agentops-accelerator 0.8.0__tar.gz → 0.8.2__tar.gz

{agentops_accelerator-0.8.0 → agentops_accelerator-0.8.2}/.claude-plugin/marketplace.json

@@ -13,7 +13,7 @@
       "name": "agentops-accelerator",
       "source": "../../plugins/agentops",
       "description": "Copilot agent skills for running standardized evaluation workflows with AgentOps Toolkit and Microsoft Foundry agents.",
-      "version": "0.8.0",
+      "version": "0.8.2",
       "keywords": [
         "agentops",
         "evaluation",

{agentops_accelerator-0.8.0 → agentops_accelerator-0.8.2}/.github/plugin/marketplace.json

@@ -13,7 +13,7 @@
       "name": "agentops-accelerator",
       "source": "../../plugins/agentops",
       "description": "Copilot agent skills for running standardized evaluation workflows with AgentOps Toolkit and Microsoft Foundry agents.",
-      "version": "0.8.0",
+      "version": "0.8.2",
       "keywords": [
         "agentops",
         "evaluation",

{agentops_accelerator-0.8.0 → agentops_accelerator-0.8.2}/CHANGELOG.md

@@ -5,6 +5,58 @@ This format follows [Keep a Changelog](https://keepachangelog.com/) and adheres
 
 ## [Unreleased]
 
+## [0.8.2] - 2026-08-07
+
+### Fixed
+- **`protocol: responses` now works against a Foundry hosted agent.** Every
+  invocation failed with
+  `HTTP 400 ... Missing required query parameter: api-version`, because the
+  hosted-agent path built the request URL by string-concatenating `/responses`
+  onto the configured URL. That had three consequences:
+  - Any existing query string was corrupted, because `/responses` was appended
+    after it (`.../responses?api-version=v1` became
+    `.../responses?api-version=v1/responses`).
+  - The required `api-version` query parameter was never added, so the Foundry
+    data plane rejected the request outright.
+  - A Foundry *agent identity* URL
+    (`/api/projects/<project>/agents/<name>/versions/<n>`) was accepted even
+    though it is not an invocable route; the invocable route is
+    `/agents/<name>/endpoint/protocols/openai/responses`.
+
+  The URL is now parsed rather than concatenated: the path and the query string
+  are handled separately, an agent identity URL is normalized onto the protocol
+  route, and `api-version` defaults to `v1` for Foundry protocol routes only.
+  When the configured URL pins a version, the version is preserved by sending an
+  `agent_reference` in the request body (the same mechanism
+  `_invoke_foundry_prompt` already uses), so pinning semantics are not lost.
+  URLs that already point at a `/responses` route and non-Foundry HTTP endpoints
+  are left untouched.
+
+## [0.8.1] - 2026-07-16
+
+### Fixed
+- **`agentops doctor` no longer prints noisy non-fatal errors to the console.**
+  Three low-level probes that already degrade gracefully were leaking their
+  transport errors to the screen during readiness checks:
+  - The **LLM judge** called the Foundry project OpenAI client on the legacy
+    `/openai/` route, which returns HTTP 404 for chat completions, printing
+    `WARNING: llm_assist: judge call failed: Error code: 404`. The client is now
+    normalized to the stable `/openai/v1/` route (with the injected
+    `api-version` query parameter cleared) using the same reused credential and
+    token refresh, so the judge runs instead of 404ing. Non-Foundry endpoints
+    are left untouched.
+  - The **OpenAI data-plane RBAC check** built an ARM role-assignment filter
+    (`atScopeAndAbove() and assignedTo('<oid>')`) that ARM rejects with
+    `UnsupportedQuery`. It now sends the supported `assignedTo('<oid>')` filter,
+    which already returns assignments at the target scope and every ancestor
+    scope, so the check runs instead of skipping with a console error.
+  - The **Application Insights** REST probe caught only `urllib.error.URLError`,
+    so a read timeout (a `socket.timeout`, which is an `OSError` but not a
+    `URLError`) escaped and surfaced
+    `INFO: Rate-limit App Insights probe failed (non-fatal): The read operation
+    timed out`. It now catches `OSError` (covering both) and the request timeout
+    was raised from 10s to 30s, so a slow App Insights degrades quietly.
+
 ## [0.8.0] - 2026-07-14
 
 ### Added

{agentops_accelerator-0.8.0/src/agentops_accelerator.egg-info → agentops_accelerator-0.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentops-accelerator
-Version: 0.8.0
+Version: 0.8.2
 Summary: Release readiness gates and evidence for Microsoft Foundry agents
 License: MIT License
         

