fix(model-fallback): don't rethrow provider-side AbortErrors as user cancellations (#90908)

shengting · Shengting Xie · yayu · web-flow · commit 98ed83f848de · 2026-06-27T20:53:16.000+03:00
* fix(model-fallback): don't rethrow provider-side AbortErrors as user cancellations

When the LLM API closes the connection mid-stream, the fetch layer
surfaces AbortError("This operation was aborted") with no external
abort signal triggered. The old guard `shouldRethrowAbort()` returned
false for these errors (because isTimeoutError matched the message),
so they fell through to the fallback loop but were never retried —
the error propagated up and produced SILENT_REPLY_TOKEN in group
sessions, permanently silencing the topic.

Replace the guard with a direct check: only rethrow AbortError when
the external abort signal is actually set (user/gateway cancellation).
Provider-side AbortErrors without an external signal now fall through
to the next fallback candidate, giving the system a chance to recover.

* fix(cron): forward abort signal into runWithModelFallback

Thread the cron executor's abort signal into the shared
runWithModelFallback call so that cron timeouts and cancellations
stop the fallback chain instead of retrying with the next candidate.

Previously, the run callback checked params.abortSignal?.aborted and
threw, but runWithModelFallback itself had no signal — so the new
guard in model-fallback.ts could not distinguish a caller abort from
a provider-side AbortError and would retry silently.

Also adds a focused regression test verifying the signal is forwarded.

---------

Co-authored-by: Shengting Xie &lt;shengting@openclaw.ai&gt;
Co-authored-by: yayu &lt;yayu@yayuMacStudio.local&gt;
diff --git a/src/agents/embedded-agent-runner/compact.ts b/src/agents/embedded-agent-runner/compact.ts
@@ -514,6 +514,7 @@ export async function compactEmbeddedAgentSessionDirect(
       agentId: fallbackAgentId,
       sessionId: params.sessionId,
       sessionKey: fallbackSessionKey,
+      abortSignal: params.abortSignal,
       prepareAgentHarnessRuntime: async ({ provider, model, agentHarnessRuntimeOverride }) => {
         await ensureSelectedAgentHarnessPlugin({
           config: params.config,
diff --git a/src/agents/model-fallback.test.ts b/src/agents/model-fallback.test.ts
@@ -2761,6 +2761,8 @@ describe("runWithModelFallback", () => {
 
   it("does not fall back on user aborts", async () => {
     const cfg = makeCfg();
+    const controller = new AbortController();
+    controller.abort(Object.assign(new Error("timeout"), { name: "TimeoutError" }));
     const run = vi
       .fn()
       .mockRejectedValueOnce(Object.assign(new Error("aborted"), { name: "AbortError" }))
@@ -2771,6 +2773,7 @@ describe("runWithModelFallback", () => {
         cfg,
         provider: "openai",
         model: "gpt-4.1-mini",
+        abortSignal: controller.signal,
         run,
       }),
     ).rejects.toThrow("aborted");
@@ -2797,6 +2800,94 @@ describe("runWithModelFallback", () => {
     expect(run).toHaveBeenCalledTimes(1);
   });
 
