backloop-sdk 0.1.1__tar.gz → 0.1.2__tar.gz

{backloop_sdk-0.1.1 → backloop_sdk-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: backloop-sdk
-Version: 0.1.1
+Version: 0.1.2
 Summary: Python SDK for the Agent Feedback Protocol: validate, send and receive structured feedback from AI agents.
 Project-URL: Homepage, https://trybackloop.com
 Project-URL: Specification, https://trybackloop.com/spec/

{backloop_sdk-0.1.1 → backloop_sdk-0.1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "backloop-sdk"
-version = "0.1.1"
+version = "0.1.2"
 description = "Python SDK for the Agent Feedback Protocol: validate, send and receive structured feedback from AI agents."
 readme = "README.md"
 license = "Apache-2.0"

{backloop_sdk-0.1.1 → backloop_sdk-0.1.2}/src/backloop/__init__.py

@@ -44,7 +44,7 @@ from .validate import (
     validate_submission,
 )
 
-__version__ = "0.1.1"
+__version__ = "0.1.2"
 
 __all__ = [
     "ACK_SCHEMA",

{backloop_sdk-0.1.1 → backloop_sdk-0.1.2}/src/backloop/server.py

@@ -12,6 +12,7 @@ from datetime import datetime, timezone
 from typing import Any, Callable, Dict, List, Mapping, Optional, Tuple, Union
 
 from .ids import new_id
+from .redact import redact as _redact
 from .types import (
     DEFAULT_MAX_BYTES,
     FEEDBACK_TYPES,
@@ -93,6 +94,9 @@ class FeedbackHandler:
       account behind a framework request; used by the integrations.
     - ``rate_limit`` is ``(max, window_seconds)`` per account (or per IP), or
       None to disable it.
+    - ``redact`` removes secrets, card numbers and email addresses from what
+      agents send, before ``on_record`` sees it. True (default), False, or a
+      dict of ``redact()`` options. Not every agent uses a client that does.
     """
 
     def __init__(
@@ -106,6 +110,7 @@ class FeedbackHandler:
         public_endpoint: Optional[str] = None,
         rate_limit: Optional[Tuple[int, float]] = (60, 60.0),
         source: FeedbackSource = "http",
+        redact: Union[bool, Mapping[str, Any]] = True,
         generate_id: Optional[Callable[[], str]] = None,
         now: Optional[Callable[[], datetime]] = None,
     ) -> None:
@@ -118,6 +123,7 @@ class FeedbackHandler:
         self.max_bytes = max_bytes
         self.public_endpoint = public_endpoint
         self.source = source
+        self.redact = redact
         self._limiter = _RateLimiter(*rate_limit) if rate_limit else None
         self._generate_id = generate_id or (lambda: new_id("fb"))
         self._now = now or (lambda: datetime.now(timezone.utc))
@@ -163,6 +169,8 @@ class FeedbackHandler:
         if account:
             record["account"] = account
         record["source"] = self.source or "http"
+        if self.redact is not False:
+            parsed = _redact(parsed, **(self.redact if isinstance(self.redact, Mapping) else {}))
         record["feedback"] = parsed
 
         try:

{backloop_sdk-0.1.1 → backloop_sdk-0.1.2}/tests/test_server.py

@@ -51,6 +51,19 @@ class HappyPathTest(unittest.TestCase):
             [{"id": "fb_test", "received_at": "2026-09-28T10:04:11.123Z", "source": "http", "feedback": SUBMISSION}],
         )
 
+    def test_removes_secrets_and_emails_whatever_client_sent_them(self):
+        leaky = dict(SUBMISSION, message="401 with Bearer 9f8e7d6c5b4a3f2e for jane@acme.test", metadata={"password": "hunter2", "plan": "team"})
+        handler, sink = make()
+        status, _, _ = handler.handle_submit(json.dumps(leaky).encode(), JSON)
+        self.assertEqual(status, 202)
+        feedback = sink.records[0]["feedback"]
+        self.assertEqual(feedback["message"], "401 with [REDACTED] for [REDACTED]")
+        self.assertEqual(feedback["metadata"], {"password": "[REDACTED]", "plan": "team"})
+        # Asked not to: as sent.
+        handler, sink = make(redact=False)
+        handler.handle_submit(json.dumps(leaky).encode(), JSON)
+        self.assertEqual(sink.records[0]["feedback"]["message"], leaky["message"])
+
     def test_record_carries_service_account_and_source(self):
         handler, sink = make(service="acme-api", source="mcp")
         handler.handle_submit(BODY, JSON, "acct_abc")