fix: compression no longer times out silently on aux retries and stays on the session's OpenAI endpoint (#98466, salvage #98480)

[teknium1]

Context compression no longer times out "with no output" on any aux retry/fallback rung, and it stays on the session's configured OpenAI endpoint instead of hopping to api.openai.com and getting a valid proxy key quarantined.

Salvages #98480 by @kokhlo (closes #98466). Field reports: Coatue (Slack gateway, ⚠ Context compression timed out after 120.0s with no output from the summary model → blocked (cooldown:60) at 333K tokens) and Miho (compression falls off the configured OpenAI endpoint, gets rejected, marks the key dead).

Changes

• Progress-hook seam default (_relay_sync_completion / _relay_async_completion): create now defaults to _create_with_progress / new _acreate_with_progress. All 18 unwrapped relay sites (same-provider retries, parameter-strip / auth-refresh / pool-rotation rungs, async fallback candidates) now stream and tick the compression fence. The async primary attempt also routes through the wrapper (it only streamed for stream-only providers before).
• Endpoint affinity for provider: openai: _expand_direct_api_alias keeps a providers.openai entry's name (named-custom branch applies its base_url/key) and otherwise prefers OPENAI_BASE_URL over the public default. The api-key discovery rung uses the bound session runtime's endpoint + key for that provider.
• Endpoint mismatch ≠ dead key: _recoverable_pool_provider returns None when the rejecting client's host differs from the session's configured endpoint for the same provider, so no pool rotation / unhealthy mark on a working credential.

Root cause

The progress hook is installed per task but _create_with_progress was applied per call site: the moment the primary attempt failed and the recovery ladder ran, every attempt went out non-streaming, the 120s idle watchdog saw silence, killed a healthy summary, armed the cooldown, and the session sat over threshold. Separately, openai was hard-aliased to custom + api.openai.com/v1 (#31452, vision), ignoring the user's configured endpoint.

Validation

Check	Before (origin/main 554eb9c)	After
Hook installed, relay default callback (sync + async)	stream=None, 0 chunk ticks	stream=True, ticks per chunk
No hook	plain create	plain create (byte-identical)
auxiliary.compression.provider: openai, OPENAI_BASE_URL=https://llm-proxy…/v1	client at https://api.openai.com/v1/	client at https://llm-proxy.corp.example/v1/
401 at api.openai.com while session is on the proxy → _recoverable_pool_provider	openai-api (rotates/quarantines)	None
401 at the proxy itself	openai-api	openai-api (unchanged)
tests/agent/test_aux_relay_progress_seam.py on origin/main	1 failed	2 passed
aux/compression/provider test dirs (111 files)	—	1321 passed, 0 failed

Live repro: call_llm(task="compression") against Nous with a 139K-char prompt: gemini-3.7-flash 7.9s / 13 ticks, gpt-6-astra 5.8s / 136 ticks on the streamed primary; the failure mode is confined to the ladder rungs (E2E probe /tmp/probe_endpoint.py results in the table above, temp HERMES_HOME, real imports).

Not in this PR: the 202,752 threshold in the Coatue report is the glm catch-all window (agent/model_metadata.py::DEFAULT_CONTEXT_LENGTHS); their model's real window vs that entry is a separate catalog check.

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on acce1f2 — fix(auxiliary): compression sticks to the session's OpenAI e}

⚠️ Warnings

OSV vulnerability scan · View job

71 known vulnerabilities found in pinned dependencies.

• CVE-2026-83608 in package-lock.json
• CVE-2026-83608 in package-lock.json
• CVE-2026-84375 in package-lock.json
• CVE-2026-84375 in website/package-lock.json
• CVE-2026-67213 in website/package-lock.json
• CVE-2026-85062 in package-lock.json
• CVE-2026-85062 in website/package-lock.json
• CVE-2026-83609 in package-lock.json
• CVE-2026-82417 in scripts/whatsapp-bridge/package-lock.json
• CVE-2026-82417 in website/package-lock.json
• CVE-2026-84369 in website/package-lock.json
• CVE-2026-83605 in package-lock.json
• CVE-2026-83605 in package-lock.json
• CVE-2026-75931 in package-lock.json
• CVE-2026-75931 in website/package-lock.json
• CVE-2026-83610 in package-lock.json
• CVE-2026-83610 in package-lock.json
• CVE-2026-83611 in package-lock.json
• CVE-2026-83611 in package-lock.json
• CVE-2026-71554 in uv.lock

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

---

debug info

CI timings

CI timings · View report · View job

Wall time 4m51s vs 5m13s (-7.0%). 8 job(s) slower, 6 faster,

• OSV scan / Emit review status: +29.0s
• Check contributors / check-attribution: -28.0s
• Python lints / Windows footguns (blocking): -26.0s
• OS-specific tests / Windows-only tests: -18.0s
• Python tests / Run tests: +8.0s

[ehz0ah]

Post-merge audit

Reviewed exact PR head 86c15dde708be00fd207f4775f2775d2bcefcdf5, merged as 2db0c7a2d8f29debe7d1cbfb4a72f4f98dc00808.

Motivation

This change fixes two valid failures. Auxiliary retry and fallback calls now report streamed progress to the compression watchdog. OpenAI auxiliary routing also stays on the configured session endpoint and avoids quarantining a session key after a rejection from another host.

Approach

The relay defaults now use the sync and async progress wrappers. The direct OpenAI alias honors a named provider or OPENAI_BASE_URL. API-key discovery can reuse the bound session endpoint. Pool recovery skips rotation when the rejecting client has a different hostname from the session endpoint.

Concrete changes

The implementation updates agent/auxiliary_client.py, adds progress-seam and endpoint-affinity regression tests, and relaxes one cancellation test so it checks hook propagation instead of an incidental exact tick count. Both normal and recovery requests now pass through the progress seam.

