From e6c75579fa71e297a9216242dd648e200fccdc57 Mon Sep 17 00:00:00 2001 From: Evan Mattson Date: Mon, 13 Jul 2026 11:52:49 +0900 Subject: [PATCH 1/2] Refine DevUI request logging --- .../devui/agent_framework_devui/_server.py | 4 ---- .../packages/devui/tests/devui/test_server.py | 24 +++++++++++++++++++ 2 files changed, 24 insertions(+), 4 deletions(-) diff --git a/python/packages/devui/agent_framework_devui/_server.py b/python/packages/devui/agent_framework_devui/_server.py index 18a90e44a3e..b8db1590915 100644 --- a/python/packages/devui/agent_framework_devui/_server.py +++ b/python/packages/devui/agent_framework_devui/_server.py @@ -837,10 +837,6 @@ async def create_response(request: AgentFrameworkRequest, raw_request: Request) return await openai_executor.execute_sync(request) # Route to local Agent Framework executor (original behavior) - raw_body = await raw_request.body() - logger.info(f"Raw request body: {raw_body.decode()}") - logger.info(f"Parsed request: metadata={request.metadata}") - # Get entity_id from metadata entity_id = request.get_entity_id() logger.info(f"Extracted entity_id: {entity_id}") diff --git a/python/packages/devui/tests/devui/test_server.py b/python/packages/devui/tests/devui/test_server.py index 075bb9d07a3..708585c6f5f 100644 --- a/python/packages/devui/tests/devui/test_server.py +++ b/python/packages/devui/tests/devui/test_server.py @@ -4,6 +4,7 @@ import asyncio import inspect +import logging import sys import tempfile from pathlib import Path @@ -653,6 +654,29 @@ def test_devserver_auth_can_be_explicitly_disabled(monkeypatch): assert response.status_code == 200 +def test_responses_endpoint_does_not_log_request_content(caplog): + """Request input and metadata must not be written to server logs.""" + server = DevServer(host="127.0.0.1", auth_enabled=False) + app = server.get_app() + input_marker = "private-input-marker" + metadata_marker = "private-metadata-marker" + caplog.set_level(logging.DEBUG, logger="agent_framework_devui._server") + + with TestClient(app, base_url="http://127.0.0.1") as client: + response = client.post( + "/v1/responses", + json={ + "input": input_marker, + "metadata": {"private_value": metadata_marker}, + "stream": False, + }, + ) + + assert response.status_code == 400 + assert input_marker not in caplog.text + assert metadata_marker not in caplog.text + + def test_devserver_rejects_non_loopback_no_auth(monkeypatch): """Non-loopback binds must not be network-reachable without authentication.""" monkeypatch.delenv("DEVUI_AUTH_TOKEN", raising=False) From e5d5b18172e76815c4ae986712b4b3df094610da Mon Sep 17 00:00:00 2001 From: Evan Mattson Date: Mon, 13 Jul 2026 12:28:48 +0900 Subject: [PATCH 2/2] Address DevUI logging review feedback --- python/packages/devui/agent_framework_devui/_server.py | 4 ++-- python/packages/devui/tests/devui/test_server.py | 10 +++++++--- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/python/packages/devui/agent_framework_devui/_server.py b/python/packages/devui/agent_framework_devui/_server.py index b8db1590915..00e03a1434c 100644 --- a/python/packages/devui/agent_framework_devui/_server.py +++ b/python/packages/devui/agent_framework_devui/_server.py @@ -839,12 +839,13 @@ async def create_response(request: AgentFrameworkRequest, raw_request: Request) # Route to local Agent Framework executor (original behavior) # Get entity_id from metadata entity_id = request.get_entity_id() - logger.info(f"Extracted entity_id: {entity_id}") if not entity_id: error = OpenAIError.create("Missing entity_id in metadata. Provide metadata.entity_id in request.") return JSONResponse(status_code=400, content=error.to_dict()) + logger.info("Extracted entity_id: %s", entity_id) + # Get executor and validate entity exists executor = await self._ensure_executor() try: @@ -940,7 +941,6 @@ async def create_conversation(raw_request: Request) -> dict[str, Any] | JSONResp try: metadata = request_data.get("metadata") - logger.debug(f"Creating OpenAI conversation with metadata: {metadata}") conversation = await client.conversations.create(metadata=metadata) logger.info(f"Created OpenAI conversation: {conversation.id}") return conversation.model_dump() diff --git a/python/packages/devui/tests/devui/test_server.py b/python/packages/devui/tests/devui/test_server.py index 708585c6f5f..9ebd4ee40d1 100644 --- a/python/packages/devui/tests/devui/test_server.py +++ b/python/packages/devui/tests/devui/test_server.py @@ -656,7 +656,7 @@ def test_devserver_auth_can_be_explicitly_disabled(monkeypatch): def test_responses_endpoint_does_not_log_request_content(caplog): """Request input and metadata must not be written to server logs.""" - server = DevServer(host="127.0.0.1", auth_enabled=False) + server = _server_with_mock_agent(host="127.0.0.1", auth_enabled=False) app = server.get_app() input_marker = "private-input-marker" metadata_marker = "private-metadata-marker" @@ -667,12 +667,16 @@ def test_responses_endpoint_does_not_log_request_content(caplog): "/v1/responses", json={ "input": input_marker, - "metadata": {"private_value": metadata_marker}, + "metadata": {"entity_id": "mock", "private_value": metadata_marker}, "stream": False, }, ) - assert response.status_code == 400 + assert response.status_code == 404 + assert any( + record.name == "agent_framework_devui._server" and record.getMessage() == "Extracted entity_id: mock" + for record in caplog.records + ) assert input_marker not in caplog.text assert metadata_marker not in caplog.text