bunnyquery 1.11.0 → 1.12.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bunnyquery",
-  "version": "1.11.0",
+  "version": "1.12.1",
   "description": "Embeddable BunnyQuery AI chat widget + its framework-agnostic chat engine",
   "main": "bunnyquery.js",
   "exports": {

package/src/engine/budget.ts

@@ -19,6 +19,8 @@ export var CONTEXT_WINDOW_DEFAULT: Record<string, number> = { claude: 200000, op
 // 128,000 output cap, i.e. the ~922,000 of usable input quoted for it elsewhere.
 export var CONTEXT_WINDOW_BY_MODEL: Record<string, number> = {
 	// claude, exact ids
+	'claude-fable-5-1': 1000000, 'claude-opus-5-5': 1000000,
+	'claude-sonnet-5-5': 1000000,
 	'claude-fable-5': 1000000, 'claude-opus-5': 1000000,
 	'claude-opus-4-8': 1000000, 'claude-opus-4-7': 1000000,
 	'claude-opus-4-6': 1000000, 'claude-opus-4-5': 200000,
@@ -26,13 +28,14 @@ export var CONTEXT_WINDOW_BY_MODEL: Record<string, number> = {
 	'claude-sonnet-4-5': 1000000, 'claude-sonnet-4': 200000,
 	'claude-haiku-4-5': 200000, 'claude-3-5-sonnet': 200000,
 	// openai, exact ids
+	'gpt-6-astra': 1050000, 'gpt-6-sol': 1050000, 'gpt-6-luna': 1050000,
 	'gpt-5.6-sol': 1050000, 'gpt-5.6-terra': 1050000, 'gpt-5.6-luna': 1050000,
 	'gpt-5.5': 1000000, 'gpt-5.4': 1050000,
 	'gpt-5.4-mini': 400000, 'gpt-5.4-nano': 400000,
 	'gpt-4.1': 1040000, 'gpt-4o': 128000, 'o1': 200000, 'o1-pro': 200000,
 	// family keys
 	'claude-fable': 1000000, 'claude-opus': 1000000, 'claude-sonnet': 1000000,
-	'claude-haiku': 200000, 'gpt-5.6': 1050000, 'gpt-5': 128000,
+	'claude-haiku': 200000, 'gpt-6': 1050000, 'gpt-5.6': 1050000, 'gpt-5': 128000,
 };
 // Two rows above are load-bearing rather than redundant, both because the family
 // walk drops trailing segments:
@@ -44,6 +47,10 @@ export var CONTEXT_WINDOW_BY_MODEL: Record<string, number> = {
 //     matters most in practice: the indexing path selects it by name.
 // The bare 'gpt-5' family stays deliberately low: it is the catch-all for gpt-5
 // variants not listed here, and a mini-class variant is the likelier unknown.
+// 'gpt-6' is a family key at the full window for the opposite reason: every
+// gpt-6 tier is 1050000, luna (the smallest) included, and without the key an
+// id this table has not met yet drops to the 128000 platform default, which is
+// what astra, sol and luna did on the day they were added to the model list.
 //
 // One asymmetry these rows expose: a total minus our output reserve can exceed a
 // model's separately-published INPUT ceiling (gpt-5.4-nano is 400000 total but
@@ -58,23 +65,26 @@ export var CONTEXT_WINDOW_BY_MODEL: Record<string, number> = {
 // flat 25000 the request builder used to send unconditionally.
 export var MAX_OUTPUT_BY_MODEL: Record<string, number> = {
 	// claude
+	'claude-fable-5-1': 128000, 'claude-opus-5-5': 128000,
+	'claude-sonnet-5-5': 128000,
 	'claude-fable-5': 128000, 'claude-opus-5': 128000,
 	'claude-opus-4-8': 128000, 'claude-sonnet-5': 128000,
 	'claude-sonnet-4-6': 64000, 'claude-haiku-4-5': 64000,
 	'claude-3-5-sonnet': 8000,
 	// openai
+	'gpt-6-astra': 128000, 'gpt-6-sol': 128000, 'gpt-6-luna': 128000,
 	'gpt-5.6-sol': 128000, 'gpt-5.6-terra': 128000, 'gpt-5.6-luna': 128000,
 	'gpt-5.5': 128000, 'gpt-5.4': 128000,
 	'gpt-5.4-mini': 128000, 'gpt-5.4-nano': 128000,
 	'gpt-4.1': 16000, 'gpt-4o': 4000, 'o1': 100000, 'o1-pro': 100000,
 	// family keys
 	'claude-fable': 128000, 'claude-opus': 128000, 'claude-sonnet': 64000,
-	'claude-haiku': 64000, 'gpt-5.6': 128000, 'gpt-5': 128000,
+	'claude-haiku': 64000, 'gpt-6': 128000, 'gpt-5.6': 128000, 'gpt-5': 128000,
 };
 
