sigit-code 1.6.2__tar.gz → 1.6.4__tar.gz

{sigit_code-1.6.2 → sigit_code-1.6.4}/.agents/AGENTS.md

@@ -113,9 +113,20 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
 - **`src/main.rs`** — entry point, mode dispatch, the full ACP `Agent` impl (session lifecycle:
   new/load/fork/prompt/cancel, config options, slash-command advertisement), and the `SYSTEM_PROMPT`.
   ACP session state owns its roots, conversation, and selected model even though the process has
-  one live backend; activating a thread parks and restores all three. Unknown session ids are
-  rejected instead of silently borrowing the active thread's cwd. Prompt cancellation is routed
-  outside `turn_lock`, which lets a client cancel the turn currently holding that lock. The
+  one working directory and one live backend slot; activating a thread parks and restores all
+  three. A thread on an HTTP backend keeps a backend of its own (`InferenceBackend::fresh`,
+  `SessionState::remote`), so its turn can wait on the endpoint while another thread is
+  installed. Unknown session ids are rejected instead of silently borrowing the active thread's
+  cwd. Prompt cancellation takes no lock, which lets a client cancel a turn whatever it holds.
+  `session/load` and `session/resume` share `restore_session`; the only difference is that
+  resume must not replay the history as `session/update`. `session/close` is the one place a
+  `SessionState` is dropped. It runs in two halves: `begin_close` signals the session's turn
+  from the dispatch loop (the turn holds the session's lock, so the signal cannot wait for it) and
+  marks the id in `closing_sessions`, which makes `handle_prompt` cancel a prompt that was
+  still queued; `handle_close_session` then runs under the session and workspace locks and
+  removes the state, the permission grants and the background commands
+  (`tools::kill_session_tasks`). It leaves `session_store` alone, so a closed thread still lists
+  and reopens. The
   `SYSTEM_PROMPT` bakes in smbCloud-specific context the agent should use when the repo is clearly
   smbCloud, and stay general otherwise.
 - **`src/backend.rs`** — the `InferenceBackend` trait and neutral types (`ToolSpec`, `ToolCall`,
@@ -268,10 +279,21 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   announced, because it sets the announced status: a call that will ask starts `pending`, the
   permission request carries that call's own id, and an `in_progress` update follows approval.
   That update also puts the card's title back, since the permission request overwrites it
-  with the full arguments. Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
-  serialized by `SiGitAgent::turn_lock` so the dispatch loop can route the client's permission
-  answer mid-turn — don't move them back inline, and don't await client requests from inline
-  handlers (deadlock).
+  with the full arguments. The Manual/Auto/Plan choice reaches an ACP client twice: as the
+  `sigit-permission-mode` config option, and as session `modes` with `session/set_mode`, which
+  the spec is retiring but some clients still render instead. Both are built from
+  `PERMISSION_MODES` in `main.rs` and read the same state, so whatever changes the mode has to
+  refresh both (`ConfigOptionUpdate` and `send_current_mode`). Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
+  so the dispatch loop can route the client's permission answer mid-turn — don't move them back
+  inline, and don't await client requests from inline handlers (deadlock). Two locks order them.
+  A per-session lock (`SiGitAgent::session_lock`) is held for a whole request, so requests on one
+  thread keep their order. `SiGitAgent::workspace_lock` guards what a session installs
+  process-wide (cwd, workspace roots, session MCP servers, the live backend slot, the engine's
+  conversation); lifecycle and config handlers hold it throughout, and `handle_prompt` holds it
+  through a `WorkspaceHold` that it releases while waiting on an HTTP endpoint or a permission
+  answer and retakes (reinstalling its session via `resume_workspace`) before any tool runs. An
+  on-device turn never releases it. Take the session lock first, never the other way round. Tool
+  execution, subagents included, still runs one session at a time.
 - **`src/instructions.rs`** — project instruction files, the always-on counterpart to skills.
   Reads `AGENTS.md` (the cross-tool [agents.md](https://agents.md) standard) and `CLAUDE.md`,
   walking from the session cwd up to the repo root (nearest ancestor with `.git`, never above it),
@@ -337,6 +359,10 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   those read env vars once at init.
 - **`src/account.rs`** — siGit Code Cloud auth (`/login`, `/logout`, `/whoami`); authenticates
   against the account API and stores a session token. Performs no console I/O.
+  ACP `logout` (the editor's sign out button, shown only because `handle_initialize` advertises
+  `agentCapabilities.auth.logout`) and `/logout` both go through `SiGitAgent::sign_out` in
+  `main.rs`. The request names no session, so `leave_cloud` moves the parked threads off their
+  cloud tier along with the live one and each of them gets a fresh model picker.
 - **`src/browser_auth.rs`** — browser sign-in, the path the editor's "Sign in to siGit Code"
   button takes. sigit is a public OAuth client (client id `sigit-code-cli`, no secret, PKCE
   S256) against the authorization server at `$SIGIT_API_URL/oauth`. Two ways the code gets

