sigit-code 1.3.1__tar.gz → 1.3.2__tar.gz

{sigit_code-1.3.1 → sigit_code-1.3.2}/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 1.3.2
+
+Adds a tool permission system with plan mode, durable sessions with context
+compaction, background command execution, a subagent research tool, and commit
+co-author attribution.
+
+### What changed
+
+- Every tool call now passes a permission policy before executing. Read-only tools always run; mutating tools (and all MCP or unknown tools) are governed by, in order: plan mode, session grants, per-tool overrides, and a default mode from `[permissions]` in `settings.toml` (`allow`/`ask`/`deny`, default `ask`). On `ask`, editors get a native ACP permission dialog (allow once / allow for this session / deny) and the TUI pauses on a y/a/n prompt showing the tool and its arguments. `SIGIT_PERMISSIONS` overrides the default mode for headless runs and clients without permission support
+- New `/plan [on|off]` command: plan mode blocks mutating tools and asks the model to present a plan while research tools keep working. `/permissions` prints the effective policy
+- Sessions are durable: conversation history is saved per session under `~/.config/sigit/sessions/` after every turn. ACP `session/load` actually restores it, the TUI gets `/resume`, and `/clear` deletes the saved file
+- Context compaction: `/compact` compresses the conversation on demand, and the agent compacts automatically once the history approaches a 24k-token budget, summarizing older turns and keeping the recent ones. The tool-round cap rises from 10 to 24 now that long sessions have a defense other than the cap
+- `run_command` can run work in the background: pass `run_in_background` and the tool returns a task id immediately, so builds, test suites, and dev servers are no longer killed by the 120 second foreground timeout. Poll with the new `command_output` tool (read-only, never prompts) and stop with `kill_command`
+- New `task` tool: delegate research to a fresh subagent conversation that only gets the read-only tools and returns its final answer, keeping the main context small. Available on OpenAI-compatible backends; on-device returns a clear fallback until onde supports a second context
+- Commits created by the agent are co-authored: commit messages end with `Co-Authored-By: siGit Code <sigit@sigit.si>` (the [sigitc](https://github.com/sigitc) account), which GitHub renders next to the human author. If the model forgets the trailer, siGit amends it in, never rewriting commits that already exist on a remote
+- ACP mode now honors the `OPENAI_BASE_URL`/`OPENAI_API_KEY` provider override at startup, matching the interactive client
+
 ## 1.3.1
 
 Adds [Model Context Protocol](https://modelcontextprotocol.io) (MCP) client

{sigit_code-1.3.1 → sigit_code-1.3.2}/CLAUDE.md

@@ -19,14 +19,22 @@ Before the TTY/ACP split, `main` also dispatches the account subcommands `sigit
 
 ## Working in this repo
 
-**IMPORTANT — branch naming:** Name every working branch after the *changes it contains*, not
-after a task, ticket, or session id. Use a short, descriptive, kebab-case slug so the branch is
-self-explanatory from its name alone (e.g. `claude/agent-tools-multiedit-glob-todos-remember`,
-not `claude/task-q003hm`).
+**IMPORTANT — branch naming:** Prefix every working branch with `feature/` (new functionality)
+or `fix/` (bug fixes) — never a tool- or agent-name prefix like `claude/`. Name the branch after
+the *changes it contains*, as a short, descriptive, kebab-case slug that is self-explanatory
+from the name alone (e.g. `feature/tool-permission-system`, `fix/glob-mtime-sort`), never after
+a task, ticket, or session id (not `feature/task-q003hm`).
 
 **IMPORTANT — pull request target:** Always open pull requests against the `development` branch,
 never `main`. `main` is release-only; `development` is where day-to-day work integrates.
 