 // The window a project runs at when nobody has touched the setting, clamped per
 // model by getContextWindow. Deliberately BELOW every frontier ceiling it can
-// resolve against (1,000,000 on the Claude 5 line, 1,050,000 on gpt-5.6) because
+// resolve against (1,000,000 on the Claude 5 line, 1,050,000 on gpt-5.6 and gpt-6) because
 // the client-side budget covers only the FIRST request: after that the model
 // runs a server-side tool loop whose web_fetch and MCP results accumulate in the
 // same conversation and are not counted here. The gap (120k and 170k

package/src/engine/errors.ts

@@ -113,6 +113,21 @@ export function getErrorMessage(input: any): string {
 	return 'Something went wrong.';
 }
 
+/**
+ * True when the worker has already sent this pass's window again. Its stored
+ * error then carries `retried` (the worker's _mark_pass_retried writes it only
+ * AFTER the replacement pass was queued, so the flag never promises a retry that
+ * does not exist). The failure is real but it is not the file's outcome: the
+ * replacement pass is. The file's row must not go red over it, and the bubble is
+ * drawn muted rather than as a dead end. Same one-level unwrap as every reader
+ * here, so a streamed turn's failure answers the same way as a buffered one.
+ */
+export function isRetriedFailure(input: any): boolean {
+	var envErr = csrEnvelopeError(input);
+	if (envErr !== undefined) input = envErr;
+	return !!input && typeof input === 'object' && input.retried === true;
+}
+
 export function isErrorResponseBody(response: any): boolean {
 	// A FAILED streamed row is an error however empty its payload turned out to
 	// be: the status is the fact. See csrEnvelopeError.

package/src/engine/history.ts

@@ -5,7 +5,7 @@
  * view-specific display formatting. projectId is passed for link sanitization.
  */
 import { extractClaudeText, extractOpenAIText, INDEXING_COMPLETE_MARKER, EMPTY_INDEXING_REPLY, getChatHistory, bgIndexingQueueName } from './requests';
-import { isErrorResponseBody, getErrorMessage } from './errors';
+import { isErrorResponseBody, getErrorMessage, isRetriedFailure } from './errors';
 import { streamRecoveryEnabled } from './config';
 import { sanitizeAttachmentLinksForHistory } from './links';
 import type { ChatMessage } from './host';
@@ -854,6 +854,10 @@ export function mapHistoryListToMessages(list: any[], platform: 'claude' | 'open
 		} else if (isQueued) { /* no assistant placeholder */ }
 		else if (isErrorResponse) {
 			var em: any = { role: 'assistant', content: getErrorMessage(response), isError: true };
+			// A failure the worker has since sent again is not this file's outcome
+			// (see isRetriedFailure): the group reader skips it when it settles the
+			// file's status, and the view draws it muted.
+			if (isRetriedFailure(response)) em.isRetried = true;
 			if (item._fromBgChain) em._fromBgChain = true;
 			if (item._isBgTask) em.isBackgroundTask = true;
 			if (serverItemId !== undefined) em._serverItemId = serverItemId;

