sigit-code 1.7.3__tar.gz → 1.7.5__tar.gz

{sigit_code-1.7.3 → sigit_code-1.7.5}/Cargo.lock

@@ -5945,7 +5945,7 @@ checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "sigit"
-version = "1.7.3"
+version = "1.7.5"
 dependencies = [
  "agent-client-protocol",
  "anyhow",
@@ -5976,7 +5976,7 @@ dependencies = [
 
 [[package]]
 name = "sigit-agent"
-version = "1.7.3"
+version = "1.7.5"
 dependencies = [
  "agent-client-protocol",
  "anyhow",

{sigit_code-1.7.3 → sigit_code-1.7.5}/Cargo.toml

@@ -3,7 +3,7 @@ resolver = "3"
 members = ["crates/cli", "crates/sigit-*"]
 
 [workspace.package]
-version = "1.7.3"
+version = "1.7.5"
 edition = "2024"
 license = "Apache-2.0"
 repository = "https://github.com/getsigit/sigit"
@@ -16,7 +16,7 @@ authors = ["Seto Elkahfi <seto@sigit.si>", "paydii <193906237+paydii@users.norep
 # crates.io, so this resolves from the registry rather than the onde-ed checkout next door.
 ed-acp = { version = "1.3.0", default-features = false }
 ed-acp-testkit = "1.3.0"
-sigit-agent = { version = "1.7.3", default-features = false, path = "crates/sigit-agent" }
+sigit-agent = { version = "1.7.5", default-features = false, path = "crates/sigit-agent" }
 
 # ACP protocol SDK
 agent-client-protocol = { version = "2.2", features = ["unstable_session_fork"] }

{sigit_code-1.7.3 → sigit_code-1.7.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sigit-code
-Version: 1.7.3
+Version: 1.7.5
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers

{sigit_code-1.7.3 → sigit_code-1.7.5}/crates/cli/src/account.rs

@@ -27,7 +27,7 @@ fn api_base() -> String {
 // `serde_json::Value` rather than a struct because of the bare-string variant.
 
 #[derive(Debug, Deserialize)]
-struct MeResponse {
+struct UserResponse {
     #[serde(default)]
     email: Option<String>,
 }
@@ -90,40 +90,6 @@ pub async fn authenticate(email: &str, password: &str) -> Result<String, String>
     Err(format!("sign-in failed: {message}"))
 }
 
-/// Verify that a usable session exists, confirming the stored token against the
-/// account API. Returns the signed-in email on success, or a human-readable
-/// reason it is not usable. Used by the ACP `authenticate` handler to answer the
-/// editor's auth gate.
-pub async fn verify_session() -> Result<String, String> {
-    let Some(creds) = credentials::load() else {
-        return Err("not signed in".to_string());
-    };
-
-    let url = format!("{}/api/v1/me", api_base().trim_end_matches('/'));
-    let response = reqwest::Client::new()
-        .get(&url)
-        .bearer_auth(&creds.access_token)
-        .send()
-        .await
-        .map_err(|error| format!("could not reach siGit Code Cloud: {error}"))?;
-
-    if response.status().is_success() {
-        let email = response
-            .json::<MeResponse>()
-            .await
-            .ok()
-            .and_then(|me| me.email)
-            .or(creds.email)
-            .unwrap_or_else(|| "(unknown)".to_string());
-        Ok(email)
-    } else {
-        Err(format!(
-            "session expired (HTTP {})",
-            response.status().as_u16()
-        ))
-    }
-}
-
 /// Run an interactive sign-in against the terminal, prompting for email and a
 /// hidden password. Used by `sigit login`, which the editor launches in an
 /// embedded terminal for ACP terminal-based authentication. Returns the signed-in
@@ -166,11 +132,10 @@ pub async fn end_session() -> String {
 /// One-line description of the current session, verifying the token if reachable.
 pub async fn status_line() -> String {
     let Some(creds) = credentials::load() else {
-        return "Not signed in. Use `/login <email> <password>` to use siGit Code Cloud."
-            .to_string();
+        return "Not signed in. Use `/login` to use siGit Code Cloud.".to_string();
     };
 
-    let url = format!("{}/api/v1/me", api_base().trim_end_matches('/'));
+    let url = format!("{}/api/v1/user", api_base().trim_end_matches('/'));
     match reqwest::Client::new()
         .get(&url)
         .bearer_auth(&creds.access_token)
@@ -179,7 +144,7 @@ pub async fn status_line() -> String {
     {
         Ok(response) if response.status().is_success() => {
             let email = response
-                .json::<MeResponse>()
+                .json::<UserResponse>()
                 .await
                 .ok()
                 .and_then(|me| me.email)