+**IMPORTANT — branch off `development`:** Start every working branch from the latest
+`origin/development`. Exception: when new work *depends on* a feature branch that has not merged
+yet (e.g. it builds on tools or APIs that branch introduces), it may be stacked on top of that
+branch instead. When stacking: merge the base PR into `development` first, then rebase the
+stacked branch onto `development` before opening its pull request, so each PR shows only its own
+commits.
+
 **IMPORTANT — run CI before pushing:** Run the full CI gate locally and confirm it is green
 *before* pushing a branch or opening a pull request — never push work that fails these:
 
@@ -55,10 +63,10 @@ Run a single test: `cargo test <test_name>`.
 
 ## Critical platform constraint: `#[cfg(unix)]` dead code
 
-The interactive client, the `InferenceBackend` seam (`backend.rs`), and provider resolution
-(`provider.rs`) are wired up **only** through `#[cfg(unix)]` code paths. On Windows the binary
-runs ACP-only and drives `onde` directly, so much of `backend.rs` and `provider.rs` is
-legitimately unused there and the dead-code lint is suppressed *on non-Unix targets only*.
+The interactive client is `#[cfg(unix)]`-only. The `InferenceBackend` seam (`backend.rs`) and
+provider resolution (`provider.rs`) are consumed by both the interactive client and the ACP
+server, but several of their items are reached only through the Unix-only interactive paths, so
+the dead-code lint is suppressed *on non-Unix targets only*.
 
 Consequence: code can pass clippy on macOS/Linux but fail on the Windows target (or vice versa).
 When touching `backend.rs`, `provider.rs`, or the interactive path, keep the `cfg` gates intact —
@@ -83,7 +91,10 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
 - **`src/tools.rs`** — agent tool schemas + execution: `read_file`, `create_directory`,
   `list_directory`, `search_files`, `glob`, `read_website`, `create_file`, `edit_file`,
   `multi_edit`, `delete_file`, `run_command`, `write_todos`, `remember`. Add a tool in both the
-  spec list (`all_tools`) and the execute `match` (`execute_tool`).
+  spec list (`all_tools`) and the execute `match` (`execute_tool`). `run_command` also enforces
+  commit attribution: when a command creates a new commit that lacks the
+  `Co-Authored-By: siGit Code` trailer (`COMMIT_CO_AUTHOR_TRAILER`), it amends the trailer in —
+  unless the commit already exists on a remote, which is never rewritten.
 - **`src/skills.rs`** — [Agent Skills](https://agentskills.io) support. Discovers skill
   folders (each with a `SKILL.md`: YAML frontmatter `name` + `description`, then Markdown
   instructions) from `.sigit/skills/` and `.claude/skills/` in the cwd, `$SIGIT_CONFIG_DIR/skills/`,
@@ -102,6 +113,17 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   official server (`<cloud>/mcp`, default `https://sigit.si/api/v1/mcp`) is baked in and authed with the
   cloud session token; extra servers live in `mcp.toml` (global `$SIGIT_CONFIG_DIR/mcp.toml` and
   project-local `.sigit/mcp.toml`). stdio transport is not supported.
+- **`src/permissions.rs`** — tool permission policy. Every tool call passes through
+  `decision_for` before executing: read-only tools always run; mutating tools (and all
+  `mcp__*`/unknown tools) are governed by, in order: per-session plan mode (`/plan` — deny all
+  mutating tools with a present-a-plan message), session "always allow" grants, per-tool
+  overrides and the default mode from `[permissions]` in `settings.toml` (`allow`/`ask`/`deny`,
+  default `ask`; `SIGIT_PERMISSIONS` env overrides the default). On `ask`, the ACP path sends
+  `session/request_permission` (allow once / allow for session / deny) and the TUI pauses the
+  inference task on a y/a/n prompt. Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
+  serialized by `SiGitAgent::turn_lock` so the dispatch loop can route the client's permission
+  answer mid-turn — don't move them back inline, and don't await client requests from inline
+  handlers (deadlock).
 - **`src/instructions.rs`** — project instruction files, the always-on counterpart to skills.
   Reads `AGENTS.md` (the cross-tool [agents.md](https://agents.md) standard) and `CLAUDE.md`,
   walking from the session cwd up to the repo root (nearest ancestor with `.git`, never above it),
@@ -120,8 +142,8 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
 - **`src/models.rs`** — model-picker types shared across platforms.
 
