ayder-cli 2.4.0__tar.gz → 2.4.1__tar.gz

{ayder_cli-2.4.0 → ayder_cli-2.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ayder-cli
-Version: 2.4.0
+Version: 2.4.1
 Summary: AI agent for any LLMs
 Project-URL: Homepage, https://github.com/ayder/ayder-cli
 Project-URL: Repository, https://github.com/ayder/ayder-cli.git
@@ -204,7 +204,7 @@ editor = "vim"                # Editor for /task-edit command
 verbose = false               # Show file contents after write + LLM debug
 max_background_processes = 5  # Max concurrent background processes (1-20)
 max_iterations = 10           # Max agentic iterations per message (1-100)
-max_output_tokens = 4096      # Max tokens in LLM response
+max_output_tokens = 32768     # Max tokens in LLM response
 max_history_messages = 30     # Messages kept in history
 prompt = "STANDARD"           # System prompt tier: MINIMAL, STANDARD, EXTENDED
 tool_tags = ["core", "metadata"]  # Enabled tool tags (see /plugin)
@@ -414,12 +414,13 @@ ayder-cli includes a context manager that automatically keeps your conversation
 - **Real token counts**: Uses Ollama's `prompt_eval_count` and `eval_count` from native API responses instead of estimates. Compaction decisions are based on actual usage, not heuristics.
 - **Cache monitoring**: Tracks `prompt_eval_duration / prompt_eval_count` ratio to detect KV-cache hits (hot/warm/miss). When the cache is hot, compaction is delayed (threshold raised from 70% to 90%) to avoid invalidating it.
 - **Auto-detected context length**: On startup, queries `/api/show` to get the model's real context length instead of relying on `num_ctx`. Falls back to `num_ctx` if detection fails.
-- **Heuristic compaction**: When the context fills up, oldest message units are replaced with a text summary — no LLM call needed.
+- **Heuristic compaction**: When the context fills up, the oldest half of the message units is replaced with a text summary — no LLM call needed. The newest unit is never folded. The summary persists: every later request reuses the same summary message, so each request extends the previous one until the next compaction. A new compaction folds the previous summary into one capped summary (8,000 characters).
+- **Prefix contract**: Message-level prefix stability holds while the model, tools and `max_history = 0` stay unchanged and the history is append-only. Rewriting history (`/clear`, a compact, loading a session) starts a new generation: the summary is dropped and compaction waits for a fresh token count. This guarantees a stable message prefix; whether the server reuses its cache is up to the server.
 - **Native SDK**: Uses `ollama.AsyncClient` directly (not the OpenAI compatibility layer) for full timing data, native thinking support, and `keep_alive=-1` to prevent model unloading.
 
 **General-purpose manager** (Anthropic, OpenAI, Gemini, and other drivers):
 
-Every message is assigned an importance tier (system > recent user > recent assistant > tool results > old history). When the conversation approaches the token budget, old tool results are compressed (JSON structurally summarized, large text head/tail truncated) and the lowest-priority messages are pruned. Tool call + result pairs are kept as atomic units.
+Every message is assigned an importance tier (system > recent user > recent assistant > tool results > old history). When the conversation approaches the token budget, old tool results are compressed (JSON structurally summarized, large text head/tail truncated) and the lowest-priority messages are pruned. Tool call + result pairs are kept as atomic units. The newest unit is always kept, even when it alone exceeds the budget, so the model always sees the request it is answering.
 
 The context manager is configured under `[context_manager]` in `config.toml`:
 
@@ -545,6 +546,8 @@ ayder-cli includes a built-in task system:
 
 Tasks are stored as markdown files in `.ayder/tasks/` using slug-based filenames (e.g., `TASK-001-add-auth-middleware.md`).
 
