[Roger Barreto (rogerbarreto)]

Motivation & Context

Foundry toolbox authentication reads platform caller context for each outbound request. When an httpx.Request instance is retried or reused after carrying a platform call ID, a later request without a current call ID must not retain the earlier header.

This change keeps outbound toolbox caller context aligned with the current hosting request.

Description & Review Guide

• What are the major changes? The toolbox authentication helper now removes any existing Foundry call-ID header before applying headers produced by the current request context. Sequential-request regression tests cover both synchronous and asynchronous authentication flows.
• What is the impact of these changes? Current call IDs continue to be forwarded normally, while requests without a current call ID no longer retain stale caller context from a reused request object.
• What do you want reviewers to focus on? Please verify that clearing the managed header before reapplying current context preserves normal forwarding and correctly handles request reuse.

Related Issue

No public issue. This hardening change is intentionally submitted without a GitHub issue.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused fix correctly handles request reuse and is covered in both authentication flows.

Review effort: Balanced
Findings: None

What changed in this PR

Prevents stale Foundry caller context when toolbox requests are reused.

Changes:

• Clears existing call-ID headers before applying current context.
• Adds sync and async regression tests.

File	Description
_toolbox.py	Clears stale call-ID headers.
test_toolbox.py	Tests reused requests without context.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-code-quality]

Code Coverage Overview

Languages: Python

Python / code-coverage/python

The overall line coverage in commit 15cde98 in the i746r703-foundry-con... branch is 91%. Line coverage data for the main branch is not yet available.

Show a line coverage summary of the most covered files.

File	main	i746r703-foundry-con... 15cde98	+/-
packages/core/a...ework/_tools.py	—	96%	—
packages/openai..._chat_client.py	—	95%	—
packages/core/a...work/_skills.py	—	95%	—
packages/core/a.../_compaction.py	—	95%	—
packages/core/a...ework/_types.py	—	93%	—
packages/core/a...ork/_vectors.py	—	93%	—
packages/core/a...bservability.py	—	93%	—
packages/core/a...amework/_mcp.py	—	92%	—
packages/ag-ui/...i/_agent_run.py	—	89%	—
packages/core/a...ork/security.py	—	89%	—

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): 15cde98ed1f4
Model: gpt-5.6-sol-fast

Overview

The change clears the managed Foundry call-ID header before reapplying headers from the current request context, keeping reused requests aligned with the active caller. The shared helper covers both synchronous and asynchronous authentication flows, and sequential-request regression tests verify stale-to-absent transitions in both paths. The dependency floor publicly exports the new constant, and no publishable correctness, compatibility, architectural, or security concern remains.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.