sigit-code 1.5.7__tar.gz → 1.5.9__tar.gz

{sigit_code-1.5.7 → sigit_code-1.5.9}/.agents/skills/sigit-code-release/SKILL.md

@@ -35,6 +35,7 @@ Use this skill when preparing a release for this repository.
 - The crate is published to crates.io (`release-crates.yml`) and the Homebrew tap is updated (`release-homebrew.yml`) as part of the tag-driven flow. Per the siGit release flow, Homebrew is auto-triggered — do not dispatch it manually.
 - `release-github.yml` builds the binaries, attaches them (plus a `.deb`/`.rpm` per Linux target built with nfpm from `packaging/nfpm.yaml`) to the GitHub release, then dispatches `release-homebrew`, `release-scoop`, `release-winget`, and `release-aur`. A dispatch failure in any one of those four is logged as a warning, not a hard failure — an unconfigured channel doesn't block the rest of the release. `release-nuget.yml` and `release-mcp-registry.yml`, by contrast, are tag-triggered directly like the other language-registry workflows, not dispatched from `release-github.yml`.
 - Every release asset carries a `.sha256` sidecar (not just the macOS Homebrew tarball). Scoop, winget, and the AUR PKGBUILD each consume the raw binaries plus their sidecar checksum, rather than the tarball.
+- The GitHub release body is generated, not hand-written: `release-github.yml`'s release job checks out the tag, awk-extracts the `## <version>` section from `CHANGELOG.md` (a missing section is a hard failure), appends a full-changelog link and a `sigit.si/code` footnote, and publishes it via `body_path: release_notes.md`. The only file a release-prep change needs to touch is `CHANGELOG.md` — never edit release notes in the GitHub UI, because the next tag push would overwrite them.
 - npm and NuGet publish via OIDC trusted publishing — neither has a stored token in the repo. On npm this is configured per package (each `@getsigit/*` name has a trusted publisher pointing at `release-npm.yml`), so a new package needs the same setup before its first publish will work. OIDC requires npm >= 11.5.1 and Node >= 22.14.0.
 - The NuGet package (`SiGit.Code`, `dotnet tool install --global SiGit.Code`) bundles all six platform binaries under `native/<os>-<arch>/` behind a managed shim, rather than shipping one package per platform like npm/PyPI. Watch the nuget.org 250 MB package-size limit if it ever grows.
 - The baked-in official MCP server is separately listed in the public MCP Registry as `si.sigit/sigit` (`release-mcp-registry.yml`, driven by `server.json` at the repo root). It's a remote Streamable-HTTP listing, so it's verified by a DNS TXT record on the `sigit.si` domain rather than the GitHub-OIDC scheme used for package listings.

