Fix compaction data loss, sideways photos, and dropped stream-error text

Author: alexylon

AGENTS.md

@@ -457,7 +457,7 @@ Gitignored scratchpad for helper files the user asks to be created there — typ
         - `cargo clippy --package sofos --target x86_64-pc-windows-gnu --all-targets`
 - Before finishing, review the change for bugs and corner cases.
 - Use international English. Avoid regional idioms (whether American or British), clever shorthand, and compressed phrases; prefer wording that a non-native English reader can understand on the first read. This applies to chat replies, commit messages, code comments, documentation, and error messages.
-- After you finish cross-checking against the Non-Negotiable Rules and fixing the code, if needed, do another pass for bugs and regressions.
+- After you finish cross-checking against the Non-Negotiable Rules and fixing the code, do another pass for bugs and regressions.
 - After each final modification, provide a clear, human-readable one-line commit message.
 
 ---

CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to Sofos are documented in this file.
 
 ## [Unreleased]
 
+### Fixed
+
+- **A failed or interrupted compaction no longer drops part of the conversation.** Compaction shortens older tool output before summarising; if the summary step then failed or was cancelled, the shortened output used to be saved anyway. The conversation is now kept intact unless compaction finishes cleanly.
+- **Photos are no longer sent to the model rotated sideways.** Images that get resized now keep the upright orientation recorded by the camera.
+- **A streamed reply cut short by a provider error keeps the text shown so far.** That text is carried into the error and the conversation, so a retry still has the context.
+
 ## [0.3.2] - 2026-05-19
 
 ### Added

STRUCTURE.md

@@ -1010,7 +1010,7 @@ Rules:
 
 It contains:
 
-- decode plus optional resize (long side fits within 2048 pixels) before the bytes reach the model;
+- decode, applying any orientation the photo's metadata records, plus optional resize (long side fits within 2048 pixels) before the bytes reach the model;
 - byte-level format detection: PNG, JPEG, GIF, and WebP pass through unchanged when small enough; other decodable formats (e.g. BMP) are re-encoded as PNG;
 - base64 encoding and media-type assignment;
 - the 20 MB per-file size cap on the raw bytes;

src/api/anthropic/mod.rs

@@ -407,6 +407,35 @@ mod tests {
             );
         }
 
+        #[tokio::test]
+        async fn error_event_keeps_partial_reply_text() {
+            // A mid-stream error must keep the reply text already
+            // streamed to the screen so the next turn is not blind to it.
+            let events = vec![
+                json!({"type": "message_start", "message": {"id": "msg_e", "model": "claude-sonnet-4-6", "usage": {"input_tokens": 1}}}),
+                json!({"type": "content_block_start", "index": 0, "content_block": {"type": "text", "text": ""}}),
+                json!({"type": "content_block_delta", "index": 0, "delta": {"type": "text_delta", "text": "Here is the fix: "}}),
+                json!({"type": "content_block_delta", "index": 0, "delta": {"type": "text_delta", "text": "rename the field"}}),
+                json!({"type": "error", "error": {"message": "overloaded"}}),
+            ];
+
+            let stream = sse_stream_from_events(events);
+            let err = parse_stream(stream, |_| {}, |_| {}, flag())
+                .await
+                .expect_err("error event must surface as error");
+            let crate::error::SofosError::Api(msg) = &err else {
+                panic!("expected SofosError::Api, got: {err:?}");
+            };
+            assert!(
+                msg.contains("overloaded"),
+                "keeps the provider message: {msg}"
+            );
+            assert!(
+                msg.contains("Here is the fix: rename the field"),
+                "must carry the partial reply text: {msg}"
+            );
+        }
+
         #[tokio::test]
         async fn multibyte_codepoint_split_across_chunks_is_preserved() {
             // Reproduces the pre-fix corruption: a UTF-8 codepoint

src/api/anthropic/stream.rs

@@ -42,6 +42,10 @@ fn saturate_u32(n: u64) -> u32 {
     u32::try_from(n).unwrap_or(u32::MAX)
 }
 
