sigit-code 1.6.4__tar.gz → 1.6.6__tar.gz

{sigit_code-1.6.4 → sigit_code-1.6.6}/.agents/AGENTS.md

@@ -152,6 +152,19 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   well-formed ones. A block that doesn't parse (or never closes) is dropped from both the reply
   and history, and `OpenAiBackend::complete` retries once with a note telling the model the call
   didn't run. Leaving the raw block in history makes the model invent `<function_results>` later.
+  What that scanner lets through then goes through `src/harness_markup.rs`, which removes
+  markup the model makes up in the harness's shape (issue #122): a `<system_warning>`-style
+  block (any `system_*`/`system-*` tag) is dropped whole, from the reply and the history, and
+  other underscore-named tags like `<Option_Picker>` lose the tags but keep their text. Code is
+  never touched, and an opening tag only counts at the start of a line, since prose writes
+  placeholders like `<repo_url>` the same way. It has to run after the inline-call scanner,
+  because `<tool_call>` matches its underscore rule.
+  `src/repetition.rs` guards the same stream against a reply that degenerates into a loop over a
+  tiny vocabulary (issue #123): a window of 200 words with at most 40 distinct ones, fenced code
+  excepted, makes `consume_stream` stop reading, truncate the text to where the loop began (so
+  history never holds the junk), tell the user, and finish with `FinishReason::Repetition`
+  (`EndTurn` in ACP). `complete` then retries once with `REPETITION_RETRY`, like the malformed
+  tool call retry. Only the streaming path is guarded; `consume_json` and `LocalBackend` are not.
   Image attachments: ACP fixes `promptCapabilities.image` for the whole connection, while the
   model can change on any turn, so the capability is always advertised and the decision is made
   per prompt. `InferenceBackend::accepts_images` answers for the active model (on-device: no;
@@ -163,6 +176,11 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   when its model cannot read them, which is what makes a mid-thread switch to a text-only tier
   safe. Read history text through `backend::message_text`, never `content.as_str()`.
   `IMAGE_TIERS` mirrors onde-cloud's `IMAGE_CANDIDATES`; update both together.
+  Audio attachments take the same path (`promptCapabilities.audio`, `accepts_audio`,
+  `audio_for_turn`, `without_audio`), sent as OpenAI `input_audio` parts. No cloud tier
+  takes audio, because onde-cloud drops `input_audio` parts when it parses a request, so
+  `provider::model_accepts_audio` says no for every `onde-*` id and yes for a user's own
+  endpoint. If onde-cloud ever routes audio, give it a tier table like `IMAGE_TIERS`.
 - **`src/provider.rs`** — decides *which* backend serves inference. Resolution order, first match
   wins: (1) override via `OPENAI_BASE_URL`+`OPENAI_API_KEY` or active profile in
   `~/.config/sigit/providers.toml`; (2) siGit Code Cloud when logged in; (3) on-device.
@@ -330,7 +348,11 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   `execute_tool_impl` asks `route_for` before it dispatches `read_file`, `create_file`,
   `edit_file` or `multi_edit`. Each of those tools is split into a parse step and a pure
   render/apply step (`ReadFileCall`, `CreateFileCall`, `EditCall`) that the disk path and the
-  client path share, so the model gets the same result text either way. The two capabilities are
+  client path share, so the model gets the same result text either way. The writing tools also
+  hand back the file before and after (`tools::FileChange`, via `execute_tool_with_change`), which
+  `handle_prompt` sends as ACP `diff` content ahead of the result text. A permission request for
+  one of them carries the same diff, worked out by `preview_file_change` without writing anything
+  and before the workspace is released, since a relative path resolves against the session's cwd. The two capabilities are
   independent: a client that only reads still gets its edits written to disk. The disk is the
   fallback throughout: nothing is registered in the TUI or headless modes, a path outside the
   session's roots is not routed, and a request the client fails or leaves unanswered for 30
@@ -338,6 +360,23 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   inside a spawned prompt turn, never from `handle_initialize` itself (deadlock, same as
   permission requests). Existence checks and `create_file`'s parent directories still use the
   disk. `SIGIT_CLIENT_FS=off` turns the routing off. Covered by `tests/acp_client_fs.rs`.