{sigit_code-1.6.2/.claude → sigit_code-1.6.4/.agents}/skills/agent-client-protocol/SKILL.md

@@ -205,6 +205,7 @@ the connection and the agent anymore. Don't reintroduce the mpsc forwarder patte
 | `ListSessionsRequest` | `handle_list_sessions` | the editor's "Import Threads" picker; gated by `SessionListCapabilities` |
 | `PromptRequest` | `handle_prompt` | the turn: parse blocks → slash commands or tool-calling loop |
 | `SetSessionConfigOptionRequest` | `handle_set_session_config_option` | the Zed model picker — switches/downloads models |
+| `SetSessionModeRequest` | `handle_set_session_mode` | legacy mode selector; same Manual/Auto/Plan state as the Permissions config option |
 | `CancelNotification` | `handle_cancel` | notification, no response |
 
 Everything else is left to the SDK default (method not found).

{sigit_code-1.6.2/.agents → sigit_code-1.6.4/.claude}/skills/agent-client-protocol/SKILL.md

@@ -205,6 +205,7 @@ the connection and the agent anymore. Don't reintroduce the mpsc forwarder patte
 | `ListSessionsRequest` | `handle_list_sessions` | the editor's "Import Threads" picker; gated by `SessionListCapabilities` |
 | `PromptRequest` | `handle_prompt` | the turn: parse blocks → slash commands or tool-calling loop |
 | `SetSessionConfigOptionRequest` | `handle_set_session_config_option` | the Zed model picker — switches/downloads models |
+| `SetSessionModeRequest` | `handle_set_session_mode` | legacy mode selector; same Manual/Auto/Plan state as the Permissions config option |
 | `CancelNotification` | `handle_cancel` | notification, no response |
 
 Everything else is left to the SDK default (method not found).

sigit_code-1.6.4/.sigit/code-cloud-agent/config.toml

@@ -0,0 +1,6 @@
+[pull_request]
+base = "development"
+branch_prefix = "feature"
+
+[agent]
+max_tool_rounds = 60

sigit_code-1.6.4/.sigit/code-review/config.toml

@@ -0,0 +1,3 @@
+[review.reviewer_skill]
+name = "sigit-code-review-inner-loop"
+version = "1.0.0"

