value handling policy change: allow,deny changes to allow,redact,drop

Author: tzanko-matev

codetracer-python-recorder/README.md

@@ -56,7 +56,7 @@ or activated virtual environments behave identically to `python script.py`.
 - Supported selector domains: `pkg`, `file`, `obj` for scopes; `local`, `global`, `arg`, `ret`, `attr` for value policies. Match types default to `glob` and also accept `regex` or `literal` (e.g. `local:regex:^(metric|masked)_\w+$`).
 - Default discovery: `.codetracer/trace-filter.toml` next to the traced script. Chain additional files via CLI (`--trace-filter path_a --trace-filter path_b`), environment variable (`CODETRACER_TRACE_FILTER=path_a::path_b`), or Python helpers (`trace(..., trace_filter=[path_a, path_b])`). Later entries override earlier ones when selectors overlap.
 - A built-in `builtin-default` filter is always prepended. It skips CPython standard-library frames (e.g. `asyncio`, `threading`, `importlib`) while re-enabling third-party packages under `site-packages` (except helpers such as `_virtualenv.py`), and redacts common secrets (`password`, `token`, API keys, etc.) across locals/globals/args/returns/attributes. Project filters can loosen or tighten these defaults as required.
-- Runtime metadata captures the active chain under `trace_metadata.json -> trace_filter`, including per-kind redaction counters. See `docs/onboarding/trace-filters.md` for the full DSL reference and examples.
+- Runtime metadata captures the active chain under `trace_metadata.json -> trace_filter`, including per-kind redaction and drop counters. See `docs/onboarding/trace-filters.md` for the full DSL reference and examples.
 
 Example snippet:
 ```toml
@@ -70,13 +70,16 @@ default_value_action = "allow"
 
 [[scope.rules]]
 selector = "pkg:my_app.services.*"
-value_default = "deny"
+value_default = "redact"
 [[scope.rules.value_patterns]]
 selector = "local:glob:public_*"
 action = "allow"
 [[scope.rules.value_patterns]]
 selector = 'local:regex:^(metric|masked)_\w+$'
 action = "allow"
+[[scope.rules.value_patterns]]
+selector = "arg:literal:debug_payload"
+action = "drop"
 ```
 
 ## Packaging expectations
@@ -93,4 +96,4 @@ decisions without re-running the trace.
 ## Development benchmarks
 - Rust microbench: `cargo bench --bench trace_filter --no-default-features` exercises baseline, glob-heavy, and regex-heavy selector chains.
 - Python smoke benchmark: `pytest codetracer-python-recorder/tests/python/perf/test_trace_filter_perf.py -q` when the environment variable `CODETRACER_TRACE_FILTER_PERF=1` is set.
-- Run both together with `just bench`. The helper seeds a virtualenv, runs Criterion, then executes the Python smoke test while writing `target/perf/trace_filter_py.json` (per-scenario durations and redaction statistics).
+- Run both together with `just bench`. The helper seeds a virtualenv, runs Criterion, then executes the Python smoke test while writing `target/perf/trace_filter_py.json` (per-scenario durations plus redaction/drop statistics).

codetracer-python-recorder/benches/trace_filter.rs

@@ -332,7 +332,7 @@ default_value_action = "allow"
 
 [[scope.rules]]
 selector = "pkg:bench_pkg.services.api.*"
-value_default = "deny"
+value_default = "redact"
 reason = "Redact service locals except approved public fields"
 [[scope.rules.value_patterns]]
 selector = "local:glob:public_*"
@@ -342,16 +342,16 @@ selector = "local:glob:metric_*"
 action = "allow"
 [[scope.rules.value_patterns]]
 selector = "local:glob:secret_*"
-action = "deny"
+action = "redact"
 [[scope.rules.value_patterns]]
 selector = "local:glob:token_*"
-action = "deny"
+action = "redact"
 [[scope.rules.value_patterns]]
 selector = "local:glob:masked_*"
 action = "allow"
 [[scope.rules.value_patterns]]
 selector = "local:glob:password_*"
-action = "deny"
+action = "redact"
 
 [[scope.rules]]
 selector = "file:glob:bench_pkg/jobs/worker/module_*.py"
@@ -360,7 +360,7 @@ reason = "Disable redundant worker instrumentation"
 
 [[scope.rules]]
 selector = "pkg:bench_pkg.external.integration_*"
-value_default = "deny"
+value_default = "redact"
 [[scope.rules.value_patterns]]
 selector = "local:glob:metric_*"
 action = "allow"
@@ -385,17 +385,17 @@ default_value_action = "allow"
 
 [[scope.rules]]
 selector = 'pkg:regex:^bench_pkg\.services\.api\.module_\d+$'
-value_default = "deny"
+value_default = "redact"
 reason = "Regex match on service modules"
 [[scope.rules.value_patterns]]
 selector = 'local:regex:^(public|metric)_\w+$'
 action = "allow"
 [[scope.rules.value_patterns]]
 selector = 'local:regex:^(secret|token)_\w+$'
-action = "deny"
+action = "redact"
 [[scope.rules.value_patterns]]
 selector = 'local:regex:^(password|api|credit|session)_.*$'
-action = "deny"
+action = "redact"
 