+  it("does not fall back when user cancels with AbortError reason", async () => {
+    const cfg = makeCfg();
+    const controller = new AbortController();
+    controller.abort(Object.assign(new Error("cancelled"), { name: "AbortError" }));
+    const run = vi
+      .fn()
+      .mockRejectedValueOnce(Object.assign(new Error("aborted"), { name: "AbortError" }))
+      .mockResolvedValueOnce("should not run");
+
+    await expect(
+      runWithModelFallback({
+        cfg,
+        provider: "openai",
+        model: "gpt-4.1-mini",
+        abortSignal: controller.signal,
+        run,
+      }),
+    ).rejects.toThrow("aborted");
+
+    expect(run).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not fall back when caller cancellation uses a string reason", async () => {
+    const cfg = makeCfg();
+    const controller = new AbortController();
+    controller.abort("Cancelled by operator.");
+    const run = vi
+      .fn()
+      .mockRejectedValueOnce(Object.assign(new Error("aborted"), { name: "AbortError" }))
+      .mockResolvedValueOnce("should not run");
+
+    await expect(
+      runWithModelFallback({
+        cfg,
+        provider: "openai",
+        model: "gpt-4.1-mini",
+        abortSignal: controller.signal,
+        run,
+      }),
+    ).rejects.toThrow("aborted");
+
+    expect(run).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not fall back when caller cancellation throws a plain error", async () => {
+    const cfg = makeCfg();
+    const controller = new AbortController();
+    controller.abort("Cancelled by operator.");
+    const run = vi
+      .fn()
+      .mockRejectedValueOnce(new Error("Cancelled by operator."))
+      .mockResolvedValueOnce("should not run");
+
+    await expect(
+      runWithModelFallback({
+        cfg,
+        provider: "openai",
+        model: "gpt-4.1-mini",
+        abortSignal: controller.signal,
+        run,
+      }),
+    ).rejects.toThrow("Cancelled by operator.");
+
+    expect(run).toHaveBeenCalledTimes(1);
+  });
+
+  it("falls back when AbortError comes from the LLM provider (no external signal)", async () => {
+    const cfg = makeProviderFallbackCfg("openai");
+    const run = vi
+      .fn()
+      .mockRejectedValueOnce(
+        Object.assign(new Error("This operation was aborted"), { name: "AbortError" }),
+      )
+      .mockResolvedValueOnce({ payloads: [{ text: "fallback ok" }] });
+
+    const result = await runWithModelFallback({
+      cfg,
+      provider: "openai",
+      model: "gpt-4.1-mini",
+      run,
+    });
+
+    expect(result.result).toEqual({ payloads: [{ text: "fallback ok" }] });
+    expect(run).toHaveBeenCalledTimes(2);
+    expect(result.attempts[0]?.provider).toBe("openai");
+    expect(result.attempts[0]?.error).toBe("This operation was aborted");
+  });
+
   it("does not fall back when the caller abort signal timed out", async () => {
     const cfg = makeCfg();
     const timeoutReason = new Error("chat run timed out");
@@ -2854,6 +2945,37 @@ describe("runWithModelFallback", () => {
     expect(classifyResult).toHaveBeenCalledTimes(1);
   });
 
+  it("does not fall back when a user AbortError is classified from the result", async () => {
+    const cfg = makeProviderFallbackCfg("openai");
+    const abortReason = new Error("chat run cancelled");
+    abortReason.name = "AbortError";
+    const controller = new AbortController();
+    controller.abort(abortReason);
+    const run = vi
+      .fn()
+      .mockResolvedValueOnce({ payloads: [] })
+      .mockResolvedValueOnce({ payloads: [{ text: "fallback should not run" }] });
+    const classifyResult = vi.fn(() => ({
+      message: "This operation was aborted",
+      reason: "timeout" as const,
+      code: "terminal_abort",
+    }));
+
+    await expect(
+      runWithModelFallback({
+        cfg,
+        provider: "openai",
+        model: "m1",
+        abortSignal: controller.signal,
+        run,
+        classifyResult,
+      }),
+    ).rejects.toThrow("This operation was aborted");
+
+    expect(run).toHaveBeenCalledTimes(1);
+    expect(classifyResult).toHaveBeenCalledTimes(1);
+  });
+
   it("does not fall back when a restart abort is classified from the result", async () => {
     const cfg = makeProviderFallbackCfg("openai");
     const controller = new AbortController();
diff --git a/src/agents/model-fallback.ts b/src/agents/model-fallback.ts
@@ -39,7 +39,6 @@ import {
   describeFailoverError,
   isFailoverError,
   isNonProviderRuntimeCoordinationError,
-  isTimeoutError,
 } from "./failover-error.js";
 import {
   shouldAllowCooldownProbeForReason,
@@ -189,25 +188,6 @@ type ModelFallbackRunFn<T> = (
   options?: ModelFallbackRunOptions,
 ) => Promise<T>;
 
-/**
- * Fallback abort check. Only treats explicit AbortError names as user aborts.
- * Message-based checks (e.g., "aborted") can mask timeouts and skip fallback.
- */
-function isFallbackAbortError(err: unknown): boolean {
-  if (!err || typeof err !== "object") {
-    return false;
-  }
-  if (isFailoverError(err)) {
-    return false;
-  }
-  const name = "name" in err ? String(err.name) : "";
-  return name === "AbortError";
-}
-
-function shouldRethrowAbort(err: unknown): boolean {
-  return isFallbackAbortError(err) && !isTimeoutError(err);
-}
-
 function isTerminalAbort(signal: AbortSignal | undefined): boolean {
   if (!signal?.aborted) {
     return false;
@@ -225,6 +205,10 @@ function isTerminalAbort(signal: AbortSignal | undefined): boolean {
   return reason.name === "ClientDisconnectError";
 }
 