 Slash commands (`/help`, `/models`, `/skills`, `/mcp`, `/login`, `/logout`, `/whoami`, `/reload`,
-`/clear`, `/status`) are advertised via `advertise_commands` in `main.rs` and handled in both the
-TUI and ACP sessions.
+`/plan`, `/permissions`, `/clear`, `/status`) are advertised via `advertise_commands` in `main.rs`
+and handled in both the TUI and ACP sessions.
 
 ## Model cache (macOS)
 
@@ -142,7 +164,9 @@ verbosity with `RUST_LOG`.
 `OPENAI_BASE_URL` / `OPENAI_API_KEY` (provider override), `SIGIT_API_URL` (account API base,
 default `https://sigit.si`), `SIGIT_CLOUD_URL`, `SIGIT_CONFIG_DIR` (default `~/.config/sigit`),
 `SIGIT_MODEL`, `SIGIT_MCP` (`off` disables MCP), `SIGIT_MCP_OFFICIAL` (`off` drops the baked-in
-server), `HF_HOME` / `HF_HUB_CACHE`, `RUST_LOG`.
+server), `SIGIT_PERMISSIONS` (`allow`/`ask`/`deny` — overrides the default permission mode for
+mutating tools; the escape hatch for clients without permission-request support),
+`HF_HOME` / `HF_HUB_CACHE`, `RUST_LOG`.
 
 ## Releasing
 

{sigit_code-1.3.1 → sigit_code-1.3.2}/Cargo.lock

@@ -5200,7 +5200,7 @@ checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "sigit"
-version = "1.3.1"
+version = "1.3.2"
 dependencies = [
  "agent-client-protocol",
  "anyhow",

{sigit_code-1.3.1 → sigit_code-1.3.2}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sigit"
-version = "1.3.1"
+version = "1.3.2"
 edition = "2024"
 description = "siGit Code — ACP-compatible AI coding agent. Sí, git."
 documentation = "https://github.com/getsigit/sigit"

{sigit_code-1.3.1 → sigit_code-1.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sigit-code
-Version: 1.3.1
+Version: 1.3.2
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers

{sigit_code-1.3.1 → sigit_code-1.3.2}/src/backend.rs

@@ -11,17 +11,17 @@
 //! The trait exposes neither `onde` nor OpenAI types, so the loop does not depend
 //! on a specific backend.
 //!
-//! The whole backend seam is wired up only through the interactive client, which
-//! is `#[cfg(unix)]` (see `run_interactive` in `main.rs` and `mod tui` in
-//! `chat.rs`). On non-Unix targets the binary runs ACP-only and drives `onde`
-//! directly, so every item here is legitimately unused there. Suppress the
-//! dead-code lint on those targets only — Unix builds still get full coverage.
+//! The seam is consumed by both surfaces: the interactive client (`#[cfg(unix)]`,
+//! see `run_interactive` in `main.rs` and `mod tui` in `chat.rs`) and the ACP
+//! server's prompt loop. Some items are still reached only through the
+//! Unix-only interactive paths, so the dead-code lint stays suppressed on
+//! non-Unix targets only — Unix builds keep full coverage.
 #![cfg_attr(not(unix), allow(dead_code))]
 
 use std::sync::Arc;
 
 use async_trait::async_trait;
-use onde::inference::{ChatEngine, ToolDefinition};
+use onde::inference::{ChatEngine, ChatMessage, ChatRole, ToolDefinition};
 use serde::Deserialize;
 use tokio::sync::Mutex;
 
@@ -62,6 +62,30 @@ pub struct TurnResult {
 /// Backend errors are plain strings. Callers map them to ACP errors.
 pub type BackendError = String;
 