+/// Cap on streamed reply text folded into a mid-stream error, so the
+/// error and the saved session stay bounded.
+const MAX_PARTIAL_REPLY_BYTES: usize = 2000;
+
 impl AnthropicClient {
     pub async fn create_message_streaming<FText, FThink>(
         &self,
@@ -405,7 +409,35 @@ where
                         .and_then(|e| e.get("message"))
                         .and_then(|m| m.as_str())
                         .unwrap_or("Unknown streaming error");
-                    return Err(SofosError::Api(format!("Streaming error: {}", error_msg)));
+                    // Returning here drops the accumulated content_blocks,
+                    // so keep the streamed text in the error for the next turn.
+                    let mut partial: String = content_blocks
+                        .iter()
+                        .filter_map(|b| match b {
+                            ContentBlock::Text { text } => Some(text.as_str()),
+                            _ => None,
+                        })
+                        .collect();
+                    if current_block_type == Some(StreamBlockKind::Text) {
+                        partial.push_str(&current_text);
+                    }
+                    let partial = partial.trim();
+                    let context = if partial.is_empty() {
+                        String::new()
+                    } else {
+                        let cutoff =
+                            utils::truncate_at_char_boundary(partial, MAX_PARTIAL_REPLY_BYTES);
+                        let ellipsis = if cutoff < partial.len() { "…" } else { "" };
+                        format!(
+                            " (partial reply before the error: {}{})",
+                            &partial[..cutoff],
+                            ellipsis
+                        )
+                    };
+                    return Err(SofosError::Api(format!(
+                        "Streaming error: {}{}",
+                        error_msg, context
+                    )));
                 }
                 _ => {}
             }

src/repl/compaction.rs

@@ -30,22 +30,27 @@ impl Repl {
             return Ok(false);
         }
 
-        self.session_state
-            .conversation
-            .truncate_tool_results(split_point);
-
-        if !force && !self.session_state.conversation.needs_compaction() {
-            let tokens_after = self.session_state.conversation.estimate_total_tokens();
-            println!(
-                "\n{} {} -> {} tokens (tool results truncated)\n",
-                "Compacted:".bright_green(),
-                tokens_before,
-                tokens_after
-            );
-            return Ok(true);
+        // Truncate a clone first: commit the truncation only when it
+        // alone frees enough tokens, so a failed or interrupted phase 2
+        // never persists half-shortened tool results.
+        if !force {
+            let mut truncated = self.session_state.conversation.clone();
+            truncated.truncate_tool_results(split_point);
+            if !truncated.needs_compaction() {
+                let tokens_after = truncated.estimate_total_tokens();
+                self.session_state.conversation = truncated;
+                println!(
+                    "\n{} {} -> {} tokens (tool results truncated)\n",
+                    "Compacted:".bright_green(),
+                    tokens_before,
+                    tokens_after
+                );
+                return Ok(true);
+            }
         }
 
-        // Phase 2: Summarize older messages via the LLM
+        // Phase 2: Summarize older messages via the LLM, leaving the
+        // history un-truncated so a failed summary trims whole messages.
         let older_messages: Vec<_> =
             self.session_state.conversation.messages()[..split_point].to_vec();
         let serialized = ConversationHistory::serialize_messages_for_summary(&older_messages);