+function isCallerAbortSignal(signal: AbortSignal | undefined): boolean {
+  return signal?.aborted === true;
+}
+
 function createModelCandidateCollector(allowlist: Set<string> | null | undefined): {
   candidates: ModelCandidate[];
   addExplicitCandidate: (candidate: ModelCandidate) => void;
@@ -367,7 +351,10 @@ async function runFallbackCandidate<T>(params: {
     if (isNonProviderRuntimeCoordinationError(err)) {
       throw err;
     }
-    if (isTerminalAbort(params.abortSignal)) {
+    if (isTerminalAbort(params.abortSignal) || isCallerAbortSignal(params.abortSignal)) {
+      throw err;
+    }
+    if (isAgentRunRestartAbortReason(err)) {
       throw err;
     }
     // Normalize abort-wrapped rate-limit errors (e.g. Google Vertex RESOURCE_EXHAUSTED)
@@ -378,9 +365,6 @@ async function runFallbackCandidate<T>(params: {
       sessionId: params.attribution?.sessionId,
       lane: params.attribution?.lane,
     });
-    if (shouldRethrowAbort(err) && !normalizedFailover) {
-      throw err;
-    }
     return { ok: false, error: normalizedFailover ?? err };
   }
 }
@@ -430,7 +414,7 @@ async function runFallbackAttempt<T>(params: {
       attribution: params.attribution,
     });
     if (classifiedError) {
-      if (isTerminalAbort(params.abortSignal)) {
+      if (isTerminalAbort(params.abortSignal) || isCallerAbortSignal(params.abortSignal)) {
         throw toErrorObject(classifiedError, "Non-Error thrown");
       }
       const preserveResultOnExhaustion =
@@ -1323,7 +1307,8 @@ function shouldDiscardDeferredSessionSuspension(params: {
 }): boolean {
   return (
     isTerminalAbort(params.abortSignal) ||
-    shouldRethrowAbort(params.error) ||
+    isCallerAbortSignal(params.abortSignal) ||
+    isAgentRunRestartAbortReason(params.error) ||
     isCommandLaneTaskTimeoutError(params.error) ||
     isNonProviderRuntimeCoordinationError(params.error) ||
     isLikelyContextOverflowError(formatErrorMessage(params.error))
diff --git a/src/cron/isolated-agent/run-executor.ts b/src/cron/isolated-agent/run-executor.ts
@@ -283,6 +283,7 @@ export function createCronPromptExecutor(params: {
       agentDir: params.agentDir,
       agentId: params.agentId,
       sessionKey: params.runSessionKey,
+      abortSignal: params.abortSignal,
       prepareAgentHarnessRuntime: async ({ provider, model, agentHarnessRuntimeOverride }) => {
         await ensureSelectedAgentHarnessPlugin({
           config: params.cfgWithAgentDefaults,
diff --git a/src/cron/isolated-agent/run.cron-model-override-forwarding.test.ts b/src/cron/isolated-agent/run.cron-model-override-forwarding.test.ts
@@ -665,4 +665,21 @@ describe("runCronIsolatedAgentTurn — cron model override forwarding (#58065)",
 
     expect(capturedFallbacksOverride).toEqual(["openai/gpt-4o"]);
   });
+
+  it("forwards the cron abort signal into runWithModelFallback", async () => {
+    const controller = new AbortController();
+    let capturedAbortSignal: AbortSignal | undefined;
+    runWithModelFallbackMock.mockImplementation(
+      async (params: { provider: string; model: string; abortSignal?: AbortSignal }) => {
+        capturedAbortSignal = params.abortSignal;
+        return makeSuccessfulRunResult();
+      },
+    );
+
+    controller.abort(new Error("cron: job execution timed out"));
+
+    await runCronIsolatedAgentTurn(makeParams({ abortSignal: controller.signal }));
+
+    expect(capturedAbortSignal).toBe(controller.signal);
+  });
 });