package/src/engine/host.ts

@@ -95,6 +95,10 @@ export interface ChatMessage {
 	_dimSending?: boolean;
 	isCancelled?: boolean;
 	isError?: boolean;
+	/** With isError: the worker has already sent this pass's window again, so the
+	 *  failure is not the file's outcome. Set from the row's error payload
+	 *  (`retried`, see errors.ts isRetriedFailure); never set locally. */
+	isRetried?: boolean;
 	isBackgroundTask?: boolean;
 	/** Set on background-indexing REQUEST bubbles only (see IndexingFileRef). */
 	_indexFile?: IndexingFileRef;

package/src/engine/index.ts

@@ -69,6 +69,7 @@ export { buildChatGreeting, type ChatGreetingParams, type ChatGreetingParts } fr
 // normalization, and history mapping — shared so both consumers stay identical.
 export {
 	getErrorMessage, isErrorResponseBody, isAuthExpiredError, isNonRetryableRequestError, isProviderApiKeyError,
+	isRetriedFailure,
 	// The csr-poll STATUS ENVELOPE, and the provider error nested one level inside a
 	// failed one. Exported because "is this an envelope or a body" is asked in two
 	// places that must agree (the streamed settle, and every error reader), and it

package/src/engine/indexing_groups.ts

@@ -728,9 +728,30 @@ export function buildChatDisplayList(
 			grp.status = 'cancelled';
 		} else {
 			// The newest loaded outcome is the file's state: an early pass may have
-			// errored and a later one succeeded.
-			var last = grp.members[grp.members.length - 1].msg;
-			grp.status = last.isError ? 'error' : 'done';
+			// errored and a later one succeeded. A failure the worker has already
+			// SENT AGAIN is not an outcome (its replacement pass is; see
+			// isRetriedFailure), so it is passed over. A run whose loaded passes are
+			// all such failures has no settled outcome yet: the replacement is on
+			// the queue by construction (the mark is written after its message went
+			// out), so the row stays live until it is adopted, rather than telling
+			// the user the file died on a page the worker is reading again.
+			// Both bubbles of the sent-again pass are passed over, the request as
+			// well as the failure: they share the row's id, and a request bubble
+			// is never an error, so stopping on it would read the pass as settled.
+			var retriedIds: { [id: string]: boolean } = {};
+			for (var ri = 0; ri < grp.members.length; ri++) {
+				var rm = grp.members[ri].msg;
+				if (rm.isRetried && rm._serverItemId) retriedIds[rm._serverItemId] = true;
+			}
+			var li = grp.members.length - 1;
+			while (li >= 0 && (grp.members[li].msg.isRetried ||
+				(grp.members[li].msg._serverItemId && retriedIds[grp.members[li].msg._serverItemId]))) li--;
+			if (li < 0) {
+				grp.status = 'active';
+			} else {
+				var last = grp.members[li].msg;
+				grp.status = last.isError ? 'error' : 'done';
+			}
 		}
 		// A group whose passes are ALL continuations began before the loaded
 		// window; its earlier passes arrive when older history is paged in.

package/src/engine/session.ts

@@ -1106,8 +1106,11 @@ export class ChatSession {
 			timers = [];
 		};
 		var stopBase = base && typeof base.stop === 'function' ? base.stop.bind(base) : null;
+		// The wrapper's own resolve, kept so that stop() below can SETTLE it.
+		var resolveRaced: ((v: any) => void) | null = null;
 
 		var raced: any = new Promise(function (resolve, reject) {
+			resolveRaced = resolve;
 			base.then(function (res: any) {
 				if (settled) return;
 				settled = true; clearProbes(); resolve(res);
@@ -1140,10 +1143,21 @@ export class ChatSession {
 		});
 
