A memory and runtime release. Native and C-to-WebAssembly programs use less memory, idle programs wake less often, and a full Unix socket queue no longer stalls other fibers.
Compatibility: native current-jiffy now counts microseconds. Code that assumes a fixed tick rate must use (jiffies-per-second) when converting ticks to seconds.
Static Linux x86_64 programs, including the shipped sigil command, and C-to-WebAssembly builds using Zig's WASI target now use mimalloc 3.5.3. In a fixed 18-minute room tour with the same Harkfell build, the owned allocator cut peak WebAssembly memory by about 213 MiB (31%).
Other targets keep their current allocator. To keep the stock allocator, add allocator-stock to your build config's features. allocator-mimalloc requests mimalloc explicitly and fails on an unsupported target. The first build after upgrading rebuilds the allocator because its identity is now part of the build cache.
The sigil-allocator query from (sigil meta) reports the running program's allocator. Native and WASI builds also write that identity in an .allocator file beside the output. See the allocator guide for configuration.
Native current-jiffy now counts microseconds, with 1,000,000 jiffies per second. Previously, the Unix clock could overflow the small-integer range after about 39 hours of machine uptime. The clock now stays exact, using a large integer when needed. Use (jiffies-per-second) to convert ticks to seconds instead of assuming a fixed rate.
unix-connect now parks only the caller and accepts a timeout-ms: deadline, closing unfinished sockets on timeout or exception.with-async could return while external work was still pending. It now waits for that work to finish.guard could leave the VM in a broken return state when a native callback raised an error. It now catches the error and resumes its handler.Sigil now manages its own memory allocator. Native programs built for static Linux x86_64 and C-to-WASM web builds use mimalloc 3.5.3 behind a new allocator interface, and the sigil command itself switches with them. Long-running programs hold much less memory, and web builds start smaller and grow less.
Existing projects build without changes. The first build after upgrading rebuilds each target's allocator once, because the allocator is now part of a build's cache identity.
Memory requests from Sigil's runtime and from bundled C code such as SQLite now go through one allocator interface that Sigil owns, instead of whatever the C library provides. On static Linux x86_64 builds and C-to-WASM web builds, that interface is backed by a pinned copy of mimalloc 3.5.3.
In our measurements, the allocator was the difference:
The shipped sigil command for Linux x86_64 is one of these static builds, so it uses mimalloc as well.
A default mimalloc reserves a large block of memory up front, which on the web made things worse, not better. C-to-WASM builds therefore get three compile-time settings automatically: MI_FREE_USE_PAGEMAP=1, MI_DEFAULT_ARENA_RESERVE=4096 and MI_ARENA_SLICE_SHIFT=14. They're upstream's own options, and the first is upstream's recommendation for WASI. You don't need to set anything.
To keep the previous allocator for a build, add the allocator-stock feature:
(build\n name: 'web-stock\n target: "wasm32-wasi"\n features: '(release allocator-stock))
allocator-mimalloc requests mimalloc explicitly, and fails on a target where it isn't qualified yet. WASI builds can also pass typed MI_* settings; unknown names are rejected. Details are in the allocator guide.
The new sigil-allocator export from (sigil meta) reports which allocator a running program uses.
A bug-fix release for compilation, long-running programs and audio. The compiler keeps its intermediate values alive through garbage collection, completed child processes release their backing memory, and async producers and consumers resume correctly. Cues and streams also share output protection in the browser.
Existing projects build without changes.
call-with-values can now yield and resume with its returned values intact, including through a first-class reference to call-with-values.A bug-fix release for closures and long-running programs. Capturing a conditional internal definition no longer breaks a closure, pipe readers keep moving on Linux static builds and Android, and short file reads no longer leave the garbage collector's allocation totals growing.
Existing projects build without changes.
An internal define inside when, unless, if, or cond could fail with "GET_CELL: expected upvalue cell" when a lambda captured its binding. The binding now gets its cell before either branch runs, and redefining it updates the same cell so existing closures see the new value. Initializers still run only when their branch runs.
The sigil/lint tool now warns about this pattern. It works, but an explicit let binding or a definition before the conditional is easier to follow.
A bug-fix release. syntax-rules now handles nested ellipses, sigil build --watch works again, and Sigil behaves better in scripts: no color codes in piped output, and clean version info.
Existing projects build without changes.
syntax-rulesPatterns such as (_ (name value ...) ...) never matched, so macros in the R7RS style that repeat inside a repetition couldn't be written. They now match and expand, including empty inner lists, and a template that uses a pattern variable at the wrong depth gets a clear error.
sigil build --watch stopped right after the first build with "unbound variable 'build-watch-loop'". Watch mode works again.sigil --version cleanly. It also honors NO_COLOR.--version and its app metadata.musl-gcc wrapper was on PATH.optimize setting. If you want the undefined-behavior checks back, put them in your config's c-flags (for example -O0 -fsanitize=undefined); Sigil passes them through unchanged.A bug-fix release. The headline: since 0.22.10, a non-ASCII character in any manifest string (an em-dash in a description:, say) broke sigil deps for every project that read it. That's fixed, along with a build hang, a few native string miscompiles and --dry-run.
Existing projects build without changes. Crash The Stack, Harkfell and Phantom Burn build and pass their own checks on this release.
write and read agree on non-ASCII textwrite escaped each byte of a non-ASCII character with no closing ;, so read couldn't read its own output back. That's what broke manifests. write now prints printable non-ASCII text as itself ((write "café — λ") prints "café — λ"), escapes control characters as valid \\x<hex>; escapes, and everything it prints reads back unchanged.
A lock file written by 0.22.13 with non-ASCII text in it won't pass 0.22.12's identity check, so upgrade every machine that shares one.
sigil build could hang forever when a compiler or linker wrote a lot of warnings to stderr. Builds now read both output streams together."a\\x0;12" came out as "a\\n", and "\\x1B;7" didn't compile. String constants now match the bytecode VM byte for byte.sigil build --dry-run actually built everything. It now only reports what each step would do.find), so a modified item could be served as verified.--no-bundle native builds left out native package initializers, so for example sha256 from (sigil crypto) was unbound.--no-bundle web build of an app with a native dependency that has no WebAssembly code (sigil-audio, for one) failed with "Failed to link dev runtime". Web builds now link only what was built for them.do now accepts a variable with no step expression, as R7RS allows.sigil --version printed garbage.syntax-rules doesn't match nested ellipses yet: a pattern such as (_ (name value ...) ...) never matches.A correctness release. Sigil ignored a program's own binding of a builtin's name, such as a local not or an internal (define (car x) ...), on every backend, and several older bugs mixed up local names with macro keywords. Both are fixed. Release configs also compile optimized C by default now.
Existing projects build without changes. Code that doesn't rebind a builtin compiles exactly as before: the release and web builds of Crash The Stack, Harkfell and Phantom Burn are byte-identical to 0.22.11's.