{sigit_code-1.6.2 → sigit_code-1.6.4}/AGENTS.md

@@ -113,9 +113,20 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
 - **`src/main.rs`** — entry point, mode dispatch, the full ACP `Agent` impl (session lifecycle:
   new/load/fork/prompt/cancel, config options, slash-command advertisement), and the `SYSTEM_PROMPT`.
   ACP session state owns its roots, conversation, and selected model even though the process has
-  one live backend; activating a thread parks and restores all three. Unknown session ids are
-  rejected instead of silently borrowing the active thread's cwd. Prompt cancellation is routed
-  outside `turn_lock`, which lets a client cancel the turn currently holding that lock. The
+  one working directory and one live backend slot; activating a thread parks and restores all
+  three. A thread on an HTTP backend keeps a backend of its own (`InferenceBackend::fresh`,
+  `SessionState::remote`), so its turn can wait on the endpoint while another thread is
+  installed. Unknown session ids are rejected instead of silently borrowing the active thread's
+  cwd. Prompt cancellation takes no lock, which lets a client cancel a turn whatever it holds.
+  `session/load` and `session/resume` share `restore_session`; the only difference is that
+  resume must not replay the history as `session/update`. `session/close` is the one place a
+  `SessionState` is dropped. It runs in two halves: `begin_close` signals the session's turn
+  from the dispatch loop (the turn holds the session's lock, so the signal cannot wait for it) and
+  marks the id in `closing_sessions`, which makes `handle_prompt` cancel a prompt that was
+  still queued; `handle_close_session` then runs under the session and workspace locks and
+  removes the state, the permission grants and the background commands
+  (`tools::kill_session_tasks`). It leaves `session_store` alone, so a closed thread still lists
+  and reopens. The
   `SYSTEM_PROMPT` bakes in smbCloud-specific context the agent should use when the repo is clearly
   smbCloud, and stay general otherwise.
 - **`src/backend.rs`** — the `InferenceBackend` trait and neutral types (`ToolSpec`, `ToolCall`,
@@ -268,10 +279,21 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   announced, because it sets the announced status: a call that will ask starts `pending`, the
   permission request carries that call's own id, and an `in_progress` update follows approval.
   That update also puts the card's title back, since the permission request overwrites it
-  with the full arguments. Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
-  serialized by `SiGitAgent::turn_lock` so the dispatch loop can route the client's permission
-  answer mid-turn — don't move them back inline, and don't await client requests from inline
-  handlers (deadlock).
+  with the full arguments. The Manual/Auto/Plan choice reaches an ACP client twice: as the
+  `sigit-permission-mode` config option, and as session `modes` with `session/set_mode`, which
+  the spec is retiring but some clients still render instead. Both are built from
+  `PERMISSION_MODES` in `main.rs` and read the same state, so whatever changes the mode has to
+  refresh both (`ConfigOptionUpdate` and `send_current_mode`). Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
+  so the dispatch loop can route the client's permission answer mid-turn — don't move them back
+  inline, and don't await client requests from inline handlers (deadlock). Two locks order them.
+  A per-session lock (`SiGitAgent::session_lock`) is held for a whole request, so requests on one
+  thread keep their order. `SiGitAgent::workspace_lock` guards what a session installs
+  process-wide (cwd, workspace roots, session MCP servers, the live backend slot, the engine's
+  conversation); lifecycle and config handlers hold it throughout, and `handle_prompt` holds it
+  through a `WorkspaceHold` that it releases while waiting on an HTTP endpoint or a permission
+  answer and retakes (reinstalling its session via `resume_workspace`) before any tool runs. An
+  on-device turn never releases it. Take the session lock first, never the other way round. Tool
+  execution, subagents included, still runs one session at a time.
 - **`src/instructions.rs`** — project instruction files, the always-on counterpart to skills.
   Reads `AGENTS.md` (the cross-tool [agents.md](https://agents.md) standard) and `CLAUDE.md`,
   walking from the session cwd up to the repo root (nearest ancestor with `.git`, never above it),
@@ -337,6 +359,10 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   those read env vars once at init.
 - **`src/account.rs`** — siGit Code Cloud auth (`/login`, `/logout`, `/whoami`); authenticates
   against the account API and stores a session token. Performs no console I/O.
+  ACP `logout` (the editor's sign out button, shown only because `handle_initialize` advertises
+  `agentCapabilities.auth.logout`) and `/logout` both go through `SiGitAgent::sign_out` in
+  `main.rs`. The request names no session, so `leave_cloud` moves the parked threads off their
+  cloud tier along with the live one and each of them gets a fresh model picker.
 - **`src/browser_auth.rs`** — browser sign-in, the path the editor's "Sign in to siGit Code"
   button takes. sigit is a public OAuth client (client id `sigit-code-cli`, no secret, PKCE
   S256) against the authorization server at `$SIGIT_API_URL/oauth`. Two ways the code gets

