From b30981595bff41d9b99dea6fc2ba61641128a658 Mon Sep 17 00:00:00 2001 From: Ali Khokhar <20476625+Alishahryar1@users.noreply.github.com> Date: Sat, 10 Oct 2026 23:06:26 -0700 Subject: [PATCH] patch: disable automatic variable dumps in file logs (#2047) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why The file logger automatically includes variable values in exception tracebacks, bypassing structured trace redaction and potentially exposing request credentials. Addresses the automatic traceback dumps reported in #2002. ## How Set `diagnose=False` when creating file sinks. Exception chains, stack traces, and explicitly logged context remain available. Automatic variable annotations are disabled, so any additional diagnostic values must be logged explicitly.

RetriggerConfidence Score: 5/5

Safe to merge. Executed checks confirmed the credential protection without losing exception details or explicit context.

T-Rex evidence

**[Command output from the check](https://app.greptile.com/trex/artifacts/44936914-51ff-483f-9754-ab9db6797f1d)** - Ran the prescribed focused test command before environment repair and captured the missing-interpreter warning and pytest\_asyncio import failure, showing an environment blocker rather than a PR defect. **[Command output from the check](https://app.greptile.com/trex/artifacts/947bf228-7b15-4b04-93c6-517557c46f3f)** - Ran uv sync --frozen --group dev and captured its successful installation output, showing that the test environment was restored. **[Command output from the check](https://app.greptile.com/trex/artifacts/89879f93-b2d8-403f-9be2-7ca43a40731c)** - Reran the exact requested pytest command and captured 24 passing tests with exit code 0, showing that the focused suite succeeds. **[Evidence from the check](https://app.greptile.com/trex/artifacts/ed90ce90-f7f5-463d-a5bf-cad7497dfca8)** - Authored and executed this isolated harness against both Git revisions with real file sinks, making the paired runtime observations reproducible without tracked code changes. **[Command output from the check](https://app.greptile.com/trex/artifacts/3f4233df-0e62-40df-82ff-1ce0c64dc193)** - Executed 16 parent-revision cases and captured their actual serialized file records, showing synthetic local credentials exposed across both logging routes and all four sink configurations. **[Command output from the check](https://app.greptile.com/trex/artifacts/dd8d06c4-0d2c-4215-8154-0c1c498c707f)** - Executed the same 16 cases against the PR and captured their actual serialized file records, showing automatic credentials omitted while exception chains, frames, and explicit context remain. **[Command output from the check](https://app.greptile.com/trex/artifacts/18872c5f-f89f-4f68-9c81-de4081418efa)** - Executed working-tree and staged diff checks plus git status after validation, showing no tracked modifications. View artifacts

Summary

 File logs now use `diagnose=False` to stop automatic variable dumps in exception traces. - File exception logs keep failure details without dumping local values.
Reviews (1) · Last reviewed commit: ["patch: disable automatic variable dumps ..."](https://github.com/alishahryar1/free-claude-code/commit/cd1550ba32c39c727adc36209b6ce98c26a91930) · [Reviewed by Greptile](https://www.greptile.com/?utm_source=greptile_expert&utm_medium=github&utm_campaign=code_reviews&utm_content=alishahryar1/free-claude-code) --- src/free_claude_code/config/logging_config.py | 1 + tests/config/test_logging_config.py | 25 +++++++++++++++++++ 2 files changed, 26 insertions(+) diff --git a/src/free_claude_code/config/logging_config.py b/src/free_claude_code/config/logging_config.py index 6391fd38..130b177e 100644 --- a/src/free_claude_code/config/logging_config.py +++ b/src/free_claude_code/config/logging_config.py @@ -71,6 +71,7 @@ def _add_file_sink(log_file: str | Path, level: str) -> int: log_path, level=level, serialize=True, + diagnose=False, encoding="utf-8", mode="a", rotation="50 MB", diff --git a/tests/config/test_logging_config.py b/tests/config/test_logging_config.py index 8ae05efa..8619f10d 100644 --- a/tests/config/test_logging_config.py +++ b/tests/config/test_logging_config.py @@ -76,6 +76,31 @@ def test_native_json_preserves_exception_chain_and_stack(tmp_path, stdlib): assert "test_native_json_preserves_exception_chain_and_stack" in row["text"] +@pytest.mark.parametrize("stdlib", [False, True]) +def test_exception_logs_omit_local_values_but_keep_explicit_context(tmp_path, stdlib): + log_file = tmp_path / "exception.log" + configure_logging(log_file, force=True) + secret = "DUMMY_EXCEPTION_CREDENTIAL" + headers = {"Authorization": f"Bearer {secret}"} + try: + _ = len(headers) / 0 + except ZeroDivisionError: + with logger.contextualize(attempt=2): + if stdlib: + logging.getLogger("test.exception").exception("request failed") + else: + logger.exception("request failed") + logger.complete() + + text = log_file.read_text(encoding="utf-8") + assert secret not in text + row = json.loads(text) + assert row["record"]["extra"]["attempt"] == 2 + assert row["record"]["message"] == "request failed" + assert row["record"]["exception"]["traceback"] is True + assert "ZeroDivisionError: division by zero" in row["text"] + + def test_logging_preserves_records_across_process_restarts(tmp_path): log_file = tmp_path / "server.log" script = """