{sigit_code-1.5.7 → sigit_code-1.5.9}/.claude/skills/sigit-code-release/SKILL.md

@@ -35,6 +35,7 @@ Use this skill when preparing a release for this repository.
 - The crate is published to crates.io (`release-crates.yml`) and the Homebrew tap is updated (`release-homebrew.yml`) as part of the tag-driven flow. Per the siGit release flow, Homebrew is auto-triggered — do not dispatch it manually.
 - `release-github.yml` builds the binaries, attaches them (plus a `.deb`/`.rpm` per Linux target built with nfpm from `packaging/nfpm.yaml`) to the GitHub release, then dispatches `release-homebrew`, `release-scoop`, `release-winget`, and `release-aur`. A dispatch failure in any one of those four is logged as a warning, not a hard failure — an unconfigured channel doesn't block the rest of the release. `release-nuget.yml` and `release-mcp-registry.yml`, by contrast, are tag-triggered directly like the other language-registry workflows, not dispatched from `release-github.yml`.
 - Every release asset carries a `.sha256` sidecar (not just the macOS Homebrew tarball). Scoop, winget, and the AUR PKGBUILD each consume the raw binaries plus their sidecar checksum, rather than the tarball.
+- The GitHub release body is generated, not hand-written: `release-github.yml`'s release job checks out the tag, awk-extracts the `## <version>` section from `CHANGELOG.md` (a missing section is a hard failure), appends a full-changelog link and a `sigit.si/code` footnote, and publishes it via `body_path: release_notes.md`. The only file a release-prep change needs to touch is `CHANGELOG.md` — never edit release notes in the GitHub UI, because the next tag push would overwrite them.
 - npm and NuGet publish via OIDC trusted publishing — neither has a stored token in the repo. On npm this is configured per package (each `@getsigit/*` name has a trusted publisher pointing at `release-npm.yml`), so a new package needs the same setup before its first publish will work. OIDC requires npm >= 11.5.1 and Node >= 22.14.0.
 - The NuGet package (`SiGit.Code`, `dotnet tool install --global SiGit.Code`) bundles all six platform binaries under `native/<os>-<arch>/` behind a managed shim, rather than shipping one package per platform like npm/PyPI. Watch the nuget.org 250 MB package-size limit if it ever grows.
 - The baked-in official MCP server is separately listed in the public MCP Registry as `si.sigit/sigit` (`release-mcp-registry.yml`, driven by `server.json` at the repo root). It's a remote Streamable-HTTP listing, so it's verified by a DNS TXT record on the `sigit.si` domain rather than the GitHub-OIDC scheme used for package listings.

{sigit_code-1.5.7 → sigit_code-1.5.9}/.github/workflows/release-github.yml

@@ -240,6 +240,41 @@ jobs:
             echo "tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
           fi
 
+      - name: Checkout tag
+        # The release job otherwise only downloads artifacts; the changelog
+        # has to be read from the tree at the tag being released.
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ steps.tag.outputs.tag }}
+
+      - name: Compose release notes
+        # The release page carries the section of CHANGELOG.md for this
+        # version, not a bare "Full changelog" default. A missing section is
+        # a hard failure: publishing a release whose notes don't match its
+        # changelog is worse than stopping the job.
+        shell: bash
+        run: |
+          version="${{ steps.tag.outputs.tag }}"
+          version="${version#v}"
+          section="$(awk -v ver="${version}" '
+            $0 == "## " ver { found = 1; next }
+            found && /^## / { exit }
+            found { print }
+          ' CHANGELOG.md)"
+          if [ -z "${section//[$' \t\n']/}" ]; then
+            echo "No ## ${version} section found in CHANGELOG.md" >&2
+            exit 1
+          fi
+          {
+            printf '%s\n' "${section}"
+            printf '\n---\n\n'
+            printf 'Full changelog: https://github.com/%s/blob/%s/CHANGELOG.md\n' \
+              "${GITHUB_REPOSITORY}" "${{ steps.tag.outputs.tag }}"
+            printf '\n---\n\n'
+            printf 'About siGit Code: [sigit.si/code](https://sigit.si/code)\n'
+          } > release_notes.md
+          cat release_notes.md
+
       - name: Download binary artifacts
         uses: actions/download-artifact@v4
         with:
@@ -258,6 +293,7 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ steps.tag.outputs.tag }}
+          body_path: release_notes.md
           files: release/*
 