{sigit_code-1.6.2 → sigit_code-1.6.4}/CHANGELOG.md

@@ -1,5 +1,85 @@
 # Changelog
 
+## 1.6.4
+
+### Added
+
+- **DeepSeek DSML tool calls written into the reply text are recovered.** A
+  DeepSeek-family endpoint can render a tool call as literal
+  `<｜DSML｜tool_calls>` text instead of the structured `tool_calls` field,
+  which streamed the tag into the editor and ended the turn with nothing run.
+  The inline tool-call scanner that already recovered the GLM XML and Kimi K3
+  shapes now recovers the DSML shape too, including a marker split across
+  stream chunks. A block that fails to parse is still kept out of the reply
+  and the history, and the model is told the call did not run (#181).
+
+### Fixed
+
+- **The round-cap stop message no longer carries a stray run of spaces.**
+  When the tool-round cap ended a turn, the closing message could collapse a
+  space run into the wrong spot, which the editor then rendered verbatim
+  (#177).
+
+## 1.6.3
+
+### Added
+
+- **A client can resume a session and close one.** siGit Code now advertises
+  `sessionCapabilities.resume` and `sessionCapabilities.close`.
+  `session/resume` restores a saved thread the way `session/load` does, but
+  sends none of it back: it is for a client that still has the thread on
+  screen, after an agent restart for example. `session/close` cancels the
+  session's running turn and drops what the process held for it, which is its
+  state, its permission grants and plan mode, the MCP servers the client named
+  for it, and the background commands it started. The saved history is left
+  alone, so a closed thread still lists and reopens (#149).
+
+- **The permission modes are also offered as ACP session modes.** Manual, Auto
+  and Plan were only reachable as a config option, which is what the protocol
+  now recommends and what Zed reads. A client that draws the older mode
+  selector saw nothing. `session/new`, `session/load` and `session/fork` now
+  return the same three in `modes`, `session/set_mode` switches between them,
+  and a change made any other way (the config option, `/plan`, `/clear`,
+  `/reload`) is announced with `current_mode_update`. A client that reads
+  config options ignores `modes`, so nothing changes there (#148).
+
+- **An editor can sign out of siGit Code.** The `initialize` reply carried an
+  empty `auth` object, so a client drew no sign out button, and typing
+  `/logout` was the only way out of an account. The reply now advertises
+  `agentCapabilities.auth.logout`, and a `logout` request ends the account
+  session through the method `/logout` calls. The request names no session,
+  so it moves every open thread that used the account, not only the live one:
+  a thread parked on a cloud tier goes on-device with the live thread instead
+  of failing to restore its tier on its next prompt, and every thread that
+  moved gets a fresh model picker. Local inference is switched back on if it
+  was off, so a thread opened after signing out asks for no cloud tier
+  (#150).
+
+### Changed
+
+- **Two threads can run a turn at the same time.** An editor runs one siGit
+  Code process for every thread it has open, and a single lock ordered every
+  turn-affecting request in it, so a second prompt waited for the first
+  thread's whole turn and two prompts never overlapped. The lock held what a
+  session installs process-wide — the working directory, the workspace roots,
+  the MCP servers the client named for it, the live backend — none of which a
+  turn touches while it waits on an HTTP endpoint, which is most of its time.
+  A session on an HTTP backend now keeps a backend of its own, so its
+  conversation is no longer swapped in and out of a shared one, and a turn
+  releases the process-wide lock while it waits on the endpoint or on a
+  permission answer and takes it back, reinstalling its session, before any
+  tool runs. On-device turns are unchanged, since the engine keeps one
+  conversation, and tool execution still runs one session at a time (#176).
+
+### Fixed
+
+- **A prompt whose inference failed is kept through a model switch.** A turn
+  that ended in an endpoint error stayed in the client's thread, but the
+  carryover into a new model dropped its trailing user message, and the error
+  path never saved the session. Only a cancelled prompt should be taken back
+  out, so cancellation now removes it from the live history, and the error
+  path persists the session (#124).
+
 ## 1.6.2
 