+The `task` tool resolves identifiers (a path, filename, ID or slug) only to files inside `.ayder/tasks/`. An identifier that points elsewhere, including through a symlink, is not resolved. If `.ayder/tasks/`, `.ayder/context/` or `.ayder/notes/` itself resolves outside the project, those tools return a security error.
+
 ```
 > /tasks            # Interactive task browser
 > /task-edit 1      # Open TASK-001 in the in-app editor

{ayder_cli-2.4.0 → ayder_cli-2.4.1}/README.md

@@ -161,7 +161,7 @@ editor = "vim"                # Editor for /task-edit command
 verbose = false               # Show file contents after write + LLM debug
 max_background_processes = 5  # Max concurrent background processes (1-20)
 max_iterations = 10           # Max agentic iterations per message (1-100)
-max_output_tokens = 4096      # Max tokens in LLM response
+max_output_tokens = 32768     # Max tokens in LLM response
 max_history_messages = 30     # Messages kept in history
 prompt = "STANDARD"           # System prompt tier: MINIMAL, STANDARD, EXTENDED
 tool_tags = ["core", "metadata"]  # Enabled tool tags (see /plugin)
@@ -371,12 +371,13 @@ ayder-cli includes a context manager that automatically keeps your conversation
 - **Real token counts**: Uses Ollama's `prompt_eval_count` and `eval_count` from native API responses instead of estimates. Compaction decisions are based on actual usage, not heuristics.
 - **Cache monitoring**: Tracks `prompt_eval_duration / prompt_eval_count` ratio to detect KV-cache hits (hot/warm/miss). When the cache is hot, compaction is delayed (threshold raised from 70% to 90%) to avoid invalidating it.
 - **Auto-detected context length**: On startup, queries `/api/show` to get the model's real context length instead of relying on `num_ctx`. Falls back to `num_ctx` if detection fails.
-- **Heuristic compaction**: When the context fills up, oldest message units are replaced with a text summary — no LLM call needed.
+- **Heuristic compaction**: When the context fills up, the oldest half of the message units is replaced with a text summary — no LLM call needed. The newest unit is never folded. The summary persists: every later request reuses the same summary message, so each request extends the previous one until the next compaction. A new compaction folds the previous summary into one capped summary (8,000 characters).
+- **Prefix contract**: Message-level prefix stability holds while the model, tools and `max_history = 0` stay unchanged and the history is append-only. Rewriting history (`/clear`, a compact, loading a session) starts a new generation: the summary is dropped and compaction waits for a fresh token count. This guarantees a stable message prefix; whether the server reuses its cache is up to the server.
 - **Native SDK**: Uses `ollama.AsyncClient` directly (not the OpenAI compatibility layer) for full timing data, native thinking support, and `keep_alive=-1` to prevent model unloading.
 
 **General-purpose manager** (Anthropic, OpenAI, Gemini, and other drivers):
 
-Every message is assigned an importance tier (system > recent user > recent assistant > tool results > old history). When the conversation approaches the token budget, old tool results are compressed (JSON structurally summarized, large text head/tail truncated) and the lowest-priority messages are pruned. Tool call + result pairs are kept as atomic units.
+Every message is assigned an importance tier (system > recent user > recent assistant > tool results > old history). When the conversation approaches the token budget, old tool results are compressed (JSON structurally summarized, large text head/tail truncated) and the lowest-priority messages are pruned. Tool call + result pairs are kept as atomic units. The newest unit is always kept, even when it alone exceeds the budget, so the model always sees the request it is answering.
 
 The context manager is configured under `[context_manager]` in `config.toml`:
 
@@ -502,6 +503,8 @@ ayder-cli includes a built-in task system:
 
 Tasks are stored as markdown files in `.ayder/tasks/` using slug-based filenames (e.g., `TASK-001-add-auth-middleware.md`).
 
+The `task` tool resolves identifiers (a path, filename, ID or slug) only to files inside `.ayder/tasks/`. An identifier that points elsewhere, including through a symlink, is not resolved. If `.ayder/tasks/`, `.ayder/context/` or `.ayder/notes/` itself resolves outside the project, those tools return a security error.
+
 ```
 > /tasks            # Interactive task browser
 > /task-edit 1      # Open TASK-001 in the in-app editor

{ayder_cli-2.4.0 → ayder_cli-2.4.1}/docs/GATE.md

@@ -12,7 +12,7 @@ Input: the candidate SHA.
    gates and the test suite, and stops at the first failing task.
 4. Copy the final pytest summary line (`=== N passed, M skipped in …s ===`) verbatim.
 