       # These channels all publish somewhere outside this repo (a tap, a Scoop

{sigit_code-1.5.7 → sigit_code-1.5.9}/CHANGELOG.md

@@ -1,5 +1,109 @@
 # Changelog
 
+## 1.5.9
+
+### Fixed
+
+- **Kimi K3 tool calls no longer arrive as raw protocol text.** Kimi K3 renders
+  a call in Moonshot's XTML protocol — pipe-delimited open/sep/close tokens
+  wrapping named blocks — and when the serving stack doesn't parse that back
+  into structured tool calls, the whole block surfaced in the editor as literal
+  text and the turn ended as though the model had answered in prose. The
+  inline-call recovery now speaks that protocol alongside the legacy XML tags:
+  tools blocks are parsed into real calls (several per block, argument values
+  decoded and typed from the block's own type attribute or, when it is
+  missing, the turn's tool schemas), response blocks are unwrapped so their
+  text still renders, and think blocks are dropped as private reasoning rather
+  than shown. The streaming scanner watches all the opening markers, so a
+  block split across chunk boundaries still recovers
+- **GLM's mis-tagged calls recover too.** GLM sometimes precedes the legacy
+  block's first argument key with another tool-call opening tag instead of the
+  arg-key opening tag the format calls for, and the recovery rejected the
+  whole block when it did — the call surfaced as text and whatever it was
+  trying to do was dropped. The parser now accepts that alias for the first
+  argument only — later arguments stay strict, so text that merely resembles a
+  call cannot be recovered as one — in both the whole-blob and streaming
+  paths, and the scanner tolerates the malformed marker split across chunk
+  boundaries. Recovery in both protocols also checks the call's name against
+  the tools actually offered in the turn: a tag naming a tool that was never
+  in the turn's spec stays on screen instead of being executed
+
+## 1.5.8
+
+### What changed
+
+- **Editor panels can switch permission mode without a slash command.** ACP
+  clients now get a Permissions selector next to the model controls with
+  Manual, Auto, and Plan choices for the current session. Manual keeps the
+  existing approval prompts, Auto lets mutating tools run unattended while
+  still respecting explicit deny rules in `settings.toml`, and Plan keeps the
+  agent in research-only mode. The selector follows `/plan` and `/clear`, and
+  it is deliberately session-scoped so a risky Auto choice does not persist
+  into the next task
+- **Tool calls in the editor are worth opening now.** Zed only drew the
+  disclosure arrow on the handful of cards siGit set `content` on — the model
+  download and switch spinners — because everything else carried nothing but
+  `rawInput` and `rawOutput`, fields ACP gives clients no display guidance for.
+  Every tool call now gets a fenced content block: the pretty-printed arguments
+  while it runs, then the tool's output once it finishes, with a `(no output)`
+  placeholder for a silent command like `git add`. Cards are titled
+  `<tool> · <arg>` rather than the bare tool name, path-bearing tools set
+  `locations` so the editor can follow along, and a replayed session gets the
+  same treatment as a live one
+- **The context window is visible before compaction fires.** Both model pickers
+  show each model's window, and the TUI title bar has a gauge for how much of
+  it the conversation is using. Cloud tiers report their own window instead of
+  the compaction budget — the budget is when siGit Code summarizes history, not
+  how much the model can hold, and labelling one with the other understated the
+  window by an order of magnitude
+- **`write_todos` renders as a plan, not a tool card.** Zed and other clients
+  have real progress UI for `session/update` plans, so the model's todo list
+  goes there
+- **Picker changes read as status rather than chat.** Switching model or
+  inference backend is UI state, so it renders as a completed think-kind tool
+  call. The sign-in prompt stays an assistant message, since it needs the user
+  to act on it
+
+### Fixed
+
+- **A reopened thread comes back with its history.** Clicking a saved thread in
+  Zed sends `session/load`, and the client draws the thread purely from the
+  `session/update` notifications the agent streams while that request is in
+  flight. siGit restored the saved history into the backend, which is what
+  makes the model remember, but sent the client nothing — so the thread opened
+  empty and looked like a brand new conversation. The snapshot is now turned
+  into updates before it is restored: user and assistant text as message chunks
+  with reasoning stripped, each tool call completed with its result folded in,
+  and `write_todos` as a plan the way it renders live. System messages stay
+  out, since they seeded the model and were never on screen
+- **Compaction no longer fails in every session that ran a tool.**
+  `compact_history` asked for the summary through `complete(None, None)`, which
+  sends no tools array but left the live history in place. That history is
+  thick with assistant `tool_calls` and `role: "tool"` messages, and an
+  endpoint handed tool shapes with no schema to check them against rejects the
+  request — Anthropic answers 400. So compaction failed on every attempt in any
+  session that had run a single tool, however small the history was, and then
+  retried on every prompt and tool round while that history kept growing. The
+  conversation now goes as a flattened transcript in one user message, which
+  keeps what the summary needs and drops the shapes that only mean anything
+  next to a tool schema
+- **A tool call emitted as text is no longer dropped.** Qwen 3, GLM and
+  DeepSeek write a call as `<tool_call>NAME<arg_key>…` in their chat template
+  and rely on the serving stack to parse it back into `tool_calls`. When that
+  doesn't happen the tag arrives as ordinary content, so it was rendered
+  verbatim in the editor and the turn ended as though the model had chosen to
+  answer in prose. Both the streaming and non-streaming paths now scan content
+  for those blocks and turn well-formed ones back into real calls, typing
+  argument values from the turn's own tool schemas. The streaming scanner holds
+  back only enough text to catch a tag straddling a chunk boundary, so ordinary
+  answers still stream token by token. A block that doesn't match the expected
+  shape is left in the text untouched: reissuing a `run_command` is cheap, but
+  guessing wrong at a half-parsed `edit_file` would write the wrong change to a
+  file
+- **Tool-call content survives awkward output.** Whitespace-only output is
+  preserved rather than collapsed, malformed arguments no longer get a
+  misleading JSON fence, and fence language identifiers are sanitized
+
 ## 1.5.7
 
