bunnyquery 1.11.1 → 1.13.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bunnyquery",
-  "version": "1.11.1",
+  "version": "1.13.0",
   "description": "Embeddable BunnyQuery AI chat widget + its framework-agnostic chat engine",
   "main": "bunnyquery.js",
   "exports": {

package/src/engine/errors.ts

@@ -113,6 +113,21 @@ export function getErrorMessage(input: any): string {
 	return 'Something went wrong.';
 }
 
+/**
+ * True when the worker has already sent this pass's window again. Its stored
+ * error then carries `retried` (the worker's _mark_pass_retried writes it only
+ * AFTER the replacement pass was queued, so the flag never promises a retry that
+ * does not exist). The failure is real but it is not the file's outcome: the
+ * replacement pass is. The file's row must not go red over it, and the bubble is
+ * drawn muted rather than as a dead end. Same one-level unwrap as every reader
+ * here, so a streamed turn's failure answers the same way as a buffered one.
+ */
+export function isRetriedFailure(input: any): boolean {
+	var envErr = csrEnvelopeError(input);
+	if (envErr !== undefined) input = envErr;
+	return !!input && typeof input === 'object' && input.retried === true;
+}
+
 export function isErrorResponseBody(response: any): boolean {
 	// A FAILED streamed row is an error however empty its payload turned out to
 	// be: the status is the fact. See csrEnvelopeError.

package/src/engine/history.ts

@@ -5,7 +5,7 @@
  * view-specific display formatting. projectId is passed for link sanitization.
  */
 import { extractClaudeText, extractOpenAIText, INDEXING_COMPLETE_MARKER, EMPTY_INDEXING_REPLY, getChatHistory, bgIndexingQueueName } from './requests';
-import { isErrorResponseBody, getErrorMessage } from './errors';
+import { isErrorResponseBody, getErrorMessage, isRetriedFailure } from './errors';
 import { streamRecoveryEnabled } from './config';
 import { sanitizeAttachmentLinksForHistory } from './links';
 import type { ChatMessage } from './host';
@@ -798,8 +798,17 @@ export function mapHistoryListToMessages(list: any[], platform: 'claude' | 'open
 		// cases the pass simply shows no duration, which is right: the honest answer
 		// to "how long did it take" is nothing, not the queue wait dressed up as it.
 		var executedTs = Number(item && item.executed);
+		// When skapi recorded the destination's response as having finished arriving.
+		// It is the answer's time whenever the row carries it, because `updated` is
+		// not that for a STREAMED turn: finalizing the turn stores its answer a few
+		// seconds later and moves `updated` to that moment. Absent on rows settled
+		// before the worker recorded it, on a turn that failed with no response, and
+		// under an SDK that does not project it. All three fall back to `updated`,
+		// which is exactly what this showed before.
+		var respondedTs = Number(item && item.responded);
 		var userTs = isFinite(createdTs) && createdTs > 0 ? createdTs : (isFinite(updatedTs) && updatedTs > 0 ? updatedTs : undefined);
-		var replyTs = isFinite(updatedTs) && updatedTs > 0 ? updatedTs : (isFinite(createdTs) && createdTs > 0 ? createdTs : undefined);
+		var replyTs = isFinite(respondedTs) && respondedTs > 0 ? respondedTs
+			: (isFinite(updatedTs) && updatedTs > 0 ? updatedTs : (isFinite(createdTs) && createdTs > 0 ? createdTs : undefined));
 
 		if (userText) {
 			var displayContent;
@@ -854,6 +863,10 @@ export function mapHistoryListToMessages(list: any[], platform: 'claude' | 'open
 		} else if (isQueued) { /* no assistant placeholder */ }
 		else if (isErrorResponse) {
 			var em: any = { role: 'assistant', content: getErrorMessage(response), isError: true };
+			// A failure the worker has since sent again is not this file's outcome
+			// (see isRetriedFailure): the group reader skips it when it settles the
+			// file's status, and the view draws it muted.
+			if (isRetriedFailure(response)) em.isRetried = true;
 			if (item._fromBgChain) em._fromBgChain = true;
 			if (item._isBgTask) em.isBackgroundTask = true;
 			if (serverItemId !== undefined) em._serverItemId = serverItemId;

package/src/engine/host.ts

@@ -95,6 +95,10 @@ export interface ChatMessage {
 	_dimSending?: boolean;
 	isCancelled?: boolean;
 	isError?: boolean;
+	/** With isError: the worker has already sent this pass's window again, so the
+	 *  failure is not the file's outcome. Set from the row's error payload
+	 *  (`retried`, see errors.ts isRetriedFailure); never set locally. */
+	isRetried?: boolean;
 	isBackgroundTask?: boolean;
 	/** Set on background-indexing REQUEST bubbles only (see IndexingFileRef). */
 	_indexFile?: IndexingFileRef;