+/// Rough context budget for a conversation, in estimated tokens (see
+/// [`estimate_tokens`]). When a snapshot exceeds this, the agent loops compact
+/// history before the next tool round.
+pub const DEFAULT_CONTEXT_TOKEN_BUDGET: usize = 24_000;
+
+/// How many trailing messages survive a compaction verbatim (the rest are
+/// folded into the summary).
+pub const COMPACT_KEEP_LAST: usize = 6;
+
+/// The summarization request sent to the model when compacting history.
+const SUMMARIZE_PROMPT: &str = "Summarize this coding session so far: decisions made, \
+    files touched, current state, open items. Be concise and factual.";
+
+/// Crude token estimate for a history snapshot: serialized characters / 4.
+/// Deliberately model-agnostic — it only needs to be in the right ballpark to
+/// decide when compaction is worth an extra inference round.
+pub fn estimate_tokens(history: &[serde_json::Value]) -> usize {
+    let chars: usize = history
+        .iter()
+        .map(|message| message.to_string().chars().count())
+        .sum();
+    chars / 4
+}
+
 /// A sink for streaming assistant text deltas to the UI as they are produced.
 ///
 /// When a caller passes `Some(sink)`, a streaming-capable backend forwards each
@@ -98,10 +122,35 @@ pub trait InferenceBackend: Send + Sync {
         sink: Option<&TokenSink>,
     ) -> Result<TurnResult, BackendError>;
 
+    /// Record tool results in the conversation history *without* asking the
+    /// model to continue the turn. Used when a turn is abandoned mid-round
+    /// (the user cancelled at the permission gate): by then the assistant
+    /// message carrying the tool calls is already in history, and leaving them
+    /// unanswered makes strict OpenAI-compatible endpoints reject every later
+    /// request in the session.
+    async fn record_cancelled_tool_results(&self, results: Vec<ToolResult>);
+
     /// Whether inference runs over the network (a configured provider) rather
     /// than on-device. Drives UI labelling so the displayed model can't claim a
     /// local model while requests actually go to the cloud.
     fn is_remote(&self) -> bool;
+
+    /// A serializable snapshot of the conversation history, one JSON object per
+    /// message (`{"role": ..., "content": ...}` at minimum). The snapshot is
+    /// what the session store persists; it includes any seeded system message
+    /// so [`InferenceBackend::restore_history`] can replace state wholesale.
+    async fn history_snapshot(&self) -> Vec<serde_json::Value>;
+
+    /// Replace the conversation history with a previously saved snapshot.
+    /// Backends that cannot represent every entry (e.g. on-device history has
+    /// no tool-call structure) flatten what they can and drop the rest.
+    async fn restore_history(&self, history: Vec<serde_json::Value>);
+
+    /// Shrink the conversation history: summarize everything so far with one
+    /// extra (non-streaming) inference round, then rebuild history as
+    /// `[system message, summary, last keep_last non-system messages]`. On
+    /// error the original history is left in place.
+    async fn compact_history(&self, keep_last: usize) -> Result<(), BackendError>;
 }
 
 // ── Local backend (onde ChatEngine) ──────────────────────────────────────────────
@@ -195,9 +244,92 @@ impl InferenceBackend for LocalBackend {
         Ok(onde_result_to_turn(result))
     }
 