{sigit_code-1.7.3 → sigit_code-1.7.5}/crates/cli/src/backend.rs

@@ -951,6 +951,9 @@ fn onde_result_to_turn(result: onde::inference::ToolAwareResult) -> TurnResult {
 pub struct OpenAiBackend {
     base_url: String,
     api_key: String,
+    /// Read the bearer from the stored session on each request instead of
+    /// using `api_key`; see `bearer`.
+    session_token: bool,
     model: String,
     http: reqwest::Client,
     /// The full message list sent on each request (system + turns + tool results).
@@ -985,6 +988,7 @@ impl OpenAiBackend {
         Self {
             base_url: base_url.into(),
             api_key: api_key.into(),
+            session_token: false,
             accepts_images: crate::provider::model_accepts_images(&model),
             accepts_audio: crate::provider::model_accepts_audio(&model),
             model,
@@ -994,6 +998,25 @@ impl OpenAiBackend {
         }
     }
 
+    /// Have the backend send the stored siGit Code Cloud session token as its
+    /// bearer, read on every request. A token captured at build time goes
+    /// stale when the user signs in as someone else; `api_key` is then only
+    /// the fallback for a signed-out request.
+    pub fn with_session_token(mut self, on: bool) -> Self {
+        self.session_token = on;
+        self
+    }
+
+    /// The bearer for the next request.
+    fn bearer(&self) -> String {
+        if self.session_token
+            && let Some(token) = crate::credentials::load_token()
+        {
+            return token;
+        }
+        self.api_key.clone()
+    }
+
     fn tools_json(tools: &[ToolSpec]) -> Vec<serde_json::Value> {
         tools
             .iter()
@@ -1122,7 +1145,7 @@ impl OpenAiBackend {
         let mut response = self
             .http
             .post(&url)
-            .bearer_auth(&self.api_key)
+            .bearer_auth(self.bearer())
             .json(&body)
             .send()
             .await
@@ -1144,7 +1167,7 @@ impl OpenAiBackend {
             response = self
                 .http
                 .post(&url)
-                .bearer_auth(&self.api_key)
+                .bearer_auth(self.bearer())
                 .json(&body)
                 .send()
                 .await
@@ -1193,7 +1216,7 @@ impl OpenAiBackend {
         let response = self
             .http
             .post(&url)
-            .bearer_auth(&self.api_key)
+            .bearer_auth(self.bearer())
             .json(&body)
             .send()
             .await
@@ -1826,6 +1849,7 @@ impl InferenceBackend for OpenAiBackend {
         Some(Arc::new(Self {
             base_url: self.base_url.clone(),
             api_key: self.api_key.clone(),
+            session_token: self.session_token,
             model: self.model.clone(),
             // The client is a handle on one connection pool; sharing it keeps
             // connections to the endpoint warm across sessions.

{sigit_code-1.7.3 → sigit_code-1.7.5}/crates/cli/src/chat.rs

@@ -3013,12 +3013,15 @@ mod tui {
                                         let system_prompt = crate::with_launch_context(
                                             &crate::system_prompt_for_model(true),
                                         );
-                                        app.backend = Arc::new(OpenAiBackend::new(
-                                            provider.base_url,
-                                            provider.api_key,
-                                            provider.model,
-                                            Some(system_prompt),
-                                        ));
+                                        app.backend = Arc::new(
+                                            OpenAiBackend::new(
+                                                provider.base_url,
+                                                provider.api_key,
+                                                provider.model,
+                                                Some(system_prompt),
+                                            )
+                                            .with_session_token(provider.session_token),
+                                        );
                                         app.current_model_name = provider.display_name.clone();
                                         app.tool_calling = true;
                                         // Selecting a cloud tier puts us in cloud mode.

{sigit_code-1.7.3 → sigit_code-1.7.5}/crates/cli/src/headless.rs

@@ -349,12 +349,15 @@ pub async fn run(config: HeadlessConfig) -> i32 {
         &crate::workspace::additional_roots(),
     ));
 
-    let backend: Arc<dyn InferenceBackend> = Arc::new(OpenAiBackend::new(
-        cfg.base_url,
-        cfg.api_key,
-        cfg.model.clone(),
-        Some(system_prompt),
-    ));
+    let backend: Arc<dyn InferenceBackend> = Arc::new(
+        OpenAiBackend::new(
+            cfg.base_url,
+            cfg.api_key,
+            cfg.model.clone(),
+            Some(system_prompt),
+        )
+        .with_session_token(cfg.session_token),
+    );
 
     if config.resume {
         let Some(history) = session_store::load(&config.session_id) else {

