fix(compression): abort + preserve context on transient network summary failure (#29559, #25585)

[kshitijk4poor]

Summary

Closes #29559 and #25585 (same root cause / same code path) — context compaction destroys the compacted turns when summary generation fails on a transient network error.

When the auxiliary summary call fails and compression.abort_on_summary_failure is at its default (False), compress() falls through to the fallback path: it inserts a static "summary unavailable" marker and drops the middle window anyway.

• [Bug] Context compression silently drops summary on connection error, causing total context loss for long tasks #29559 (field report): a Connection error. at the compaction moment dropped 124 → 15 messages (110 lost) mid-task — catastrophic for long browser-automation / multi-step work; the agent "forgets" and redoes/misassumes.
• bug(compression): failed summaries should not discard conversation context #25585 (engineering writeup of the same failure mode): a failed summary should not discard the middle turns; record the failure so callers can warn, but leave context intact.

Verified still live on current main by default (the abort-and-keep path exists but is opt-in).

Fix

compress() already carves out an always-abort exception for auth failures (401/403) regardless of the config flag — rotating into a placeholder-summary child on a broken credential strands the user. A transient network/connection error is the same logic in reverse: it will recover, so retrying then is strictly better than discarding context for a momentary blip.

Extend that carve-out to terminal connection/network failures:

• new _last_summary_network_failure flag, set in _generate_summary's terminal failure branch when _is_connection_error(e) (reached only after any main-model fallback is exhausted), reset alongside the auth flag;
• compress() aborts when it's set — returns messages unchanged, _last_compress_aborted=True — independent of abort_on_summary_failure;
• a network-specific operator warning (distinct from the auth + config-flag messages).

Scoped to connection errors only: a generic 400/500 still takes the historical fallback-drop path (test_non_auth_failure_still_uses_fallback_path stays green). This mirrors an existing house pattern (the auth carve-out) rather than flipping the global default.

Tests

tests/agent/test_context_compressor.py:

• test_generate_summary_flags_network_failure — a ConnectionError flags _last_summary_network_failure (not auth);
• test_compress_aborts_on_network_failure_despite_flag_false — with the default flag off, a connection error aborts (messages unchanged, _last_compress_aborted=True, no fallback-drop).

Both mutation-checked (removing the flag-set fails detection; removing the carve-out fails the abort). Full test_context_compressor.py suite: 120 passed.

Attribution

Thanks to @MattChen1981 (#29559) for the field report + repro and @franksong2702 (#25585) for the precise failure-mode writeup and proposed approach.

Fixes #29559
Fixes #25585

[github-actions]

🔎 Lint report: fix/29559-compression-abort-on-network-failure vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 11180 on HEAD, 11180 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 5906 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.