+    async fn record_cancelled_tool_results(&self, _results: Vec<ToolResult>) {
+        // onde's public API cannot append tool-result history entries without
+        // running another inference round, so the dangling tool call stays in
+        // its history. The chat template replays it as-is, which local models
+        // tolerate — worst case the model re-issues the call next turn.
+    }
+
     fn is_remote(&self) -> bool {
         false
     }
+
+    async fn history_snapshot(&self) -> Vec<serde_json::Value> {
+        // onde's `history()` already flattens tool entries: assistant tool
+        // calls become plain assistant text and tool results are omitted, so
+        // the snapshot is lossy for tool-heavy turns (acceptable in this MVP).
+        self.engine
+            .history()
+            .await
+            .iter()
+            .map(|message| {
+                serde_json::json!({
+                    "role": message.role.to_string(),
+                    "content": message.content,
+                })
+            })
+            .collect()
+    }
+
+    async fn restore_history(&self, history: Vec<serde_json::Value>) {
+        self.engine.clear_history().await;
+        for entry in history {
+            let role = entry["role"].as_str().unwrap_or("");
+            let content = entry["content"].as_str().unwrap_or("").to_string();
+            // Tool-call-only assistant entries and empty tool results carry no
+            // text a plain chat history can replay; drop them.
+            if content.is_empty() && role != "user" && role != "system" {
+                continue;
+            }
+            let message = match role {
+                "system" => ChatMessage::system(content),
+                "user" => ChatMessage::user(content),
+                "assistant" => ChatMessage::assistant(content),
+                // Tool results flatten to plain text (MVP; acceptable loss).
+                "tool" => ChatMessage::user(format!("[tool result]\n{content}")),
+                _ => continue,
+            };
+            self.engine.push_history(message).await;
+        }
+    }
+
+    async fn compact_history(&self, keep_last: usize) -> Result<(), BackendError> {
+        let snapshot = self.engine.history().await;
+        // One plain (tool-free) inference round produces the summary. On error
+        // history is untouched — send_message only mutates it on success, and
+        // whatever it appended is wiped by the clear below anyway.
+        let result = self
+            .engine
+            .send_message(SUMMARIZE_PROMPT)
+            .await
+            .map_err(|error| error.to_string())?;
+        // Local models may reason in <think> blocks; keep only the visible part.
+        let (_think, summary) = crate::chat::strip_think_blocks(&result.text);
+
+        self.engine.clear_history().await;
+        // Leading system messages carry the session context; keep them all.
+        for message in snapshot
+            .iter()
+            .take_while(|message| message.role == ChatRole::System)
+        {
+            self.engine.push_history(message.clone()).await;
+        }
+        self.engine
+            .push_history(ChatMessage::user(format!(
+                "[Conversation summary]\n{summary}"
+            )))
+            .await;
+        let non_system: Vec<&ChatMessage> = snapshot
+            .iter()
+            .filter(|message| message.role != ChatRole::System)
+            .collect();
+        let tail_start = non_system.len().saturating_sub(keep_last);
+        for message in &non_system[tail_start..] {
+            self.engine.push_history((*message).clone()).await;
+        }
+        Ok(())
+    }
 }
 
 /// Drain an onde streaming receiver, forwarding each token to `sink` and
@@ -562,9 +694,82 @@ impl InferenceBackend for OpenAiBackend {
         self.complete(tools, sink).await
     }
 
+    async fn record_cancelled_tool_results(&self, results: Vec<ToolResult>) {
+        let mut history = self.history.lock().await;
+        for result in results {
+            history.push(serde_json::json!({
+                "role": "tool",
+                "tool_call_id": result.tool_call_id,
+                "content": result.content,
+            }));
+        }
+    }
+
     fn is_remote(&self) -> bool {
         true
     }
+
+    async fn history_snapshot(&self) -> Vec<serde_json::Value> {
+        self.history.lock().await.clone()
+    }
+
+    async fn restore_history(&self, history: Vec<serde_json::Value>) {
+        // The snapshot includes the seeded system message, so a wholesale
+        // replacement restores exactly what was saved.
+        *self.history.lock().await = history;
+    }
+
+    async fn compact_history(&self, keep_last: usize) -> Result<(), BackendError> {
+        let snapshot: Vec<serde_json::Value> = self.history.lock().await.clone();
+
+        // Ask the endpoint for a summary of the conversation so far, through
+        // the ordinary completion machinery (non-streaming).
+        self.history
+            .lock()
+            .await
+            .push(serde_json::json!({ "role": "user", "content": SUMMARIZE_PROMPT }));
+        let summary = match self.complete(None, None).await {
+            Ok(result) => result.text,
+            Err(error) => {
+                // Roll back the summarization request; the turn never happened.
+                *self.history.lock().await = snapshot;
+                return Err(error);
+            }
+        };
+
+        let system = snapshot
+            .first()
+            .filter(|message| message["role"] == "system")
+            .cloned();
+        let non_system: Vec<serde_json::Value> = snapshot
+            .iter()
+            .filter(|message| message["role"] != "system")
+            .cloned()
+            .collect();
+        let tail_start = non_system.len().saturating_sub(keep_last);
+        let mut tail = non_system[tail_start..].to_vec();
+        // Drop leading tool results whose assistant tool-call message was
+        // summarized away — strict endpoints reject orphaned `role: "tool"`
+        // entries on the very next request.
+        while tail
+            .first()
+            .is_some_and(|message| message["role"] == "tool")
+        {
+            tail.remove(0);
+        }
+
+        let mut rebuilt = Vec::new();
+        if let Some(system) = system {
+            rebuilt.push(system);
+        }
+        rebuilt.push(serde_json::json!({
+            "role": "user",
+            "content": format!("[Conversation summary]\n{summary}"),
+        }));
+        rebuilt.extend(tail);
+        *self.history.lock().await = rebuilt;
+        Ok(())
+    }
 }
 