{sigit_code-1.7.3 → sigit_code-1.7.5}/crates/cli/src/main.rs

@@ -907,12 +907,15 @@ fn agent_tools_as_specs() -> Vec<ToolSpec> {
 fn register_subagent_factory_for(cfg: &provider::ProviderConfig) {
     let cfg = cfg.clone();
     tools::set_subagent_factory(Box::new(move |system_prompt: &str| {
-        Some(Arc::new(OpenAiBackend::new(
-            cfg.base_url.clone(),
-            cfg.api_key.clone(),
-            cfg.model.clone(),
-            Some(system_prompt.to_string()),
-        )) as Arc<dyn InferenceBackend>)
+        Some(Arc::new(
+            OpenAiBackend::new(
+                cfg.base_url.clone(),
+                cfg.api_key.clone(),
+                cfg.model.clone(),
+                Some(system_prompt.to_string()),
+            )
+            .with_session_token(cfg.session_token),
+        ) as Arc<dyn InferenceBackend>)
     }));
 }
 
@@ -2332,17 +2335,12 @@ impl SiGitAgent {
             ));
         }
 
-        // An existing session clears the gate without sending anyone to a
-        // browser they didn't ask for.
-        if let Ok(email) = account::verify_session().await {
-            log::info!("authenticate: verified existing session for {email}");
-            return Ok(AuthenticateResponse::default());
-        }
-
-        // Otherwise run the browser flow. There is no way to collect a password
-        // here (the spec forbids asking for credentials in a form) and no way
-        // to take a pasted code back, so this is the loopback variant or
-        // nothing: the editor gets an error naming the terminal command that
+        // `authenticate` is the user asking to sign in, so it always runs the
+        // browser flow, even with a valid session stored: that is how they
+        // switch accounts. There is no way to collect a password here (the
+        // spec forbids asking for credentials in a form) and no way to take a
+        // pasted code back, so this is the loopback variant or nothing: the
+        // editor gets an error naming the terminal command that
         // does work without a listener.
         let flow = browser_auth::begin();
         if !flow.is_loopback() {
@@ -4390,12 +4388,10 @@ impl SiGitAgent {
             )),
             None => system_prompt_for_model(true),
         };
-        let cloud_backend: Arc<dyn InferenceBackend> = Arc::new(OpenAiBackend::new(
-            cfg.base_url,
-            cfg.api_key,
-            cfg.model,
-            Some(system_prompt),
-        ));
+        let cloud_backend: Arc<dyn InferenceBackend> = Arc::new(
+            OpenAiBackend::new(cfg.base_url, cfg.api_key, cfg.model, Some(system_prompt))
+                .with_session_token(cfg.session_token),
+        );
         // Continue the thread on the new backend instead of starting over.
         let carried =
             backend::carryover_history(self.backend.lock().await.history_snapshot().await);
@@ -6015,12 +6011,15 @@ async fn run_interactive(tty: std::fs::File, mut cleanup_tty: std::fs::File) ->
                 let _ = load_tx.send(Ok(()));
                 let label = provider.display_name.clone();
                 register_subagent_factory_for(&provider);
-                let backend = Arc::new(OpenAiBackend::new(
-                    provider.base_url,
-                    provider.api_key,
-                    provider.model,
-                    Some(with_instructions(system_prompt_for_model(true))),
-                )) as Arc<dyn InferenceBackend>;
+                let backend = Arc::new(
+                    OpenAiBackend::new(
+                        provider.base_url,
+                        provider.api_key,
+                        provider.model,
+                        Some(with_instructions(system_prompt_for_model(true))),
+                    )
+                    .with_session_token(provider.session_token),
+                ) as Arc<dyn InferenceBackend>;
                 (backend, label)
             }
             None => {
@@ -6045,12 +6044,15 @@ async fn run_interactive(tty: std::fs::File, mut cleanup_tty: std::fs::File) ->
                         let _ = load_tx.send(Ok(()));
                         let label = provider.display_name.clone();
                         register_subagent_factory_for(&provider);
-                        let backend = Arc::new(OpenAiBackend::new(
-                            provider.base_url,
-                            provider.api_key,
-                            provider.model,
-                            Some(with_instructions(system_prompt_for_model(true))),
-                        )) as Arc<dyn InferenceBackend>;
+                        let backend = Arc::new(
+                            OpenAiBackend::new(
+                                provider.base_url,
+                                provider.api_key,
+                                provider.model,
+                                Some(with_instructions(system_prompt_for_model(true))),
+                            )
+                            .with_session_token(provider.session_token),
+                        ) as Arc<dyn InferenceBackend>;
                         (backend, label)
                     }
                     None => {
@@ -6217,12 +6219,15 @@ async fn run_acp_server(auto_load_local_model: bool) -> anyhow::Result<()> {
             cfg.base_url
         );
         register_subagent_factory_for(&cfg);
-        let override_backend: Arc<dyn InferenceBackend> = Arc::new(OpenAiBackend::new(
-            cfg.base_url,
-            cfg.api_key,
-            cfg.model,
-            Some(system_prompt_for_model(true)),
-        ));
+        let override_backend: Arc<dyn InferenceBackend> = Arc::new(
+            OpenAiBackend::new(
+                cfg.base_url,
+                cfg.api_key,
+                cfg.model,
+                Some(system_prompt_for_model(true)),
+            )
+            .with_session_token(cfg.session_token),
+        );
         *state.backend.lock().await = override_backend;
     } else {
         // On-device inference has a single shared conversation history, so a
@@ -7133,6 +7138,7 @@ mod tests {
             base_url: "http://127.0.0.1:9".into(),
             api_key: String::new(),
             model: "test".into(),
+            session_token: false,
         };
 
