From bf88b7ca9fffac7378ecc31d05c02546349f8cb6 Mon Sep 17 00:00:00 2001 From: liweiguang Date: Mon, 9 Feb 2026 13:11:53 +0800 Subject: [PATCH 1/3] fix(tracing): default sensitive trace data to false --- docs/tracing.md | 2 +- src/agents/run_config.py | 2 +- tests/test_run_config.py | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/tracing.md b/docs/tracing.md index e6be1da87e..3d266a9356 100644 --- a/docs/tracing.md +++ b/docs/tracing.md @@ -85,7 +85,7 @@ The `generation_span()` stores the inputs/outputs of the LLM generation, and `fu Similarly, Audio spans include base64-encoded PCM data for input and output audio by default. You can disable capturing this audio data by configuring [`VoicePipelineConfig.trace_include_sensitive_audio_data`][agents.voice.pipeline_config.VoicePipelineConfig.trace_include_sensitive_audio_data]. -By default, `trace_include_sensitive_data` is `True`. You can set the default without code by exporting the `OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA` environment variable to `true/1` or `false/0` before running your app. +By default, `trace_include_sensitive_data` is `False`. You can set the default without code by exporting the `OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA` environment variable to `true/1` or `false/0` before running your app. ## Custom tracing processors diff --git a/src/agents/run_config.py b/src/agents/run_config.py index d182905866..5145229b6d 100644 --- a/src/agents/run_config.py +++ b/src/agents/run_config.py @@ -29,7 +29,7 @@ def _default_trace_include_sensitive_data() -> bool: """Return the default for trace_include_sensitive_data based on environment.""" - val = os.getenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", "true") + val = os.getenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", "false") return val.strip().lower() in ("1", "true", "yes", "on") diff --git a/tests/test_run_config.py b/tests/test_run_config.py index 31d6d0a46a..67cbc90229 100644 --- a/tests/test_run_config.py +++ b/tests/test_run_config.py @@ -88,11 +88,11 @@ async def test_agent_model_object_is_used_when_present() -> None: assert result.final_output == "from-agent-object" -def test_trace_include_sensitive_data_defaults_to_true_when_env_not_set(monkeypatch): - """By default, trace_include_sensitive_data should be True when the env is not set.""" +def test_trace_include_sensitive_data_defaults_to_false_when_env_not_set(monkeypatch): + """By default, trace_include_sensitive_data should be False when the env is not set.""" monkeypatch.delenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", raising=False) config = RunConfig() - assert config.trace_include_sensitive_data is True + assert config.trace_include_sensitive_data is False @pytest.mark.parametrize( From 3b3d21f4200fec8d43345898be453f89f89ede2b Mon Sep 17 00:00:00 2001 From: liweiguang Date: Mon, 9 Feb 2026 14:30:07 +0800 Subject: [PATCH 2/3] test(tracing): pin sensitive-data snapshots to explicit opt-in --- tests/test_tracing_errors.py | 32 ++++++++++++++++++++++----- tests/test_tracing_errors_streamed.py | 32 ++++++++++++++++++++++----- 2 files changed, 54 insertions(+), 10 deletions(-) diff --git a/tests/test_tracing_errors.py b/tests/test_tracing_errors.py index 6149afc79f..6f022bb4f9 100644 --- a/tests/test_tracing_errors.py +++ b/tests/test_tracing_errors.py @@ -13,6 +13,7 @@ InputGuardrail, InputGuardrailTripwireTriggered, MaxTurnsExceeded, + RunConfig, RunContextWrapper, Runner, TResponseInputItem, @@ -92,7 +93,11 @@ async def test_multi_turn_no_handoffs(): ) with pytest.raises(ValueError): - await Runner.run(agent, input="first_test") + await Runner.run( + agent, + input="first_test", + run_config=RunConfig(trace_include_sensitive_data=True), + ) assert fetch_normalized_spans() == snapshot( [ @@ -149,7 +154,11 @@ async def test_tool_call_error(): ] ) - result = await Runner.run(agent, input="first_test") + result = await Runner.run( + agent, + input="first_test", + run_config=RunConfig(trace_include_sensitive_data=True), + ) tool_outputs = [item for item in result.new_items if item.type == "tool_call_output_item"] assert tool_outputs, "Expected a tool output item for invalid JSON" @@ -232,7 +241,11 @@ async def test_multiple_handoff_doesnt_error(): [get_text_message("done")], ] ) - result = await Runner.run(agent_3, input="user_message") + result = await Runner.run( + agent_3, + input="user_message", + run_config=RunConfig(trace_include_sensitive_data=True), + ) assert result.last_agent == agent_1, "should have picked first handoff" assert fetch_normalized_spans() == snapshot( @@ -367,7 +380,11 @@ async def test_handoffs_lead_to_correct_agent_spans(): [get_text_message("done")], ] ) - result = await Runner.run(agent_3, input="user_message") + result = await Runner.run( + agent_3, + input="user_message", + run_config=RunConfig(trace_include_sensitive_data=True), + ) assert result.last_agent == agent_3, ( f"should have ended on the third agent, got {result.last_agent.name}" @@ -475,7 +492,12 @@ async def test_max_turns_exceeded(): ) with pytest.raises(MaxTurnsExceeded): - await Runner.run(agent, input="user_message", max_turns=2) + await Runner.run( + agent, + input="user_message", + max_turns=2, + run_config=RunConfig(trace_include_sensitive_data=True), + ) assert fetch_normalized_spans() == snapshot( [ diff --git a/tests/test_tracing_errors_streamed.py b/tests/test_tracing_errors_streamed.py index 5b66cb968b..a3aa5f2114 100644 --- a/tests/test_tracing_errors_streamed.py +++ b/tests/test_tracing_errors_streamed.py @@ -16,6 +16,7 @@ MaxTurnsExceeded, OutputGuardrail, OutputGuardrailTripwireTriggered, + RunConfig, RunContextWrapper, Runner, TResponseInputItem, @@ -98,7 +99,11 @@ async def test_multi_turn_no_handoffs(): ) with pytest.raises(ValueError): - result = Runner.run_streamed(agent, input="first_test") + result = Runner.run_streamed( + agent, + input="first_test", + run_config=RunConfig(trace_include_sensitive_data=True), + ) async for _ in result.stream_events(): pass @@ -158,7 +163,11 @@ async def test_tool_call_error(): ] ) - result = Runner.run_streamed(agent, input="first_test") + result = Runner.run_streamed( + agent, + input="first_test", + run_config=RunConfig(trace_include_sensitive_data=True), + ) async for _ in result.stream_events(): pass @@ -243,7 +252,11 @@ async def test_multiple_handoff_doesnt_error(): [get_text_message("done")], ] ) - result = Runner.run_streamed(agent_3, input="user_message") + result = Runner.run_streamed( + agent_3, + input="user_message", + run_config=RunConfig(trace_include_sensitive_data=True), + ) async for _ in result.stream_events(): pass @@ -380,7 +393,11 @@ async def test_handoffs_lead_to_correct_agent_spans(): [get_text_message("done")], ] ) - result = Runner.run_streamed(agent_3, input="user_message") + result = Runner.run_streamed( + agent_3, + input="user_message", + run_config=RunConfig(trace_include_sensitive_data=True), + ) async for _ in result.stream_events(): pass @@ -485,7 +502,12 @@ async def test_max_turns_exceeded(): ) with pytest.raises(MaxTurnsExceeded): - result = Runner.run_streamed(agent, input="user_message", max_turns=2) + result = Runner.run_streamed( + agent, + input="user_message", + max_turns=2, + run_config=RunConfig(trace_include_sensitive_data=True), + ) async for _ in result.stream_events(): pass From 35c274f7af39c2a0fad21e36743a7a7e25483cad Mon Sep 17 00:00:00 2001 From: liweiguang Date: Tue, 10 Feb 2026 09:50:16 +0800 Subject: [PATCH 3/3] test(mcp): refresh tracing snapshot after input normalization --- tests/mcp/test_mcp_tracing.py | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/tests/mcp/test_mcp_tracing.py b/tests/mcp/test_mcp_tracing.py index 9cb3454b1b..504182270c 100644 --- a/tests/mcp/test_mcp_tracing.py +++ b/tests/mcp/test_mcp_tracing.py @@ -61,7 +61,6 @@ async def test_mcp_tracing(): "type": "function", "data": { "name": "test_tool_1", - "input": "", "output": "{'type': 'text', 'text': 'result_test_tool_1_{}'}", # noqa: E501 "mcp_data": {"server": "fake_mcp_server"}, }, @@ -122,17 +121,12 @@ async def test_mcp_tracing(): "children": [ { "type": "function", - "data": { - "name": "non_mcp_tool", - "input": "", - "output": "tool_result", - }, + "data": {"name": "non_mcp_tool"}, }, { "type": "function", "data": { "name": "test_tool_2", - "input": "", "output": "{'type': 'text', 'text': 'result_test_tool_2_{}'}", # noqa: E501 "mcp_data": {"server": "fake_mcp_server"}, }, @@ -196,7 +190,6 @@ async def test_mcp_tracing(): "type": "function", "data": { "name": "test_tool_3", - "input": "", "output": "{'type': 'text', 'text': 'result_test_tool_3_{}'}", # noqa: E501 "mcp_data": {"server": "fake_mcp_server"}, },