-Last measured: `2494 passed, 2 skipped` on `feat/evren-terms` with the evren default profile (2026-09-29).
+Last measured: `2606 passed, 2 skipped` on `fix/max-output-tokens-default` (2026-10-16).
 
 ## Report format
 

{ayder_cli-2.4.0 → ayder_cli-2.4.1}/docs/PROJECT_STRUCTURE.md

@@ -605,9 +605,11 @@ previously-split `AgentLoopBase` and `LoopConfig` were merged back in):
 - Routes *every* LLM response through the injected `ContextManagerProtocol` (`prepare_messages()` / `update_from_response()`); tool outputs are truncated at insertion time via `truncate_tool_result()` so the KV-cache prefix remains stable
 
 Key features:
-- Auto-approved tools run in parallel (`asyncio.gather`); confirmation-required tools run sequentially
+- Auto-approved tools run in parallel (`asyncio.as_completed`); confirmation-required tools run sequentially
 - Confirmation gate applies to **both** OpenAI-format and XML/JSON custom tool calls
-- `ExecutionPolicy.execute_with_registry()` is the single execution entry (validate → permission → execute)
+- `ExecutionPolicy.execute_with_registry()` is the single execution entry (object check → `canonicalize_arguments()` → validate → permission → execute). Canonicalization applies aliases and `"123"`/`"true"`/`"false"` coercion; the loop's required-argument gate uses the same function
+- Argument integrity: `_parse_tool_arguments()` reports `ok`, `repaired` or `invalid`. Non-object arguments never run. Arguments repaired after being cut off (output token limit) run only for tools registered explicitly as `r`; other tools get an error asking the model to resend in smaller calls
+- Cancellation: each batch owns a `_ToolBatch`. Workers refuse to start once the batch is cancelled and record their own result and `tool_call` event. When a batch ends early (Ctrl+C or a raising callback), a `finally` appends exactly one tool message per unanswered call: its result, an "interrupted, may have partially applied" notice, or a "cancelled before it ran" notice. Running workers are not awaited, so Ctrl+C returns at once
 - Token usage tracking and iteration limiting
 - Pre-iteration hook (`pre_iteration_hook`) used by the agent system to inject summaries
 - Graceful cancellation via `is_cancelled()`

{ayder_cli-2.4.0 → ayder_cli-2.4.1}/docs/config.toml.example

@@ -201,7 +201,7 @@ think = true                        # default; set false if the selected model r
 # api_key = "sk-..."                        # your key (or "ollama"/"none" for local servers)
 # model = "gpt-5.5"
 # num_ctx = 65536            # sizes the context-manager budget (default 65536); NOT sent to the API
-# max_output_tokens = 8192   # -> max_tokens / max_completion_tokens (default 4096); keep WELL below num_ctx
+# max_output_tokens = 8192   # -> max_tokens / max_completion_tokens (default 32768); keep WELL below num_ctx
 # stop_sequences = []        # -> stop (default [])
 # reasoning_effort = "medium" # choose a value supported by the selected model
 # # temperature / think are NOT applied by the openai driver.

{ayder_cli-2.4.0 → ayder_cli-2.4.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ayder-cli"
-version = "2.4.0"
+version = "2.4.1"
 description = "AI agent for any LLMs"
 readme = "README.md"
 requires-python = ">=3.12"

{ayder_cli-2.4.0 → ayder_cli-2.4.1}/src/ayder_cli/application/execution_policy.py

@@ -158,19 +158,40 @@ class ExecutionPolicy:
         *,
         pre_approved: bool = False,
     ) -> ExecutionResult:
-        """Single shared execution path: validate → check permission → execute.
+        """Single shared execution path: canonicalize → validate → permission → execute.
 
         Both CLI and TUI route through this method so registry.execute is never
         called directly from interface-specific code.
 