         // Thread A is parked on a cloud tier, thread B stays on-device, and
@@ -7249,6 +7255,7 @@ mod tests {
                     base_url: "http://127.0.0.1:9".into(),
                     api_key: String::new(),
                     model: "test".into(),
+                    session_token: false,
                 },
                 "sigit-cloud:test".into(),
             )
@@ -7311,6 +7318,7 @@ mod tests {
                     base_url: "http://127.0.0.1:9".into(),
                     api_key: String::new(),
                     model: "test-b".into(),
+                    session_token: false,
                 },
                 "sigit-cloud:test-b".into(),
             )

{sigit_code-1.7.3 → sigit_code-1.7.5}/crates/cli/src/provider.rs

@@ -40,7 +40,7 @@ const DEFAULT_CLOUD_URL: &str = "https://sigit.si/api/v1";
 /// to be updated together when a tier is added.
 pub const CLOUD_TIERS: &[&str] = &[
     "fast", "balanced", "large", "mini", "air", "pro", "oke", "flux", "apex", "aura", "orbit",
-    "nova", "flare", "zenith", "prism",
+    "nova", "flare", "zenith", "prism", "lumen",
 ];
 
 pub const DEFAULT_CLOUD_TIER: &str = "nova";
@@ -57,6 +57,7 @@ pub const DEFAULT_CLOUD_TIER: &str = "nova";
 /// client does not know is not offered at all (see [`CLOUD_TIERS`]).
 const IMAGE_TIERS: &[&str] = &[
     "fast", "balanced", "large", "mini", "air", "pro", "oke", "aura", "flare", "zenith", "prism",
+    "lumen",
 ];
 
 /// Whether the cloud tier `tier` reads images.
@@ -110,6 +111,7 @@ pub fn cloud_tier_provider(tier: &str) -> Option<ProviderConfig> {
         base_url: cloud_base_url(),
         api_key: token,
         model: tier_to_model(tier),
+        session_token: true,
     })
 }
 
@@ -132,6 +134,7 @@ fn tier_to_model(tier: &str) -> String {
         "flare" => "onde-flare",
         "zenith" => "onde-zenith",
         "prism" => "onde-prism",
+        "lumen" => "onde-lumen",
         other => other,
     }
     .to_string()
@@ -148,6 +151,11 @@ pub struct ProviderConfig {
     pub api_key: String,
     /// Model id sent to the endpoint, e.g. `onde-balanced` or `gpt-4o-mini`.
     pub model: String,
+    /// Whether `api_key` is the stored siGit Code Cloud session token. A
+    /// backend built from such a config reads the token again on every
+    /// request, so signing in as another account takes effect without a
+    /// restart.
+    pub session_token: bool,
 }
 
 /// Title-case a tier name for display (`balanced` → `Balanced`).
@@ -201,6 +209,7 @@ fn from_env() -> Option<ProviderConfig> {
         base_url,
         api_key,
         model,
+        session_token: false,
     })
 }
 