package/src/engine/index.ts

@@ -69,6 +69,7 @@ export { buildChatGreeting, type ChatGreetingParams, type ChatGreetingParts } fr
 // normalization, and history mapping — shared so both consumers stay identical.
 export {
 	getErrorMessage, isErrorResponseBody, isAuthExpiredError, isNonRetryableRequestError, isProviderApiKeyError,
+	isRetriedFailure,
 	// The csr-poll STATUS ENVELOPE, and the provider error nested one level inside a
 	// failed one. Exported because "is this an envelope or a body" is asked in two
 	// places that must agree (the streamed settle, and every error reader), and it

package/src/engine/indexing_groups.ts

@@ -728,9 +728,30 @@ export function buildChatDisplayList(
 			grp.status = 'cancelled';
 		} else {
 			// The newest loaded outcome is the file's state: an early pass may have
-			// errored and a later one succeeded.
-			var last = grp.members[grp.members.length - 1].msg;
-			grp.status = last.isError ? 'error' : 'done';
+			// errored and a later one succeeded. A failure the worker has already
+			// SENT AGAIN is not an outcome (its replacement pass is; see
+			// isRetriedFailure), so it is passed over. A run whose loaded passes are
+			// all such failures has no settled outcome yet: the replacement is on
+			// the queue by construction (the mark is written after its message went
+			// out), so the row stays live until it is adopted, rather than telling
+			// the user the file died on a page the worker is reading again.
+			// Both bubbles of the sent-again pass are passed over, the request as
+			// well as the failure: they share the row's id, and a request bubble
+			// is never an error, so stopping on it would read the pass as settled.
+			var retriedIds: { [id: string]: boolean } = {};
+			for (var ri = 0; ri < grp.members.length; ri++) {
+				var rm = grp.members[ri].msg;
+				if (rm.isRetried && rm._serverItemId) retriedIds[rm._serverItemId] = true;
+			}
+			var li = grp.members.length - 1;
+			while (li >= 0 && (grp.members[li].msg.isRetried ||
+				(grp.members[li].msg._serverItemId && retriedIds[grp.members[li].msg._serverItemId]))) li--;
+			if (li < 0) {
+				grp.status = 'active';
+			} else {
+				var last = grp.members[li].msg;
+				grp.status = last.isError ? 'error' : 'done';
+			}
 		}
 		// A group whose passes are ALL continuations began before the loaded
 		// window; its earlier passes arrive when older history is paged in.

package/src/engine/prompts/chat_system_prompt.ts

@@ -72,10 +72,33 @@ export function buildChatSystemPrompt(params: ChatSystemPromptParams): string {
 		: (g === 'public' || g === 'private' || g === 'authorized' || g === 'admin') ? `"${g}"`
 		: '"authorized"';
 
