Feature: Make trace_include_sensitive_data configurable via environment variable (openai#1192)

Co-authored-by: SyedMohamedHyder <[email protected]>

Author: Kunmeer-SyedMohamedHyder

src/agents/run.py

@@ -2,6 +2,7 @@
 
 import asyncio
 import inspect
+import os
 from dataclasses import dataclass, field
 from typing import Any, Callable, Generic, cast, get_args
 
@@ -91,6 +92,12 @@ def get_default_agent_runner() -> AgentRunner:
     return DEFAULT_AGENT_RUNNER
 
 
+def _default_trace_include_sensitive_data() -> bool:
+    """Returns the default value for trace_include_sensitive_data based on environment variable."""
+    val = os.getenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", "true")
+    return val.strip().lower() in ("1", "true", "yes", "on")
+
+
 @dataclass
 class ModelInputData:
     """Container for the data that will be sent to the model."""
@@ -145,7 +152,9 @@ class RunConfig:
     """Whether tracing is disabled for the agent run. If disabled, we will not trace the agent run.
     """
 
-    trace_include_sensitive_data: bool = True
+    trace_include_sensitive_data: bool = field(
+        default_factory=_default_trace_include_sensitive_data
+    )
     """Whether we include potentially sensitive data (for example: inputs/outputs of tool calls or
     LLM generations) in traces. If False, we'll still create spans for these events, but the
     sensitive data will not be included.

tests/test_run_config.py

@@ -86,3 +86,55 @@ async def test_agent_model_object_is_used_when_present() -> None:
     # the FakeModel on the agent.
     assert provider.last_requested is None
     assert result.final_output == "from-agent-object"
+
+
+def test_trace_include_sensitive_data_defaults_to_true_when_env_not_set(monkeypatch):
+    """By default, trace_include_sensitive_data should be True when the env is not set."""
+    monkeypatch.delenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", raising=False)
+    config = RunConfig()
+    assert config.trace_include_sensitive_data is True
+
+
+@pytest.mark.parametrize(
+    "env_value,expected",
+    [
+        ("true", True),
+        ("True", True),
+        ("1", True),
+        ("yes", True),
+        ("on", True),
+        ("false", False),
+        ("False", False),
+        ("0", False),
+        ("no", False),
+        ("off", False),
+    ],
+    ids=[
+        "lowercase-true",
+        "capital-True",
+        "numeric-1",
+        "text-yes",
+        "text-on",
+        "lowercase-false",
+        "capital-False",
+        "numeric-0",
+        "text-no",
+        "text-off",
+    ],
+)
+def test_trace_include_sensitive_data_follows_env_value(env_value, expected, monkeypatch):
+    """trace_include_sensitive_data should follow the environment variable if not explicitly set."""
+    monkeypatch.setenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", env_value)
+    config = RunConfig()
+    assert config.trace_include_sensitive_data is expected
+
+
+def test_trace_include_sensitive_data_explicit_override_takes_precedence(monkeypatch):
+    """Explicit value passed to RunConfig should take precedence over the environment variable."""
+    monkeypatch.setenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", "false")
+    config = RunConfig(trace_include_sensitive_data=True)
+    assert config.trace_include_sensitive_data is True
+
+    monkeypatch.setenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", "true")
+    config = RunConfig(trace_include_sensitive_data=False)
+    assert config.trace_include_sensitive_data is False