 		// _trackPoll and the cancel path both reach for .stop, so the wrapper has to carry it.
+		//
+		// A stop SETTLES the wrapper, with the {status:'stopped'} shape the SDK's own
+		// stop resolves with. It used to mark itself settled and then ignore the base
+		// poll's stopped result in the handler above, so the wrapper never resolved at
+		// all. Harmless for a queued turn (nothing awaits that chain to the end), but a
+		// dispatch chain awaits THIS promise to clear state.sending and
+		// pendingAgentRequests, so stopping a running turn's poll wedged every later
+		// send onto the queued path for good. Resolving here, rather than waiting on
+		// the base poll, also covers an older skapi-js whose poll cannot be stopped.
 		raced.stop = function () {
+			if (settled) return;
 			settled = true;
 			clearProbes();
-			if (stopBase) stopBase();
+			if (stopBase) { try { stopBase(); } catch (e) { /* already gone */ } }
+			if (resolveRaced) resolveRaced({ id: itemId, status: 'stopped' });
 		};
 		return raced;
 	}
@@ -2559,6 +2573,13 @@ export class ChatSession {
 				return response;
 			})
 			.then(function (response: any) {
+				// Neither of these is an answer. A STOPPED poll is this client giving up
+				// on the turn (cancelPendingReply), a CANCELLED envelope is the server
+				// saying the row was cancelled from elsewhere (another tab or device).
+				// Read as a provider body, both extract to nothing, and the turn was
+				// stamped "No text response received from AI provider." and the cache
+				// kept that as the answer to a question the user had stopped waiting on.
+				if (isPollStopped(response) || self._isCancelledPollResult(response)) return { content: '', isError: false, cancelled: true };
 				if (isErrorResponseBody(response)) return { content: getErrorMessage(response), isError: true };
 				var answer = (params.aiPlatform === 'openai' ? extractOpenAIText(response) : extractClaudeText(response));
 				answer = (answer || '').trim();
@@ -2571,6 +2592,14 @@ export class ChatSession {
 				// if the chatbox unmounted mid-request.
 				delete self.pendingAgentRequests[params.key];
 				if (dispatchItemId) self.historyItemPolls.delete(dispatchItemId);
+				if (result.cancelled) {
+					// Settle the turn as cancelled and write NO reply. When this client made
+					// the cancel the bubbles are already settled (cancelPendingReply does it
+					// before the stop resolves this chain) and this finds nothing to do; when
+					// the cancel came from elsewhere, this is what settles them.
+					if (dispatchItemId) self._settleCancelledTurn(dispatchItemId, params.key);
+					return result;
+				}
 				var reply: ChatMessage = { role: 'assistant', content: result.content, isError: result.isError };
 				if (dispatchItemId) reply._serverItemId = dispatchItemId;
 
@@ -3165,7 +3194,7 @@ export class ChatSession {
 		// When it ISN'T (unmounted / another project), dispatchAgentRequest has
 		// already replaced the pending bubble with the answer IN THE CACHE, so a
 		// later loadChatHistory renders it.
-		Promise.resolve(run).catch(function () { }).then(function () {
+		Promise.resolve(run).catch(function () { }).then(function (result: any) {
 			// Clear `sending` UNCONDITIONALLY. It is session-global (it gates
 			// isQueuedSend above, plus the platform/model pickers in the view), so
 			// leaving it set when the user navigated to another project wedged
@@ -3175,6 +3204,12 @@ export class ChatSession {
 			// dispatchAgentRequest has already written the answer into the cache
 			// under `key`, so a later loadChatHistory renders it.
 			self.state.sending = false;
+			// A cancelled turn has NO reply to type. typewriteLatestReply reads the
+			// latest settled assistant bubble out of the cache and types it into the
+			// first pending placeholder on screen, and after a cancel that placeholder
+			// belongs to the NEXT turn (the cancel promotes it), so running it here
+			// would paint the previous answer under a question nobody has answered.
+			if (result && result.cancelled) return;
 			if (!(self.host.isViewMounted() && self.getHistoryCacheKey() === key)) return;
 			return Promise.resolve(self.typewriteLatestReply(key)).then(function () { self.host.scrollToBottomIfSticky(true); });
 		});
@@ -3385,6 +3420,14 @@ export class ChatSession {
 
 	onQueuedSendResponse(_composed: string, response: any, platform: string, serverId?: string, ownerKey?: string): void {
 		if (serverId) this.historyItemPolls.delete(serverId);
+		// The row was cancelled while this poll was still running (from another tab,
+		// or under an SDK whose poll could not be stopped): settle the turn as
+		// cancelled and write no answer. Read as a reply, the envelope below became
+		// "No text response received from AI provider."
+		if (this._isCancelledPollResult(response)) {
+			if (serverId) this._settleCancelledTurn(serverId, ownerKey);
+			return;
+		}
 		// This turn resolved while a DIFFERENT chat is on screen (the user moved to
 		// another project mid-flight). state.messages now belongs to that chat, and
 		// resolveQueuedUserBubble's positional fallbacks would happily hijack ITS
@@ -3579,6 +3622,186 @@ export class ChatSession {
 		});
 	}
 