Sigil compiled a call to car, not, +, list, raise, call/cc and about sixty other builtins straight to the builtin whenever the operator was spelled that way, whatever the program had bound to the name. So (let ((not (lambda (x) 42))) (not #f)) gave #t, an internal (define (car x) 99) was ignored, and ((lambda (car) (car 5)) (lambda (x) 77)) raised car: expected pair. The same happened with a library's own definitions, with names imported from a library other than (sigil core), and in the macro expander, where a parameter named like a macro was expanded as the macro: (define (g twice) (twice 3)) expanded a twice macro instead of calling its argument. The bytecode VM, native builds and WebAssembly all gave the same wrong answers. Now a binding the program introduces wins, apart from two cases involving a macro defined inside a procedure body (see Known issues), and code that doesn't rebind a builtin compiles exactly as before: every compiled module of the standard library and the CLI is byte-identical to 0.22.11's apart from the two below.
If your code relied on the old behavior, SIGIL_DEBUG_PRIMITIVE_SHADOW=1 prints each call to a builtin's name that now goes to your own binding, with the reason. Two places in Sigil itself did: the MCP server's project overview used its own keyword? from before keywords were their own type, so it never showed a project's name, description, dependencies or packages (it does now), and (sigil test) had its own list? that never ran.
Three older bugs in the same area are fixed. A macro whose expansion uses when failed with syntax-rules: no matching pattern when the caller had a local named when, as in (let ((when 1)) (m)): syntax-rules now ignores the keyword position of a pattern, as R7RS says. After (let () (define foo ...) ...), a later foo in the same procedure read the let's variable and failed with call: not a procedure; it now refers to whatever foo means outside the let. And with-exception-handler passed as a value (through apply, or bound to another name) now installs a handler that raise and raise-continuable reach, exactly like a direct call.
A config that leaves out optimize: now builds at level 2 when it is a release config: one named release, release-static, prerelease, prerelease-static or web, or one that says debug?: #f. Before, it compiled its C without -O and skipped the optimizer: a web app's runtime came out 6.6 MB and about four times slower than with optimize: 2. Any other config that leaves it out still builds at 0, and an explicit optimize: always wins. Every release config in the projects we checked already declares optimize:, so their builds don't change.
write prints compiled procedures as #<procedure>0.22.11 made format print a compiled procedure as #<procedure>; write and display still printed #<object 0x...>. All three agree now. To tell compiled code from bytecode, use the new (procedure-native? p): #t for a procedure compiled by the native backend or a builtin written in C, #f for a bytecode closure or anything that isn't a procedure.
sgx appears on the first upgradeUpgrading from 0.22.10 or earlier no longer needs a second sigil cli use to create sgx: the first command the new version runs writes $SIGIL_HOME/bin/sgx (and bin/sigil, if that is missing) and says so once on stderr.
only, rename or prefix, or through a renamed re-export, left it unbound under its new name: after (import (rename (only (demo source) allowed) (allowed selected))), (selected ...) failed with unbound variable 'selected'. Imported macros now follow the same selectors as values.(let () ...) and calls it still gets the builtin, and the definition leaks into the module (0.22.11 too).sigil build, native or WebAssembly), a macro defined inside a procedure body whose template names one of that body's own defines fails when it runs, whatever the name: macro template refers to local 'helper', which a compiled app can't capture yet (a macro defined inside a body). 0.22.11 failed the same way, as unbound variable 'str'. sigil run, eval and the REPL call the local.let-bound variable or a parameter with a builtin's name still gets the builtin: in (let ((car (lambda (x) 'mine))) (define-syntax m (syntax-rules () ((_ x) (car x)))) (m '(1 2))), (m '(1 2)) gives 1.(do ((x 1) (i 0 (+ i 1))) ...), a do variable with no step, fails with syntax-rules: no matching pattern.A release in two parts. sigil task gives a project and its dependencies one way to share scripts, such as a game engine's publish tools. And a long list of memory-safety and correctness fixes, found by reading and testing the runtime closely: several were silent wrong answers or memory corruption that had been there for a long time.
Existing projects build without changes. Run sigil deps install once in each project after upgrading, so it writes the new dependency index.
sigil task runs a project's scripts and its dependencies'sigil task <name> [args...] runs one of the project's tasks: a step task (a tasks: build pipeline, which takes no arguments) or a script task, a Sigil shell script that receives every argument after its name unchanged. A package declares script tasks as quoted data under provides::
provides: (list\n script-tasks: '((publish-web file: "tasks/publish-web.sgl"\n description: "Publish a checked site tree")))
A dependency's script tasks run only with its package prefix, as in sigil task substratic:publish-web, and only for dependencies listed in dependencies: or dev-dependencies:. A bare name is always the project's own task, so a dependency can't stand in for one, and sigil build, sigil test and sigil deps install never run a script task. Before a script task runs, one line on stderr says where it comes from, including the locked commit. sigil task --list lists every task.
sgx is sigil task under a short name: sigil cli install, use and upgrade write $SIGIL_HOME/bin/sgx, and sigil completions bash|zsh prints a completion script for both. sigil run -t <task> still works, prints Deprecated: use 'sigil task' instead, and goes away before 1.0.
Upgrading from 0.22.10 or earlier, the older CLI does the switch and doesn't know about sgx, so run sigil cli use 0.22.11 once more after upgrading to create it.
sigil run passes your arguments throughEverything after sigil run's own options now goes to the program unchanged: sigil run app --dry-run -t x passes app --dry-run -t x instead of running task x. The program reads them with (command-line), as a built binary does.
The shell prelude gains (project-root), the root of the project the script was started in. $, $?, the captures, spawn and pipe stages accept env-unset: ("NAME" ...) to keep a variable such as a token out of a child's environment.
sigil deps install writes .sigil/deps.index, so commands no longer read every dependency's package.sgl each time they start: an empty script starts about 100 ms faster in a project with many dependencies. sigil deps verify re-hashes each installed dependency and reports anything changed since it was installed. Native builds no longer write into a dependency's shared copy; the generated version_info.c goes to the build's own output. A package.sgl whose sigil: floor is newer than the running Sigil is refused before anything in it runs: this package needs sigil ≥ X; this is Y.
number->string on a large integer in a radix below 10 wrote past the end of its buffer, and string->number with a radix above 16 skipped the digits g to z and could abort.bytevector-copy! and other range checks could wrap around and write out of bounds, and make-vector or make-bytevector with a huge length quietly made a tiny one. They raise an error now.syntax->datum could lose objects to the garbage collector under memory pressure, so macro-heavy code could read freed memory.--profile.let no longer mistakes its body for a named letA let whose body starts with a list of lists, such as (let ((k 5)) ((f k)) 0), was read as a named let and referred to a global k instead of the binding, failing with unbound variable 'k'. It affected every backend.