+- **`src/client_terminal.rs`** — `run_command` in the ACP client's terminal. A client that
+  advertises `terminal` in `initialize` runs a foreground command itself (`terminal/create`, with
+  the platform shell as `command` and the whole command line as one argument), and
+  `exec_run_command_via_client` embeds the terminal in the tool call as `terminal` content, so the
+  user watches the output live and can stop the command from the editor. The seam is
+  `client_fs`'s: `handle_initialize` registers `AcpClientTerminal`, and `execute_tool_impl` asks
+  `client_terminal_route` before the blocking path. Embedding needs the tool call's id, which is
+  why `execute_tool_with_change` takes one. What `run_command` promises stays put: the 120 s
+  timeout ends in `terminal/kill`, the output is capped, and `CommitWatch` still amends the
+  co-author trailer, checking HEAD on disk before and after. Background commands stay local
+  (`command_output` and `kill_command` read their pipes), and so does a command whose directory
+  is outside the session's roots, since nothing says the editor's machine can see it. A
+  `terminal/create` the client fails means nothing ran, so the command runs locally; a failure
+  after that is reported as the tool's error instead, because running it again could repeat its
+  effects. The finished card keeps the terminal and drops the result text, which still goes out
+  as `raw_output`. `SIGIT_CLIENT_TERMINAL=off` turns the routing off. Covered by
+  `tests/acp_client_terminal.rs`.
 - **`src/chat.rs`** — the Unix-only ratatui TUI. Loading-spinner phase then chat; uses
   `tokio::select!` to multiplex terminal events with streaming tokens.
 - **`src/headless.rs`** — non-interactive `sigit run` execution for scripts, CI, and Factory
@@ -407,7 +446,8 @@ verbosity with `RUST_LOG`.
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
 `SIGIT_MODEL`, `SIGIT_MAX_TOOL_ROUNDS` (1 to 500, default 24; the tool-round cap of a
 headless run or an ACP prompt turn), `SIGIT_MCP` (`off` disables MCP), `SIGIT_CLIENT_FS` (`off` keeps the file tools on disk even when the
-ACP client offers `fs/read_text_file` / `fs/write_text_file`), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
+ACP client offers `fs/read_text_file` / `fs/write_text_file`), `SIGIT_CLIENT_TERMINAL` (`off` runs
+`run_command` locally even when the ACP client offers a terminal), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
 smbCloud CLI server), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
 server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
 mutating tools; the escape hatch for clients without permission-request support),

{sigit_code-1.6.4 → sigit_code-1.6.6}/AGENTS.md

@@ -152,6 +152,19 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   well-formed ones. A block that doesn't parse (or never closes) is dropped from both the reply
   and history, and `OpenAiBackend::complete` retries once with a note telling the model the call
   didn't run. Leaving the raw block in history makes the model invent `<function_results>` later.
+  What that scanner lets through then goes through `src/harness_markup.rs`, which removes
+  markup the model makes up in the harness's shape (issue #122): a `<system_warning>`-style
+  block (any `system_*`/`system-*` tag) is dropped whole, from the reply and the history, and
+  other underscore-named tags like `<Option_Picker>` lose the tags but keep their text. Code is
+  never touched, and an opening tag only counts at the start of a line, since prose writes
+  placeholders like `<repo_url>` the same way. It has to run after the inline-call scanner,
+  because `<tool_call>` matches its underscore rule.
+  `src/repetition.rs` guards the same stream against a reply that degenerates into a loop over a
+  tiny vocabulary (issue #123): a window of 200 words with at most 40 distinct ones, fenced code
+  excepted, makes `consume_stream` stop reading, truncate the text to where the loop began (so
+  history never holds the junk), tell the user, and finish with `FinishReason::Repetition`
+  (`EndTurn` in ACP). `complete` then retries once with `REPETITION_RETRY`, like the malformed
+  tool call retry. Only the streaming path is guarded; `consume_json` and `LocalBackend` are not.
   Image attachments: ACP fixes `promptCapabilities.image` for the whole connection, while the
   model can change on any turn, so the capability is always advertised and the decision is made
   per prompt. `InferenceBackend::accepts_images` answers for the active model (on-device: no;
@@ -163,6 +176,11 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   when its model cannot read them, which is what makes a mid-thread switch to a text-only tier
   safe. Read history text through `backend::message_text`, never `content.as_str()`.
   `IMAGE_TIERS` mirrors onde-cloud's `IMAGE_CANDIDATES`; update both together.