+	/**
+	 * Stop waiting for the reply to the chat turn that is running now, and move on.
+	 *
+	 * `msg` is the turn's pending ASSISTANT bubble (the dot-trail "Thinking"
+	 * placeholder), which is where both views draw the control. A turn's two bubbles
+	 * carry the same _serverItemId, so it is also how the request is found.
+	 * cancelQueuedMessage is the sibling for a turn still waiting in the queue and
+	 * takes the USER bubble; the two differ in what they are handed and in what has
+	 * to be unwound afterwards, not in what the server is asked.
+	 *
+	 * What ends the wait:
+	 *   1. csr-cancel marks the running row cancelled. The worker stops relaying and
+	 *      never stores an answer for it, so the reply cannot turn up later on this
+	 *      device or another, and history replays the turn as cancelled;
+	 *   2. the poll on it is stopped, which settles whichever chain was awaiting it
+	 *      with a stopped result: dispatchAgentRequest's for an immediate send, the
+	 *      queued chain for a promoted turn, the history poll after a reload. Each
+	 *      reads a stopped or cancelled result as "no reply" and releases what it
+	 *      holds (state.sending, pendingAgentRequests, historyItemPolls), which is
+	 *      what lets the next send go out immediately instead of queueing;
+	 *   3. the bubbles settle at once, without waiting for that chain: the user
+	 *      bubble takes its cancelled form, the placeholder goes, and the next queued
+	 *      turn, if there is one, is promoted so its own "Thinking" appears.
+	 *
+	 * What it does NOT do: the provider call already in flight on the worker runs
+	 * to its end (a streamed one stops within about a second). A message sent
+	 * behind it on the same queue starts once the worker acks the cancelled row.
+	 *
+	 * Refused without a server id (the ack has not come back yet; the views disable
+	 * the control until it has) and while a cancel is already out. Indexing passes
+	 * are not this method's business: their Stop is cancelIndexingGroup, which ends
+	 * the file's whole chain.
+	 */
+	cancelPendingReply(msg: ChatMessage, idx: number): void {
+		var self = this;
+		var id = this.host.getIdentity();
+		var serverId = msg._serverItemId;
+		if (!serverId || msg._cancelling) return;
+		if (msg.role !== 'assistant' || !msg.isPending || msg.isBackgroundTask) return;
+		var platform = id.platform;
+		if (platform !== 'claude' && platform !== 'openai') return;
+		var url = platform === 'claude' ? ANTHROPIC_MESSAGES_API_URL : OPENAI_RESPONSES_API_URL;
+		var queueBase = id.userId || id.projectId;
+		var queue = msg._useBgQueue ? bgIndexingQueueName(queueBase) : queueBase;
+		var findPlaceholder = function () {
+			return self.state.messages.findIndex(function (m) { return m._serverItemId === serverId && m.role === 'assistant' && !!m.isPending; });
+		};
+		// Same rule as cancelQueuedMessage: the rendered index is a hint, the server
+		// id is the identity, and the role test keeps this off the user bubble that
+		// shares the id.
+		var at = (this.state.messages[idx] && this.state.messages[idx]._serverItemId === serverId && this.state.messages[idx].role === 'assistant')
+			? idx
+			: findPlaceholder();
+		if (at !== -1) {
+			this.state.messages[at] = Object.assign({}, this.state.messages[at], { _cancelling: true, _cancelError: undefined });
+		}
+		this.host.notify();
+		var unmark = function (errMsg?: string) {
+			var ci = findPlaceholder();
+			if (ci === -1) return;
+			self.state.messages[ci] = Object.assign({}, self.state.messages[ci], { _cancelling: false, _cancelError: errMsg });
+			self.host.notify();
+		};
+		Promise.resolve(this.host.cancelRequest({
+			url: url, method: 'POST', id: serverId, queue: queue, service: id.projectId, owner: id.owner,
+		})).then(function (result: any) {