Generic runtime errors now have the kind runtime-error everywhere (the bytecode VM used vm-error), and index errors say "index out of range". Code that catches vm-error by name should catch runtime-error instead.
length of an improper list returned -1 in compiled code, and length or apply on a circular list aborted or hung. Both raise a catchable error now, and list? of a circular list is #f.apply accepts continuations and parameter objects, as a direct call does.call/cc continuation could stop the bytecode VM with a GET_CELL error, and compile-file on a file with several libraries folded them into the first.(format "~a" proc) printed compiled procedures as #<object>; it prints #<procedure>.format, println and str printed integers of 2^31 and above wrong on the web (4294967297 came out as 1, 4294967295 as -1), and wrote a non-ASCII character as one broken byte on every platform: (format "~a" (integer->char 955)) now prints λ.sigil_make_bytevector now returns zeroed memory, so C code that builds a bytevector, including an embedder's natives, can't expose old heap contents.string-repeat could crash in desktop builds, and a corrupt .sgb file could corrupt memory as it loaded. make-srcloc and make-generated-srcloc raise for positions past 2^31-1.Set SIGIL_NATIVE_DEPS=all when you build, and a desktop app's release build compiles the dependency modules it imports to native code, not just its own modules; the rest stays bytecode. Calls into libraries such as sigil-geometry run 1.5 to 2 times faster and stop allocating per argument. It is off by default in this release while games try it. Binaries grow with the code they carry: 11% for Crash The Stack, 31% for Phantom Burn and 36% for Harkfell.
To try it, raise sigil: to 0.22.11, run sigil deps update --upgrade-sigil, and build with SIGIL_NATIVE_DEPS=all. A native app links the runtime its lock names, so the lock must carry 0.22.11's: it fixes a garbage-collector bug that native dependency code exposed.
eq? as they are on the bytecode VM.(apply apply k args) with a bytecode continuation k doesn't work; (apply k args) does.write still prints a compiled procedure as #<object …> while format "~a" now prints #<procedure>.A correctness and build-cache release. Optimized builds could compute wrong answers in two patterns, compiled code skipped argument-count checks, and Sigil's caches could run the wrong compiled code, ship stale native code, or throw away work they had already done. All of that is fixed, and an unchanged rebuild of a program now recompiles almost nothing.
Relock projects that make native or web builds. Code compiled by 0.22.10 needs the 0.22.10 runtime, and linking it against an older one fails with undefined reference to 'sigil_native_requires_sigil_lib_0_22_10_checked_calls'. Run sigil deps update --upgrade-sigil and rebuild. It moves the project's Sigil packages to the newest version its sigil: field allows, and it also re-resolves every other dependency, so expect those to move too. If sigil: pins a version below 0.22.10, raise it first.
sigil <file>, sigil eval, sigil test and the REPL cache compiled libraries. That cache found a library by its name and trusted its timestamp, so it could hand back the wrong compiled copy: two projects that lock different versions of one library ran each other's code, and so did a scratch copy with a newer timestamp, an in-place edit that kept the timestamp, or a change to SIGIL_FEATURES. Every compiled module is now stored under what actually shaped it: its source, the compiler, the settings that change output, its dependencies, its path and the host. The new cache lives in $XDG_CACHE_HOME/sigil/compiled/; the old $XDG_CACHE_HOME/sigil/lib/<commit>+sgbN directories are no longer used and can be deleted.
Scripts and tests also follow the project's redirects now: sigil <file>, eval and test take a redirected dependency's sources from the redirect target, and sigil --redirects FILE ... sets redirects for one command.
Release and web builds use the optimizer (O1 and O2), and so does bytecode compiled at those levels. Two of its passes could treat a value that came from a conditional as if it always came from one branch:
(define (caller choose replacement)\n (let ((target (if choose (lambda (n) (+ n 1)) replacement)))\n (+ (target 7) 1))) With choose false and a replacement that returns 41, this returned 9 instead of 42.
selected set to either an empty list or (cons 1 '()), (null? selected) answered #t for the one-element list.Both returned the wrong value silently, with no error. The optimizer now checks that a value has a single source before it relies on one. The fixes change no other generated code: the standard library and the packages compile to identical C, and so do both Flux Harmonic games for the second fix.
include, a library condition in cond-expand), used to switch caching off for every module in the package. Now only the files that need it compile fresh. Crash The Stack's unchanged rebuild went from 170 recompiled modules to 3 in its dev configuration, and from 167 to 19 for the web.sigil build --no-cache, and a build whose cache failed to start, reused the old compiled object and printed the old behavior. Native objects are now reused only when their inputs match by content.--verbose prints an UNCACHED line for it.eval-string) turns caching off for the rest of that build, and --verbose says so: NO-CACHE a task step registered or redefined <module>.sigil build --watch session that outlives a rebuild of Sigil itself stops caching, instead of filing new entries under the new compiler.arity-error with the bytecode VM's message, for example "<lambda>: expected 2 argument(s), got 1". Code that caught the old runtime-error from the native bridge should catch arity-error instead. Calling a delimited continuation with the wrong number of values from compiled code now raises too, as on the bytecode VM.apply in tail position is now a real tail call in native builds. A loop that recursed through apply a million times crashed with a segmentation fault; it now runs in constant stack, as on the bytecode VM.defines or set!s an existing binding in a library module isn't detected by the new step check.(sigil user), or whose macros look up modules outside their own imports, is never cached.case.sgl, regex.sgl and sigil/audio/sink.sgl on every build (as on 0.22.9).(list? x) on a circular list never returns.call/cc continuation is re-entered, and with "SET_CELL: expected upvalue cell" on some module bindings.A size release. Web builds of native-compiled apps are about 70% smaller, and call-heavy native code runs faster, because the compiler no longer spends most of each function's code on bookkeeping. Measured on Crash The Stack, Harkfell and Phantom Burn at the same commits.
Existing projects build without changes. Rebuild to pick up the smaller output.
A game's wasm is almost all code the compiler emits for its Sigil modules, and two thirds of that was per-function boilerplate: every local variable registered with the garbage collector by its own inlined call, and every call followed by its own copies of the error and exception exits. Locals are now kept in one array that is registered once, and a function's exits share one label.
| Game | 0.22.8 | 0.22.9 | Change |
|---|---|---|---|
| Crash The Stack | 44.8 MB | 12.0 MB | -73% |
| Harkfell | 31.7 MB | 9.0 MB | -72% |
| Phantom Burn | 11.4 MB | 3.7 MB | -68% |
Gzipped downloads shrink by 35 to 42%. Crash The Stack and Harkfell were over Cloudflare Pages' 25 MiB file limit and are now well under it.
Native desktop builds use the same compiler, so a function now makes room for its garbage collector roots once instead of once per local. A call-heavy benchmark (fib, tak) runs in about half the time. In the browser, Crash The Stack's game tick went from 11.7 ms to 9.2 ms a frame, and its whole frame callback from 14.4 ms to 10.6 ms.
