Skip to content

feat: add debug logging for final messages #4682

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ocetars wants to merge 1 commit into
base: master
Choose a base branch
from
Open

feat: add debug logging for final messages #4682

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions astrbot/core/agent/runners/tool_loop_agent_runner.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
import logging
import sys
import time
import traceback
Expand Down Expand Up @@ -113,6 +114,19 @@ async def reset(
)
self.run_context.messages = messages

# ========== DEBUG: dump final messages sent to LLM ==========
# 打印最终发给 LLM 的完整 messages 列表
if logger.isEnabledFor(logging.DEBUG):
logger.debug("===== [LLM Request Messages] =====")
for idx, msg in enumerate(messages):
role = msg.role if hasattr(msg, "role") else msg.get("role", "?")
content = (
msg.content if hasattr(msg, "content") else msg.get("content", "")
)
logger.debug(f" [{idx}] {role}: {content}")
Comment on lines +119 to +126
Copy link
Contributor

@sourcery-ai sourcery-ai bot Jan 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚨 issue (security): 将完整的 LLM 消息写入日志可能会泄露敏感用户数据和凭据。

即使是在 DEBUG 级别，记录完整的提示词和工具消息也可能暴露用户数据、密钥或标识符，尤其是在集中式日志系统中。请对敏感字段进行脱敏处理，只记录元数据（例如角色、长度、工具名），或者将这类日志放在一个明确标记为不安全的开关（例如 unsafe_debug/log_prompts）后面，并确保在非本地环境中默认关闭。

Original comment in English

🚨 issue (security): Dumping full LLM messages to logs can leak sensitive user data and credentials.

Even at DEBUG level, logging full prompts and tool messages can expose user data, secrets, or identifiers, especially in centralized logging systems. Please either redact sensitive fields, restrict logs to metadata (e.g., role, length, tool name), or guard this behind an explicit, clearly unsafe flag (e.g., unsafe_debug/log_prompts) that is disabled in non-local environments.

logger.debug("===== [End LLM Request Messages] =====")
# =============================================================

self.stats = AgentStats()
self.stats.start_time = time.time()

Expand Down