@@ -260,6 +269,7 @@ fn from_config_file() -> Result<Option<ProviderConfig>, String> {
         base_url: entry.base_url,
         api_key: entry.api_key,
         model: entry.model,
+        session_token: false,
     }))
 }
 

sigit_code-1.7.5/crates/cli/tests/acp_cloud_reauth.rs

@@ -0,0 +1,208 @@
+//! Signing in as another account takes effect on the next message.
+//!
+//! A cloud backend used to keep the session token it was built with, so after
+//! Reauthenticate wrote a new one the thread went on sending the old account's
+//! bearer until the editor restarted the agent. The token is now read from the
+//! stored session on every request.
+
+use std::io::{BufRead, BufReader, Read, Write};
+use std::net::TcpListener;
+use std::process::{Child, ChildStdin, Command, Stdio};
+use std::sync::mpsc::{Receiver, channel};
+use std::time::{Duration, Instant};
+
+use serde_json::{Value, json};
+
+const TIMEOUT: Duration = Duration::from_secs(60);
+
+/// Stand in for `<cloud>/chat/completions`. The `authorization` header of each
+/// request is forwarded to the returned receiver.
+fn start_fake_cloud() -> (u16, Receiver<String>) {
+    let listener = TcpListener::bind("127.0.0.1:0").expect("bind fake cloud");
+    let port = listener.local_addr().unwrap().port();
+    let (auth_tx, auths) = channel();
+
+    std::thread::spawn(move || {
+        for stream in listener.incoming() {
+            let Ok(mut stream) = stream else { continue };
+            let mut reader = BufReader::new(match stream.try_clone() {
+                Ok(clone) => clone,
+                Err(_) => continue,
+            });
+            let mut content_length = 0usize;
+            let mut authorization = String::new();
+            loop {
+                let mut line = String::new();
+                if reader.read_line(&mut line).unwrap_or(0) == 0 {
+                    break;
+                }
+                let line = line.trim().to_string();
+                if line.is_empty() {
+                    break;
+                }
+                let lower = line.to_ascii_lowercase();
+                if let Some(length) = lower.strip_prefix("content-length:") {
+                    content_length = length.trim().parse().unwrap_or(0);
+                }
+                if lower.starts_with("authorization:") {
+                    authorization = lower;
+                }
+            }
+            let mut body = vec![0u8; content_length];
+            if reader.read_exact(&mut body).is_err() {
+                continue;
+            }
+            let _ = auth_tx.send(authorization);
+
+            let body = format!(
+                "data: {}\n\ndata: [DONE]\n\n",
+                json!({"choices": [{"delta": {"content": "ok"}}]})
+            );
+            let response = format!(
+                "HTTP/1.1 200 OK\r\ncontent-type: text/event-stream\r\n\
+                 content-length: {}\r\nconnection: close\r\n\r\n{body}",
+                body.len()
+            );
+            let _ = stream.write_all(response.as_bytes());
+            let _ = stream.flush();
+        }
+    });
+
+    (port, auths)
+}
+
+struct AgentUnderTest {
+    child: Child,
+    stdin: ChildStdin,
+    incoming: Receiver<Value>,
+    next_id: u64,
+}
+
+fn spawn_agent(cloud_port: u16, config_dir: &std::path::Path) -> AgentUnderTest {
+    let mut child = Command::new(env!("CARGO_BIN_EXE_sigit"))
+        // No provider override and no on-device model: the thread starts on a
+        // cloud tier because a session is stored.
+        .env_remove("OPENAI_BASE_URL")
+        .env_remove("OPENAI_API_KEY")
+        .env_remove("SIGIT_MODEL")
+        .env("SIGIT_LOCAL_INFERENCE", "off")
+        .env("SIGIT_CLOUD_URL", format!("http://127.0.0.1:{cloud_port}"))
+        .env("SIGIT_CONFIG_DIR", config_dir)
+        .env("SIGIT_MCP", "off")
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::null())
+        .spawn()
+        .expect("spawn sigit in ACP mode");
+
+    let stdout = child.stdout.take().unwrap();
+    let (message_tx, incoming) = channel();
+    std::thread::spawn(move || {
+        for line in BufReader::new(stdout).lines() {
+            let Ok(line) = line else { break };
+            if let Ok(message) = serde_json::from_str::<Value>(&line)
+                && message_tx.send(message).is_err()
+            {
+                break;
+            }
+        }
+    });
+
+    let stdin = child.stdin.take().unwrap();
+    AgentUnderTest {
+        child,
+        stdin,
+        incoming,
+        next_id: 0,
+    }
+}
+
+impl AgentUnderTest {
+    fn request(&mut self, method: &str, params: Value) -> u64 {
+        self.next_id += 1;
+        let id = self.next_id;
+        let mut line =
+            json!({"jsonrpc": "2.0", "id": id, "method": method, "params": params}).to_string();
+        line.push('\n');
+        self.stdin.write_all(line.as_bytes()).expect("write stdin");
+        self.stdin.flush().expect("flush stdin");
+        id
+    }
+
+    fn wait_for_response(&mut self, id: u64) -> Value {
+        let deadline = Instant::now() + TIMEOUT;
+        loop {
+            let remaining = deadline.saturating_duration_since(Instant::now());
+            let Ok(message) = self.incoming.recv_timeout(remaining) else {
+                panic!("timed out waiting for the response to request {id}");
+            };
+            if message["id"] == id && message.get("method").is_none() {
+                assert!(
+                    message.get("error").is_none(),
+                    "request {id} failed: {message}"
+                );
+                return message;
+            }
+        }
+    }
+
+    fn prompt(&mut self, session_id: &str, text: &str) {
+        let id = self.request(
+            "session/prompt",
+            json!({"sessionId": session_id, "prompt": [{"type": "text", "text": text}]}),
+        );
+        self.wait_for_response(id);
+    }
+}
+
+impl Drop for AgentUnderTest {
+    fn drop(&mut self) {
+        let _ = self.child.kill();
+        let _ = self.child.wait();
+    }
+}
+
+fn store_token(config_dir: &std::path::Path, token: &str) {
+    std::fs::write(
+        config_dir.join("credentials.toml"),
+        format!("access_token = \"{token}\"\nemail = \"dev@example.com\"\n"),
+    )
+    .unwrap();
+}
+
+#[test]
+fn a_new_session_token_is_used_by_the_next_turn() {
+    let scratch = std::env::temp_dir().join(format!("sigit_acp_reauth_{}", std::process::id()));
+    let config_dir = scratch.join("config");
+    let work_dir = scratch.join("work");
+    std::fs::create_dir_all(&config_dir).unwrap();
+    std::fs::create_dir_all(&work_dir).unwrap();
+    store_token(&config_dir, "token-a");
+
+    let (port, auths) = start_fake_cloud();
+    let mut agent = spawn_agent(port, &config_dir);
+
+    let id = agent.request(
+        "initialize",
+        json!({"protocolVersion": 1, "clientCapabilities": {}}),
+    );
+    agent.wait_for_response(id);
+    let id = agent.request("session/new", json!({"cwd": work_dir, "mcpServers": []}));
+    let session_id = agent.wait_for_response(id)["result"]["sessionId"]
+        .as_str()
+        .expect("session id")
+        .to_string();
+
+    agent.prompt(&session_id, "first");
+    let first = auths.recv_timeout(TIMEOUT).expect("first request");
+    assert_eq!(first, "authorization: bearer token-a");
+
+    // What Reauthenticate does once the browser flow hands back a code.
+    store_token(&config_dir, "token-b");
+
+    agent.prompt(&session_id, "second");
+    let second = auths.recv_timeout(TIMEOUT).expect("second request");
+    assert_eq!(second, "authorization: bearer token-b");
+
+    std::fs::remove_dir_all(&scratch).ok();
+}