(remainder 7.0 2) returned an undefined value in release and web builds, for every inexact argument. It now returns 1.0, and a zero divisor raises an error, as on the bytecode VM.apply with an improper list as its last argument silently dropped the tail in native code: (apply f 1 '(2 . 3)) called f with (1 2). It now raises the same error as the bytecode VM.integer? was wrong on both backends: (integer? 1.0) was #f on the bytecode VM, and (integer? 3.5) and (integer? +inf.0) were #t in native code. It now follows R7RS everywhere: exact integers and finite integral floats.-0.0 literal lost its sign in release and web builds, and prints as -0 on every backend now. +inf.0, -inf.0 and NaN literals are also emitted exactly.with-async returned an undefined value on the bytecode VM and cached it, so every later force was wrong too. It now returns the body's value, as native code already did.with-async stops the program, as it did in 0.22.8. The bytecode VM fix above doesn't cover the web path yet.A correctness release. Release and web builds could drop the guard of a small helper procedure, comparisons with NaN answered true, and sigil mcp serve showed no tools in new Claude Code sessions. It also fixes a web app that doesn't import (sigil core), a from-path dependency that was silently left out, macros that allocated on every use in native code, and modules reused after SIGIL_FEATURES changed. More of R7RS now works without an import.
Existing projects build without changes. Rebuild your release and web builds to pick up the first fix.
Since 0.16.1, release and web builds replaced a small helper with a fast path when its body could end in a struct field read, an index calculation (+ x (* y (cols g))) or a vector lookup (vector-ref (items s) i), even when the helper did something else first. (if (< i 0) 'none (vector-ref (items s) i)) crashed on the guarded branch, a guarded index helper returned the unguarded sum, and a counter bumped before the lookup never moved. Dev builds were right, so tests passed. The fast path now applies only when the whole helper is that one expression.
(<= nan 1.0), (>= nan 1.0) and (= nan nan) answered #t, so a tolerance check like (<= (abs (- a b)) eps) let a NaN through, and zero? said #t for NaN. Every comparison with NaN is now false, on every backend, and min and max return NaN when an argument is NaN.
Since 2026-09-25, Claude Code 2.1.282 negotiates MCP protocol revision 2026-07-28 with any server that offers it, and sigil mcp serve offered it without answering in that revision's shape. Claude Code checks that a tool listing says how long it may be cached (ttlMs and cacheScope). The listing from sigil mcp serve had neither, so the client retried a few times and then registered no tools at all, with no error shown. This release takes sigil-mcp 0.18.1, which adds both fields whenever the client speaks 2026-07-28, and older clients get exactly the answers they got before. Sessions that are already running keep the server they started with, so restart them after upgrading.
(sigil core) startsAn app whose modules never import (sigil core) died in the browser before running anything, with unbound variable '%set-spec!'. The core library is now always set up first.
from-path dependency is installed and builtA project's (from-path dir: "../lib") without package: was left out: sigil deps install didn't link it and sigil build finished without it, with only a "failed to load import" warning. It's now linked and built like any other dependency, and one that doesn't resolve stops both commands with its directory named. When --redirects points a dependency elsewhere than its .sigil/deps link, the build says which tree it used.
A syntax-rules macro whose expansion calls a procedure or reads a variable of the macro's own library looked the name up, and allocated, on every use in release and web builds: 27 allocations for one vector operation in sigil-geometry. Each use now finds the binding once, and still sees it change after a set!.
SIGIL_FEATURES changessigil eval, sigil run and sigil test keep compiled copies of the modules they build from source, and reused a copy compiled without a feature when that feature was set, so a cond-expand kept its old branch. Each feature set now has its own copies.
A library that imports only (sigil core), and every test file, now has these (scheme base) procedures:
floor, ceiling, round, truncate, max, min, quotient, gcd, lcm, expt, square, exact, inexact, exact?, inexact?, exact-integer? and the floor/ and truncate/ families, which needed (sigil math);string<?, string>?, string<=? and string>=?, which needed (sigil string) and now take more than two strings;list-tail, list-set!, list-copy, vector-append, boolean=?, symbol=?, exact-integer-sqrt, input-port-open?, output-port-open?, rational?, real?, complex?, numerator, denominator, rationalize, exact->inexact and inexact->exact, which didn't exist. Sigil has no exact fractions, so numerator, denominator and rationalize return floats for a fractional argument, and rationalize computes in floating point.(sigil math) and (sigil string) still export the names they had. A library or program that defines one of these names itself keeps its own definition. abs, modulo, remainder and call/cc can now be passed as values: (map abs xs) raised "unbound variable". Importing (sigil string) no longer swaps string-upcase and string-downcase for its own ASCII-only versions; they are core's.
The R7RS compatibility page now says which module each name is in and lists the gaps that remain.
sigil cli use v0.22.7 works; the leading v of a tag name is accepted.sigil deps install --help lists the options, including --redirects and --upgrade-sigil.string-index and string-index-right take a character as well as a predicate: (string-index "a,b" #\\,) is 1.sigil test shows each file's time in its per-file line, and --report lists every file with its outcome, counts and time in milliseconds.(sigil core), and a web app that linked several of them could run core out of room. A module past the limit now reports each name it can't export instead of dropping it silently.Release builds of desktop apps run the standard library and dependency packages as bytecode; only the app's own modules are native. Web builds run everything native. SIGIL_NATIVE_DEPS=1 makes a release build compile the standard library natively, at the cost of a much larger binary, since every standard library module is included. A proper fix is coming.
string-upcase and string-downcase convert non-ASCII letters with the C library's case tables, so their results for non-ASCII text can differ between systems: the Linux release build turns "λ" into "Λ", and a build against glibc may leave it unchanged. Before 0.22.8 a library that imported (sigil string) got ASCII-only versions whenever it passed these procedures as values.
A game audio and correctness release. Sound effects in the browser now play the moment they're triggered, a game's synth can drop to a lower rate on a weak phone, and sigil is ready to take upgrades from the signed registry. Three defects are fixed along the way: an error lost between nested guards, a -L path that stopped sigil starting, and tests run against dependencies the lock doesn't name.
Existing projects build without changes. The audio calls come with sigil-audio 0.13.0, released alongside.
A sound effect pushed into the music stream was heard one buffer later, up to a quarter second on a phone, and the delay came and went. Load a sound once with load-audio-cue and play it with play-audio-cue: it's mixed into the very next audio block, about 3 ms, however much music is buffered. audio-cue-lag reports the wait for an on-device readout.
open-audio-stream takes rate:, and set-audio-stream-rate! changes it mid-stream. The sink upsamples on the audio thread, so a game can render its music at 24000 on a 48000 device without a resampler of its own.