+	// ---- Grounding ---------------------------------------------------------
+	// The rules around this block were all written against the OPPOSITE mistake: a
+	// model that says "not found" before it has really looked. Read alone they push
+	// one way only (keep searching, never say it is absent), and nothing said the
+	// other half: state only what the data returned. Customers reported answers
+	// that were not in their data at all, which is the one thing this product must
+	// never do, so the other half is spelled out here.
+	//
+	// Three rules, each closing one way an invented answer gets out: a fact with no
+	// source, a "not found" replaced by general knowledge, and an inference worded
+	// as if the data said it. The last line keeps them from swallowing what is NOT
+	// a claim about the project's data (product help, a greeting, authored text).
+	// The upload suggestion follows canUpload for the same reason the About section
+	// does: a visitor who cannot upload must never be told to.
+	const groundingRules =
+`ANSWER ONLY FROM THE DATA. Every fact you state about this project's data - a name, a number, a date, a status, what a document says, whether something exists - must come from one of four places: a tool result returned in THIS conversation, a file or image attached to it (including one you read through its attachment link), the project description at the end of this prompt, or what the user told you themselves in this chat. Your general knowledge, the open internet and a plausible guess are NOT sources. Never use them to answer a question about the user's data, to fill a gap in it, or to complete a record that came back partial. A value that is not in what you retrieved is unknown: say it is not in the data instead of supplying a likely one.
+WHEN THE DATA DOES NOT HAVE IT, SAY SO. Once you have searched the way these rules require and nothing answers the question, tell the user plainly, in their language, that this project's data does not contain it, and say what you searched (the tables, files or terms) so they can tell missing data from a missed search. Do not answer from memory instead, and do not turn a missing answer into a general explanation of the topic. Offer what would let you answer it: ${canUpload === false
+			? `another name or file to look under, or asking the project's owner to add it`
+			: `the document to upload, or another name or file to look under`}.
+KEEP WHAT THE DATA SAYS APART FROM WHAT YOU WORKED OUT. A total you computed, a comparison, a trend, an interpretation or a recommendation is yours, not the data's: label it as such ("calculated from...", "this suggests...") and name the rows or files it was made from. Never present an estimate, an assumption or an inference as something the data states.
+These three rules govern every claim about the project's data. They do not limit the About BunnyQuery section (answer product questions from it), a greeting, or text the user explicitly asks you to write.`;
+
 	let systemPrompt = `
 You are a dedicated assistant for the project ID: "${projectId}".
 Scope: Only answer questions about this project and its data. Do not answer questions about other projects or topics unrelated to this project. When the user refers to "my database", "my data", or "my files", treat those as references to this project's database and file storage. The ONE exception is BunnyQuery itself - what this app is, what it can do, and how to use it - which is always in scope: answer it from the "About BunnyQuery" section at the end of this prompt.
 Knowledge lookup: Before saying you don't know or that something isn't in the chat history, ALWAYS query this project's database through the available MCP tools to look for the answer. The user's data is the source of truth - the chat transcript is not. Only respond with "I don't know" or "I couldn't find that" after you have actually searched the project's data and come back empty.
+${groundingRules}
 NUMBERS FROM A SPREADSHEET: use queryGrid, never mental arithmetic over records. A total, a count, an average, a "how many mention X", a "which one is biggest" - all of those are computed server-side over EVERY row of the file and come back with the sheet, the row count and the row numbers they were made from. Records are a SAMPLE, and a sample added up is a confident wrong number. Quote the row count and the sheet alongside the figure so the reader can check it.
 CALL queryGrid describe FIRST, before any figure. Workbooks routinely state the same money more than once: a detail sheet, then per-song, per-album and per-artist sheets that each re-total it, plus a summary sheet whose bottom row is the file total. Those look like four different answers and are one. describe names which sheets restate which, and which rows are totals. Pick ONE sheet, say which you picked, and never add figures across a sheet and its summary. If the reply carries a warning about restatement, repeat it to the user.
 A FILE TOTAL IS NOT A ROW'S TOTAL. The biggest number on a summary sheet is the whole file, not the thing that was asked about. Before quoting any figure, check it is scoped to what the question named: filter by the column that identifies it and report how many rows matched.

package/src/engine/session.ts

@@ -1106,8 +1106,11 @@ export class ChatSession {
 			timers = [];
 		};
 		var stopBase = base && typeof base.stop === 'function' ? base.stop.bind(base) : null;
+		// The wrapper's own resolve, kept so that stop() below can SETTLE it.
+		var resolveRaced: ((v: any) => void) | null = null;
 
 		var raced: any = new Promise(function (resolve, reject) {
+			resolveRaced = resolve;
 			base.then(function (res: any) {
 				if (settled) return;
 				settled = true; clearProbes(); resolve(res);
@@ -1140,10 +1143,21 @@ export class ChatSession {
 		});
 
 		// _trackPoll and the cancel path both reach for .stop, so the wrapper has to carry it.
+		//
+		// A stop SETTLES the wrapper, with the {status:'stopped'} shape the SDK's own
+		// stop resolves with. It used to mark itself settled and then ignore the base
+		// poll's stopped result in the handler above, so the wrapper never resolved at
+		// all. Harmless for a queued turn (nothing awaits that chain to the end), but a
+		// dispatch chain awaits THIS promise to clear state.sending and
+		// pendingAgentRequests, so stopping a running turn's poll wedged every later
+		// send onto the queued path for good. Resolving here, rather than waiting on
+		// the base poll, also covers an older skapi-js whose poll cannot be stopped.
 		raced.stop = function () {
+			if (settled) return;
 			settled = true;
 			clearProbes();
-			if (stopBase) stopBase();
+			if (stopBase) { try { stopBase(); } catch (e) { /* already gone */ } }
+			if (resolveRaced) resolveRaced({ id: itemId, status: 'stopped' });
 		};
 		return raced;
 	}
@@ -1206,6 +1220,35 @@ export class ChatSession {
 	/** Live streams by server item id. One per in-flight streamed turn. */
 	private liveStreams: { [itemId: string]: LiveStreamState } = {};
 