 ### What changed

{sigit_code-1.5.7 → sigit_code-1.5.9}/Cargo.lock

@@ -5778,7 +5778,7 @@ checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "sigit"
-version = "1.5.7"
+version = "1.5.9"
 dependencies = [
  "agent-client-protocol",
  "anyhow",

{sigit_code-1.5.7 → sigit_code-1.5.9}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sigit"
-version = "1.5.7"
+version = "1.5.9"
 edition = "2024"
 description = "siGit Code — ACP-compatible AI coding agent. Sí, git."
 documentation = "https://github.com/getsigit/sigit"

{sigit_code-1.5.7 → sigit_code-1.5.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sigit-code
-Version: 1.5.7
+Version: 1.5.9
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers

{sigit_code-1.5.7 → sigit_code-1.5.9}/src/backend.rs

@@ -28,7 +28,8 @@ use tokio::sync::Mutex;
 // ── Neutral types ───────────────────────────────────────────────────────────────
 
 /// A tool the model may call, in a provider-neutral form. `parameters_schema` is
-/// a JSON Schema encoded as a string (matching how siGit already declares tools).
+/// a JSON Schema encoded as a string (matching how siGit Code already declares
+/// tools).
 #[derive(Debug, Clone)]
 pub struct ToolSpec {
     pub name: String,
@@ -75,6 +76,51 @@ pub const COMPACT_KEEP_LAST: usize = 6;
 const SUMMARIZE_PROMPT: &str = "Summarize this coding session so far: decisions made, \
     files touched, current state, open items. Be concise and factual.";
 
+/// Render a history snapshot as a plain-text transcript, with tool calls and
+/// tool results spelled out as prose rather than left in their wire shapes.
+///
+/// Compaction summarizes a conversation that is, by definition, thick with
+/// `tool_calls` and `role: "tool"` messages — but the summarization round asks
+/// for a plain answer and so sends no `tools` array. Forwarding the raw shapes
+/// in that request produces tool blocks with no schema to validate against,
+/// which strict endpoints reject outright: Anthropic answers 400, so every
+/// compaction of a session that had ever run a tool failed, permanently, no
+/// matter how small the history was. Flattening to text keeps everything the
+/// summary actually needs and drops the shapes that only make sense alongside
+/// a tool schema. It also sidesteps orphaned `tool_call_id`s and role-
+/// alternation rules, neither of which a transcript can violate.
+fn transcript_for_summary(history: &[serde_json::Value]) -> String {
+    let mut lines: Vec<String> = Vec::new();
+    for message in history {
+        let role = message["role"].as_str().unwrap_or("user");
+        // The system prompt is carried over verbatim, so it needn't be summarized.
+        if role == "system" {
+            continue;
+        }
+
+        let mut parts: Vec<String> = Vec::new();
+        if let Some(text) = message["content"].as_str()
+            && !text.trim().is_empty()
+        {
+            parts.push(text.to_string());
+        }
+        for call in message["tool_calls"].as_array().into_iter().flatten() {
+            parts.push(format!(
+                "called {}({})",
+                call["function"]["name"].as_str().unwrap_or("tool"),
+                call["function"]["arguments"].as_str().unwrap_or_default(),
+            ));
+        }
+        if parts.is_empty() {
+            continue;
+        }
+
+        let label = if role == "tool" { "tool result" } else { role };
+        lines.push(format!("{label}: {}", parts.join("\n")));
+    }
+    lines.join("\n\n")
+}
+
 /// Crude token estimate for a history snapshot: serialized characters / 4.
 /// Deliberately model-agnostic — it only needs to be in the right ballpark to
 /// decide when compaction is worth an extra inference round.
@@ -482,15 +528,22 @@ impl OpenAiBackend {
             return Err(describe_api_error(status, &body));
         }
 