(sigil audio ladder) decides when to step down. It's the policy Crash The Stack tuned on a phone: it watches the steady cost per frame, ignores the moments next to a sound effect or a tune starting, and never steps back up on its own. rate-ladder-report gives a readout line such as 48000/24000 BY LADDER@20.2S.
audio-stream-underruns-sounding counts only the dropouts a player could hear, apart from a stream with nothing to play running dry.
sigil can now take upgrades from the registry's signed release list, checking every step itself with no minisign needed: the key list against the root key built into sigil, the release list against a key from that list, and the binary against the hash, size and file name the list gives for your platform. An older list than one sigil has already seen is refused, so a stale copy can't roll you back.
The registry's signed list goes live with its first signing. Until then, and whenever the registry can't be reached, sigil says Registry unavailable, using Codeberg. and upgrades from Codeberg as before. If the registry answers but what it serves fails a check, sigil installs nothing and says why. SIGIL_REGISTRY points it at a mirror.
guard reaches the outer one0.22.6's known issue is fixed: when one guard sat in tail position of another's body, an error the inner one passed on skipped the outer handler. The workarounds are no longer needed.
One cost: a loop that calls itself from inside a guard body now keeps each iteration's handler until it returns, about 150 bytes each. For a long-running loop, put the recursive call after the guard.
-L can no longer stop sigil startingPointing -L at another project's build output could replace the modules sigil itself is built from, and it failed before running anything. Those modules now always come from sigil's own copy. Separately released packages such as (sigil json) can still be replaced with -L.
After switching branches, .sigil/deps can still point at the old branch's dependencies, and tests ran against code the lock doesn't name. sigil build, sigil test and sigil run now stop with exit code 78 and name the package and both commits. Run sigil deps install, or set SIGIL_ALLOW_STALE_DEPS=1 to go ahead anyway.
make no longer prints Error in macro 'let' while bootstrapping, and the core library it builds is now checked to match a normal build.
A reliability release for scripts, plus the groundwork for sigil env. Two defects let a program lose data or an error and still exit 0, and the command line swallowed -L arguments meant for other programs. All three are fixed, and several errors that named nothing now say what went wrong.
Existing projects build without changes. One behaviour change to know about: a guard that used to return #f for an error none of its clauses matched now passes the error on, so a script that seemed to succeed may now report it.
write-file-string, the shell's write-text and display stopped at the first NUL byte and reported success. A script saving a downloaded archive could end up with a 24-byte file and exit 0. Every byte of a string is now written, to files, pipes and ports alike.
guard passes on an error that no clause matchesA guard with two or more clauses returned #f when none of them matched, so the error vanished and the script exited 0. It now propagates, as R7RS specifies.
Known issue: when the inner guard sits in tail position of an outer guard's body, the error it passes on skips the outer handler and reaches the top level. Until it's fixed, call the inner code in non-tail position, for example (let ((r (thunk))) r), or give the inner guard an else clause.
-- reach your programsigil treated -L as its own load-path flag wherever it appeared, even after --, so sigil env shell -- tmux -L work started tmux on the wrong server. Everything after -- now passes through untouched.
Struct, record and multimethod errors printed placeholders like ~a: unknown field ~a; they now read like point: unknown field z. And when a module on a -L path stops sigil itself from starting, the error names the module, the file and the -L directory, and says to remove the -L or rebuild what it holds.
sigil env: one-time setup and a read-only storesigil env setup offers to create the /sigil link that store programs need outside sigil env shell. It always asks first and refuses to run as root. The environment store now lives in ~/.local/share/sigil/store, apart from the build cache, and its items are read-only: sigil env store rm removes them and sigil env verify --full checks every file.
A lock with nothing to build now takes about 2 seconds instead of 12, and shows its progress as it goes. The first public channel follows once its signing is done.
", "summary": "A reliability release for scripts, plus the groundwork for sigil env. Two defects let a program lose data or an error and still exit 0, and the command line swallowed -L arguments meant for other programs. All three are fixed, and several errors that named nothing now say what went wrong.", "tags": [ "release" ] }, { "id": "https://usesigil.org/releases/0.22.5/", "url": "https://usesigil.org/releases/0.22.5/", "title": "Sigil 0.22.5", "date_published": "2026-09-23T00:00:00Z", "content_html": "A regular expressions and web reliability release, plus Windows icons. Sigil now has regular expressions in the standard library. Web builds could also fail in ways nothing on the code path explained: a type error from nowhere, or text that parsed fine natively coming back as garbage. Crash The Stack hit both, including a menu that froze on phones.
Existing projects build without changes. A native or wasm app picks up the fixes by rebuilding with this toolchain. (sigil regex) and (sigil unicode case) are new, and a Windows build config gains two optional keys.
(sigil regex)Sigil now has regular expressions in the standard library, using the same syntax as RE2 and Go. regex-match?, regex-search, regex-replace-all, regex-split and the rest take either a compiled pattern or a plain string, so a one-off check is a single call.
Matching always runs in linear time, so no pattern can hang your program, even one you didn't write. The trade-off is that a pattern can't refer back to its own groups (backreferences like \\1) or use lookaround, and such patterns are rejected with an error pointing at the position. Replacements can still use captured groups: $1 and ${name} work in regex-replace and regex-replace-all.
The module is plain Sigil, so it behaves the same on bytecode, native and WebAssembly. Shell scripts get it without an import:
(unless (regex-match? "^v[0-9]+\\\\.[0-9]+\\\\.[0-9]+$" tag)\n (error "not a release tag" tag))A tail call into a built-in procedure could lose its arguments to the garbage collector while the built-in was still using them. Reading from a fresh string port was the usual victim: a large parse failed partway through with a type error or a reader error on text that was fine.
Only web builds showed it, and only when a collection happened to land mid-call, so the same code could work in one build and fail in the next. Rebuilding with 0.22.5 fixes it.
Recursion more than 1024 native frames deep could leave the innermost frames unprotected from the garbage collector. Values still in use could be freed, and the next operation to touch them failed with an unrelated type error. The limit is gone: the frame stack now grows as needed.
SIGIL_GC_POISON_FREE=1 fills freed memory with a marker pattern, so a use-after-free fails right away instead of at some random later point. The GC's other environment variables, such as SIGIL_GC_STRESS, now reach a wasm module when its host supplies them.
char-upcase and char-downcase depend on the C library the runtime was linked against, so é could uppercase in one build and not in another. The new (sigil unicode case) carries the Unicode 15 case tables itself and gives the same answer everywhere. Case-insensitive regex matching uses it.
A Windows config in your project's package file can now set the exe icon for sigil build with icon:, pointing at a .ico file in your project. The exe also gets its Properties → Details tab filled in from your package's version: and author, and the new optional product-name:.
(config\n name: 'windows-amd64\n toolchain: 'zig\n target: "x86_64-windows-gnu"\n backend: 'native\n icon: "windows/app.ico"\n product-name: "My Game")A missing or invalid icon fails the build with a clear message instead of quietly shipping without one. Configs that don't use these keys build exactly as before.