+	/** When skapi recorded a turn's response as having finished arriving, by server
+	 *  item id. Read off the terminal envelope of a STREAMED turn (the only settle
+	 *  that carries it, see _settleLiveStream) and used as the answer bubble's time
+	 *  in place of this browser's clock. Entries are never removed: a settle reaches
+	 *  here twice (the poll's onResponse, then the promise), and the value for an id
+	 *  cannot change. */
+	private _respondedAt: { [itemId: string]: number } = {};
+
+	private _noteRespondedAt(itemId: string, response: any): void {
+		if (!itemId || !isCsrStatusEnvelope(response)) return;
+		var at = Number(response.responded);
+		if (!isFinite(at) || at <= 0) return;
+		// Self-healing for a session built without the constructor (the engine tests
+		// drive Object.create(ChatSession.prototype)), like typewriterQueue below.
+		if (!this._respondedAt) this._respondedAt = {};
+		this._respondedAt[itemId] = at;
+	}
+
+	/** The time a live answer bubble is stamped with: when skapi received the
+	 *  response, if the settle told us, else now. "Now" is what every bubble got
+	 *  before, and it is still right for a buffered turn, whose settle hands back the
+	 *  destination's body and nothing of skapi's; a history load then replaces it
+	 *  with the server's value. */
+	private _replyStampFor(msg: ChatMessage | undefined): number {
+		var id = msg ? msg._serverItemId : undefined;
+		var at = (typeof id === 'string' && id && this._respondedAt) ? this._respondedAt[id] : undefined;
+		return typeof at === 'number' ? at : wallClockNow();
+	}
+
 	/**
 	 * Open (or re-open) the live stream for `itemId`, or null when this poll must
 	 * not carry one.
@@ -1458,6 +1501,10 @@ export class ChatSession {
 	private _settleLiveStream(st: LiveStreamState, response: any): any {
 		this._closeLiveStream(st, true);
 		if (!isCsrStatusEnvelope(response)) return response;
+		// Before any return below, and for every terminal status: the bubble that
+		// settles this turn is stamped from it whether it ends as an answer, an error
+		// or a truncation.
+		this._noteRespondedAt(st.id, response);
 		// RESOLVED only, and this is not caution, it is correctness. 'cancelled' is the
 		// envelope the user's own Stop produces, and _isCancelledPollResult downstream
 		// is what settles the turn as stopped: hand it an assembled body instead and a
@@ -2559,6 +2606,13 @@ export class ChatSession {
 				return response;
 			})
 			.then(function (response: any) {
+				// Neither of these is an answer. A STOPPED poll is this client giving up
+				// on the turn (cancelPendingReply), a CANCELLED envelope is the server
+				// saying the row was cancelled from elsewhere (another tab or device).
+				// Read as a provider body, both extract to nothing, and the turn was
+				// stamped "No text response received from AI provider." and the cache
+				// kept that as the answer to a question the user had stopped waiting on.
+				if (isPollStopped(response) || self._isCancelledPollResult(response)) return { content: '', isError: false, cancelled: true };
 				if (isErrorResponseBody(response)) return { content: getErrorMessage(response), isError: true };
 				var answer = (params.aiPlatform === 'openai' ? extractOpenAIText(response) : extractClaudeText(response));
 				answer = (answer || '').trim();
@@ -2571,6 +2625,14 @@ export class ChatSession {
 				// if the chatbox unmounted mid-request.
 				delete self.pendingAgentRequests[params.key];
 				if (dispatchItemId) self.historyItemPolls.delete(dispatchItemId);
+				if (result.cancelled) {
+					// Settle the turn as cancelled and write NO reply. When this client made
+					// the cancel the bubbles are already settled (cancelPendingReply does it
+					// before the stop resolves this chain) and this finds nothing to do; when
+					// the cancel came from elsewhere, this is what settles them.
+					if (dispatchItemId) self._settleCancelledTurn(dispatchItemId, params.key);
+					return result;
+				}
 				var reply: ChatMessage = { role: 'assistant', content: result.content, isError: result.isError };
 				if (dispatchItemId) reply._serverItemId = dispatchItemId;
 