+  Audio attachments take the same path (`promptCapabilities.audio`, `accepts_audio`,
+  `audio_for_turn`, `without_audio`), sent as OpenAI `input_audio` parts. No cloud tier
+  takes audio, because onde-cloud drops `input_audio` parts when it parses a request, so
+  `provider::model_accepts_audio` says no for every `onde-*` id and yes for a user's own
+  endpoint. If onde-cloud ever routes audio, give it a tier table like `IMAGE_TIERS`.
 - **`src/provider.rs`** — decides *which* backend serves inference. Resolution order, first match
   wins: (1) override via `OPENAI_BASE_URL`+`OPENAI_API_KEY` or active profile in
   `~/.config/sigit/providers.toml`; (2) siGit Code Cloud when logged in; (3) on-device.
@@ -330,7 +348,11 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   `execute_tool_impl` asks `route_for` before it dispatches `read_file`, `create_file`,
   `edit_file` or `multi_edit`. Each of those tools is split into a parse step and a pure
   render/apply step (`ReadFileCall`, `CreateFileCall`, `EditCall`) that the disk path and the
-  client path share, so the model gets the same result text either way. The two capabilities are
+  client path share, so the model gets the same result text either way. The writing tools also
+  hand back the file before and after (`tools::FileChange`, via `execute_tool_with_change`), which
+  `handle_prompt` sends as ACP `diff` content ahead of the result text. A permission request for
+  one of them carries the same diff, worked out by `preview_file_change` without writing anything
+  and before the workspace is released, since a relative path resolves against the session's cwd. The two capabilities are
   independent: a client that only reads still gets its edits written to disk. The disk is the
   fallback throughout: nothing is registered in the TUI or headless modes, a path outside the
   session's roots is not routed, and a request the client fails or leaves unanswered for 30
@@ -338,6 +360,23 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   inside a spawned prompt turn, never from `handle_initialize` itself (deadlock, same as
   permission requests). Existence checks and `create_file`'s parent directories still use the
   disk. `SIGIT_CLIENT_FS=off` turns the routing off. Covered by `tests/acp_client_fs.rs`.
+- **`src/client_terminal.rs`** — `run_command` in the ACP client's terminal. A client that
+  advertises `terminal` in `initialize` runs a foreground command itself (`terminal/create`, with
+  the platform shell as `command` and the whole command line as one argument), and
+  `exec_run_command_via_client` embeds the terminal in the tool call as `terminal` content, so the
+  user watches the output live and can stop the command from the editor. The seam is
+  `client_fs`'s: `handle_initialize` registers `AcpClientTerminal`, and `execute_tool_impl` asks
+  `client_terminal_route` before the blocking path. Embedding needs the tool call's id, which is
+  why `execute_tool_with_change` takes one. What `run_command` promises stays put: the 120 s
+  timeout ends in `terminal/kill`, the output is capped, and `CommitWatch` still amends the
+  co-author trailer, checking HEAD on disk before and after. Background commands stay local
+  (`command_output` and `kill_command` read their pipes), and so does a command whose directory
+  is outside the session's roots, since nothing says the editor's machine can see it. A
+  `terminal/create` the client fails means nothing ran, so the command runs locally; a failure
+  after that is reported as the tool's error instead, because running it again could repeat its
+  effects. The finished card keeps the terminal and drops the result text, which still goes out
+  as `raw_output`. `SIGIT_CLIENT_TERMINAL=off` turns the routing off. Covered by
+  `tests/acp_client_terminal.rs`.
 - **`src/chat.rs`** — the Unix-only ratatui TUI. Loading-spinner phase then chat; uses
   `tokio::select!` to multiplex terminal events with streaming tokens.
 - **`src/headless.rs`** — non-interactive `sigit run` execution for scripts, CI, and Factory
@@ -407,7 +446,8 @@ verbosity with `RUST_LOG`.