", "summary": "A regular expressions and web reliability release, plus Windows icons. Sigil now has regular expressions in the standard library. Web builds could also fail in ways nothing on the code path explained: a type error from nowhere, or text that parsed fine natively coming back as garbage. Crash The Stack hit both, including a menu that froze on phones.", "tags": [ "release" ] }, { "id": "https://usesigil.org/releases/0.22.4/", "url": "https://usesigil.org/releases/0.22.4/", "title": "Sigil 0.22.4", "date_published": "2026-09-22T00:00:00Z", "content_html": "A web audio release. A page that is not cross-origin isolated no longer mixes its sound on the main thread, so a long game frame no longer pops the audio. Found by Crash The Stack's live soundtrack on a phone over a plain http host.
Existing projects build without changes. The (sigil audio sink) facade is the same; a project picks the new path up by rebuilding with this toolchain.
The bridge used an AudioWorkletNode only when the page could share memory with it (cross-origin isolated) and fell back to a ScriptProcessorNode on the main thread otherwise, where any frame that ran long starved the ring. A third mode now sits between them: the worklet is fed the frames by message and drains them on the audio thread, with the depth and underrun readings lagging by at most one report. SigilWasmAudio.sinkMode(id) says which path a sink is on (worklet-sab, worklet-msg or scriptprocessor). A browser without a worklet keeps the old path. test/integration/test-wasm-audio-worklet-msg.mjs drives the processor against the real producer and bounds the lag with the main thread stalled.
A native-codegen correctness release. Two defects found by Crash The Stack in its first week of play, both invisible to the bytecode VM and to every in-process test suite: a release binary that could crash at startup depending on where it was built, and a web build that leaked memory on every frame.
Existing projects build without changes. A declaration such as sigil: "0.22" already admits 0.22.3. Nothing in the language or the build surface changed; a project picks the fixes up by rebuilding with this toolchain.
A native binary rebuilds every quoted list or vector at module init, and that reconstruction was not GC-safe: a collection landing in the middle of a large literal could leave later elements dangling, and the crash came much later, in the first major collection. Whether it happened depended on the length of the checkout's path, so the same commit could run in one worktree and segfault in another.
Literals are now rooted and barriered while they are rebuilt, on both the native and the wasm targets. test/integration/test-native-literal-gc.sh forces the timing and is red on 0.22.2, green here.
A tail call between native-codegen procedures with nine or more arguments carried its arguments in a heap buffer that was never freed. A game's draw path can make thousands of such calls a frame: the published web build grew by about 90 KB per frame and hit FATAL: Out of memory after an hour or two on a board, and the native release binary grew from 283 MB to 907 MB in three and a half minutes.
Both trampoline loops now free the buffer once the callee returns. test/integration/test-native-tramp-args.sh bounces five million nine-argument calls and caps the resident set's growth at 8 MB; on 0.22.2 it grows by 390 MB, here by zero.
Release binaries are stripped. To get a symbolized frame, relink the objects under build/release/native/ without -s and re-append the bundle trailer. To catch a missed barrier directly, run with SIGIL_GC_AUDIT_BARRIERS=1 and force the timing with SIGIL_GC_ADAPTIVE_YOUNG=0 SIGIL_YOUNG_THRESHOLD=<n>; SIGIL_GC_STRESS=1 is blind to this class, since its collections are all major.
A patch for the seams a game project hit in its first two days: between the two backends, between a game and the web loader, between what a docstring says and what a procedure does. It also repairs a 0.22.1 regression that stopped script-style source files from building. Everything here came from Crash The Stack's toolchain notes, each item with the measurement that found it.
Existing projects build without changes. A declaration such as sigil: "0.22" already admits 0.22.2. The one behaviour a page might notice: sigil_wasm_dispatch_event now reports a handler's positive integer instead of 0, so a page that treated any non-zero return as failure should treat only a negative one that way.
0.22.1 rejected any source whose declaration forms the bytecode-input identity extractor could not model, and that included a script-style file under src/: a top-level (import ...) followed by expressions and no define-library, loaded by the wasm runtime at startup. sigil build died with unsupported dependency declaration or feature condition on a repository 0.22.0 built.
A script's top-level imports are now modeled declaration positions: they are dependency edges, so the script compiles after the modules it imports, and its cache identity is complete. A form the extractor still cannot model (an import inside a procedure body, an include, a (library ...) feature test) no longer fails the build: the file compiles fresh, the build prints one UNCACHED line naming the form, and the package declines cache reuse until the form is gone. The contract is in the build cache reference.
(map f a b) with two lists raised map: expected 2 argument(s), got 3 in the bytecode VM and ran under native codegen, which silently dropped the extra list; one source tree gave a green browser build and a native game that drew nothing. Core map and for-each now take any number of lists and stop at the shortest, as R7RS says.
A define inside a cond-expand clause in a library or procedure body is now a define of that body on every backend. Before, the bytecode compiler raised GET_CELL: expected upvalue cell at the call and native codegen resolved the name to an immediate, so a module that differed per target had to cond-expand inside every body.
write prints a symbol as |...| when the reader would not read the bare name back as that symbol: |1| (a keyboard's digit key), |a b|, |foo:|. Written data round-trips through read again; display is unchanged.
A conformance fixture now runs a list of stdlib forms through the differential harness on bytecode, native ELF and native wasm and fails on any disagreement; make test-conformance runs the bytecode and native rungs and is part of make test. A second fixture records a known gap for its own ticket: native codegen does not check call arity, so a two-argument procedure called with three runs as if called with two.
A dispatch made from SigilWasmBridges.setInstance, where a page first learns the wasm instance, reached a runtime with no VM and was dropped with a success-shaped return. The loader now publishes globalThis.SigilWebApp: a dispatch made before sigil_wasm_start is queued and delivered, in order, right after it; SigilWebApp.ready resolves then, and document receives a sigil-web-app-ready event for scripts that ran before the loader.
SigilWebApp.dispatch() returns the handler's integer, so a page can ask the app a question through the return value instead of polling localStorage. A pointerdown on a canvas is forwarded as ("pointerdown", "x,y,mods") in canvas-buffer pixels with a modifier bitmask, unless the page's own listener handled it, so a game page no longer re-implements pointer forwarding.
(struct-update s field: proc ...) copies a struct with each named field passed through its procedure, replacing the read-apply-rebuild idiom (session s trace: (trace-hint (session-trace s))). (struct-equal? a b) compares two instances of one type field by field. equal? on instances is still identity in this release.
Three sigil-build gaps met by a package that builds both a native binary and a browser application:
--tests, sigil test). A plain sigil build --config web used to compile the test runner's whole closure for wasm and fail in mbedtls two and a half minutes in.configs: gate is honoured. build can be declared once for the wasm config, linking a web application, while the native configs keep the default task.native-init: is called in a wasm build: the build generates a weak sigil_wasm_app_register that calls each one, so no hand-written app-register.c is needed, and a package that still ships its own keeps winning.Procedures in (sigil fs) and (sigil io) that can raise carry a raises: line, and those that answer #f say so; the browser storage facades document that they never raise and what a missing value looks like. read-file-bytes takes missing: like read-file-string, and with-current-directory raises when it cannot enter the directory instead of running its thunk in the old one.
