Redaction

Secret masking for provider error text before it leaves the code interpreter.

Provider and SDK exceptions can echo credentials (API keys, bearer tokens, credential URLs). Each sink that their text reaches masks it itself, so call sites format exceptions normally:

• CodeInterpreterError masks its own message.
• TemplateBuildResult masks its detail.
• Code interpreter loggers carry RedactingFilter, which masks the message and the traceback.
• Spans record a masked exception event (observability._start_span).
• ExecutionResult.create masks an exception passed as error. A string is kept unchanged, because the user program's own errors must reach the model as is; cause-chain renderings use redacted_chain.

Only the secrets are masked; the rest of the message and its cause chain are kept, so the failure stays diagnosable. The masking engine and most rules come from gllm_core.masking. The raw text is still available to programmatic callers through the exception's __cause__ chain.

RedactingFilter

Bases: Filter

Mask secrets in a record's message and traceback before any handler sees it.

The traceback is rendered here, masked, into exc_text and exc_info is cleared, so a handler that reads the live exception cannot reach the raw text.

filter(record)

Mask the record in place.

Parameters:

Name	Type	Description	Default
record	LogRecord	The record to mask.	required

Returns:

Name	Type	Description
bool	bool	Always True; the record is kept.

format_error_chain(error)

Render an exception with its cause chain intact.

str(e) alone drops the wrapped cause, which is where the useful detail lives — a pyqwest TLS EOF reads as "peer closed connection without sending TLS close_notify" only on the inner exception. That holds however the SDK presents the failure: OpenSandbox's converter embeds the immediate cause's message in its wrapper, so a one-level chain survives str() by luck, but anything deeper does not. The result is raw provider text: pass it through redact (or use redacted_chain) before it leaves the sandbox.

Parameters:

Name	Type	Description	Default
error	BaseException	The exception to render.	required

Returns:

Name	Type	Description
str	str	The exception and its causes, outermost first, stopping at a context the raiser suppressed.

get_redacting_logger(name)

Get the module logger with RedactingFilter attached.

Parameters:

Name	Type	Description	Default
name	str	The logger name, usually __name__.	required

Returns:

Type	Description
Logger	logging.Logger: The logger, masking every record logged on it.

qualified_type(error)

Render an exception's fully qualified type name for FailureDetail.exception_type.

Shared so every backend reports the same string for the same exception: consumers branch on this value, so a per-backend spelling would silently break them.

Parameters:

Name	Type	Description	Default
error	BaseException	The exception to name.	required

Returns:

Name	Type	Description
str	str	Dotted module path and qualified class name, e.g. httpx.ReadError.

redact(text, fallback=REDACTION_FAILED)

Mask registered secret values and credential shapes, keeping the rest of the text.

Parameters:

Name	Type	Description	Default
text	str	Provider text to mask.	required
fallback	str	Returned instead of text when a masking rule fails, so raw text never escapes. Defaults to REDACTION_FAILED.	REDACTION_FAILED

Returns:

Name	Type	Description
str	str	The text with every secret replaced by a placeholder, or fallback when masking fails.

redacted_chain(error)

Render an exception's cause chain (see format_error_chain) with secrets masked.

Parameters:

Name	Type	Description	Default
error	BaseException	The exception to render.	required

Returns:

Name	Type	Description
str	str	The masked cause chain, or the qualified type name when masking fails.

redacted_message(error)

Render str(error) with secrets masked.

Parameters:

Name	Type	Description	Default
error	BaseException	The exception to render.	required

Returns:

Name	Type	Description
str	str	The masked message, or the qualified type name when masking fails.

redacted_traceback(error)

Render an exception's full traceback, chained causes included, with secrets masked.

Parameters:

Name	Type	Description	Default
error	BaseException	The exception to render.	required

Returns:

Name	Type	Description
str	str	The masked traceback, or the qualified type name when masking fails.

register_secret(value)

Mask value by exact match in every later redaction, whatever its shape.

Called where a configured credential enters (sandbox create, template builder __init__), so paths that never see the key (execution, download, module helpers) still mask it.

Parameters:

Name	Type	Description	Default
value	str | None	The secret, such as the configured API key. None and values shorter than 8 characters are ignored.	required