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
 `SIGIT_MODEL`, `SIGIT_MAX_TOOL_ROUNDS` (1 to 500, default 24; the tool-round cap of a
 headless run or an ACP prompt turn), `SIGIT_MCP` (`off` disables MCP), `SIGIT_CLIENT_FS` (`off` keeps the file tools on disk even when the
-ACP client offers `fs/read_text_file` / `fs/write_text_file`), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
+ACP client offers `fs/read_text_file` / `fs/write_text_file`), `SIGIT_CLIENT_TERMINAL` (`off` runs
+`run_command` locally even when the ACP client offers a terminal), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
 smbCloud CLI server), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
 server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
 mutating tools; the escape hatch for clients without permission-request support),

{sigit_code-1.6.4 → sigit_code-1.6.6}/CHANGELOG.md

@@ -1,5 +1,118 @@
 # Changelog
 
+## Unreleased
+
+## 1.6.6
+
+### Added
+
+- **A tool call carries its programmatic tool name.** The `tool_call` an editor
+  gets for a running tool now includes `name` (`read_file`, `run_command`,
+  `mcp__…`) next to the human title, sent on the first report of the call only
+  as the protocol asks. A client can tell a command from a file edit without
+  parsing the title, and a replayed thread from `session/load` carries the same
+  name (#196).
+
+### Changed
+
+- **MCP runs on `rmcp`, the official Rust SDK, through `ed-mcp`.** siGit Code's
+  own JSON-RPC client for stdio and Streamable HTTP servers (about 600 lines)
+  is gone; `ed-mcp` is the layer every Onde agent shares. `mcp.toml`, the
+  baked-in `sigit` and `smbcloud` servers, tool names and `/mcp` are unchanged.
+  An HTTP server that stops answering is now reconnected and the call retried
+  once for any failure but a timeout, not only on a 404.
+
+### Fixed
+
+- **A reply that degenerates into a repetition loop is cut off.** After a tool
+  call, a model could fall into thousands of words from a tiny vocabulary
+  (`find: list: check: get: …`) with no tool call and no end, and the junk went
+  into history for the next turn. siGit Code now watches a streamed reply for a
+  window of 200 words with very few distinct ones (code blocks excepted), stops
+  reading, keeps only the text before the loop, tells you it stopped, and asks
+  the model once to make its call or answer briefly (#123).
+- **A linked selection written as `L10-L20` or `L10` reads just those lines.**
+  siGit Code read the line range of a `resource_link` only as `L10:20` or
+  `L10-20`, so `L10-L20` (the GitHub style) and a single line `L10` sent the
+  whole file instead of the selection. It now reads the same forms Zed's own
+  mention parser does, and a range that starts at line 0 or runs backwards
+  counts as no range.
+
+## 1.6.5
+
+### Added
+
+- **An `@file` mention can carry unsaved edits.** siGit Code now advertises
+  `promptCapabilities.embeddedContext`, so a client can put a resource's
+  contents in the prompt instead of sending a link to it. Before, a client
+  that follows the spec only sent `resource_link`, and siGit Code read the
+  file from disk, missing whatever the user had not saved yet (#141).
+- **A prompt can carry audio.** siGit Code now advertises
+  `promptCapabilities.audio` and sends an attached clip to the model as an
+  OpenAI `input_audio` part. It works the way image attachments do: a model on
+  an endpoint you configure yourself gets the clip and decides for itself,
+  while siGit Code Cloud tiers and on-device models, none of which take audio
+  today, get a note in its place and the editor says the clip was left out
+  (#143).
+- **The README says what telemetry is sent.** A new Telemetry section covers
+  the model-timing events Onde Inference can report for on-device models,
+  what they leave out, and how to turn them off with `ONDE_DISABLE_PULSE=1`.
+
+### Changed
+
+- **A turn that cannot get its session back stops.** A turn on an HTTP backend
+  gives up the process-wide working directory while it waits and reinstalls
+  its session before a tool runs. If the reinstall failed, the turn logged a
+  warning and carried on in whichever directory was current. Nothing makes it
+  fail today, since a close waits for the turn, but the turn now ends as
+  cancelled instead of depending on that.
+- **Dependencies match the rest of the Onde stack.** Onde 1.2.2 to 1.3.1,
+  reqwest 0.12 to 0.13 and ratatui 0.29 to 0.30, the versions Ed, OndeCode and
+  SplitFire Agent use. ratatui is built with only its crossterm backend, which
+  drops the second copy of crossterm (0.28) from the build.