@@ -3165,7 +3227,7 @@ export class ChatSession {
 		// When it ISN'T (unmounted / another project), dispatchAgentRequest has
 		// already replaced the pending bubble with the answer IN THE CACHE, so a
 		// later loadChatHistory renders it.
-		Promise.resolve(run).catch(function () { }).then(function () {
+		Promise.resolve(run).catch(function () { }).then(function (result: any) {
 			// Clear `sending` UNCONDITIONALLY. It is session-global (it gates
 			// isQueuedSend above, plus the platform/model pickers in the view), so
 			// leaving it set when the user navigated to another project wedged
@@ -3175,6 +3237,12 @@ export class ChatSession {
 			// dispatchAgentRequest has already written the answer into the cache
 			// under `key`, so a later loadChatHistory renders it.
 			self.state.sending = false;
+			// A cancelled turn has NO reply to type. typewriteLatestReply reads the
+			// latest settled assistant bubble out of the cache and types it into the
+			// first pending placeholder on screen, and after a cancel that placeholder
+			// belongs to the NEXT turn (the cancel promotes it), so running it here
+			// would paint the previous answer under a question nobody has answered.
+			if (result && result.cancelled) return;
 			if (!(self.host.isViewMounted() && self.getHistoryCacheKey() === key)) return;
 			return Promise.resolve(self.typewriteLatestReply(key)).then(function () { self.host.scrollToBottomIfSticky(true); });
 		});
@@ -3342,7 +3410,7 @@ export class ChatSession {
 	insertAtTarget(msg: ChatMessage, targetIdx: number): void {
 		// Error/direct replies land here rather than through the typewriter, so this
 		// is where they pick up their display time.
-		if (msg && msg.role === 'assistant' && msg._ts === undefined) msg._ts = wallClockNow();
+		if (msg && msg.role === 'assistant' && msg._ts === undefined) msg._ts = this._replyStampFor(msg);
 		// Overwrite only a placeholder that genuinely belongs to the turn above it.
 		// Two things now sit at this index that must never be replaced by a chat
 		// answer: a background "Indexing:" placeholder (a file's rows are inserted
@@ -3385,6 +3453,14 @@ export class ChatSession {
 
 	onQueuedSendResponse(_composed: string, response: any, platform: string, serverId?: string, ownerKey?: string): void {
 		if (serverId) this.historyItemPolls.delete(serverId);
+		// The row was cancelled while this poll was still running (from another tab,
+		// or under an SDK whose poll could not be stopped): settle the turn as
+		// cancelled and write no answer. Read as a reply, the envelope below became
+		// "No text response received from AI provider."
+		if (this._isCancelledPollResult(response)) {
+			if (serverId) this._settleCancelledTurn(serverId, ownerKey);
+			return;
+		}
 		// This turn resolved while a DIFFERENT chat is on screen (the user moved to
 		// another project mid-flight). state.messages now belongs to that chat, and
 		// resolveQueuedUserBubble's positional fallbacks would happily hijack ITS
@@ -3579,6 +3655,186 @@ export class ChatSession {
 		});
 	}
 