 [[scope.rules]]
 selector = 'file:regex:^bench_pkg/jobs/worker/module_\d+\.py$'
@@ -404,7 +404,7 @@ reason = "Regex skip for worker modules"
 
 [[scope.rules]]
 selector = 'obj:regex:^bench_pkg\.external\.integration_\d+\.integration_op_\d+$'
-value_default = "deny"
+value_default = "redact"
 [[scope.rules.value_patterns]]
 selector = 'local:regex:^masked_.*$'
 action = "allow"

codetracer-python-recorder/resources/trace_filters/builtin_default.toml

@@ -1,7 +1,7 @@
 [meta]
 name = "builtin-default"
 version = 1
-description = "Skip CPython stdlib internals and redact common sensitive identifiers."
+description = "Skip CPython stdlib internals, redact sensitive identifiers, and drop nothing by default."
 labels = ["builtin", "default"]
 
 [scope]
@@ -39,25 +39,25 @@ value_default = "allow"
 
 [[scope.rules.value_patterns]]
 selector = 'local:regex:(?i).*(pass(word)?|passwd|pwd|secret|token|session|cookie|auth|credential|creds|bearer|ssn|credit|card|iban|cvv|cvc|pan|api[_-]?key|private[_-]?key|secret[_-]?key|ssh[_-]?key|jwt|refresh[_-]?token|access[_-]?token).*'
-action = "deny"
+action = "redact"
 reason = "Redact sensitive locals"
 
 [[scope.rules.value_patterns]]
 selector = 'global:regex:(?i).*(pass(word)?|passwd|pwd|secret|token|session|cookie|auth|credential|creds|bearer|ssn|credit|card|iban|cvv|cvc|pan|api[_-]?key|private[_-]?key|secret[_-]?key|ssh[_-]?key|jwt|refresh[_-]?token|access[_-]?token).*'
-action = "deny"
+action = "redact"
 reason = "Redact sensitive globals"
 
 [[scope.rules.value_patterns]]
 selector = 'arg:regex:(?i).*(pass(word)?|passwd|pwd|secret|token|session|cookie|auth|credential|creds|bearer|ssn|credit|card|iban|cvv|cvc|pan|api[_-]?key|private[_-]?key|secret[_-]?key|ssh[_-]?key|jwt|refresh[_-]?token|access[_-]?token).*'
-action = "deny"
+action = "redact"
 reason = "Redact sensitive arguments"
 
 [[scope.rules.value_patterns]]
 selector = 'ret:regex:(?i).*(pass(word)?|passwd|pwd|secret|token|session|cookie|auth|credential|creds|bearer|ssn|credit|card|iban|cvv|cvc|pan|api[_-]?key|private[_-]?key|secret[_-]?key|ssh[_-]?key|jwt|refresh[_-]?token|access[_-]?token).*'
-action = "deny"
+action = "redact"
 reason = "Redact sensitive return values"
 
 [[scope.rules.value_patterns]]
 selector = 'attr:regex:(?i).*(pass(word)?|passwd|pwd|secret|token|session|cookie|auth|credential|creds|bearer|ssn|credit|card|iban|cvv|cvc|pan|api[_-]?key|private[_-]?key|secret[_-]?key|ssh[_-]?key|jwt|refresh[_-]?token|access[_-]?token).*'
-action = "deny"
+action = "redact"
 reason = "Redact sensitive attributes"

codetracer-python-recorder/src/runtime/mod.rs

@@ -16,7 +16,7 @@ use activation::ActivationController;
 use frame_inspector::capture_frame;
 use logging::log_event;
 use value_capture::{
-    capture_call_arguments, record_return_value, record_visible_scope, ValueRedactionStats,
+    capture_call_arguments, record_return_value, record_visible_scope, ValueFilterStats,
 };
 
 use std::collections::{hash_map::Entry, HashMap, HashSet};
@@ -137,31 +137,40 @@ impl FailureStage {
 #[derive(Debug, Default)]
 struct FilterStats {
     skipped_scopes: u64,
-    redactions: ValueRedactionStats,
+    values: ValueFilterStats,
 }
 
 impl FilterStats {
     fn record_skip(&mut self) {
         self.skipped_scopes += 1;
     }
 
-    fn redactions_mut(&mut self) -> &mut ValueRedactionStats {
-        &mut self.redactions
+    fn values_mut(&mut self) -> &mut ValueFilterStats {
+        &mut self.values
     }
 
     fn reset(&mut self) {
         self.skipped_scopes = 0;
-        self.redactions = ValueRedactionStats::default();
+        self.values = ValueFilterStats::default();
     }
 
     fn summary_json(&self) -> serde_json::Value {
         let mut redactions = serde_json::Map::new();
+        let mut drops = serde_json::Map::new();
         for kind in ValueKind::ALL {
-            redactions.insert(kind.label().to_string(), json!(self.redactions.count(kind)));
+            redactions.insert(
+                kind.label().to_string(),
+                json!(self.values.redacted_count(kind)),
+            );
+            drops.insert(
+                kind.label().to_string(),
+                json!(self.values.dropped_count(kind)),
+            );
         }
         json!({
             "scopes_skipped": self.skipped_scopes,
             "value_redactions": serde_json::Value::Object(redactions),
+            "value_drops": serde_json::Value::Object(drops),
         })
     }
 }
@@ -725,7 +734,7 @@ impl Tracer for RuntimeTracer {
 