{agentops_accelerator-0.8.0 → agentops_accelerator-0.8.2}/plugins/agentops/package.json

@@ -2,7 +2,7 @@
   "name": "agentops-accelerator",
   "displayName": "AgentOps Accelerator — Skills for GitHub Copilot",
   "description": "Copilot agent skills for running standardized evaluation workflows with AgentOps Accelerator and Microsoft Foundry agents.",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "publisher": "AgentOpsAccelerator",
   "icon": "icon.png",
   "license": "MIT",

{agentops_accelerator-0.8.0 → agentops_accelerator-0.8.2}/plugins/agentops/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agentops-accelerator",
   "description": "Copilot agent skills for running standardized evaluation workflows with AgentOps Accelerator and Microsoft Foundry agents.",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "author": {
     "name": "AgentOps Accelerator",
     "url": "https://github.com/Azure/agentops"

{agentops_accelerator-0.8.0 → agentops_accelerator-0.8.2}/src/agentops/agent/checks/_rbac_authorization.py

@@ -60,8 +60,13 @@ def list_principal_role_definition_ids(
     """List role definition GUIDs assigned to the principal at/above scope.
 
     Uses ``RoleAssignmentsOperations.list_for_scope`` with the
-    ``atScopeAndAbove() and assignedTo('<oid>')`` filter so management-plane
-    inheritance (subscription, resource group, account) is honoured.
+    ``assignedTo('<oid>')`` filter. That filter already returns assignments at
+    the given scope and every ancestor scope (subscription, resource group,
+    account), including those inherited through group membership, so
+    management-plane inheritance is honoured. The ARM RBAC API rejects the
+    combined ``atScopeAndAbove() and assignedTo(...)`` form
+    (``UnsupportedQuery``); ``assignedTo(...)`` on its own is the supported
+    equivalent.
     """
     try:
         from azure.mgmt.authorization import AuthorizationManagementClient
@@ -95,9 +100,7 @@ def list_principal_role_definition_ids(
         assignments = list(
             client.role_assignments.list_for_scope(
                 scope=scope,
-                filter=(
-                    f"atScopeAndAbove() and assignedTo('{principal_object_id}')"
-                ),
+                filter=f"assignedTo('{principal_object_id}')",
             )
         )
     except Exception as exc:  # noqa: BLE001

{agentops_accelerator-0.8.0 → agentops_accelerator-0.8.2}/src/agentops/agent/llm_assist/_client.py

@@ -39,6 +39,51 @@ class JudgementMeta:
     model_deployment: Optional[str] = None
 
 
+def _normalize_foundry_openai_client(client: Any) -> Any:
+    """Point a Foundry project OpenAI client at the ``/openai/v1/`` route.
+
+    ``AIProjectClient.get_openai_client()`` returns a client whose
+    ``base_url`` ends in ``/openai/`` and which injects an ``api-version``
+    query parameter. On that legacy route Foundry chat completions return
+    HTTP 404. The stable surface is the OpenAI v1 route (``/openai/v1/``)
+    served *without* an ``api-version`` parameter.
+
+    We rewrite the client in place with the public ``with_options`` API so
+    the reused credential and its token refresh keep working (no second
+    credential, no endpoint string-munging). The client is returned
+    unchanged when its ``base_url`` is not the recognised Foundry project
+    shape, so custom or already-normalised endpoints are left untouched.
+    """
+    try:
+        base_url = str(getattr(client, "base_url", "") or "")
+    except Exception:  # pragma: no cover - defensive
+        return client
+    if not base_url:
+        return client
+
+    normalized = base_url if base_url.endswith("/") else base_url + "/"
+    if normalized.endswith("/openai/v1/"):
+        # Already on the v1 surface; only ensure api-version is dropped.
+        pass
+    elif normalized.endswith("/openai/"):
+        normalized = normalized + "v1/"
+    else:
+        # Unknown shape (non-Foundry route). Leave routing untouched.
+        return client
+
+    with_options = getattr(client, "with_options", None)
+    if with_options is None:  # pragma: no cover - defensive
+        return client
+    try:
+        return with_options(
+            base_url=normalized,
+            default_query={"api-version": None},
+        )
+    except Exception as exc:  # pragma: no cover - defensive
+        log.info("llm_assist: could not normalize OpenAI route: %s", exc)
+        return client
+
+
 class LLMJudge:
     """Thin wrapper around the Foundry project's OpenAI client."""
 