 ### Added

{sigit_code-1.6.2 → sigit_code-1.6.4}/CLAUDE.md

@@ -113,9 +113,20 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
 - **`src/main.rs`** — entry point, mode dispatch, the full ACP `Agent` impl (session lifecycle:
   new/load/fork/prompt/cancel, config options, slash-command advertisement), and the `SYSTEM_PROMPT`.
   ACP session state owns its roots, conversation, and selected model even though the process has
-  one live backend; activating a thread parks and restores all three. Unknown session ids are
-  rejected instead of silently borrowing the active thread's cwd. Prompt cancellation is routed
-  outside `turn_lock`, which lets a client cancel the turn currently holding that lock. The
+  one working directory and one live backend slot; activating a thread parks and restores all
+  three. A thread on an HTTP backend keeps a backend of its own (`InferenceBackend::fresh`,
+  `SessionState::remote`), so its turn can wait on the endpoint while another thread is
+  installed. Unknown session ids are rejected instead of silently borrowing the active thread's
+  cwd. Prompt cancellation takes no lock, which lets a client cancel a turn whatever it holds.
+  `session/load` and `session/resume` share `restore_session`; the only difference is that
+  resume must not replay the history as `session/update`. `session/close` is the one place a
+  `SessionState` is dropped. It runs in two halves: `begin_close` signals the session's turn
+  from the dispatch loop (the turn holds the session's lock, so the signal cannot wait for it) and
+  marks the id in `closing_sessions`, which makes `handle_prompt` cancel a prompt that was
+  still queued; `handle_close_session` then runs under the session and workspace locks and
+  removes the state, the permission grants and the background commands
+  (`tools::kill_session_tasks`). It leaves `session_store` alone, so a closed thread still lists
+  and reopens. The
   `SYSTEM_PROMPT` bakes in smbCloud-specific context the agent should use when the repo is clearly
   smbCloud, and stay general otherwise.
 - **`src/backend.rs`** — the `InferenceBackend` trait and neutral types (`ToolSpec`, `ToolCall`,
@@ -268,10 +279,21 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   announced, because it sets the announced status: a call that will ask starts `pending`, the
   permission request carries that call's own id, and an `in_progress` update follows approval.
   That update also puts the card's title back, since the permission request overwrites it
-  with the full arguments. Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
-  serialized by `SiGitAgent::turn_lock` so the dispatch loop can route the client's permission
-  answer mid-turn — don't move them back inline, and don't await client requests from inline
-  handlers (deadlock).
+  with the full arguments. The Manual/Auto/Plan choice reaches an ACP client twice: as the
+  `sigit-permission-mode` config option, and as session `modes` with `session/set_mode`, which
+  the spec is retiring but some clients still render instead. Both are built from
+  `PERMISSION_MODES` in `main.rs` and read the same state, so whatever changes the mode has to
+  refresh both (`ConfigOptionUpdate` and `send_current_mode`). Note: ACP turn-affecting handlers run in `cx.spawn`ed tasks
+  so the dispatch loop can route the client's permission answer mid-turn — don't move them back
+  inline, and don't await client requests from inline handlers (deadlock). Two locks order them.
+  A per-session lock (`SiGitAgent::session_lock`) is held for a whole request, so requests on one
+  thread keep their order. `SiGitAgent::workspace_lock` guards what a session installs
+  process-wide (cwd, workspace roots, session MCP servers, the live backend slot, the engine's
+  conversation); lifecycle and config handlers hold it throughout, and `handle_prompt` holds it
+  through a `WorkspaceHold` that it releases while waiting on an HTTP endpoint or a permission
+  answer and retakes (reinstalling its session via `resume_workspace`) before any tool runs. An
+  on-device turn never releases it. Take the session lock first, never the other way round. Tool
+  execution, subagents included, still runs one session at a time.
 - **`src/instructions.rs`** — project instruction files, the always-on counterpart to skills.
   Reads `AGENTS.md` (the cross-tool [agents.md](https://agents.md) standard) and `CLAUDE.md`,
   walking from the session cwd up to the repo root (nearest ancestor with `.git`, never above it),
@@ -337,6 +359,10 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   those read env vars once at init.
 - **`src/account.rs`** — siGit Code Cloud auth (`/login`, `/logout`, `/whoami`); authenticates
   against the account API and stores a session token. Performs no console I/O.
+  ACP `logout` (the editor's sign out button, shown only because `handle_initialize` advertises
+  `agentCapabilities.auth.logout`) and `/logout` both go through `SiGitAgent::sign_out` in
+  `main.rs`. The request names no session, so `leave_cloud` moves the parked threads off their
+  cloud tier along with the live one and each of them gets a fresh model picker.
 - **`src/browser_auth.rs`** — browser sign-in, the path the editor's "Sign in to siGit Code"
   button takes. sigit is a public OAuth client (client id `sigit-code-cli`, no secret, PKCE
   S256) against the authorization server at `$SIGIT_API_URL/oauth`. Two ways the code gets

{sigit_code-1.6.2 → sigit_code-1.6.4}/Cargo.lock

@@ -5778,7 +5778,7 @@ checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "sigit"
-version = "1.6.2"
+version = "1.6.4"
 dependencies = [
  "agent-client-protocol",
  "anyhow",

{sigit_code-1.6.2 → sigit_code-1.6.4}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sigit"
-version = "1.6.2"
+version = "1.6.4"
 edition = "2024"
 description = "siGit Code — ACP-compatible AI coding agent. Sí, git."
 documentation = "https://github.com/getsigit/sigit"

{sigit_code-1.6.2 → sigit_code-1.6.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sigit-code
-Version: 1.6.2
+Version: 1.6.4
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers

{sigit_code-1.6.2 → sigit_code-1.6.4}/src/backend.rs

@@ -445,6 +445,15 @@ pub trait InferenceBackend: Send + Sync {
     /// local model while requests actually go to the cloud.
     fn is_remote(&self) -> bool;
 