+        // The specs are needed downstream to type the arguments of any tool
+        // call the model emitted as text rather than as a structured call.
+        let tools = tools.unwrap_or(&[]);
         if let Some(sink) = sink {
-            self.consume_stream(response, sink).await
+            self.consume_stream(response, sink, tools).await
         } else {
-            self.consume_json(response).await
+            self.consume_json(response, tools).await
         }
     }
 
     /// Parse a single non-streaming chat-completion response.
-    async fn consume_json(&self, response: reqwest::Response) -> Result<TurnResult, BackendError> {
+    async fn consume_json(
+        &self,
+        response: reqwest::Response,
+        tools: &[ToolSpec],
+    ) -> Result<TurnResult, BackendError> {
         let parsed: ChatCompletion = response
             .json()
             .await
@@ -515,6 +568,41 @@ impl OpenAiBackend {
             })
             .collect();
 
+        // Some models write a tool call out as literal `<tool_call>` text
+        // instead of using the structured field (see `inline_tool_calls`).
+        // Recover it, or the turn ends with the tag rendered as prose and
+        // whatever the model meant to do is dropped.
+        if tool_calls.is_empty() {
+            let (cleaned, recovered) = crate::inline_tool_calls::extract(&text, tools);
+            if !recovered.is_empty() {
+                log::warn!(
+                    "recovered {} tool call(s) the model emitted as text instead of a structured call",
+                    recovered.len()
+                );
+                let tool_calls: Vec<ToolCall> = recovered
+                    .into_iter()
+                    .enumerate()
+                    .map(|(index, call)| ToolCall {
+                        id: format!("call_recovered_{index}"),
+                        name: call.name,
+                        arguments: call.arguments,
+                    })
+                    .collect();
+                // Record the recovered shape, not the raw tag: the tool
+                // results that follow have to answer an assistant message
+                // that actually carries these calls, or the next request is
+                // rejected for orphaned tool results.
+                self.history
+                    .lock()
+                    .await
+                    .push(streamed_assistant_history(&cleaned, &tool_calls));
+                return Ok(TurnResult {
+                    text: cleaned,
+                    tool_calls,
+                });
+            }
+        }
+
         // Record the assistant turn so later tool results have context.
         self.history.lock().await.push(message.into_history_value());
 
@@ -528,6 +616,7 @@ impl OpenAiBackend {
         &self,
         response: reqwest::Response,
         sink: &TokenSink,
+        tools: &[ToolSpec],
     ) -> Result<TurnResult, BackendError> {
         use futures::StreamExt;
 
@@ -538,6 +627,13 @@ impl OpenAiBackend {
         let mut text = String::new();
         let mut tool_accum: Vec<StreamingToolCall> = Vec::new();
         let mut done = false;
+        // Recovers a tool call the model wrote as literal `<tool_call>` text
+        // instead of a structured delta. Scanning here (rather than after the
+        // stream) keeps the tag off the UI: content goes straight to `sink` as
+        // it arrives, so by the time a whole turn is assembled the tag has
+        // already been rendered. See `inline_tool_calls`.
+        let mut scanner = crate::inline_tool_calls::StreamScanner::new(tools);
+        let mut recovered: Vec<ToolCall> = Vec::new();
 