src/repl/conversation/mod.rs

@@ -586,6 +586,56 @@ mod tests {
         }
     }
 
+    #[test]
+    fn truncate_tool_results_on_clone_leaves_original_intact() {
+        // compact_conversation truncates a clone to test whether
+        // truncation alone frees enough tokens; the original must stay
+        // byte-identical so a failed summary can fall back to it.
+        let mut history = ConversationHistory::new();
+        history.config.tool_result_truncate_threshold = 100;
+        let original_text = "x".repeat(500);
+        history.messages.push(Message::user_with_tool_results(vec![
+            MessageContentBlock::ToolResult {
+                tool_use_id: "id1".to_string(),
+                content: original_text.clone(),
+                cache_control: None,
+            },
+        ]));
+
+        let mut probe = history.clone();
+        probe.truncate_tool_results(1);
+
+        let crate::api::MessageContent::Blocks { content } = &probe.messages()[0].content else {
+            panic!("expected Blocks");
+        };
+        let MessageContentBlock::ToolResult {
+            content: probe_text,
+            ..
+        } = &content[0]
+        else {
+            panic!("expected ToolResult");
+        };
+        assert!(
+            probe_text.contains("truncated"),
+            "the clone must be truncated"
+        );
+
+        let crate::api::MessageContent::Blocks { content } = &history.messages()[0].content else {
+            panic!("expected Blocks");
+        };
+        let MessageContentBlock::ToolResult {
+            content: original_after,
+            ..
+        } = &content[0]
+        else {
+            panic!("expected ToolResult");
+        };
+        assert_eq!(
+            original_after, &original_text,
+            "truncating the clone must not touch the original conversation"
+        );
+    }
+
     #[test]
     fn test_replace_with_summary() {
         let mut history = ConversationHistory::new();

src/tools/image.rs

@@ -2,7 +2,9 @@ use crate::error::{Result, ResultExt, SofosError};
 use crate::tools::permissions::{CommandPermission, PermissionManager};
 use crate::tools::utils::{is_absolute_or_tilde, is_http_url};
 use base64::{Engine, engine::general_purpose::STANDARD};
-use image::{DynamicImage, GenericImageView, ImageEncoder, ImageFormat as ImageCrateFormat};
+use image::{
+    DynamicImage, GenericImageView, ImageDecoder, ImageEncoder, ImageFormat as ImageCrateFormat,
+};
 use std::collections::HashSet;
 use std::path::{Path, PathBuf};
 use std::sync::{Arc, Mutex};
@@ -39,11 +41,7 @@ pub struct EncodedImage {
 pub fn encode_image_for_prompt(bytes: Vec<u8>) -> Result<EncodedImage> {
     let detected = image::guess_format(&bytes).ok();
 
-    let decoded = image::load_from_memory(&bytes).map_err(|e| {
-        SofosError::ToolExecution(format!(
-            "Failed to decode image: {e}. Supported: {SUPPORTED_FORMATS_HUMAN_LIST}."
-        ))
-    })?;
+    let decoded = decode_with_orientation(&bytes)?;
     let (width, height) = decoded.dimensions();
 
     let within_bound = width <= MAX_PROMPT_IMAGE_DIMENSION && height <= MAX_PROMPT_IMAGE_DIMENSION;
@@ -76,6 +74,26 @@ pub fn encode_image_for_prompt(bytes: Vec<u8>) -> Result<EncodedImage> {
     })
 }
 