         if let Ok(fid) = self.ensure_function_id(py, code) {
             let mut telemetry_holder = if wants_telemetry {
-                Some(self.filter_stats.redactions_mut())
+                Some(self.filter_stats.values_mut())
             } else {
                 None
             };
@@ -805,7 +814,7 @@ impl Tracer for RuntimeTracer {
 
         let mut recorded: HashSet<String> = HashSet::new();
         let mut telemetry_holder = if wants_telemetry {
-            Some(self.filter_stats.redactions_mut())
+            Some(self.filter_stats.values_mut())
         } else {
             None
         };
@@ -850,7 +859,7 @@ impl Tracer for RuntimeTracer {
         let object_name = scope_resolution.as_ref().and_then(|res| res.object_name());
 
         let mut telemetry_holder = if wants_telemetry {
-            Some(self.filter_stats.redactions_mut())
+            Some(self.filter_stats.values_mut())
         } else {
             None
         };
@@ -1718,23 +1727,27 @@ def emit_return(value):
 
                 [[scope.rules.value_patterns]]
                 selector = "arg:password"
-                action = "deny"
+                action = "redact"
 
                 [[scope.rules.value_patterns]]
                 selector = "local:password"
-                action = "deny"
+                action = "redact"
 
                 [[scope.rules.value_patterns]]
                 selector = "local:secret"
-                action = "deny"
+                action = "redact"
 
                 [[scope.rules.value_patterns]]
                 selector = "global:shared_secret"
-                action = "deny"
+                action = "redact"
 
                 [[scope.rules.value_patterns]]
                 selector = "ret:literal:app.sec.sensitive"
-                action = "deny"
+                action = "redact"
+
+                [[scope.rules.value_patterns]]
+                selector = "local:internal"
+                action = "drop"
                 "#,
             );
             let config = TraceFilterConfig::from_paths(&[filter_path]).expect("load filter");
@@ -1748,6 +1761,7 @@ shared_secret = "initial"
 
 def sensitive(password):
     secret = "token"
+    internal = "hidden"
     public = "visible"
     globals()['shared_secret'] = password
     snapshot()
@@ -1786,6 +1800,10 @@ sensitive("s3cr3t")
                     variable_names.push(name.clone());
                 }
             }
+            assert!(
+                !variable_names.iter().any(|name| name == "internal"),
+                "internal variable should not be recorded"
+            );
 
             let password_index = variable_names
                 .iter()
@@ -1832,6 +1850,7 @@ sensitive("s3cr3t")
                 "password",
                 SimpleValue::Raw("<redacted>".to_string()),
             );
+            assert_no_variable(&snapshots, "internal");
 
             let return_record = tracer
                 .writer
@@ -1879,23 +1898,27 @@ sensitive("s3cr3t")
 
                 [[scope.rules.value_patterns]]
                 selector = "arg:password"
-                action = "deny"
+                action = "redact"
 
                 [[scope.rules.value_patterns]]
                 selector = "local:password"
-                action = "deny"
+                action = "redact"
 
                 [[scope.rules.value_patterns]]
                 selector = "local:secret"
-                action = "deny"
+                action = "redact"
 
                 [[scope.rules.value_patterns]]
                 selector = "global:shared_secret"
-                action = "deny"
+                action = "redact"
 
                 [[scope.rules.value_patterns]]
                 selector = "ret:literal:app.sec.sensitive"
-                action = "deny"
+                action = "redact"
+
+                [[scope.rules.value_patterns]]
+                selector = "local:internal"
+                action = "drop"
                 "#,
             );
             let config = TraceFilterConfig::from_paths(&[filter_path]).expect("load filter");
@@ -1909,6 +1932,8 @@ shared_secret = "initial"
 
 def sensitive(password):
     secret = "token"
+    internal = "hidden"
+    public = "visible"
     globals()['shared_secret'] = password
     snapshot()
     emit_return(password)
@@ -1999,6 +2024,21 @@ sensitive("s3cr3t")
                 value_redactions.get("attribute").and_then(|v| v.as_u64()),
                 Some(0)
             );
+            let value_drops = stats
+                .get("value_drops")
+                .and_then(|value| value.as_object())
+                .expect("value_drops object");
+            assert_eq!(
+                value_drops.get("argument").and_then(|v| v.as_u64()),
+                Some(0)
+            );
+            assert_eq!(value_drops.get("local").and_then(|v| v.as_u64()), Some(1));
+            assert_eq!(value_drops.get("global").and_then(|v| v.as_u64()), Some(0));
+            assert_eq!(value_drops.get("return").and_then(|v| v.as_u64()), Some(0));
+            assert_eq!(
+                value_drops.get("attribute").and_then(|v| v.as_u64()),
+                Some(0)
+            );
         });
     }