+
+### Fixed
+
+- **Tags a model makes up no longer show in the reply.** After a long run of
+  tool rounds, a model could start writing markup that looked like it came
+  from siGit Code: a `<system_warning>` block telling the user the previous
+  turn was injected and should be ignored, or a question wrapped in
+  `<Option_Picker>`. Neither tag means anything to siGit Code or the editor,
+  so both rendered as raw text. A `system_*` block is now dropped from the
+  reply and from the history, and other made-up tags are removed while the
+  text inside them stays. Code blocks are left alone. The system prompt also
+  tells the model to write plain Markdown and to list choices as plain text
+  (#122).
+- **Closing a thread that is waiting at a permission prompt no longer hangs.**
+  `session/close` cancels the session's running turn and waits for it to end,
+  but a turn stopped at a permission prompt only went on when the client
+  answered the request. A client that closed the thread without answering
+  left the close, and every later request for that thread, waiting for good.
+  The same held for `session/cancel` with a client that did not send the
+  cancelled outcome the protocol asks for. The permission wait now ends on
+  the cancellation as well, and an approval that arrives after the turn was
+  cancelled runs nothing.
+
+- **A closed thread no longer leaves its request lock behind.** The process
+  kept one lock per session id for as long as it ran, for closed threads and
+  for ids no session ever had. The entry now goes with the last request that
+  used it.
+
+- **A tool call that did not run no longer shows as completed.** When policy
+  or plan mode denied a call, when the user picked Deny at the permission
+  prompt, or when the repeat guard skipped a call the model made three times,
+  the editor's card still ended `completed`. Those cards now end `failed`, the
+  same way a call cancelled at the prompt already did. A call denied at the
+  prompt also gets its own title back instead of keeping the permission
+  request's (#139).
+
+- **On-device inference no longer panics on some non-English text.** siGit Code
+  now builds on Onde 1.3.1, which fixes a panic when a message longer than 100
+  bytes had a multi-byte character (an accented letter, CJK, or an emoji) at
+  byte 100. Onde 1.3 also reports Pulse events for streaming inference, which
+  is the path on-device turns take, so those turns are now reported alongside
+  model loads. `ONDE_DISABLE_PULSE=1` turns Pulse off.
+
 ## 1.6.4
 
 ### Added

{sigit_code-1.6.4 → sigit_code-1.6.6}/CLAUDE.md

@@ -152,6 +152,19 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   well-formed ones. A block that doesn't parse (or never closes) is dropped from both the reply
   and history, and `OpenAiBackend::complete` retries once with a note telling the model the call
   didn't run. Leaving the raw block in history makes the model invent `<function_results>` later.
+  What that scanner lets through then goes through `src/harness_markup.rs`, which removes
+  markup the model makes up in the harness's shape (issue #122): a `<system_warning>`-style
+  block (any `system_*`/`system-*` tag) is dropped whole, from the reply and the history, and
+  other underscore-named tags like `<Option_Picker>` lose the tags but keep their text. Code is
+  never touched, and an opening tag only counts at the start of a line, since prose writes
+  placeholders like `<repo_url>` the same way. It has to run after the inline-call scanner,
+  because `<tool_call>` matches its underscore rule.
+  `src/repetition.rs` guards the same stream against a reply that degenerates into a loop over a
+  tiny vocabulary (issue #123): a window of 200 words with at most 40 distinct ones, fenced code
+  excepted, makes `consume_stream` stop reading, truncate the text to where the loop began (so
+  history never holds the junk), tell the user, and finish with `FinishReason::Repetition`
+  (`EndTurn` in ACP). `complete` then retries once with `REPETITION_RETRY`, like the malformed
+  tool call retry. Only the streaming path is guarded; `consume_json` and `LocalBackend` are not.
   Image attachments: ACP fixes `promptCapabilities.image` for the whole connection, while the
   model can change on any turn, so the capability is always advertised and the decision is made
   per prompt. `InferenceBackend::accepts_images` answers for the active model (on-device: no;
@@ -163,6 +176,11 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   when its model cannot read them, which is what makes a mid-thread switch to a text-only tier
   safe. Read history text through `backend::message_text`, never `content.as_str()`.
   `IMAGE_TIERS` mirrors onde-cloud's `IMAGE_CANDIDATES`; update both together.
+  Audio attachments take the same path (`promptCapabilities.audio`, `accepts_audio`,
+  `audio_for_turn`, `without_audio`), sent as OpenAI `input_audio` parts. No cloud tier
+  takes audio, because onde-cloud drops `input_audio` parts when it parses a request, so
+  `provider::model_accepts_audio` says no for every `onde-*` id and yes for a user's own
+  endpoint. If onde-cloud ever routes audio, give it a tier table like `IMAGE_TIERS`.