+	/**
+	 * Stop waiting for the reply to the chat turn that is running now, and move on.
+	 *
+	 * `msg` is the turn's pending ASSISTANT bubble (the dot-trail "Thinking"
+	 * placeholder), which is where both views draw the control. A turn's two bubbles
+	 * carry the same _serverItemId, so it is also how the request is found.
+	 * cancelQueuedMessage is the sibling for a turn still waiting in the queue and
+	 * takes the USER bubble; the two differ in what they are handed and in what has
+	 * to be unwound afterwards, not in what the server is asked.
+	 *
+	 * What ends the wait:
+	 *   1. csr-cancel marks the running row cancelled. The worker stops relaying and
+	 *      never stores an answer for it, so the reply cannot turn up later on this
+	 *      device or another, and history replays the turn as cancelled;
+	 *   2. the poll on it is stopped, which settles whichever chain was awaiting it
+	 *      with a stopped result: dispatchAgentRequest's for an immediate send, the
+	 *      queued chain for a promoted turn, the history poll after a reload. Each
+	 *      reads a stopped or cancelled result as "no reply" and releases what it
+	 *      holds (state.sending, pendingAgentRequests, historyItemPolls), which is
+	 *      what lets the next send go out immediately instead of queueing;
+	 *   3. the bubbles settle at once, without waiting for that chain: the user
+	 *      bubble takes its cancelled form, the placeholder goes, and the next queued
+	 *      turn, if there is one, is promoted so its own "Thinking" appears.
+	 *
+	 * What it does NOT do: the provider call already in flight on the worker runs
+	 * to its end (a streamed one stops within about a second). A message sent
+	 * behind it on the same queue starts once the worker acks the cancelled row.
+	 *
+	 * Refused without a server id (the ack has not come back yet; the views disable
+	 * the control until it has) and while a cancel is already out. Indexing passes
+	 * are not this method's business: their Stop is cancelIndexingGroup, which ends
+	 * the file's whole chain.
+	 */
+	cancelPendingReply(msg: ChatMessage, idx: number): void {
+		var self = this;
+		var id = this.host.getIdentity();
+		var serverId = msg._serverItemId;
+		if (!serverId || msg._cancelling) return;
+		if (msg.role !== 'assistant' || !msg.isPending || msg.isBackgroundTask) return;
+		var platform = id.platform;
+		if (platform !== 'claude' && platform !== 'openai') return;
+		var url = platform === 'claude' ? ANTHROPIC_MESSAGES_API_URL : OPENAI_RESPONSES_API_URL;
+		var queueBase = id.userId || id.projectId;
+		var queue = msg._useBgQueue ? bgIndexingQueueName(queueBase) : queueBase;
+		var findPlaceholder = function () {
+			return self.state.messages.findIndex(function (m) { return m._serverItemId === serverId && m.role === 'assistant' && !!m.isPending; });
+		};
+		// Same rule as cancelQueuedMessage: the rendered index is a hint, the server
+		// id is the identity, and the role test keeps this off the user bubble that
+		// shares the id.
+		var at = (this.state.messages[idx] && this.state.messages[idx]._serverItemId === serverId && this.state.messages[idx].role === 'assistant')
+			? idx
+			: findPlaceholder();
+		if (at !== -1) {
+			this.state.messages[at] = Object.assign({}, this.state.messages[at], { _cancelling: true, _cancelError: undefined });
+		}
+		this.host.notify();
+		var unmark = function (errMsg?: string) {
+			var ci = findPlaceholder();
+			if (ci === -1) return;
+			self.state.messages[ci] = Object.assign({}, self.state.messages[ci], { _cancelling: false, _cancelError: errMsg });
+			self.host.notify();
+		};
+		Promise.resolve(this.host.cancelRequest({
+			url: url, method: 'POST', id: serverId, queue: queue, service: id.projectId, owner: id.owner,
+		})).then(function (result: any) {
+			if (result && result.removed) {
+				// Stop asking about a row that will never answer, THEN settle the
+				// bubbles. The stop resolves the awaiting chain with a stopped result,
+				// and that chain's own settle then finds nothing left to do.
+				self._stopPoll(serverId as string);
+				self._settleCancelledTurn(serverId as string);
+				return;
+			}
+			// Not removed: the row had already finished (or was already gone), so the
+			// answer is on its way through the poll that is still attached. Nothing to
+			// unwind and nothing to report: the user gets the reply they were waiting
+			// for, a moment late.
+			unmark(undefined);
+		}).catch(function (err: any) {
+			unmark(err && typeof err.message === 'string' && err.message ? err.message : 'Could not stop this request.');
+		});
+	}
+
+	/** The cancelled form of a request bubble, with everything that keeps it in
+	 *  place carried over: the file markers that hold an indexing pass in its
+	 *  collapsed row, the chat it belongs to, its send time and its render key. */
+	private _cancelledCopyOf(m: ChatMessage, itemId?: string): ChatMessage {
+		var cancelled: ChatMessage = { role: 'user', content: m.content, isCancelled: true };
+		if (itemId !== undefined) cancelled._serverItemId = itemId;
+		else if (m._serverItemId !== undefined) cancelled._serverItemId = m._serverItemId;
+		if (m.isBackgroundTask) cancelled.isBackgroundTask = true;
+		if (m._indexFile) cancelled._indexFile = m._indexFile;
+		if (m._useBgQueue) cancelled._useBgQueue = true;
+		if (m._ownerKey !== undefined) cancelled._ownerKey = m._ownerKey;
+		if (m._ts !== undefined) cancelled._ts = m._ts;
+		if (m._localId !== undefined) cancelled._localId = m._localId;
+		return cancelled;
+	}
+
+	/**
+	 * Settle a turn as cancelled wherever it lives, and let the queue move on.
+	 *
+	 * On the chat on screen: every pending placeholder carrying the id goes (a
+	 * history refetch can have re-mapped the running turn into a second one), the
+	 * request bubble takes its cancelled form, and the next queued turn is promoted
+	 * so the conversation does not sit on an "(In queue)" bubble with nothing
+	 * running. For a chat that is NOT on screen (the user moved on while the turn
+	 * ran, and it was cancelled from elsewhere) the same edit is made in that chat's
+	 * history cache, which is what the next visit renders.
+	 *
+	 * Idempotent on purpose: a cancel this client made settles the bubbles at once,