Risk to main

[Bug] (blocking follow-up) agent/auxiliary_client.py:3303 compares only the hostname when deciding whether a rejected auxiliary endpoint can mutate the session credential pool. Different schemes and ports are different origins. For example, with the session at https://proxy.example:8443/v1, clients at https://proxy.example:9443/v1 and http://proxy.example:8443/v1 both return openai-api from _recoverable_pool_provider(). A 402 then reaches mark_exhausted_and_rotate() with the session key and can persist that valid key as exhausted based on a response from another endpoint. The shared base_url_origin() helper already defines scheme, hostname, and effective port as the credential trust boundary. This guard should use the same origin identity. The added regression test covers a different hostname but does not cover either same-host case.

Validation

• Focused repository runner: 5 files, 44 tests passed, 0 failed.
• Direct route probe confirmed normal auxiliary.compression configuration can produce the same-host, different-port route while retaining the session pool key.
• Direct recovery-ladder probes confirmed both the port mismatch and HTTPS-to-HTTP mismatch call mark_exhausted_and_rotate() and schedule a same-provider retry after a 402.
• Hosted CI is green, including macOS and Windows jobs.

Overall assessment

The progress-seam fix is well placed and the main endpoint-affinity direction is correct. A focused follow-up is required so the quarantine guard compares full origins instead of hostnames.

[victor-kyriazakos]

Follow-up review of #106866

Reviewed 86c15dde708be00fd207f4775f2775d2bcefcdf5 against dcf725e6d2c97bcdb2b3f09cf0fb7de4f95233cc.

The progress-wrapper change fixes a real timeout mechanism. A local probe through public call_llm(task="compression") and the host watchdog reproduced a parameter-strip retry exceeding the idle budget on base, then completing on this head because substantive streamed chunks reached the progress hook. The provider was synthetic. This validates the recovery path, not the full reported gateway incident.

P1: task endpoint/key overrides are lost when providers.openai exists

The new branch in _expand_direct_api_alias preserves openai, which enters _resolve_named_custom_branch. That resolver reads the named entry's URL/key without composing a single-field task override.

Reproduced through public call_llm with real temporary YAML and SDK requests intercepted by httpx.MockTransport:

• URL-only override: providers.openai.base_url = https://named.example/v1, while auxiliary.compression selects provider: openai and base_url: https://aux-explicit.example/v1. Base sends to aux-explicit.example; head sends to named.example.
• Key-only override: a task-specific api_key: task-key becomes the provider-level named-key on head. Base preserves task-key.
• Both URL and key supplied: the explicit route remains intact.

Please compose task/call overrides over named-provider defaults without silently substituting the destination or credential. Add public-route tests for URL-only, key-only, both, and neither. The destination change matters because compression requests contain conversation history.

P2: preserve independent auxiliary recovery alongside the existing origin-boundary fix

The earlier post-merge audit already identifies the other side of this guard: comparing only hostnames allows a different port or scheme to quarantine the session key. That review recommends using the shared base_url_origin() identity. This is a complementary finding, not a replacement: a full-origin comparison must also distinguish the main credential from an independently owned auxiliary credential pool. Simply replacing hostname equality with origin equality would leave the independent-pool failure below intact.

The combined regression matrix should cover a main key rejected by a different host, port, or scheme without quarantining it, while retaining rotation for an independent auxiliary pool at its configured origin. The earlier audit's same-host cases are attributed here; our independent reproducer covers the auxiliary-pool case.

The new guard in _recoverable_pool_provider compares the auxiliary host with main's host before establishing whose credential failed.

Reproducer: main uses openai-api at https://main-proxy.example/v1 with its own key. Auxiliary explicitly selects https://api.openai.com/v1, backed by an independent persisted pool containing a rejected key followed by a working key. A synthetic 401 on the first auxiliary key produces:

• Base: rotate the failed auxiliary key, try the second key, succeed.
• Head: raise AuthenticationError after the first request. The second auxiliary key is never tried.

Protect main's credential when it was misrouted, but retain recovery for credentials actually owned by the auxiliary endpoint. Provider-name equality plus host inequality is not sufficient to distinguish those cases.

Robustness: distinguish stream negotiation from stream consumption

_acreate_with_progress catches exceptions around both opening and consuming the stream. The sync wrapper catches only opening it.

A public async_call_llm probe that yields content and then raises a decoding ValueError produces a second, non-streaming request. That adds work and restores a silent waiting interval. It does not prove duplicate user-visible delivery, since the partial summary has not committed.

Limit plain fallback to stream negotiation failures before consumption. Let midstream failures reach the normal classified recovery path, and test content-then-error separately from unsupported streaming.

Remaining continuity acceptance

The change fixes missing progress on affected recovery paths. It does not establish task continuation after a tool result crosses the threshold. A composed test should connect the tool result, auxiliary retry, watchdog, admitted summary commit, next main-model request, and final turn outcome. Cover successful streaming, first-token stall, content-then-stall, keepalive-only traffic, total ceiling, cooldown with provider-confirmed overflow, and late results after cancellation. Assert preserved task/tool results, bounded retries, no late commit, and an explicit recoverable outcome.

The local validation here passed 35 tests across six focused files, plus base/head probes. No live customer route, full suite, or deployed behavior was verified.

[teknium1]

Follow-up landed: #106955 (edac5f6378) — origin-scoped (scheme+host+port) session-key shield that only protects the session's own key (independent aux pools keep rotating), per-task base_url/api_key composing over providers.<name>, and negotiation-only async stream fallback. Thanks @ehz0ah and @victor-kyriazakos; both reproducers are pinned as tests.