 - **`src/provider.rs`** — decides *which* backend serves inference. Resolution order, first match
   wins: (1) override via `OPENAI_BASE_URL`+`OPENAI_API_KEY` or active profile in
   `~/.config/sigit/providers.toml`; (2) siGit Code Cloud when logged in; (3) on-device.
@@ -330,7 +348,11 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   `execute_tool_impl` asks `route_for` before it dispatches `read_file`, `create_file`,
   `edit_file` or `multi_edit`. Each of those tools is split into a parse step and a pure
   render/apply step (`ReadFileCall`, `CreateFileCall`, `EditCall`) that the disk path and the
-  client path share, so the model gets the same result text either way. The two capabilities are
+  client path share, so the model gets the same result text either way. The writing tools also
+  hand back the file before and after (`tools::FileChange`, via `execute_tool_with_change`), which
+  `handle_prompt` sends as ACP `diff` content ahead of the result text. A permission request for
+  one of them carries the same diff, worked out by `preview_file_change` without writing anything
+  and before the workspace is released, since a relative path resolves against the session's cwd. The two capabilities are
   independent: a client that only reads still gets its edits written to disk. The disk is the
   fallback throughout: nothing is registered in the TUI or headless modes, a path outside the
   session's roots is not routed, and a request the client fails or leaves unanswered for 30
@@ -338,6 +360,23 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   inside a spawned prompt turn, never from `handle_initialize` itself (deadlock, same as
   permission requests). Existence checks and `create_file`'s parent directories still use the
   disk. `SIGIT_CLIENT_FS=off` turns the routing off. Covered by `tests/acp_client_fs.rs`.
+- **`src/client_terminal.rs`** — `run_command` in the ACP client's terminal. A client that
+  advertises `terminal` in `initialize` runs a foreground command itself (`terminal/create`, with
+  the platform shell as `command` and the whole command line as one argument), and
+  `exec_run_command_via_client` embeds the terminal in the tool call as `terminal` content, so the
+  user watches the output live and can stop the command from the editor. The seam is
+  `client_fs`'s: `handle_initialize` registers `AcpClientTerminal`, and `execute_tool_impl` asks
+  `client_terminal_route` before the blocking path. Embedding needs the tool call's id, which is
+  why `execute_tool_with_change` takes one. What `run_command` promises stays put: the 120 s
+  timeout ends in `terminal/kill`, the output is capped, and `CommitWatch` still amends the
+  co-author trailer, checking HEAD on disk before and after. Background commands stay local
+  (`command_output` and `kill_command` read their pipes), and so does a command whose directory
+  is outside the session's roots, since nothing says the editor's machine can see it. A
+  `terminal/create` the client fails means nothing ran, so the command runs locally; a failure
+  after that is reported as the tool's error instead, because running it again could repeat its
+  effects. The finished card keeps the terminal and drops the result text, which still goes out
+  as `raw_output`. `SIGIT_CLIENT_TERMINAL=off` turns the routing off. Covered by
+  `tests/acp_client_terminal.rs`.
 - **`src/chat.rs`** — the Unix-only ratatui TUI. Loading-spinner phase then chat; uses
   `tokio::select!` to multiplex terminal events with streaming tokens.
 - **`src/headless.rs`** — non-interactive `sigit run` execution for scripts, CI, and Factory
@@ -407,7 +446,8 @@ verbosity with `RUST_LOG`.
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
 `SIGIT_MODEL`, `SIGIT_MAX_TOOL_ROUNDS` (1 to 500, default 24; the tool-round cap of a
 headless run or an ACP prompt turn), `SIGIT_MCP` (`off` disables MCP), `SIGIT_CLIENT_FS` (`off` keeps the file tools on disk even when the
-ACP client offers `fs/read_text_file` / `fs/write_text_file`), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
+ACP client offers `fs/read_text_file` / `fs/write_text_file`), `SIGIT_CLIENT_TERMINAL` (`off` runs
+`run_command` locally even when the ACP client offers a terminal), `SIGIT_MCP_SMBCLOUD` (`off` drops the baked-in
 smbCloud CLI server), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
 server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
 mutating tools; the escape hatch for clients without permission-request support),