         while let Some(item) = stream.next().await {
             let bytes = item.map_err(|error| format!("stream read error: {error}"))?;
@@ -583,9 +679,31 @@ impl OpenAiBackend {
                 if let Some(content) = choice.delta.content
                     && !content.is_empty()
                 {
-                    text.push_str(&content);
-                    if sink.send(content).is_err() {
-                        // Consumer dropped (turn cancelled) — stop reading.
+                    let mut cancelled = false;
+                    for event in scanner.push(&content) {
+                        match event {
+                            crate::inline_tool_calls::ScanEvent::Text(chunk) => {
+                                text.push_str(&chunk);
+                                if sink.send(chunk).is_err() {
+                                    // Consumer dropped (turn cancelled).
+                                    cancelled = true;
+                                    break;
+                                }
+                            }
+                            crate::inline_tool_calls::ScanEvent::ToolCall(call) => {
+                                log::warn!(
+                                    "recovered tool call '{}' the model emitted as text instead of a structured call",
+                                    call.name
+                                );
+                                recovered.push(ToolCall {
+                                    id: format!("call_recovered_{}", recovered.len()),
+                                    name: call.name,
+                                    arguments: call.arguments,
+                                });
+                            }
+                        }
+                    }
+                    if cancelled {
                         done = true;
                         break;
                     }
@@ -615,7 +733,13 @@ impl OpenAiBackend {
             }
         }
 
-        let tool_calls: Vec<ToolCall> = tool_accum
+        // Text held back waiting on a tag that never closed is just text.
+        if let Some(leftover) = scanner.take_pending() {
+            text.push_str(&leftover);
+            let _ = sink.send(leftover);
+        }
+
+        let mut tool_calls: Vec<ToolCall> = tool_accum
             .iter()
             .filter(|call| !call.name.is_empty())
             .enumerate()
@@ -629,6 +753,7 @@ impl OpenAiBackend {
                 arguments: call.arguments.clone(),
             })
             .collect();
+        tool_calls.extend(recovered);
 
         // Record the assistant turn so later tool results have context.
         self.history
@@ -738,12 +863,30 @@ impl InferenceBackend for OpenAiBackend {
     async fn compact_history(&self, keep_last: usize) -> Result<(), BackendError> {
         let snapshot: Vec<serde_json::Value> = self.history.lock().await.clone();
 
-        // Ask the endpoint for a summary of the conversation so far, through
-        // the ordinary completion machinery (non-streaming).
-        self.history
-            .lock()
-            .await
-            .push(serde_json::json!({ "role": "user", "content": SUMMARIZE_PROMPT }));
+        let system = snapshot
+            .first()
+            .filter(|message| message["role"] == "system")
+            .cloned();
+
+        // Ask the endpoint for a summary of the conversation so far, through the
+        // ordinary completion machinery (non-streaming). The request carries the
+        // conversation as a flattened transcript in a single user message rather
+        // than the live history: this round offers no tools, and a tool-shaped
+        // history sent without a tool schema is rejected upstream (see
+        // `transcript_for_summary`).
+        let mut request = Vec::new();
+        if let Some(system) = system.clone() {
+            request.push(system);
+        }
+        request.push(serde_json::json!({
+            "role": "user",
+            "content": format!(
+                "{}\n\n{SUMMARIZE_PROMPT}",
+                transcript_for_summary(&snapshot),
+            ),
+        }));
+        *self.history.lock().await = request;
+
         let summary = match self.complete(None, None).await {
             Ok(result) => result.text,
             Err(error) => {
@@ -753,10 +896,6 @@ impl InferenceBackend for OpenAiBackend {
             }
         };
 
-        let system = snapshot
-            .first()
-            .filter(|message| message["role"] == "system")
-            .cloned();
         let non_system: Vec<serde_json::Value> = snapshot
             .iter()
             .filter(|message| message["role"] != "system")
@@ -1342,12 +1481,16 @@ mod tests {
     }
 