+	 * and the chain that was awaiting the poll settles again a moment later when the
+	 * stop resolves it. The second pass finds nothing to do. Deliberately NOT
+	 * _removeStrayPendingAssistants: by then the placeholder on screen is the freshly
+	 * promoted turn's, whose user bubble is pending, and the sweep would take it.
+	 */
+	private _settleCancelledTurn(itemId: string, ownerKey?: string): void {
+		if (!itemId) return;
+		if (ownerKey && this.getHistoryCacheKey() !== ownerKey) {
+			this._applyCancelToCache(ownerKey, itemId);
+			return;
+		}
+		var changed = false, wasBg = false;
+		for (var i = this.state.messages.length - 1; i >= 0; i--) {
+			var m = this.state.messages[i];
+			if (!m || m._serverItemId !== itemId) continue;
+			if (m.role === 'assistant' && m.isPending) { this.state.messages.splice(i, 1); changed = true; continue; }
+			if (m.role === 'user' && !m.isCancelled) {
+				if (m.isBackgroundTask) wasBg = true;
+				this.state.messages[i] = this._cancelledCopyOf(m, itemId);
+				changed = true;
+			}
+		}
+		this.cancelledServerIds.delete(itemId);
+		if (!changed) return;
+		if (wasBg) this.promoteNextBgQueuedToRunning(); else this.promoteNextQueuedToRunning();
+		this.updateHistoryCache();
+		this.host.notify();
+	}
+
+	/**
+	 * _settleCancelledTurn for a chat that is not on screen: the same edit, made in
+	 * its history cache. Matched by id where the cached bubbles carry one; an
+	 * off-chat send caches its pair before the ack (see dispatchComposedMessage), so
+	 * the fallback is positional, exactly as _applyReplyToCache's is: the trailing
+	 * pending placeholder, and the last request bubble still marked in flight.
+	 */
+	private _applyCancelToCache(key: string, itemId: string): void {
+		var existing = key ? this.aiChatHistoryCache[key] : undefined;
+		if (!existing) return;
+		var msgs = existing.messages.slice();
+		var changed = false;
+		var pIdx = -1, uIdx = -1;
+		for (var i = msgs.length - 1; i >= 0; i--) {
+			var m = msgs[i];
+			if (!m || m._serverItemId !== itemId) continue;
+			if (m.role === 'assistant' && m.isPending) { msgs.splice(i, 1); changed = true; pIdx = i; }
+			else if (m.role === 'user' && !m.isCancelled && uIdx === -1) uIdx = i;
+		}
+		if (pIdx === -1) {
+			for (var p = msgs.length - 1; p >= 0; p--) {
+				var pm = msgs[p];
+				if (!pm || !pm.isPending || pm.role !== 'assistant' || pm.isBackgroundTask || pm._serverItemId !== undefined) continue;
+				msgs.splice(p, 1); changed = true; break;
+			}
+		}
+		if (uIdx === -1) {
+			for (var u = msgs.length - 1; u >= 0; u--) {
+				var um = msgs[u];
+				if (!um || um.role !== 'user' || um.isBackgroundTask || um._serverItemId !== undefined || um._stageId) continue;
+				if (!(um.isPendingQueued || um.isPendingInProcess || um.isSendingToServer)) continue;
+				uIdx = u; break;
+			}
+		}
+		if (uIdx !== -1) { msgs[uIdx] = this._cancelledCopyOf(msgs[uIdx], itemId); changed = true; }
+		if (!changed) return;
+		this.aiChatHistoryCache[key] = { messages: msgs, endOfList: existing.endOfList, startKeyHistory: existing.startKeyHistory };
+	}
+
 	/**
 	 * Stop indexing a file, from its collapsed row — every pass at once, not just
 	 * the bubble the user happens to see.
@@ -3679,6 +3935,16 @@ export class ChatSession {
 		// server-cancelled by _applyIndexCancellations on the next drain, which is
 		// also what makes the worker stop enqueueing windows.
 		this._adoptWorkerIndexingPasses(0);
+		// And every pass of this file the client ALREADY knows to be live, now, not on
+		// the next drain. `cancellableIds` below is the row's own list, and it leaves
+		// out an in-flight pass that a later pass has already outlived - a rule written
+		// for one pass at a time, which a PDF no longer is: the worker runs several
+		// windows of one file at once and they settle out of order, so the row's list
+		// can be empty while eight passes are running. The sweep reads the key just
+		// recorded above and cancels each known pending pass once (it skips one already
+		// being cancelled, so the loop below cannot cancel a bubble twice). Server-side,
+		// one cancelled window stops the whole document.
+		this._sweepCancelledIndexing();
 		var ids = group.cancellableIds || [];
 		if (!ids.length) { this.host.notify(); return; }
 		ids.forEach(function (serverId) {
@@ -3836,9 +4102,11 @@ export class ChatSession {
 		// Stamp the reply bubble's display time as it starts revealing. This is the
 		// single chokepoint every typed reply (immediate, queued, and bg-resolution)
 		// passes through, so it is where a live reply gets its "when it arrived"
-		// timestamp; a history reload later replaces it with the server `updated`.
+		// timestamp; a history reload later replaces it with the server's own.
+		// _replyStampFor prefers the time skapi received the response when the settle
+		// reported one (a streamed turn), over this browser's clock.
 		var target = this.state.messages[idx];
-		if (target && target._ts === undefined) target._ts = wallClockNow();
+		if (target && target._ts === undefined) target._ts = this._replyStampFor(target);
 		// SELF-HEALING, because this is now reached from the live paint path too. The
 		// queue is a class field, so it is only initialised by the constructor; any
 		// caller holding a ChatSession built another way (the engine tests drive
@@ -4016,9 +4284,12 @@ export class ChatSession {
 		if (this.state.messages.some(function (m) { return (m.isPending || m.isPendingQueued) && !m.isBackgroundTask && !m._useBgQueue; })) return Promise.resolve();
 		this.state.sending = true;
 		this.host.scrollToBottomIfSticky(true);
-		return Promise.resolve(pending).catch(function () { }).then(function () {
+		return Promise.resolve(pending).catch(function () { }).then(function (result: any) {
 			if (token !== self.state.gateRefreshToken) return;
 			self.state.sending = false;
+			// Same guard as the immediate-send settle: a cancelled turn has no reply
+			// to type, and the placeholder on screen may be the next turn's by now.
+			if (result && result.cancelled) return;
 			return Promise.resolve(self.typewriteLatestReply(key)).then(function () { self.host.scrollToBottomIfSticky(true); });
 		});
 	}