 // ── OpenAI response shapes ────────────────────────────────────────────────────────
@@ -727,6 +932,189 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn cancelled_tool_results_close_out_history() {
+        let backend = OpenAiBackend::new("http://localhost", "", "test-model", None);
+        backend
+            .history
+            .lock()
+            .await
+            .push(streamed_assistant_history(
+                "",
+                &[ToolCall {
+                    id: "call_9".to_string(),
+                    name: "run_command".to_string(),
+                    arguments: r#"{"command":"ls"}"#.to_string(),
+                }],
+            ));
+
+        backend
+            .record_cancelled_tool_results(vec![ToolResult {
+                tool_call_id: "call_9".to_string(),
+                content: "cancelled by the user".to_string(),
+            }])
+            .await;
+
+        let history = backend.history.lock().await;
+        let last = history.last().unwrap();
+        assert_eq!(last["role"], "tool");
+        assert_eq!(last["tool_call_id"], "call_9");
+        assert_eq!(last["content"], "cancelled by the user");
+    }
+
+    #[test]
+    fn estimate_tokens_scales_with_serialized_size() {
+        assert_eq!(estimate_tokens(&[]), 0);
+
+        let short = vec![serde_json::json!({ "role": "user", "content": "hi" })];
+        let long = vec![serde_json::json!({ "role": "user", "content": "x".repeat(4_000) })];
+        let short_estimate = estimate_tokens(&short);
+        let long_estimate = estimate_tokens(&long);
+
+        assert!(short_estimate > 0, "non-empty history estimates > 0 tokens");
+        assert!(long_estimate > short_estimate, "longer history costs more");
+        // 4,000 content chars / 4 ≈ 1,000 tokens, plus a little JSON framing.
+        assert!((1_000..1_100).contains(&long_estimate), "{long_estimate}");
+    }
+
+    #[tokio::test]
+    async fn openai_snapshot_restore_round_trips_exactly() {
+        let backend = OpenAiBackend::new("http://localhost", "", "m", Some("be helpful".into()));
+        {
+            let mut history = backend.history.lock().await;
+            history.push(serde_json::json!({ "role": "user", "content": "hello" }));
+            history.push(streamed_assistant_history(
+                "",
+                &[ToolCall {
+                    id: "call_1".to_string(),
+                    name: "read_file".to_string(),
+                    arguments: r#"{"path":"a.rs"}"#.to_string(),
+                }],
+            ));
+            history.push(serde_json::json!({
+                "role": "tool", "tool_call_id": "call_1", "content": "fn main() {}",
+            }));
+            history.push(serde_json::json!({ "role": "assistant", "content": "done" }));
+        }
+        let snapshot = backend.history_snapshot().await;
+        assert_eq!(
+            snapshot[0]["role"], "system",
+            "snapshot keeps the system message"
+        );
+
+        // Restoring into a backend seeded with a *different* system prompt must
+        // replace everything, including that seed.
+        let restored = OpenAiBackend::new("http://localhost", "", "m", Some("other seed".into()));
+        restored.restore_history(snapshot.clone()).await;
+        assert_eq!(restored.history_snapshot().await, snapshot);
+    }
+
+    /// Minimal scripted OpenAI-compatible endpoint: accepts one HTTP request on
+    /// a std listener and answers with a fixed non-streaming completion.
+    fn spawn_completion_stub(summary: &str) -> std::net::SocketAddr {
+        use std::io::{Read, Write};
+
+        let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = listener.local_addr().unwrap();
+        let body = serde_json::json!({
+            "choices": [{ "message": { "role": "assistant", "content": summary } }]
+        })
+        .to_string();
+        std::thread::spawn(move || {