@@ -230,6 +275,7 @@ class LLMJudge:
         if not endpoint:
             log.info("llm_assist: project endpoint not configured")
             return None
+
         try:
             from azure.ai.projects import AIProjectClient  # type: ignore
             from azure.identity import DefaultAzureCredential  # type: ignore
@@ -240,7 +286,9 @@ class LLMJudge:
         try:
             project_client = AIProjectClient(
                 endpoint=endpoint,
-                credential=DefaultAzureCredential(exclude_developer_cli_credential=True, process_timeout=30),
+                credential=DefaultAzureCredential(
+                    exclude_developer_cli_credential=True, process_timeout=30
+                ),
             )
             # Foundry exposes get_openai_client without an api_version arg;
             # never pass one (the SDK picks the right version).
@@ -251,7 +299,7 @@ class LLMJudge:
             if get_openai_client is None:
                 log.info("llm_assist: AIProjectClient has no OpenAI client helper")
                 return None
-            self._client = get_openai_client()
+            self._client = _normalize_foundry_openai_client(get_openai_client())
         except Exception as exc:  # pragma: no cover
             log.warning("llm_assist: openai client init failed: %s", exc)
             return None

{agentops_accelerator-0.8.0 → agentops_accelerator-0.8.2}/src/agentops/agent/sources/azure_monitor.py

@@ -13,7 +13,7 @@ import os
 import re
 from dataclasses import dataclass, field
 from typing import Any, Dict, List, Optional
-from urllib import error, request
+from urllib import request
 
 from agentops.agent.config import AzureMonitorSourceConfig
 
@@ -504,9 +504,13 @@ def _query_application_insights(
         method="POST",
     )
     try:
-        with request.urlopen(req, timeout=10) as resp:  # noqa: S310
+        with request.urlopen(req, timeout=30) as resp:  # noqa: S310
             parsed = json.loads(resp.read())
-    except (error.URLError, ValueError, KeyError) as exc:
+    except (OSError, ValueError, KeyError) as exc:
+        # OSError covers urllib.error.URLError *and* socket.timeout /
+        # TimeoutError. A read timeout is not a URLError, so catching only
+        # URLError here would let it propagate to the caller and surface a
+        # noisy non-fatal INFO line on the console. Degrade quietly instead.
         log.debug("App Insights REST query failed: %s", exc)
         return None
 

{agentops_accelerator-0.8.0 → agentops_accelerator-0.8.2}/src/agentops/pipeline/invocations.py

@@ -18,8 +18,10 @@ from __future__ import annotations
 
 import json
 import os
+import re
 import time
 import urllib.error
+import urllib.parse
 import urllib.request
 from dataclasses import dataclass, field
 from typing import Any, Dict, List, Optional
@@ -49,6 +51,79 @@ _MAX_TOOL_ITERATIONS = 4
 # while letting the agent produce its final natural-language reply.
 _TOOL_STUB_OUTPUT = '{"status": "ok"}'
 