{sigit_code-1.7.3 → sigit_code-1.7.5}/crates/cli/tests/acp_logout.rs

@@ -123,6 +123,32 @@ impl AgentUnderTest {
             }
         }
     }
+
+    /// Send `text` as a prompt and return the agent message text it streamed
+    /// before the turn ended.
+    fn prompt_text(&mut self, session_id: &str, text: &str) -> String {
+        let id = self.request(
+            "session/prompt",
+            json!({"sessionId": session_id, "prompt": [{"type": "text", "text": text}]}),
+        );
+        let deadline = Instant::now() + TIMEOUT;
+        let mut reply = String::new();
+        loop {
+            let remaining = deadline.saturating_duration_since(Instant::now());
+            let Ok(message) = self.incoming.recv_timeout(remaining) else {
+                panic!("timed out waiting for the response to prompt {id}");
+            };
+            if message["method"] == "session/update"
+                && message["params"]["update"]["sessionUpdate"] == "agent_message_chunk"
+                && let Some(chunk) = message["params"]["update"]["content"]["text"].as_str()
+            {
+                reply.push_str(chunk);
+            }
+            if message["id"] == id && message.get("method").is_none() {
+                return reply;
+            }
+        }
+    }
 }
 
 impl Drop for AgentUnderTest {
@@ -177,3 +203,48 @@ fn logout_is_advertised_and_ends_the_account_session() {
 