+        Order:
+        1. Arguments that are not a JSON object are a validation error.
+        2. ``canonicalize_arguments``: aliases, integer and boolean coercion.
+        3. ``ValidationAuthority`` on the canonical arguments.
+        4. Permission check (unless pre-approved), then ``registry.execute``
+           with the canonical arguments.
+
         Args:
             pre_approved: If True, skip the permission check (user already
                 confirmed via the confirmation dialog).
         """
         from ayder_cli.application.validation import ValidationAuthority
+        from ayder_cli.tools.normalization import canonicalize_arguments
+
+        if not isinstance(request.arguments, dict):
+            return ExecutionResult(
+                success=False,
+                error=ValidationError(
+                    tool_name=request.name,
+                    message=(
+                        "arguments must be a JSON object, got "
+                        f"{type(request.arguments).__name__}"
+                    ),
+                ),
+            )
+        canonical = canonicalize_arguments(request.name, request.arguments)
 
         authority = ValidationAuthority()
-        v_request = ToolRequest(name=request.name, arguments=request.arguments)
+        v_request = ToolRequest(name=request.name, arguments=canonical)
         valid, err = authority.validate(v_request)
         if not valid:
             return ExecutionResult(success=False, error=err)
@@ -180,7 +201,7 @@ class ExecutionPolicy:
             if perm_err is not None:
                 return ExecutionResult(success=False, error=perm_err)
 
-        raw = registry.execute(request.name, request.arguments)
+        raw = registry.execute(request.name, v_request.arguments)
         if isinstance(raw, ToolError):
             # A tool that ran and failed is NOT a successful execution.
             return ExecutionResult(success=False, was_confirmed=pre_approved, error=raw)

{ayder_cli-2.4.0 → ayder_cli-2.4.1}/src/ayder_cli/application/validation.py

@@ -101,6 +101,12 @@ class SchemaValidator:
                     field=param_name,
                     message=f"'{param_name}' must be integer, got {type(value).__name__}",
                 )
+            if expected_type == "boolean" and not isinstance(value, bool):
+                return False, ValidationError(
+                    tool_name=request.name,
+                    field=param_name,
+                    message=f"'{param_name}' must be boolean, got {type(value).__name__}",
+                )
             if expected_type == "string" and not isinstance(value, str):
                 return False, ValidationError(
                     tool_name=request.name,

{ayder_cli-2.4.0 → ayder_cli-2.4.1}/src/ayder_cli/core/config.py

@@ -352,7 +352,7 @@ class Config(BaseModel):
     max_background_processes: int = Field(default=5)
     # Local Unix-socket inbox that accepts prompts from peer processes.
     messaging_enabled: bool = Field(default=True)
-    max_output_tokens: int = Field(default=4096)
+    max_output_tokens: int = Field(default=32768)
     # 0 = unlimited: let the context manager's token budget + compaction be the
     # bound. The old fixed 30 predates large-context models and thrashes a tiny
     # history window on a big context.

{ayder_cli-2.4.0 → ayder_cli-2.4.1}/src/ayder_cli/core/context.py

@@ -44,6 +44,39 @@ class ProjectContext:
 
         return target_path
 
+    def harness_dir(self, *parts: str) -> Path:
+        """Return ``<root>/.ayder/<parts>``, refusing a location outside the root.
+
+        ``validate_path`` resolves symlinks, so a ``.ayder/<parts>`` symlink that
+        points outside the project raises instead of redirecting writes.
+        The directory is not created.
+
+        Raises:
+            ValueError: If the resolved directory is outside the project root.
+        """
+        return self.validate_path(str(Path(".ayder", *parts)))
+
+    @staticmethod
+    def within(directory: Path, path: Path | str) -> Path:
+        """Return ``path`` unchanged if it resolves inside ``directory``.
+
+        The resolved form is only checked, never returned, so names and
+        relative paths stay stable when an in-directory symlink is followed.
+        ``os.path.realpath`` is used rather than ``Path.resolve``, which also
+        stats the final target. Resolving still lstats and reads links along
+        the path, including outside components; what it never does is read or
+        follow-stat the target's content, so a refused entry stays unread.
+
+        Raises:
+            ValueError: If ``path`` resolves outside ``directory``.
+        """
+        resolved = Path(os.path.realpath(path))
+        if not resolved.is_relative_to(Path(os.path.realpath(directory))):
+            raise ValueError(
+                f"Security Alert: Path '{resolved}' is outside '{directory}'"
+            )
+        return Path(path)
+
     def to_relative(self, absolute_path: Path) -> str:
         """Convert an absolute path to relative path for LLM output.
 