+# Foundry serves hosted agents on a protocol route hanging off the agent
+# resource, not on the resource URL itself. The portal and `azd` surface
+# identity URLs (`.../agents/<name>` or `.../agents/<name>/versions/<n>`),
+# which cannot be POSTed to, so they are normalised onto this suffix.
+_FOUNDRY_HOSTED_RESPONSES_SUFFIX = "/endpoint/protocols/openai/responses"
+
+# The Foundry protocol route rejects requests without `api-version`
+# (HTTP 400 "Missing required query parameter: api-version"). This is the
+# default applied when the configured URL does not carry one already.
+_FOUNDRY_HOSTED_API_VERSION = "v1"
+
+# Matches a Foundry agent identity path, optionally pinned to a version.
+_FOUNDRY_AGENT_PATH_RE = re.compile(
+    r"^(?P<base>.*/agents/(?P<name>[^/]+))(?:/versions/(?P<version>[^/]+))?$"
+)
+
+
+def _foundry_hosted_responses_target(
+    raw_url: str,
+) -> tuple[str, Optional[Dict[str, Any]]]:
+    """Normalise a Foundry hosted-agent URL into its Responses invocation route.
+
+    Accepts any of the URL shapes users realistically have on hand:
+
+    * ``.../agents/<name>`` - agent identity URL
+    * ``.../agents/<name>/versions/<n>`` - version-pinned identity URL
+    * ``.../agents/<name>/endpoint/protocols/openai`` - protocol route
+    * ``.../agents/<name>/endpoint/protocols/openai/responses`` - full route
+
+    Query parameters on the configured URL are preserved, and ``api-version``
+    is defaulted when absent. When the source URL pinned a specific version,
+    an ``agent_reference`` block is returned so the pin survives the rewrite
+    (the protocol route itself is not version-scoped).
+
+    Returns ``(url, agent_reference_or_None)``.
+    """
+    parts = urllib.parse.urlsplit(raw_url)
+    path = parts.path.rstrip("/")
+    agent_reference: Optional[Dict[str, Any]] = None
+
+    if not path.endswith("/responses"):
+        identity = _FOUNDRY_AGENT_PATH_RE.match(path)
+        if identity:
+            path = identity.group("base") + _FOUNDRY_HOSTED_RESPONSES_SUFFIX
+            version = identity.group("version")
+            if version:
+                agent_reference = {
+                    "type": "agent_reference",
+                    "name": urllib.parse.unquote(identity.group("name")),
+                    "version": urllib.parse.unquote(version),
+                }
+        else:
+            path = f"{path}/responses"
+
+    query = urllib.parse.parse_qsl(parts.query, keep_blank_values=True)
+    # Only Foundry's own protocol route mandates api-version; leave custom
+    # hosted endpoints (e.g. *.azurewebsites.net) byte-for-byte unchanged.
+    if "/protocols/openai" in path and not any(
+        key.lower() == "api-version" for key, _ in query
+    ):
+        query.append(("api-version", _FOUNDRY_HOSTED_API_VERSION))
+
+    url = urllib.parse.urlunsplit(
+        (
+            parts.scheme,
+            parts.netloc,
+            path,
+            urllib.parse.urlencode(query),
+            parts.fragment,
+        )
+    )
+    return url, agent_reference
+
 
 def _summarise_tool_calls(calls: List[Any]) -> str:
     """Build a short, human-readable summary of executed tool calls.
@@ -547,16 +622,21 @@ def _invoke_foundry_hosted(
     }
 
     if target.protocol == "responses":
-        url = target.url.rstrip("/")
-        if not url.endswith("/responses"):
-            url = f"{url}/responses"
-        initial_body = {"input": [{"role": "user", "content": _row_input(row)}]}
+        url, agent_reference = _foundry_hosted_responses_target(target.url)
+        initial_body: Dict[str, Any] = {
+            "input": [{"role": "user", "content": _row_input(row)}]
+        }
+        if agent_reference:
+            initial_body["agent_reference"] = agent_reference
 
         text, aggregated_tool_calls, elapsed = _run_responses_tool_loop(
             url=url,
             headers=headers,
             initial_body=initial_body,
             timeout=timeout,
+            follow_up_extras=(
+                {"agent_reference": agent_reference} if agent_reference else None
+            ),
         )
 
         if not text:

{agentops_accelerator-0.8.0 → agentops_accelerator-0.8.2/src/agentops_accelerator.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentops-accelerator
-Version: 0.8.0
+Version: 0.8.2
 Summary: Release readiness gates and evidence for Microsoft Foundry agents
 License: MIT License
         

{agentops_accelerator-0.8.0 → agentops_accelerator-0.8.2}/tests/unit/test_agent_checks_rbac_openai_data_plane.py

@@ -310,8 +310,12 @@ def test_list_role_definition_ids_extracts_guid_suffix() -> None:
     role_assignments.list_for_scope.assert_called_once()
     kwargs = role_assignments.list_for_scope.call_args.kwargs
     assert kwargs["scope"] == _ACCOUNT_TARGET
-    assert _PRINCIPAL_OID in kwargs["filter"]
-    assert "atScopeAndAbove" in kwargs["filter"]
+    # The ARM RBAC API rejects the combined
+    # ``atScopeAndAbove() and assignedTo(...)`` filter with UnsupportedQuery.
+    # ``assignedTo(...)`` alone is the supported equivalent and already
+    # returns assignments at scope and every ancestor scope.
+    assert kwargs["filter"] == f"assignedTo('{_PRINCIPAL_OID}')"
+    assert "atScopeAndAbove" not in kwargs["filter"]
 
 
 def test_list_role_definition_ids_raises_when_sdk_missing() -> None:

agentops_accelerator-0.8.2/tests/unit/test_invocations.py

@@ -0,0 +1,112 @@
+"""Unit tests for target invocation helpers."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from agentops.core.agentops_config import AgentOpsConfig
+from agentops.pipeline import invocations
+
+
+def _config(**overrides: object) -> AgentOpsConfig:
+    data = {
+        "version": 1,
+        "agent": "my-agent:1",
+        "dataset": Path("data.jsonl"),
+        **overrides,
+    }
+    return AgentOpsConfig(**data)
+
+
+def test_project_endpoint_prefers_config_over_environment(monkeypatch):
+    monkeypatch.setenv(
+        "AZURE_AI_FOUNDRY_PROJECT_ENDPOINT",
+        "https://from-env.services.ai.azure.com/api/projects/p",
+    )
+    cfg = _config(
+        project_endpoint="https://from-config.services.ai.azure.com/api/projects/p"
+    )
+
+    assert (
+        invocations._project_endpoint(cfg)
+        == "https://from-config.services.ai.azure.com/api/projects/p"
+    )
+
+
+def test_project_endpoint_falls_back_to_environment(monkeypatch):
+    monkeypatch.setenv(
+        "AZURE_AI_FOUNDRY_PROJECT_ENDPOINT",
+        "https://from-env.services.ai.azure.com/api/projects/p",
+    )
+
+    assert (
+        invocations._project_endpoint(_config())
+        == "https://from-env.services.ai.azure.com/api/projects/p"
+    )
+
+
+def test_project_endpoint_requires_config_or_environment(monkeypatch):
+    monkeypatch.delenv("AZURE_AI_FOUNDRY_PROJECT_ENDPOINT", raising=False)
+
+    with pytest.raises(RuntimeError, match="project_endpoint"):
+        invocations._project_endpoint(_config())
+
+
+_AGENT_BASE = "https://acct.services.ai.azure.com/api/projects/proj/agents/helpdeskbot"
+_PROTOCOL_ROUTE = f"{_AGENT_BASE}/endpoint/protocols/openai/responses"
+
+
+def test_hosted_responses_target_rewrites_version_pinned_identity_url():
+    url, agent_reference = invocations._foundry_hosted_responses_target(
+        f"{_AGENT_BASE}/versions/11"
+    )
+
+    assert url == f"{_PROTOCOL_ROUTE}?api-version=v1"
+    assert agent_reference == {
+        "type": "agent_reference",
+        "name": "helpdeskbot",
+        "version": "11",
+    }
+
+
+def test_hosted_responses_target_rewrites_unversioned_identity_url():
+    url, agent_reference = invocations._foundry_hosted_responses_target(_AGENT_BASE)
+
+    assert url == f"{_PROTOCOL_ROUTE}?api-version=v1"
+    assert agent_reference is None
+
+
+def test_hosted_responses_target_preserves_existing_query_parameters():
+    url, _ = invocations._foundry_hosted_responses_target(
+        f"{_AGENT_BASE}/endpoint/protocols/openai?api-version=2025-05-01&trace=on"
+    )
+
+    assert url == f"{_PROTOCOL_ROUTE}?api-version=2025-05-01&trace=on"
+
+
+def test_hosted_responses_target_is_idempotent_on_full_route():
+    configured = f"{_PROTOCOL_ROUTE}?api-version=v1"
+
+    url, agent_reference = invocations._foundry_hosted_responses_target(configured)
+
+    assert url == configured
+    assert agent_reference is None
+
+
+def test_hosted_responses_target_appends_responses_to_protocol_route():
+    url, _ = invocations._foundry_hosted_responses_target(
+        f"{_AGENT_BASE}/endpoint/protocols/openai"
+    )
+
+    assert url == f"{_PROTOCOL_ROUTE}?api-version=v1"
+
+
+def test_hosted_responses_target_leaves_custom_endpoints_without_api_version():
+    url, agent_reference = invocations._foundry_hosted_responses_target(
+        "https://my-agent.azurewebsites.net/chat"
+    )
+
+    assert url == "https://my-agent.azurewebsites.net/chat/responses"
+    assert agent_reference is None

{agentops_accelerator-0.8.0 → agentops_accelerator-0.8.2}/tests/unit/test_llm_assist.py