     std::fs::remove_dir_all(&scratch).ok();
 }
+
+/// `/whoami` asks `/api/v1/user`, the endpoint that accepts the OAuth tokens
+/// browser sign-in stores. The deprecated `/api/v1/me` answers them with a 403.
+#[test]
+fn whoami_checks_the_session_against_the_user_endpoint() {
+    let scratch = std::env::temp_dir().join(format!("sigit_acp_whoami_{}", std::process::id()));
+    let config_dir = scratch.join("config");
+    std::fs::create_dir_all(&config_dir).unwrap();
+    std::fs::write(
+        config_dir.join("credentials.toml"),
+        "access_token = \"token-under-test\"\nemail = \"dev@example.com\"\n",
+    )
+    .unwrap();
+
+    let (api_port, api_requests) = start_fake_account_api();
+    let mut agent = spawn_agent(api_port, &config_dir);
+
+    let id = agent.request(
+        "initialize",
+        json!({"protocolVersion": 1, "clientCapabilities": {}}),
+    );
+    agent.wait_for_response(id);
+    let id = agent.request("session/new", json!({"cwd": scratch, "mcpServers": []}));
+    let session_id = agent.wait_for_response(id)["result"]["sessionId"]
+        .as_str()
+        .expect("session id")
+        .to_string();
+
+    let reply = agent.prompt_text(&session_id, "/whoami");
+    assert!(
+        reply.contains("Signed in to siGit Code Cloud as dev@example.com"),
+        "{reply}"
+    );
+
+    let head = api_requests
+        .recv_timeout(TIMEOUT)
+        .expect("/whoami should ask the account API");
+    assert!(head.starts_with("get /api/v1/user "), "{head}");
+    assert!(
+        head.contains("authorization: bearer token-under-test"),
+        "{head}"
+    );
+
+    std::fs::remove_dir_all(&scratch).ok();
+}

{sigit_code-1.7.3 → sigit_code-1.7.5}/crates/sigit-agent/src/browser_auth.rs

@@ -180,11 +180,27 @@ pub async fn complete_loopback(flow: Flow) -> Result<String, String> {
     let listener = listener.ok_or_else(|| "this sign-in has no local listener".to_string())?;
 
     let expected_state = state.clone();
-    let code = tokio::task::spawn_blocking(move || wait_for_code(listener, &expected_state))
-        .await
-        .map_err(|error| format!("sign-in was interrupted: {error}"))??;
-
-    exchange(&code, &verifier, &redirect_uri).await
+    let (code, mut stream) =
+        tokio::task::spawn_blocking(move || wait_for_code(listener, &expected_state))
+            .await
+            .map_err(|error| format!("sign-in was interrupted: {error}"))??;
+
+    // The browser is still waiting on its request. Answer it only once the
+    // exchange has settled, so the page never reports a sign-in that failed.
+    let result = exchange(&code, &verifier, &redirect_uri).await;
+    match &result {
+        Ok(_) => respond(
+            &mut stream,
+            "Signed in to siGit Code",
+            "You can close this tab.",
+        ),
+        Err(_) => respond(
+            &mut stream,
+            "Sign-in did not complete",
+            "Return to siGit Code and try again.",
+        ),
+    }
+    result
 }
 
 /// Redeem a code the person pasted in. Returns the signed-in email.
@@ -198,8 +214,12 @@ pub async fn complete_paste(flow: &Flow, code: &str) -> Result<String, String> {
 
 /// Accept connections until one carries our callback. Anything else on the
 /// port (a browser probe, a stray scan) is answered and ignored rather than
-/// ending the wait.
-fn wait_for_code(listener: TcpListener, expected_state: &str) -> Result<String, String> {
+/// ending the wait. On success the matching connection is returned unanswered,
+/// for the caller to respond to once the code has been redeemed.
+fn wait_for_code(
+    listener: TcpListener,
+    expected_state: &str,
+) -> Result<(String, std::net::TcpStream), String> {
     let deadline = std::time::Instant::now() + CALLBACK_TIMEOUT;
     listener
         .set_nonblocking(true)
@@ -243,7 +263,7 @@ fn wait_for_code(listener: TcpListener, expected_state: &str) -> Result<String,
                     }
                 }
                 Err(error) => {
-                    respond(&mut stream, "Could not read the sign-in callback.");
+                    respond(&mut stream, "Nothing to do here", "");
                     log::debug!("could not read browser callback: {error}");
                     continue 'connections;
                 }
@@ -255,7 +275,7 @@ fn wait_for_code(listener: TcpListener, expected_state: &str) -> Result<String,
             .next()
             .and_then(|line| line.split_whitespace().nth(1))
         else {
-            respond(&mut stream, "Bad request.");
+            respond(&mut stream, "Nothing to do here", "");
             continue;
         };
 