{ayder_cli-2.4.0 → ayder_cli-2.4.1}/src/ayder_cli/core/default_context_manager.py

@@ -371,39 +371,45 @@ class DefaultContextManager:
         overhead = effective_system_tokens + effective_schema_tokens
         available = self._available_budget(overhead)
 
-        if available <= 0:
-            # Overhead ate the whole budget: every history message is dropped.
-            kept = 1 if system_msg else 0
-            self._emit_trim(len(self._messages), kept, "budget_exhausted")
-            return [system_msg] if system_msg else []
-
         start_idx = 1 if system_msg else 0
         history_msgs = self._messages[start_idx:]
 
         units = self._group_into_units(history_msgs)
 
         result: List[Dict[str, Any]] = []
-        used = 0
-        messages_count = 0
-        reason: str | None = None
-        for unit in reversed(units):
-            if max_history > 0 and messages_count + len(unit) > max_history:
-                reason = "max_history"
-                break
-
-            cost = self._counter.count_messages(unit)
-            if used + cost > available:
-                reason = "token_budget"
-                break
-
-            result = unit + result
-            used += cost
-            messages_count += len(unit)
-
-        # Emitted BEFORE the truncation marker below: that marker ADDS a
-        # message, and counting after it would under-report `dropped` by one.
-        if reason is not None:
-            self._emit_trim(len(history_msgs), len(result), reason)
+        if available <= 0:
+            # Overhead ate the whole budget: every history message is dropped
+            # except the newest unit, the request the model must see (F8).
+            if units:
+                result = list(units[-1])
+            kept = (1 if system_msg else 0) + len(result)
+            self._emit_trim(len(self._messages), kept, "budget_exhausted")
+        else:
+            used = 0
+            messages_count = 0
+            reason: str | None = None
+            for unit in reversed(units):
+                # The newest unit is always kept, even when it alone exceeds
+                # the budget or max_history: dropping it would send a request
+                # the model never saw (F8). If it truly exceeds the model's
+                # window, the provider's error reaches the user.
+                if result and max_history > 0 and messages_count + len(unit) > max_history:
+                    reason = "max_history"
+                    break
+
+                cost = self._counter.count_messages(unit)
+                if result and used + cost > available:
+                    reason = "token_budget"
+                    break
+
+                result = unit + result
+                used += cost
+                messages_count += len(unit)
+
+            # Emitted BEFORE the truncation marker below: that marker ADDS a
+            # message, and counting after it would under-report `dropped` by one.
+            if reason is not None:
+                self._emit_trim(len(history_msgs), len(result), reason)
 
         if result and result[0].get("role") != "user":
             result.insert(

{ayder_cli-2.4.0 → ayder_cli-2.4.1}/src/ayder_cli/core/ollama_context_manager.py

@@ -23,6 +23,10 @@ from ayder_cli.providers.impl.ollama_inspector import OllamaInspector
 
 logger = get_logger("context")
 
+SUMMARY_HEADER = "[Previous conversation summary]"
+# Cap on the accumulated summary body. Oldest lines are evicted first.
+_SUMMARY_MAX_CHARS = 8000
+
 
 @dataclass
 class OllamaContextStats(ContextStats):
@@ -46,6 +50,22 @@ class OllamaContextManager:
     3. Tool results are truncated at insertion time (immutable after that).
     4. Compaction is the only mutation — oldest units replaced with a heuristic
        text summary, never an LLM call.
+
+    Compaction persists. The caller's history is never mutated; the manager
+    remembers the folded message objects and one summary dict, and every later
+    call replaces exactly those objects with that same summary. Between two
+    compactions or resets, each request's message list therefore extends the
+    previous one, provided the model, tools and rendering are unchanged,
+    ``max_history`` is 0, and the history is append-only with no sent message
+    dict edited in place. That last point is an assumption of this manager's
+    history contract (object identity cannot see an in-place edit). The
+    system message is exempt: the frozen copy is always sent.
+
+    A history that is not an identity extension of the previous call's input
+    (``/clear``, a pending compact, a session load, a removed skill message)
+    is a new generation: the summary is dropped and compaction waits for a
+    fresh ``prompt_tokens`` measurement, since the stale one described the old
+    history. Every compaction or reset is an intentional prefix change.
     """
 
     def __init__(
@@ -85,6 +105,12 @@ class OllamaContextManager:
         self._compaction_count: int = 0
         self._messages_compacted: int = 0
 