A cache-correctness and test-reliability release. The package cache now proves what it reuses: it hashes the bytes of every input and output it depends on, binds the compiler's own identity into the cache key, and declines to reuse anything it cannot fully account for. The test runner stops counting other checkouts' tests as your own, and its file summary can finally report a shortfall. An opt-in evidence journal records what a test run actually loaded and executed, for qualifying a release rather than trusting a green suite.
Existing projects build without changes. No dependency-wide version bumps are required; a declaration such as sigil: "0.22" already admits 0.22.1. The first build after upgrading rebuilds packages whose manifests predate the new schema, and later builds reuse as before. No store reset is needed.
Package reuse used to trust a manifest whose inputs matched by size and modification time. Sigil now hashes the bytes of every input and every required output before reusing a package, so a same-size edit with a restored timestamp, a broken link, or a missing documentation sidecar rebuilds instead of restoring a stale result. Older manifests miss safely and are replaced after the next complete build.
The compiler's own identity is part of the cache key too: the executable's bytes and its startup libraries, not the version it reports. A rebuilt toolchain that still says 0.22.0 no longer reuses bytecode from the previous one. Full contract in the build cache reference.
In a repository without a test/ directory, discovery walks the whole tree and used to descend into other checkouts underneath it. One repository counted 117 of 319 per-file results from .worktrees/ and .claude/worktrees/, including a test that passed in the real tree and failed in a stale copy. Discovery now stops at any directory containing a .git and prints a SKIP line saying so.
The Files: summary line could not report a shortfall: a run in which nothing executed still printed Files: 4 of 4 run. It now reads X of Y loaded, so 0 of 1 loaded, 1 failed to load beside Tests: 1 passed tells you exactly what happened.
Set SIGIL_TEST_EVIDENCE to a new JSONL path and SIGIL_TEST_RUN_ID to a run token before starting Sigil, and the runtime journals every input buffer it acquired (with its SHA-256), every module initialization, and the runner's selection and completion records. scripts/observe-test-evidence.py runs one sigil test --sgl invocation under an external observer and reconciles the journal against the expected files and module bytes; it exits 2 for incomplete evidence, and a missing or truncated journal never qualifies as a pass. Inconsistent evidence is rejected, partial-load fail-fast is honored, and large journals stream during validation. This is POSIX-only and experimental; Windows and browser builds refuse the opt-in with exit 74. See runtime evidence and test execution evidence.
Async readers and writers are preserved when the opposite direction becomes ready on the same socket or descriptor, so duplex connections no longer freeze under backpressure; the visible symptom was terminal scrollback replay stalling on reconnect. Native closures stay rooted across allocating metadata initialization, closing a collection window that WebAssembly builds could hit. PTY children on macOS and BSD now receive the requested environment, so a TERM override reaches the shell as it already did on Linux. The build store retries a content lock that its previous owner releases mid-contention instead of reporting an unwritable store. Compiler summary export lookups are indexed, development CLI entrypoints read startup library roots the same way the bundled CLI does, and the release Scheme observation timeout is configurable.
A scripting and reliability release. Sigil is more convenient for operational scripts, the bundled client supports TLS 1.3, and builds and sockets recover more reliably from cache and resource problems. Direct file execution now provides the scripting prelude automatically; ordinary evaluation remains available through sigil eval -f.
No dependency-wide version bumps are required. A declaration such as sigil: "0.21" already admits 0.22.0, but sigil deps install preserves a valid locked runtime. Upgrading the CLI does not rewrite project lockfiles. Projects that start using the new runtime or standard-library APIs should raise their minimum to sigil: "0.22" and run sigil deps install. To refresh dependencies and explicitly move the runtime within the existing compatibility window, use sigil deps update --upgrade-sigil; this also updates ordinary dependencies.
The bundled TLS client now supports TLS 1.3 alongside TLS 1.2, using Mbed TLS 3.6.7. Certificate and hostname verification remain enabled. New tls-connect/details and tls-upgrade/details procedures expose per-attempt handshake failures and negotiated protocol details; existing connection APIs keep their behavior.
sigil script.sgl now loads (sigil shell prelude), including short text/path names, positional arguments, iteration, polling, and temporary-directory scopes. sigil eval -f file.sgl keeps ordinary explicit imports; sigil eval --quiet suppresses implicit expression results. See the shell scripting guide.
Unix command capture drains both output streams while feeding stdin, fixing stalls when output fills a pipe. Background commands can write directly to log files and explicitly detach from the launching script. Unsupported options now fail before spawning. File/directory scopes clean up when their body raises, and printing to a closed port raises instead of crashing.
Shebang scripts work with formatter verification and strict test classification. Reader errors retain the source filename. Concurrent auto-compilation uses unique staging files, and failed cache refreshes stop execution instead of loading stale bytecode.
Script and eval errors now show concise diagnostics on stderr, with expanded call history available through --error-history. The guide includes a complete HTTP harness with child cleanup and retained failure evidence, and explains how polling deadlines interact with blocking readiness probes.
(sigil string) adds string-truncate, with a configurable truncation marker, and string-contains-any? for literal alternatives. (sigil iteration) adds each for lists and arrays, and (sigil time) adds wait-until for readiness polling. These helpers are also available in the scripting prelude.
read-file-string, also exposed as read-text in scripts, reads complete UTF-8 files without truncating multibyte text. Its new missing: and trim: options cover optional state files and whitespace trimming without hiding permission or other read errors.
Restoring compiled modules from the build store now restores their documentation metadata too, keeping help, editor navigation, and MCP documentation available after a cache hit. When a second checkout reuses that cache, source locations are updated to point into the current checkout. Missing or unusable metadata causes recompilation instead of leaving an incomplete cache result in place.
On systems using epoll or kqueue, socket polling falls back to poll when the process or system cannot allocate another file descriptor. Applications can continue draining and closing existing sockets, including high-numbered descriptors, so they can recover from that condition.
The async scheduler rounds future fractional-millisecond deadlines up when polling, avoiding a busy loop while waiting for the timer to expire.
The WebAssembly network bridge accepts an optional onEvent(socketId, eventType) callback when creating imports or opening a WebSocket directly. Hosts can wake their event loop when a connection, message, error, or close event is queued. The existing event queue remains available, and a callback exception does not discard the event.
The CLI now bundles HTTP 0.18.7, log 0.17.0, nREPL 0.17.2, MCP 0.18.0, SQLite 0.16.3, and LSP 0.16.3 alongside crypto 0.16.6 and TLS 0.16.7. The MCP transition pin is replaced by its published release. The refreshed dependency graph no longer locks the retired standalone socket, docs, and ANSI providers.
