Command And Key Reference

Docs home · 简体中文

This page collects user-facing commands, keys, paths, shared config sections, approval outcomes, and recovery facts. Provider selection and credentials stay in the provider documentation so this reference does not duplicate them.

TUI Keys

When the composer is focused, Up/Down first handles prompt history or cursor movement inside multiline input. If child agents exist, Down from the last composer input row focuses the composer agent panel. Ctrl-Z is a single draft restore for text cleared by Esc, not a general undo stack.

Slash Commands

Aliases: /m for /model, /e for /effort, and /q or /exit for /quit.

Workspace trust is handled by the startup workspace trust gate, not a slash command. Trust decisions are recorded in the session audit log. They allow repository-local verification candidates to be promoted for task readiness and permit an exact-workspace LSP with trust_required = true to start. They do not grant shell, plugin, MCP, or file-write permissions, and LSP write tools still require diff approval.

/model, /effort, /resume, /agent, and /queue show candidates. Use Up/Down to select, Tab to accept, and Enter to execute. /agent rename also shows child-agent candidates before the new name is typed.

CLI Commands

Subcommands are for automation, diagnostics, scripts, and setup checks. The full product surface is the TUI.

Machine Output And Local Server

sigil run --output json writes one versioned terminal record to stdout. --output jsonl writes ordered versioned event records and then exactly one terminal result or error. Human progress and safe network-disclosure notices stay on stderr. Stable exit codes are 0 for success, 1 for execution failure, 2 for invalid invocation or configuration, and 130 for a cooperatively cancelled run.

The local server is an advanced interface for a local client; it does not replace the TUI. Start it with a token stored in an environment variable:

export SIGIL_HTTP_TOKEN="$(openssl rand -hex 32)"
sigil serve

The command prints the actual loopback address selected by the OS. GET /health is unauthenticated; GET /openapi.json, GET /disclosures, and every session, run, event, cancellation, or approval route require Authorization: Bearer <token>. V1 rejects non-loopback hosts, a missing token, and --no-token before opening a listener. It does not enable cookie auth, wildcard CORS, remote access, daemon auto-start, or multi-user isolation.

Run events replay durable history and then remain live until a terminal event, disconnect, stream gap, or server shutdown. Last-Event-ID resumes retained durable events; transient text and reasoning progress is best effort and has no replay id. Ctrl-C closes command admission, cooperatively cancels active runs, drains owned workers and connections, and then exits.

Config Resolution

Sigil resolves config in this order:

1. --config <path>
2. sigil.toml in the user-visible Sigil config directory

Default user config path:

• ~/.sigil/sigil.toml

Important Paths

Do not commit real secrets in sigil.toml or local memory files. A workspace-root sigil.toml is not loaded by default; pass --config <path> explicitly if you need one for an experiment.

Provider Setup

Use the Provider guide for the supported provider values, model selection, and authentication priority. Each linked provider page owns its copyable config block and complete environment-variable list. Shared model-request timeout overrides are documented in Advanced configuration.

Common Config Sections

See Sigil Configuration Guide for examples. Provider and model selection, [providers.*] blocks, and authentication variables are indexed in the Provider guide.

Web Tool Inputs

Both tools are Read operations with an independent NetworkRead effect. [web].network_mode = "deny" blocks them even if the local permission mode is permissive. ask requires an explicit interactive action and therefore fails closed in headless/eager contexts that cannot ask.

Approval Outcomes

Session Recovery Facts

• Session logs are append-only JSONL.
• Restarting restores visible session state.
• Started tools without terminal records are restored as interrupted.
• Cancellation is durable and exact-once per run scope: cancel requested is followed by either cleanup-confirmed cancelled or cleanup-unconfirmed interrupted; recovery never upgrades an unconfirmed cancellation to cancelled.
• Restore does not silently replay unfinished tools.
• /new starts a fresh append-only session log.
• /resume selects older sessions.
• A selected /resume row exposes resume, finalized-turn fork, safe export, pin/unpin, and exact delete preview through Ctrl-O or right-click. The modal keeps exclusive keyboard focus.
• The Storage section in /config exposes retention as an explicit preview and confirmation. Normal startup, runs, resume, and sigil serve never apply it automatically.
• Exiting the TUI prints the current session id and a sigil resume <session-id> command.
• /task continue continues the latest unfinished planned task when one exists.