@@ -481,3 +481,85 @@ def test_judge_falls_back_to_inference_get_openai_client(
     judge = LLMJudge(config=_enabled_config(), workspace=tmp_path)
 
     assert judge._get_client() == "legacy-openai-client"
+
+
+# ---------------------------------------------------------------------------
+# _normalize_foundry_openai_client -- Foundry /openai/v1/ route fix
+# ---------------------------------------------------------------------------
+
+
+class _FakeOpenAIClient:
+    """Minimal stand-in exposing ``base_url`` and ``with_options``."""
+
+    def __init__(self, base_url: str) -> None:
+        self.base_url = base_url
+        self.with_options_kwargs: Optional[Dict[str, Any]] = None
+
+    def with_options(self, **kwargs: Any) -> "_FakeOpenAIClient":
+        self.with_options_kwargs = kwargs
+        new = _FakeOpenAIClient(kwargs.get("base_url", self.base_url))
+        new.with_options_kwargs = kwargs
+        return new
+
+
+def test_normalize_rewrites_openai_route_to_v1_and_drops_api_version() -> None:
+    from agentops.agent.llm_assist._client import (
+        _normalize_foundry_openai_client,
+    )
+
+    client = _FakeOpenAIClient(
+        "https://acct.services.ai.azure.com/api/projects/p/openai/"
+    )
+    normalized = _normalize_foundry_openai_client(client)
+
+    assert normalized.with_options_kwargs is not None
+    assert (
+        normalized.with_options_kwargs["base_url"]
+        == "https://acct.services.ai.azure.com/api/projects/p/openai/v1/"
+    )
+    # The injected ``api-version`` query param must be cleared, otherwise the
+    # Foundry v1 route returns HTTP 404.
+    assert normalized.with_options_kwargs["default_query"] == {
+        "api-version": None
+    }
+
+
+def test_normalize_leaves_v1_route_but_still_drops_api_version() -> None:
+    from agentops.agent.llm_assist._client import (
+        _normalize_foundry_openai_client,
+    )
+
+    client = _FakeOpenAIClient(
+        "https://acct.services.ai.azure.com/api/projects/p/openai/v1/"
+    )
+    normalized = _normalize_foundry_openai_client(client)
+
+    assert (
+        normalized.with_options_kwargs["base_url"]
+        == "https://acct.services.ai.azure.com/api/projects/p/openai/v1/"
+    )
+    assert normalized.with_options_kwargs["default_query"] == {
+        "api-version": None
+    }
+
+
+def test_normalize_leaves_unknown_route_untouched() -> None:
+    from agentops.agent.llm_assist._client import (
+        _normalize_foundry_openai_client,
+    )
+
+    client = _FakeOpenAIClient("https://custom.example.com/v1/")
+    normalized = _normalize_foundry_openai_client(client)
+
+    # Non-Foundry routes are returned as-is; with_options is never called.
+    assert normalized is client
+    assert client.with_options_kwargs is None
+
+
+def test_normalize_ignores_client_without_base_url() -> None:
+    from agentops.agent.llm_assist._client import (
+        _normalize_foundry_openai_client,
+    )
+
+    sentinel = object()
+    assert _normalize_foundry_openai_client(sentinel) is sentinel

{agentops_accelerator-0.8.0 → agentops_accelerator-0.8.2}/tests/unit/test_telemetry.py

@@ -708,6 +708,46 @@ def test_azure_monitor_skipped_when_connection_string_lacks_application_id(
     assert payload.diagnostics["discovery_reason"]
 
 
+def test_query_application_insights_returns_none_on_read_timeout(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A read timeout must degrade quietly, not raise.
+
+    ``socket.timeout`` (aka ``TimeoutError``) is an ``OSError`` but NOT a
+    ``urllib.error.URLError``, so the previous narrow ``except URLError``
+    let it escape and surface a noisy non-fatal INFO line on the console.
+    The fix catches ``OSError`` and returns ``None``.
+    """
+    import socket
+
+    def _raise_timeout(*_args, **_kwargs):
+        raise socket.timeout("The read operation timed out")
+
+    monkeypatch.setattr(azure_monitor.request, "urlopen", _raise_timeout)
+
+    assert (
+        azure_monitor._query_application_insights("app-id", "bearer", "kql")
+        is None
+    )
+
+
+def test_query_application_insights_returns_none_on_urlerror(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Transport failures (URLError) also degrade quietly to None."""
+    from urllib.error import URLError
+
+    def _raise_urlerror(*_args, **_kwargs):
+        raise URLError("connection refused")
+
+    monkeypatch.setattr(azure_monitor.request, "urlopen", _raise_urlerror)
+
+    assert (
+        azure_monitor._query_application_insights("app-id", "bearer", "kql")
+        is None
+    )
+
+
 def _app_insights_result(row: dict[str, object]) -> dict[str, object]:
     return {
         "tables": [