+        # Persistent compaction state for the current history generation.
+        self._summary_msg: dict | None = None  # sent verbatim on every call
+        self._folded: list[dict] = []  # caller objects the summary replaces
+        self._last_seen: list[dict] = []  # previous call's untrimmed input
+        self._awaiting_measurement: bool = False  # block until fresh prompt_tokens
+
         self._cache_monitor: CacheMonitor = CacheMonitor()
 
         # Event-correlation ids. The factory that builds this manager knows
@@ -211,21 +237,43 @@ class OllamaContextManager:
             history = list(messages)
 
         if not history:
+            self._reset_generation()
+            self._last_seen = []
             return [system_msg] if system_msg else []
 
-        # Compact if threshold exceeded
-        compaction_summary: dict | None = None
-        if self.should_compact() and history:
-            before_compact = len(history)
-            history, compaction_summary = self._compact(history)
-            self._emit_trim(before_compact, len(history), "compaction")
+        # A history that does not extend the previous call's input is a new
+        # generation: the old summary and the old measurement do not apply.
+        if not self._extends_last_seen(history):
+            self._reset_generation()
+        self._last_seen = list(history)
+
+        # Re-apply the current summary in place of the messages it folded.
+        surviving = history[len(self._folded):] if self._summary_msg else history
+        if not surviving:
+            self._reset_generation()
+            surviving = history
+
+        # Compact at most once per fresh measurement of this generation.
+        if not self._awaiting_measurement and self.should_compact():
+            surviving, newly_folded = self._compact(surviving)
+            if newly_folded:
+                previous = self._summary_msg["content"] if self._summary_msg else None
+                self._summary_msg = {
+                    "role": "user",
+                    "content": self._merge_summary(
+                        previous, self._summary_lines(newly_folded)
+                    ),
+                }
+                self._folded = self._folded + newly_folded
+                self._awaiting_measurement = True
+                self._emit_trim(len(history), len(surviving), "compaction")
 
         # Apply max_history cap — trim from the head on unit boundaries so
         # assistant+tool_calls stays atomic with its tool_result responses.
         # See opus47.md finding #3.
-        if max_history > 0 and len(history) > max_history:
-            before_trim = len(history)
-            units = self._group_into_units(history)
+        if max_history > 0 and len(surviving) > max_history:
+            before_trim = len(surviving)
+            units = self._group_into_units(surviving)
             kept: list[list[dict]] = []
             msg_count = 0
             for unit in reversed(units):
@@ -233,16 +281,16 @@ class OllamaContextManager:
                     break
                 kept.insert(0, unit)
                 msg_count += len(unit)
-            history = [m for unit in kept for m in unit]
-            self._emit_trim(before_trim, len(history), "max_history")
+            surviving = [m for unit in kept for m in unit]
+            self._emit_trim(before_trim, len(surviving), "max_history")
 
         # Build the output — stable prefix order
         result: list[dict] = []
         if system_msg:
             result.append(system_msg)
-        if compaction_summary is not None:
-            result.append(compaction_summary)
-        result.extend(history)
+        if self._summary_msg is not None:
+            result.append(self._summary_msg)
+        result.extend(surviving)
         self._estimated_prompt_tokens = self._counter.count_messages(result)
         return result
 
@@ -256,6 +304,9 @@ class OllamaContextManager:
         self._real_completion_tokens = usage.get(
             "completion_tokens", self._real_completion_tokens
         )
+        if "prompt_tokens" in usage:
+            # A fresh measurement of the history that was just sent.
+            self._awaiting_measurement = False
         self._last_prompt_eval_ns = usage.get("prompt_eval_ns", self._last_prompt_eval_ns)
         self._last_eval_ns = usage.get("eval_ns", self._last_eval_ns)
 