package/styles/chat.css

@@ -83,6 +83,28 @@
 .bq-message.is-assistant:not(.is-error):not(.is-cancelled):not(.bq-index-pass) .bq-bubble:has(> .bq-loader) > .bq-loader {
     vertical-align: middle;
 }
+/* The dot-trail cycles '.', '..', '...', so left to itself it is a box that
+   changes width three times every 1.2s: the bubble pulsed with it, and the
+   stop-waiting control that follows the dots moved each time, which made it hard
+   to hit. Inside a bubble the loader therefore RESERVES the width of its widest
+   frame: a hidden '...' sets the box and the animated dots are laid over it from
+   the left. Sized by the text itself rather than by a length, so it is right in
+   any font and at any letter-spacing. Scoped to bubbles on purpose: a loader that
+   trails a label ("Saving...") has to keep hugging its text. */
+.bq-bubble > .bq-loader {
+    position: relative;
+    display: inline-block;
+    white-space: nowrap;
+}
+.bq-bubble > .bq-loader::before {
+    content: '...';
+    visibility: hidden;
+}
+.bq-bubble > .bq-loader::after {
+    position: absolute;
+    left: 0;
+    top: 0;
+}
 
 .bq-message.is-error .bq-bubble {
     background: var(--bq-danger-bg);
@@ -95,6 +117,14 @@
     color: var(--bq-danger);
     opacity: 0.65;
 }
+/* A failed pass the worker has already sent again: real, but not the file's
+   outcome (the replacement pass is), so it is told in the muted voice of a
+   note rather than the red of a dead end. */
+.bq-message.is-error.is-retried .bq-bubble {
+    background: var(--bq-paper);
+    border-color: var(--bq-line);
+    color: var(--bq-muted);
+}
 .bq-message.is-pending-older .bq-bubble {
     background: var(--bq-warning-bg);
     border-color: var(--bq-warning-border);
@@ -153,6 +183,35 @@
 }
 .bq-cancel-queue-btn:hover:not(.is-disabled) { background: var(--bq-warning-bg); color: var(--bq-warning); }
 .bq-cancel-queue-btn.is-disabled { opacity: 0.3; cursor: not-allowed; pointer-events: none; }
+/* Stop waiting for a reply: sits INLINE after the dot-trail in a chat turn's own
+   "Thinking" bubble, where the bunny is inline too (:has(> .bq-loader) above).
+   Same face as the queued-message × but placed differently: that one floats to
+   its bubble's corner, this one simply follows the dots. Muted at rest so the
+   dots stay the thing the eye lands on; hover changes opacity only, never its
+   colour. Shared by both chatboxes. */
+.bq-cancel-wait-btn {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    vertical-align: middle;
+    margin-left: 0.55rem;
+    width: 1.1rem;
+    height: 1.1rem;
+    min-height: 0;
+    padding: 0;
+    border: 1px solid var(--bq-line);
+    background: transparent;
+    color: var(--bq-muted);
+    font-size: 0.85rem;
+    line-height: 1;
+    cursor: pointer;
+    box-shadow: none;
+    border-radius: 0;
+    flex-shrink: 0;
+    opacity: 0.7;
+}
+.bq-cancel-wait-btn:hover:not(.is-disabled) { opacity: 1; }
+.bq-cancel-wait-btn.is-disabled { opacity: 0.3; cursor: not-allowed; pointer-events: none; }
 
 /* ---- unfinalized streamed answer (ask for it) ----------------------------
    A turn whose answer was streamed and never finalized keeps its bytes in the