepts_images` answers for the active model (on-device: no;
@@ -163,6 +170,11 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   when its model cannot read them, which is what makes a mid-thread switch to a text-only tier
   safe. Read history text through `backend::message_text`, never `content.as_str()`.
   `IMAGE_TIERS` mirrors onde-cloud's `IMAGE_CANDIDATES`; update both together.
+  Audio attachments take the same path (`promptCapabilities.audio`, `accepts_audio`,
+  `audio_for_turn`, `without_audio`), sent as OpenAI `input_audio` parts. No cloud tier
+  takes audio, because onde-cloud drops `input_audio` parts when it parses a request, so
+  `provider::model_accepts_audio` says no for every `onde-*` id and yes for a user's own
+  endpoint. If onde-cloud ever routes audio, give it a tier table like `IMAGE_TIERS`.
 - **`src/provider.rs`** — decides *which* backend serves inference. Resolution order, first match
   wins: (1) override via `OPENAI_BASE_URL`+`OPENAI_API_KEY` or active profile in
   `~/.config/sigit/providers.toml`; (2) siGit Code Cloud when logged in; (3) on-device.
@@ -330,7 +342,11 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   `execute_tool_impl` asks `route_for` before it dispatches `read_file`, `create_file`,
   `edit_file` or `multi_edit`. Each of those tools is split into a parse step and a pure
   render/apply step (`ReadFileCall`, `CreateFileCall`, `EditCall`) that the disk path and the
-  client path share, so the model gets the same result text either way. The two capabilities are
+  client path share, so the model gets the same result text either way. The writing tools also
+  hand back the file before and after (`tools::FileChange`, via `execute_tool_with_change`), which
+  `handle_prompt` sends as ACP `diff` content ahead of the result text. A permission request for
+  one of them carries the same diff, worked out by `preview_file_change` without writing anything
+  and before the workspace is released, since a relative path resolves against the session's cwd. The two capabilities are
   independent: a client that only reads still gets its edits written to disk. The disk is the
   fallback throughout: nothing is registered in the TUI or headless modes, a path outside the
   session's roots is not routed, and a request the client fails or leaves unanswered for 30
@@ -338,6 +354,23 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   inside a spawned prompt turn, never from `handle_initialize` itself (deadlock, same as
   permission requests). Existence checks and `create_file`'s parent directories still use the
   disk. `SIGIT_CLIENT_FS=off` turns the routing off. Covered by `tests/acp_client_fs.rs`.
+- **`src/client_terminal.rs`** — `run_command` in the ACP client's terminal. A client that
+  advertises `terminal` in `initialize` runs a foreground command itself (`terminal/create`, with
+  the platform shell as `command` and the whole command line as one argument), and
+  `exec_run_command_via_client` embeds the terminal in the tool call as `terminal` content, so the
+  user watches the output live and can stop the command from the editor. The seam is
+  `client_fs`'s: `handle_initialize` registers `AcpClientTerminal`, and `execute_tool_impl` asks
+  `client_terminal_route` before the blocking path. Embedding needs the tool call's id, which is
+  why `execute_tool_with_change` takes one. What `run_command` promises stays put: the 120 s
+  timeout ends in `terminal/kill`, the output is capped, and `CommitWatch` still amends the
+  co-author trailer, checking HEAD on disk before and after. Background commands stay local
+  (`command_output` and `kill_command` read their pipes), and so does a command whose directory
+  is outside the session's roots, since nothing says the editor's machine can see it. A
+  `terminal/create` the client fails means nothing ran, so the command runs locally; a failure
+  after that is reported as the tool's error instead, because running it again could repeat its
+  effects. The finished card keeps the terminal and drops the result text, which still goes out
+  as `raw_output`. `SIGIT_CLIENT_TERMINAL=off` turns the routing off. Covered by
+  `tests/acp_client_terminal.rs`.
 - **`src/chat.rs`** — the Unix-only ratatui TUI. Loading-spinner phase then chat; uses
   `tokio::select!` to multiplex terminal events with streaming tokens.
 - **`src/headless.rs`** — non-interactive `sigit run` execution for scripts, CI, and Factory
@@ -407,7 +440,8 @@ verbosity with `RUST_LOG`.
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
 `SIGIT_MODEL`, `SIGIT_MAX_TOOL_ROUNDS` (1 to 500, default 24; the tool-round cap of a
 headless run or an ACP prompt turn), `SIGIT_MCP` (`off` disables MCP), `SIGIT_CLIENT_FS` (`off` keeps the file tools on disk even when the
-ACP client offers `fs/read_text_file` / `fs/write_text_file`), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
+ACP client offers `fs/read_text_file` / `fs/write_text_file`), `SIGIT_CLIENT_TERMINAL` (`off` runs
+`run_command` locally even when the ACP client offers a terminal), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
 smbCloud CLI server), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
 server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
 mutating tools; the escape hatch for clients without permission-request support),