+            let (mut stream, _) = listener.accept().unwrap();
+            // Read until the full request (headers + content-length body) is in.
+            let mut request = Vec::new();
+            let mut chunk = [0u8; 4096];
+            loop {
+                let n = stream.read(&mut chunk).unwrap_or(0);
+                if n == 0 {
+                    break;
+                }
+                request.extend_from_slice(&chunk[..n]);
+                if let Some(headers_end) =
+                    request.windows(4).position(|window| window == b"\r\n\r\n")
+                {
+                    let headers = String::from_utf8_lossy(&request[..headers_end]);
+                    let content_length = headers
+                        .lines()
+                        .find_map(|line| {
+                            line.to_ascii_lowercase()
+                                .strip_prefix("content-length:")
+                                .map(|value| value.trim().parse::<usize>().unwrap_or(0))
+                        })
+                        .unwrap_or(0);
+                    if request.len() >= headers_end + 4 + content_length {
+                        break;
+                    }
+                }
+            }
+            let response = format!(
+                "HTTP/1.1 200 OK\r\ncontent-type: application/json\r\n\
+                 content-length: {}\r\nconnection: close\r\n\r\n{}",
+                body.len(),
+                body
+            );
+            let _ = stream.write_all(response.as_bytes());
+        });
+        addr
+    }
+
+    #[tokio::test]
+    async fn compact_history_rebuilds_system_summary_and_tail() {
+        let addr = spawn_completion_stub("We refactored backend.rs; tests pass.");
+        let backend = OpenAiBackend::new(
+            format!("http://{addr}/v1"),
+            "test-key",
+            "test-model",
+            Some("be helpful".into()),
+        );
+        {
+            let mut history = backend.history.lock().await;
+            for i in 0..5 {
+                let role = if i % 2 == 0 { "user" } else { "assistant" };
+                history.push(serde_json::json!({
+                    "role": role, "content": format!("message {i}"),
+                }));
+            }
+        }
+
+        backend.compact_history(2).await.unwrap();
+
+        let history = backend.history_snapshot().await;
+        assert_eq!(history.len(), 4, "system + summary + last 2: {history:?}");
+        assert_eq!(history[0]["role"], "system");
+        assert_eq!(history[0]["content"], "be helpful");
+        assert_eq!(history[1]["role"], "user");
+        let summary_text = history[1]["content"].as_str().unwrap();
+        assert!(summary_text.starts_with("[Conversation summary]\n"));
+        assert!(summary_text.contains("We refactored backend.rs; tests pass."));
+        assert_eq!(
+            history[2],
+            serde_json::json!({ "role": "assistant", "content": "message 3" })
+        );
+        assert_eq!(
+            history[3],
+            serde_json::json!({ "role": "user", "content": "message 4" })
+        );
+    }
+
+    #[tokio::test]
+    async fn compact_history_failure_leaves_history_intact() {
+        // No listener at this address: the summarization request fails, and
+        // history must roll back to exactly what it was.
+        let backend =
+            OpenAiBackend::new("http://127.0.0.1:9", "", "test-model", Some("sys".into()));
+        backend
+            .history
+            .lock()
+            .await
+            .push(serde_json::json!({ "role": "user", "content": "hello" }));
+        let before = backend.history_snapshot().await;
+
+        assert!(backend.compact_history(2).await.is_err());
+        assert_eq!(backend.history_snapshot().await, before);
+    }
+
     #[test]
     fn assistant_message_with_tool_calls_round_trips() {
         let message = ResponseMessage {