     /// Minimal scripted OpenAI-compatible endpoint: accepts one HTTP request on
-    /// a std listener and answers with a fixed non-streaming completion.
-    fn spawn_completion_stub(summary: &str) -> std::net::SocketAddr {
+    /// a std listener and answers with a fixed non-streaming completion. The
+    /// receiver yields the request body the backend actually put on the wire.
+    fn spawn_completion_stub(
+        summary: &str,
+    ) -> (std::net::SocketAddr, std::sync::mpsc::Receiver<String>) {
         use std::io::{Read, Write};
 
         let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
         let addr = listener.local_addr().unwrap();
+        let (sender, receiver) = std::sync::mpsc::channel();
         let body = serde_json::json!({
             "choices": [{ "message": { "role": "assistant", "content": summary } }]
         })
@@ -1376,6 +1519,9 @@ mod tests {
                         })
                         .unwrap_or(0);
                     if request.len() >= headers_end + 4 + content_length {
+                        let _ = sender.send(
+                            String::from_utf8_lossy(&request[headers_end + 4..]).into_owned(),
+                        );
                         break;
                     }
                 }
@@ -1388,12 +1534,12 @@ mod tests {
             );
             let _ = stream.write_all(response.as_bytes());
         });
-        addr
+        (addr, receiver)
     }
 
     #[tokio::test]
     async fn compact_history_rebuilds_system_summary_and_tail() {
-        let addr = spawn_completion_stub("We refactored backend.rs; tests pass.");
+        let (addr, _requests) = spawn_completion_stub("We refactored backend.rs; tests pass.");
         let backend = OpenAiBackend::new(
             format!("http://{addr}/v1"),
             "test-key",
@@ -1430,6 +1576,66 @@ mod tests {
         );
     }
 
+    /// Compacting a tool-heavy session must not put tool shapes on the wire.
+    /// The summarization round offers no `tools`, and endpoints reject tool
+    /// calls and tool results that arrive without a schema — which used to make
+    /// compaction fail forever in any session that had run a single tool.
+    #[tokio::test]
+    async fn compact_history_sends_no_tool_artifacts() {
+        let (addr, requests) = spawn_completion_stub("Ran git status on main.");
+        let backend = OpenAiBackend::new(
+            format!("http://{addr}/v1"),
+            "test-key",
+            "test-model",
+            Some("be helpful".into()),
+        );
+        {
+            let mut history = backend.history.lock().await;
+            history.push(serde_json::json!({ "role": "user", "content": "check the repo" }));
+            history.push(serde_json::json!({
+                "role": "assistant",
+                "content": null,
+                "tool_calls": [{
+                    "id": "call_1",
+                    "type": "function",
+                    "function": { "name": "run_command", "arguments": "{\"command\":\"git status\"}" },
+                }],
+            }));
+            history.push(serde_json::json!({
+                "role": "tool",
+                "tool_call_id": "call_1",
+                "content": "on branch main",
+            }));
+        }
+
+        backend.compact_history(2).await.unwrap();
+
+        let body: serde_json::Value =
+            serde_json::from_str(&requests.recv().unwrap()).expect("request body is JSON");
+        assert!(
+            body.get("tools").is_none(),
+            "summarization offers no tools: {body}"
+        );
+        for message in body["messages"].as_array().unwrap() {
+            assert!(
+                message.get("tool_calls").is_none(),
+                "no tool_calls may be sent without a schema: {message}"
+            );
+            assert_ne!(
+                message["role"], "tool",
+                "no tool results may be sent without a schema: {message}"
+            );
+        }
+
+        // The tool round still has to survive into the summary request as prose,
+        // or the summary loses the work the session actually did.
+        let transcript = body["messages"].as_array().unwrap().last().unwrap()["content"]
+            .as_str()
+            .unwrap();
+        assert!(transcript.contains("called run_command({\"command\":\"git status\"})"));
+        assert!(transcript.contains("tool result: on branch main"));
+    }
+
     #[tokio::test]
     async fn compact_history_failure_leaves_history_intact() {
         // No listener at this address: the summarization request fails, and