+    /// A backend for the same endpoint and model with an empty conversation,
+    /// or `None` when the conversation cannot be separated from the backend
+    /// (on-device, the engine holds it). An editor keeps several threads open
+    /// in one process; this is what lets each of them own its history instead
+    /// of taking turns on a shared one.
+    fn fresh(&self) -> Option<Arc<dyn InferenceBackend>> {
+        None
+    }
+
     /// A serializable snapshot of the conversation history, one JSON object per
     /// message (`{"role": ..., "content": ...}` at minimum). The snapshot is
     /// what the session store persists; it includes any seeded system message
@@ -1554,6 +1563,19 @@ impl InferenceBackend for OpenAiBackend {
         true
     }
 
+    fn fresh(&self) -> Option<Arc<dyn InferenceBackend>> {
+        Some(Arc::new(Self {
+            base_url: self.base_url.clone(),
+            api_key: self.api_key.clone(),
+            model: self.model.clone(),
+            // The client is a handle on one connection pool; sharing it keeps
+            // connections to the endpoint warm across sessions.
+            http: self.http.clone(),
+            history: Mutex::new(Vec::new()),
+            accepts_images: self.accepts_images,
+        }))
+    }
+
     async fn history_snapshot(&self) -> Vec<serde_json::Value> {
         self.history.lock().await.clone()
     }
@@ -1944,18 +1966,25 @@ pub fn carryover_history(snapshot: Vec<serde_json::Value>) -> Vec<serde_json::Va
         }
     }
 
-    // Session switches happen only after the serialized turn has ended. A
-    // trailing user message therefore belongs to a cancelled/failed inference
-    // request with no answer; carrying it would make the next activation feed
-    // the model an orphaned prompt that the client considers cancelled.
-    while carried
+    carried
+}
+
+/// Take a cancelled prompt's user message back out of the live history.
+///
+/// The client drops a cancelled prompt from its thread, so the model must not
+/// keep answering it. Only the first inference round can cancel with the user
+/// message as the last entry; later rounds end on tool or assistant output.
+/// A prompt that fails with an error is not taken back: the client keeps it,
+/// so the history keeps it too and a model switch carries it over.
+pub async fn forget_trailing_user_message(backend: &dyn InferenceBackend) {
+    let mut history = backend.history_snapshot().await;
+    if history
         .last()
         .is_some_and(|message| message["role"] == "user")
     {
-        carried.pop();
+        history.pop();
+        backend.restore_history(history).await;
     }
-
-    carried
 }
 
 /// Replay `carried` (from [`carryover_history`]) into `backend`, on top of the
@@ -2161,16 +2190,39 @@ mod tests {
     }
 
     #[test]
-    fn carryover_drops_a_cancelled_trailing_user_message() {
+    fn carryover_keeps_a_trailing_user_message_from_a_failed_turn() {
+        // The client keeps a prompt whose inference errored, so a switch must
+        // not drop it (issue #124).
         let carried = carryover_history(vec![
             serde_json::json!({ "role": "system", "content": "prompt" }),
             serde_json::json!({ "role": "user", "content": "completed question" }),
             serde_json::json!({ "role": "assistant", "content": "completed answer" }),
-            serde_json::json!({ "role": "user", "content": "cancelled question" }),
+            serde_json::json!({ "role": "user", "content": "failed question" }),
         ]);
 
-        assert_eq!(carried.len(), 2, "{carried:#?}");
-        assert_eq!(carried.last().unwrap()["content"], "completed answer");
+        assert_eq!(carried.len(), 3, "{carried:#?}");
+        assert_eq!(carried.last().unwrap()["content"], "failed question");
+    }
+
+    #[tokio::test]
+    async fn forget_trailing_user_message_drops_only_a_cancelled_prompt() {
+        let backend = OpenAiBackend::new("http://localhost", "", "m", None);
+        backend
+            .restore_history(vec![
+                serde_json::json!({ "role": "user", "content": "completed question" }),
+                serde_json::json!({ "role": "assistant", "content": "completed answer" }),
+                serde_json::json!({ "role": "user", "content": "cancelled question" }),
+            ])
+            .await;
+
+        forget_trailing_user_message(&backend).await;
+
+        let history = backend.history_snapshot().await;
+        assert_eq!(history.len(), 2, "{history:#?}");
+        assert_eq!(history[1]["content"], "completed answer");
+
+        forget_trailing_user_message(&backend).await;
+        assert_eq!(backend.history_snapshot().await.len(), 2);
     }
 
     #[test]