Text log fields now quote and escape unsafe values; JSON log output is unchanged. Requesting dependency-subcommand help no longer starts an install or upgrade. The updated HTTP library also includes byte-preserving uploads, streamed responses, and multipart file parsing.
", "summary": "A scripting and reliability release. Sigil is more convenient for operational scripts, the bundled client supports TLS 1.3, and builds and sockets recover more reliably from cache and resource problems. Direct file execution now provides the scripting prelude automatically; ordinary evaluation remains available through sigil eval -f.", "tags": [ "release" ] }, { "id": "https://usesigil.org/releases/0.21.0/", "url": "https://usesigil.org/releases/0.21.0/", "title": "Sigil 0.21.0", "date_published": "2026-09-02T00:00:00Z", "content_html": "A test-reporting honesty release, and the first one that can turn a previously green suite red. sigil test could report success while running fewer tests than it appeared to, or none at all, and nothing in its output said so. Both cases now fail the run.
It also adds (sigil grant), a standard library type for capability grants and the algebra for narrowing them. Nothing enforces a grant yet; this is the shared vocabulary, not a sandbox.
This is a breaking change. If your test/ directory holds a .sgl file that registers tests and is not named test-*.sgl or *-test.sgl, sigil test now exits 1 and names it. That file has never run. See "If this release turns your build red" below.
It reaches you without any change on your part. The sigil: field is a floor with an implicit 1.0.0 ceiling, so a project declaring 0.19, 0.20, 0.20.3 or ^0.20 admits 0.21.0 and picks it up on its next sigil deps install. There is no pre-1.0 version you can be pinned to that holds this back. The minor bump is a signal, not a barrier.
sigil test always reports how many files it ranThe summary's Files: line used to print only when discovery selected at least one file. A package whose tests are a native binary could lose its entire Sigil suite to a rename and still print Tests: 0 passed (0 total) under a green All tests passed!, with no Files: line at all, and exit 0. Zero tests run and every test passing looked identical. The line now always prints, including Files: 0 of 0 run.
If discovery selects nothing while a .sgl file sits in test/ or tests/, sigil test exits 1 and names the files it skipped. A package with genuinely no Sigil tests has no .sgl under test/ and is unaffected.
Discovery selects test-*.sgl and *-test.sgl only, so a file named anything else sits beside the suite and never runs. The summary cannot show this: a file that never matched is upstream of every count it reports, which is how a repository can publish Files: 5 of 5 run with a sixth file of real tests unrun beside the five.
sigil test now fails when a .sgl file that is a direct child of a test directory imports (sigil test), registers at least one test, and was not selected. It reads the file rather than running it, so a file that starts a server or calls exit is examined safely, and a file that mentions (sigil test) only in its comments is not flagged.
Files in subdirectories of test/ are never considered, because that is where fixtures, integration drivers and helper modules live. Across 175 checkouts holding 5193 test .sgl files, 1850 are not selected by discovery and 1647 of those are nested. The rule flags 28 files in four projects, and every one is a real test file.
The message names the file:
✗ STRICT: 1 .sgl file(s) in a test directory register tests and were\n not selected by discovery. They have never run.\n - ./test/parser-regression.sgl
That file has never run, so the question the red is asking you is whether it should have. Both answers are a one line change.
If it should be running, rename it to test-parser-regression.sgl (or parser-regression-test.sgl). It joins the suite on the next run, and you get back however many tests it holds.
If it should not, because it is a live gate or a driver invoked by its own script, add it to .testignore in your project root. Globs work, so one line covers a family:
test/parser-regression.sgl\npackages/myapp/test/*-live.sgl
.testignore is the same file discovery already honours, not a new mechanism.
If you cannot deal with it now, sigil test --no-strict restores the previous behaviour and you can come back to it. It is worth knowing that this is the larger of the changes available to you: it means editing your CI config, where the two fixes above are a rename or a single line, and it leaves the file unrun in the meantime.
(sigil grant): a shared vocabulary for capability grantsA new standard library module holding an immutable capability grant and the algebra for comparing and narrowing one. A grant is a set of facets, each naming a kind (fs, exec, net, import, eval, ffi, pty), a mode, and a resource pattern. A facet is a permission, and absence is denial:
(import (sigil grant))\n\n(define g (grant fs: '(rw "/work") exec: '(allowlist "git" "sigil")))\n(grant-covers? g (grant-from-specs '("fs:ro:/work/src"))) ; => #t\n(grant-covers? g (grant-from-specs '("fs:rw:/etc"))) ; => #fgrant-covers? is the partial order, "has at least as much authority as". attenuate narrows. empty-grant permits nothing and grant-allow-all permits everything. grant-facets returns the facets for a consent prompt or an audit line, and grant=? compares authority rather than spelling, so two grants written differently that permit the same things compare equal.
Several tools in the Sigil ecosystem had each grown a grant table of their own, with their own idea of what a filesystem root or an allowed command meant. This is the type they can share, so a narrowing computed in one place means the same thing in another.
(grant-covers? g (attenuate g narrowing)) holds for every pair of grants, so attenuating can only ever remove authority. attenuate also returns the greatest grant covered by both of its inputs rather than merely some grant covered by both, which is what makes narrowings safe to compose: applying two restrictions in either order gives the same authority, and a grant narrowed twice is exactly the intersection of the two, not something smaller that happens to be under both.
That distinction is easy to state and easy to get wrong, so the module ships 90 tests that check these as properties over a generated corpus of grants rather than as examples, along with the component boundary that keeps /a/bc from counting as under /a/b, and the argv[0] match that lets an allowlist entry git permit git and refuse /tmp/evil/git.
grant->specs renders a grant to strings like fs:rw:/work and exec:allowlist:git,sigil; grant-from-specs parses them back. Every spec string (sigil system grant) accepts today parses to the same authority here.
A grant round-trips through that surface preserving what it permits, and that holds by construction rather than by testing: a resource the grammar cannot carry unambiguously is refused when the grant is built, so the value that would survive the round trip as something broader cannot be created in the first place. The cost is worth knowing up front. An exec command cannot contain a comma, because the comma is what separates commands in exec:allowlist:. Filesystem paths may contain commas and colons, and both round-trip.
This release ships the value and the algebra, and nothing else. Nothing in Sigil consults a grant yet: there is no enforcement, no sandbox, and no VM involvement. Importing (sigil grant) does not restrict what your code can do.
It is useful now to any tool that already decides what it will allow and wants to express that decision in a form another tool can read, compare and narrow. The checking layer is later work.
", "summary": "A test-reporting honesty release, and the first one that can turn a previously green suite red. sigil test could report success while running fewer tests than it appeared to, or none at all, and nothing in its output said so. Both cases now fail the run.", "tags": [ "release" ] } ] }