+			if (result && result.removed) {
+				// Stop asking about a row that will never answer, THEN settle the
+				// bubbles. The stop resolves the awaiting chain with a stopped result,
+				// and that chain's own settle then finds nothing left to do.
+				self._stopPoll(serverId as string);
+				self._settleCancelledTurn(serverId as string);
+				return;
+			}
+			// Not removed: the row had already finished (or was already gone), so the
+			// answer is on its way through the poll that is still attached. Nothing to
+			// unwind and nothing to report: the user gets the reply they were waiting
+			// for, a moment late.
+			unmark(undefined);
+		}).catch(function (err: any) {
+			unmark(err && typeof err.message === 'string' && err.message ? err.message : 'Could not stop this request.');
+		});
+	}
+
+	/** The cancelled form of a request bubble, with everything that keeps it in
+	 *  place carried over: the file markers that hold an indexing pass in its
+	 *  collapsed row, the chat it belongs to, its send time and its render key. */
+	private _cancelledCopyOf(m: ChatMessage, itemId?: string): ChatMessage {
+		var cancelled: ChatMessage = { role: 'user', content: m.content, isCancelled: true };
+		if (itemId !== undefined) cancelled._serverItemId = itemId;
+		else if (m._serverItemId !== undefined) cancelled._serverItemId = m._serverItemId;
+		if (m.isBackgroundTask) cancelled.isBackgroundTask = true;
+		if (m._indexFile) cancelled._indexFile = m._indexFile;
+		if (m._useBgQueue) cancelled._useBgQueue = true;
+		if (m._ownerKey !== undefined) cancelled._ownerKey = m._ownerKey;
+		if (m._ts !== undefined) cancelled._ts = m._ts;
+		if (m._localId !== undefined) cancelled._localId = m._localId;
+		return cancelled;
+	}
+
+	/**
+	 * Settle a turn as cancelled wherever it lives, and let the queue move on.
+	 *
+	 * On the chat on screen: every pending placeholder carrying the id goes (a
+	 * history refetch can have re-mapped the running turn into a second one), the
+	 * request bubble takes its cancelled form, and the next queued turn is promoted
+	 * so the conversation does not sit on an "(In queue)" bubble with nothing
+	 * running. For a chat that is NOT on screen (the user moved on while the turn
+	 * ran, and it was cancelled from elsewhere) the same edit is made in that chat's
+	 * history cache, which is what the next visit renders.
+	 *
+	 * Idempotent on purpose: a cancel this client made settles the bubbles at once,
+	 * and the chain that was awaiting the poll settles again a moment later when the
+	 * stop resolves it. The second pass finds nothing to do. Deliberately NOT
+	 * _removeStrayPendingAssistants: by then the placeholder on screen is the freshly
+	 * promoted turn's, whose user bubble is pending, and the sweep would take it.
+	 */
+	private _settleCancelledTurn(itemId: string, ownerKey?: string): void {
+		if (!itemId) return;
+		if (ownerKey && this.getHistoryCacheKey() !== ownerKey) {
+			this._applyCancelToCache(ownerKey, itemId);
+			return;
+		}
+		var changed = false, wasBg = false;
+		for (var i = this.state.messages.length - 1; i >= 0; i--) {
+			var m = this.state.messages[i];
+			if (!m || m._serverItemId !== itemId) continue;
+			if (m.role === 'assistant' && m.isPending) { this.state.messages.splice(i, 1); changed = true; continue; }
+			if (m.role === 'user' && !m.isCancelled) {
+				if (m.isBackgroundTask) wasBg = true;
+				this.state.messages[i] = this._cancelledCopyOf(m, itemId);
+				changed = true;
+			}
+		}
+		this.cancelledServerIds.delete(itemId);
+		if (!changed) return;
+		if (wasBg) this.promoteNextBgQueuedToRunning(); else this.promoteNextQueuedToRunning();
+		this.updateHistoryCache();
+		this.host.notify();
+	}
+
+	/**
+	 * _settleCancelledTurn for a chat that is not on screen: the same edit, made in