@@ -398,8 +449,21 @@ class OllamaContextManager:
 
         return units
 
-    def _heuristic_summarize(self, messages: list[dict]) -> str:
-        """Produce a compact text summary of messages without calling an LLM."""
+    def _extends_last_seen(self, history: list[dict]) -> bool:
+        """True if the previous call's input is an identity prefix of ``history``."""
+        last = self._last_seen
+        if len(history) < len(last):
+            return False
+        return all(history[i] is last[i] for i in range(len(last)))
+
+    def _reset_generation(self) -> None:
+        """Forget the summary; wait for a measurement of the new history."""
+        self._summary_msg = None
+        self._folded = []
+        self._awaiting_measurement = True
+
+    def _summary_lines(self, messages: list[dict]) -> list[str]:
+        """One heuristic summary line per message, without calling an LLM."""
         parts: list[str] = []
         for msg in messages:
             role = msg["role"]
@@ -418,29 +482,57 @@ class OllamaContextManager:
             elif role == "tool":
                 name = msg.get("name", "unknown")
                 parts.append(f"Tool {name} returned result")
-        return "[Previous conversation summary]\n" + "\n".join(parts)
+        return parts
+
+    def _heuristic_summarize(self, messages: list[dict]) -> str:
+        """Produce a compact text summary of messages without calling an LLM."""
+        return SUMMARY_HEADER + "\n" + "\n".join(self._summary_lines(messages))
+
+    def _merge_summary(self, previous: str | None, new_lines: list[str]) -> str:
+        """Fold ``new_lines`` into the previous summary under one header.
+
+        The body keeps the newest lines whose total length, newlines
+        included, is at most ``_SUMMARY_MAX_CHARS``. If the newest line alone
+        is longer, it is kept as its first ``_SUMMARY_MAX_CHARS - 1``
+        characters plus an ellipsis.
+        """
+        lines: list[str] = []
+        if previous:
+            body = previous.split("\n", 1)[1] if "\n" in previous else ""
+            lines = body.split("\n") if body else []
+        lines += new_lines
+
+        kept: list[str] = []
+        total = 0
+        for line in reversed(lines):
+            cost = len(line) + (1 if kept else 0)
+            if total + cost > _SUMMARY_MAX_CHARS:
+                break
+            kept.append(line)
+            total += cost
+        if not kept and lines:
+            kept = [lines[-1][: _SUMMARY_MAX_CHARS - 1] + "…"]
+        return SUMMARY_HEADER + "\n" + "\n".join(reversed(kept))
 
     def _compact(
         self, history: list[dict]
-    ) -> tuple[list[dict], dict]:
-        """Replace the oldest half of message units with a heuristic summary.
+    ) -> tuple[list[dict], list[dict]]:
+        """Fold the oldest half of message units, never the newest unit.
 
-        Returns the surviving history and the summary message dict.
+        Returns ``(surviving, folded)``. With fewer than two units nothing is
+        folded: the newest unit is the request the model must see.
         """
         units = self._group_into_units(history)
+        if len(units) < 2:
+            return history, []
 
-        # Compact the oldest half of units (at least 1)
-        compact_count = max(1, len(units) // 2)
+        # Compact the oldest half of units (at least 1, never the newest)
+        compact_count = min(max(1, len(units) // 2), len(units) - 1)
         units_to_compact = units[:compact_count]
         units_to_keep = units[compact_count:]
 
-        # Flatten compacted units for summarisation
-        msgs_to_compact = [msg for unit in units_to_compact for msg in unit]
-        compacted_msg_count = len(msgs_to_compact)
-
-        summary_text = self._heuristic_summarize(msgs_to_compact)
-        summary_msg = {"role": "user", "content": summary_text}
-
+        folded = [msg for unit in units_to_compact for msg in unit]
+        compacted_msg_count = len(folded)
         surviving = [msg for unit in units_to_keep for msg in unit]
 
         self._compaction_count += 1
@@ -453,4 +545,4 @@ class OllamaContextManager:
             self._compaction_count,
         )
 
-        return surviving, summary_msg
+        return surviving, folded