@@ -273,39 +293,68 @@ fn wait_for_code(listener: TcpListener, expected_state: &str) -> Result<String,
         }
 
         if let Some(error) = error {
-            respond(
-                &mut stream,
-                "Sign-in was cancelled. You can close this tab.",
-            );
+            respond(&mut stream, "Sign-in cancelled", "You can close this tab.");
             return Err(format!("sign-in was declined ({error})"));
         }
 
         let Some(code) = code else {
-            respond(&mut stream, "Nothing to do here.");
+            respond(&mut stream, "Nothing to do here", "");
             continue;
         };
 
         // The state proves this callback belongs to the flow we started, not
         // to a link someone else sent to this browser.
         if state.as_deref() != Some(expected_state) {
-            respond(&mut stream, "That sign-in did not come from siGit Code.");
+            respond(
+                &mut stream,
+                "Sign-in didn't match",
+                "That sign-in did not come from siGit Code.",
+            );
             return Err("the sign-in response did not match this request".to_string());
         }
 
-        respond(
-            &mut stream,
-            "Signed in to siGit Code. You can close this tab.",
-        );
-        return Ok(code);
+        return Ok((code, stream));
     }
 }
 
-fn respond(stream: &mut std::net::TcpStream, message: &str) {
-    let body = format!(
-        "<!doctype html><meta charset=\"utf-8\"><title>siGit Code</title>\
-         <body style=\"font:16px system-ui;display:grid;place-items:center;height:90vh\">\
-         <p>{message}</p></body>"
-    );
+/// The 64x64 app icon, inlined into the page so it needs no second request.
+const LOGO_PNG: &[u8] = include_bytes!("../assets/sign-in-logo.png");
+
+/// Renders the page the browser lands on. Self-contained: inline CSS and an
+/// inline logo, because the page is served from the loopback address and must
+/// not fetch anything. Title and hint are constants, so nothing is escaped.
+fn page(title: &str, hint: &str) -> String {
+    let logo = base64::engine::general_purpose::STANDARD.encode(LOGO_PNG);
+    let hint = if hint.is_empty() {
+        String::new()
+    } else {
+        format!("<p>{hint}</p>")
+    };
+    format!(
+        "<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\">\
+         <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\
+         <meta name=\"color-scheme\" content=\"dark\"><title>{title}</title><style>\
+         :root{{color-scheme:dark}}\
+         html,body{{margin:0;height:100%}}\
+         body{{display:flex;align-items:center;justify-content:center;background:#15171a;\
+         font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Roboto,\"Helvetica Neue\",Arial,sans-serif}}\
+         main{{display:flex;flex-direction:column;align-items:center;text-align:center;\
+         padding:0 24px;transform:translateY(-6%);animation:fade-in 240ms ease-out}}\
+         img{{width:40px;height:40px;border-radius:9px;opacity:.8;\
+         box-shadow:0 0 0 1px rgb(255 255 255/.06)}}\
+         h1{{margin:16px 0 0;font-size:15px;line-height:20px;font-weight:500;\
+         letter-spacing:-.01em;color:#f3f4f6}}\
+         p{{margin:4px 0 0;font-size:13px;line-height:18px;color:#6b7280}}\
+         @keyframes fade-in{{from{{opacity:0}}to{{opacity:1}}}}\
+         @media(prefers-reduced-motion:reduce){{main{{animation:none}}}}\
+         </style></head><body><main>\
+         <img src=\"data:image/png;base64,{logo}\" alt=\"\" width=\"40\" height=\"40\">\
+         <h1>{title}</h1>{hint}</main></body></html>"
+    )
+}
+
+fn respond(stream: &mut std::net::TcpStream, title: &str, hint: &str) {
+    let body = page(title, hint);
     let response = format!(
         "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
         body.len(),
@@ -464,6 +513,19 @@ fn percent_decode(value: &str) -> String {
 mod tests {
     use super::*;
 
+    #[test]
+    fn page_carries_the_title_hint_and_an_inline_logo() {
+        let body = page("Signed in to siGit Code", "You can close this tab.");
+        assert!(body.contains("<h1>Signed in to siGit Code</h1>"));
+        assert!(body.contains("<p>You can close this tab.</p>"));
+        assert!(body.contains("data:image/png;base64,"));
+    }
+
+    #[test]
+    fn page_omits_the_hint_when_empty() {
+        assert!(!page("Nothing to do here", "").contains("<p>"));
+    }
+
     #[test]
     fn code_challenge_matches_rfc_7636_example() {
         // RFC 7636 Appendix B.