+	 * its history cache. Matched by id where the cached bubbles carry one; an
+	 * off-chat send caches its pair before the ack (see dispatchComposedMessage), so
+	 * the fallback is positional, exactly as _applyReplyToCache's is: the trailing
+	 * pending placeholder, and the last request bubble still marked in flight.
+	 */
+	private _applyCancelToCache(key: string, itemId: string): void {
+		var existing = key ? this.aiChatHistoryCache[key] : undefined;
+		if (!existing) return;
+		var msgs = existing.messages.slice();
+		var changed = false;
+		var pIdx = -1, uIdx = -1;
+		for (var i = msgs.length - 1; i >= 0; i--) {
+			var m = msgs[i];
+			if (!m || m._serverItemId !== itemId) continue;
+			if (m.role === 'assistant' && m.isPending) { msgs.splice(i, 1); changed = true; pIdx = i; }
+			else if (m.role === 'user' && !m.isCancelled && uIdx === -1) uIdx = i;
+		}
+		if (pIdx === -1) {
+			for (var p = msgs.length - 1; p >= 0; p--) {
+				var pm = msgs[p];
+				if (!pm || !pm.isPending || pm.role !== 'assistant' || pm.isBackgroundTask || pm._serverItemId !== undefined) continue;
+				msgs.splice(p, 1); changed = true; break;
+			}
+		}
+		if (uIdx === -1) {
+			for (var u = msgs.length - 1; u >= 0; u--) {
+				var um = msgs[u];
+				if (!um || um.role !== 'user' || um.isBackgroundTask || um._serverItemId !== undefined || um._stageId) continue;
+				if (!(um.isPendingQueued || um.isPendingInProcess || um.isSendingToServer)) continue;
+				uIdx = u; break;
+			}
+		}
+		if (uIdx !== -1) { msgs[uIdx] = this._cancelledCopyOf(msgs[uIdx], itemId); changed = true; }
+		if (!changed) return;
+		this.aiChatHistoryCache[key] = { messages: msgs, endOfList: existing.endOfList, startKeyHistory: existing.startKeyHistory };
+	}
+
 	/**
 	 * Stop indexing a file, from its collapsed row — every pass at once, not just
 	 * the bubble the user happens to see.
@@ -3679,6 +3902,16 @@ export class ChatSession {
 		// server-cancelled by _applyIndexCancellations on the next drain, which is
 		// also what makes the worker stop enqueueing windows.
 		this._adoptWorkerIndexingPasses(0);
+		// And every pass of this file the client ALREADY knows to be live, now, not on
+		// the next drain. `cancellableIds` below is the row's own list, and it leaves
+		// out an in-flight pass that a later pass has already outlived - a rule written
+		// for one pass at a time, which a PDF no longer is: the worker runs several
+		// windows of one file at once and they settle out of order, so the row's list
+		// can be empty while eight passes are running. The sweep reads the key just
+		// recorded above and cancels each known pending pass once (it skips one already
+		// being cancelled, so the loop below cannot cancel a bubble twice). Server-side,
+		// one cancelled window stops the whole document.
+		this._sweepCancelledIndexing();
 		var ids = group.cancellableIds || [];
 		if (!ids.length) { this.host.notify(); return; }
 		ids.forEach(function (serverId) {
@@ -4016,9 +4249,12 @@ export class ChatSession {
 		if (this.state.messages.some(function (m) { return (m.isPending || m.isPendingQueued) && !m.isBackgroundTask && !m._useBgQueue; })) return Promise.resolve();
 		this.state.sending = true;
 		this.host.scrollToBottomIfSticky(true);
-		return Promise.resolve(pending).catch(function () { }).then(function () {
+		return Promise.resolve(pending).catch(function () { }).then(function (result: any) {
 			if (token !== self.state.gateRefreshToken) return;
 			self.state.sending = false;
+			// Same guard as the immediate-send settle: a cancelled turn has no reply
+			// to type, and the placeholder on screen may be the next turn's by now.
+			if (result && result.cancelled) return;
 			return Promise.resolve(self.typewriteLatestReply(key)).then(function () { self.host.scrollToBottomIfSticky(true); });
 		});
 	}

