[lorenzejay]

Related issue

None.

Summary

Long conversational histories currently fail at the model context limit without using CrewAI's shared compaction. Reuse the BaseLLM summarizer for built-in converse, history-only, and router calls, with proactive compaction and one recovery attempt after a provider context-limit error.

Preserve the public transcript, system prompt, and latest user message. Keep internal summary text out of streamed replies. Enable handling by default through respect_context_window, with an opt-out supported in Python and declarative flows. Document the behavior in English, Arabic, Korean, and Brazilian Portuguese.

Verification

• Added behavioral tests for compaction, normal and streaming recovery, transcript and latest-message preservation, router and history handling, bounded retries, failures, opt-out, and declaration round-tripping.
• 555 focused tests passed across conversational flows, flow definitions, shared agent utilities, and context compaction.
• Ruff, formatting, and mypy passed, including repository commit hooks.
• Real OpenAI calls verified proactive compaction and recovery from actual 140,065-token HTTP 400 errors against a 128,000-token window in normal and streaming turns. Preflight was bypassed only in recovery probes to exercise the provider-error path; counting, summaries, and completions called the real provider.
• Two consecutive real compactions on the same LLM and Flow preserved the launch date and answered the latest question directly.

Additional context

Compaction changes the model request; state.messages remains intact for display and persistence, so later turns may summarize again. Call-only custom LLM objects, legacy intent pre-classification, and custom route handlers retain their existing context handling. Local probe scripts and logs are excluded from this PR.

---

Note

Medium Risk
Changes default LLM request shaping for built-in chat/router paths and adds one-shot recovery on context errors; transcript persistence is preserved but model inputs differ from before when histories are long.

Overview
Adds automatic context compaction for conversational Flows on BaseLLM models, enabled by default via new ConversationConfig.respect_context_window (also on declarative conversational blocks and DSL round-trips).

Built-in converse, deprecated answer_from_history, and router calls now go through _call_conversation_llm, which proactively summarizes when the window is near the limit and retries once after provider context-overflow errors. Compaction only changes the per-turn model request: state.messages stays intact, system prompts are kept, the latest user turn is re-appended after summarization, and summary LLM calls run with streaming disabled so internal text does not leak into replies. Custom call()-only LLMs, legacy intent pre-classification, and custom route handlers are unchanged. agent_utils gains allow_single_user_compaction so router payloads that are a single user message can still be compacted.

Docs for conversational flows are updated in en, ar, ko, and pt-BR. test_flow_context_compaction.py covers proactive compaction, streaming, bounded retry, opt-out, router/history paths, and declaration round-tripping. authlib is bumped to ≥1.9.1 in pyproject.toml / uv.lock.

^{Reviewed by Cursor Bugbot for commit 0836feb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
crewai	🟢 Ready	View Preview	Oct 27, 2026, 6:03 AM

💡 Tip: Enable Automations to automatically generate PRs for you.

[strix-security]

Strix Security Review

Warning

This pull request has 33 commits after the last Strix review (f9e7ef3). Strix has not reviewed these changes.
Automatic review on push is off for this repository. To review the latest changes, tag @strix-security in a comment, or turn on re-review on push.

✅ No open security findings.

PR summary: This PR adds context-window compaction to conversational Flows: the built-in `converse`, `answer_from_history` and router LLM calls now go through CrewAI's shared summarizer (compacting proactively near the model limit and retrying once after a provider context-limit error), controlled by a new `respect_context_window` setting that defaults to enabled across the Python config, the declarative definition and the DSL round-trip, with documentation in four locales.

Review summary

Reviewed all ten changed files in full, including every hunk of the new _call_conversation_llm helper, the three call sites it replaces, the new respect_context_window plumbing and the allow_single_user guard change in the shared summarizer. Static analysis (semgrep python ruleset, bandit) reported nothing on the changed files. No security vulnerabilities were confirmed. The security-relevant properties hold up: compaction request lists are always request-local so the canonical transcript cannot be mutated; summarize_messages pins system messages, so the system prompt survives; the summary is inserted with the default user role and never as a system message, and the latest user message is re-appended verbatim; internal summary calls run under a scoped streaming override, so summary text cannot surface in the streamed reply, and the override is restored correctly for the real answer; provider before_llm_call hooks still gate the summarization request, so guarded/blocked calls are not smuggled past an operator's policy; the opt-out is honoured on all three call sites and round-trips through declarations; and retry behaviour is bounded to a single recovery attempt. Two suspected issues were investigated and rejected: prompt-injection laundering across the compaction boundary, and resource amplification from the new default-on summarization path. One non-security observation was noted by the validating reviewers and is not a blocker: when both the proactive and the recovery compaction fire in the same turn, the latest user message can be appended to the retried request a second time, which is a correctness/cleanup matter rather than a security issue.

Ruled out (2)

• Can a chat user plant forged assistant statements that survive context compaction and poison every later turn?
  The summary is re-inserted with the default user role rather than as a system message, the built-in conversational handlers call the model with no tools or side effects, and the canonical transcript in state.messages is never mutated, so the attacker gains no authority beyond ordinary user content…
• Can a chat user drive unbounded model cost or denial of service through the now default-on compaction path?
  Measured amplification is bounded at a small constant factor (roughly 1.2x the user's own transmitted transcript, about 2.3x in the worst case of one message larger than the entire window), summary provider calls scale linearly with transcript size, and each call site performs at most one proactive…

_{Review 1 on this PR · f9e7ef3 · requested Oct 26 17:58 UTC when the PR was opened}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}

[Vidit-Ostwal]

One naming suggestion for clarity.

[Vidit-Ostwal]

Lgtm