+/// Decode image bytes, applying any EXIF orientation. A resize +
+/// re-encode strips EXIF, so the orientation is baked into the pixels.
+fn decode_with_orientation(bytes: &[u8]) -> Result<DynamicImage> {
+    fn decode_err<E: std::fmt::Display>(e: E) -> SofosError {
+        SofosError::ToolExecution(format!(
+            "Failed to decode image: {e}. Supported: {SUPPORTED_FORMATS_HUMAN_LIST}."
+        ))
+    }
+
+    let mut decoder = image::ImageReader::new(std::io::Cursor::new(bytes))
+        .with_guessed_format()
+        .map_err(decode_err)?
+        .into_decoder()
+        .map_err(decode_err)?;
+    let orientation = decoder.orientation().map_err(decode_err)?;
+    let mut decoded = DynamicImage::from_decoder(decoder).map_err(decode_err)?;
+    decoded.apply_orientation(orientation);
+    Ok(decoded)
+}
+
 fn is_passthrough_format(format: ImageCrateFormat) -> bool {
     matches!(
         format,
@@ -376,4 +394,63 @@ mod tests {
             "error should explain the failure; got: {msg}"
         );
     }
+
+    /// Build a JPEG carrying an EXIF orientation tag, so the decode
+    /// path under test has a real orientation to read.
+    fn jpeg_with_exif_orientation(
+        width: u32,
+        height: u32,
+        rgba: [u8; 4],
+        orientation: u16,
+    ) -> Vec<u8> {
+        let base = encode_fixture(width, height, rgba, ImageCrateFormat::Jpeg);
+        assert!(
+            base.starts_with(&[0xFF, 0xD8]),
+            "JPEG must open with the start-of-image marker"
+        );
+
+        // EXIF holds the orientation in a little-endian TIFF block: a
+        // byte-order marker, then a directory with one entry.
+        let mut tiff = Vec::new();
+        tiff.extend_from_slice(&[0x49, 0x49, 0x2A, 0x00]); // "II" marker + magic 42
+        tiff.extend_from_slice(&8u32.to_le_bytes()); // byte offset of the directory
+        tiff.extend_from_slice(&1u16.to_le_bytes()); // entry count
+        tiff.extend_from_slice(&0x0112u16.to_le_bytes()); // orientation tag id
+        tiff.extend_from_slice(&3u16.to_le_bytes()); // field type: 16-bit unsigned
+        tiff.extend_from_slice(&1u32.to_le_bytes()); // value count
+        tiff.extend_from_slice(&u32::from(orientation).to_le_bytes());
+        tiff.extend_from_slice(&0u32.to_le_bytes()); // no following directory
+
+        let mut body = b"Exif\0\0".to_vec();
+        body.extend_from_slice(&tiff);
+
+        let mut app1 = vec![0xFF, 0xE1]; // EXIF metadata marker
+        // The segment length counts its own two length bytes.
+        let segment_len = (2 + body.len()) as u16;
+        app1.extend_from_slice(&segment_len.to_be_bytes());
+        app1.extend_from_slice(&body);
+
+        let mut out = Vec::with_capacity(base.len() + app1.len());
+        out.extend_from_slice(&base[..2]);
+        out.extend_from_slice(&app1);
+        out.extend_from_slice(&base[2..]);
+        out
+    }
+
+    #[test]
+    fn applies_exif_orientation_when_decoding() {
+        // A wide JPEG tagged "rotate 90°" must come back with its
+        // dimensions swapped — the orientation is applied before the
+        // resize + re-encode that would otherwise strip the EXIF tag.
+        let bytes = jpeg_with_exif_orientation(8, 4, [180, 60, 60, 255], 6);
+        let decoded = decode_with_orientation(&bytes).expect("decode oriented JPEG");
+        assert_eq!(decoded.dimensions(), (4, 8));
+    }
+
+    #[test]
+    fn identity_exif_orientation_keeps_dimensions() {
+        let bytes = jpeg_with_exif_orientation(8, 4, [180, 60, 60, 255], 1);
+        let decoded = decode_with_orientation(&bytes).expect("decode JPEG");
+        assert_eq!(decoded.dimensions(), (8, 4));
+    }
 }

src/tools/permissions/scope.rs

@@ -130,7 +130,6 @@ impl PermissionManager {
         )
     }
 
-    #[allow(dead_code)]
     pub fn check_write_permission(&self, path: &str) -> CommandPermission {
         self.check_scope_permission(
             path,
@@ -145,20 +144,10 @@ impl PermissionManager {
         self.is_scope_explicit_allow(path, Self::normalize_read, &self.read_allow_set)
     }
 
-    #[allow(dead_code)]
-    pub fn is_read_explicit_allow_both_forms(&self, original: &str, canonical: &str) -> bool {
-        self.is_read_explicit_allow(original) || self.is_read_explicit_allow(canonical)
-    }
-
     pub fn is_write_explicit_allow(&self, path: &str) -> bool {
         self.is_scope_explicit_allow(path, Self::normalize_write, &self.write_allow_set)
     }
 
-    #[allow(dead_code)]
-    pub fn is_write_explicit_allow_both_forms(&self, original: &str, canonical: &str) -> bool {
-        self.is_write_explicit_allow(original) || self.is_write_explicit_allow(canonical)
-    }
-
     /// Check if a path is covered by a Bash(/path/**) grant
     pub fn is_bash_path_allowed(&self, path: &str) -> bool {
         self.is_scope_explicit_allow(path, Self::normalize_command, &self.bash_path_allow_set)