package/styles/chat.css

@@ -83,6 +83,28 @@
 .bq-message.is-assistant:not(.is-error):not(.is-cancelled):not(.bq-index-pass) .bq-bubble:has(> .bq-loader) > .bq-loader {
     vertical-align: middle;
 }
+/* The dot-trail cycles '.', '..', '...', so left to itself it is a box that
+   changes width three times every 1.2s: the bubble pulsed with it, and the
+   stop-waiting control that follows the dots moved each time, which made it hard
+   to hit. Inside a bubble the loader therefore RESERVES the width of its widest
+   frame: a hidden '...' sets the box and the animated dots are laid over it from
+   the left. Sized by the text itself rather than by a length, so it is right in
+   any font and at any letter-spacing. Scoped to bubbles on purpose: a loader that
+   trails a label ("Saving...") has to keep hugging its text. */
+.bq-bubble > .bq-loader {
+    position: relative;
+    display: inline-block;
+    white-space: nowrap;
+}
+.bq-bubble > .bq-loader::before {
+    content: '...';
+    visibility: hidden;
+}
+.bq-bubble > .bq-loader::after {
+    position: absolute;
+    left: 0;
+    top: 0;
+}
 
 .bq-message.is-error .bq-bubble {
     background: var(--bq-danger-bg);
@@ -95,6 +117,14 @@
     color: var(--bq-danger);
     opacity: 0.65;
 }
+/* A failed pass the worker has already sent again: real, but not the file's
+   outcome (the replacement pass is), so it is told in the muted voice of a
+   note rather than the red of a dead end. */
+.bq-message.is-error.is-retried .bq-bubble {
+    background: var(--bq-paper);
+    border-color: var(--bq-line);
+    color: var(--bq-muted);
+}
 .bq-message.is-pending-older .bq-bubble {
     background: var(--bq-warning-bg);
     border-color: var(--bq-warning-border);
@@ -153,6 +183,35 @@
 }
 .bq-cancel-queue-btn:hover:not(.is-disabled) { background: var(--bq-warning-bg); color: var(--bq-warning); }
 .bq-cancel-queue-btn.is-disabled { opacity: 0.3; cursor: not-allowed; pointer-events: none; }
+/* Stop waiting for a reply: sits INLINE after the dot-trail in a chat turn's own
+   "Thinking" bubble, where the bunny is inline too (:has(> .bq-loader) above).
+   Same face as the queued-message × but placed differently: that one floats to
+   its bubble's corner, this one simply follows the dots. Muted at rest so the
+   dots stay the thing the eye lands on; hover changes opacity only, never its
+   colour. Shared by both chatboxes. */
+.bq-cancel-wait-btn {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    vertical-align: middle;
+    margin-left: 0.55rem;
+    width: 1.1rem;
+    height: 1.1rem;
+    min-height: 0;
+    padding: 0;
+    border: 1px solid var(--bq-line);
+    background: transparent;
+    color: var(--bq-muted);
+    font-size: 0.85rem;
+    line-height: 1;
+    cursor: pointer;
+    box-shadow: none;
+    border-radius: 0;
+    flex-shrink: 0;
+    opacity: 0.7;
+}
+.bq-cancel-wait-btn:hover:not(.is-disabled) { opacity: 1; }
+.bq-cancel-wait-btn.is-disabled { opacity: 0.3; cursor: not-allowed; pointer-events: none; }
 
 /* ---- unfinalized streamed answer (ask for it) ----------------------------
    A turn whose answer was streamed and never finalized keeps its bytes in the