debugbundle-python 1.4.2__py3-none-any.whl → 1.5.0__py3-none-any.whl

debugbundle/core.py

@@ -45,7 +45,13 @@ from .event_support import (
     time_now,
 )
 from .logger_integrations import attach_optional_integrations
-from .redaction import DEFAULT_REDACT_FIELDS, redact_value
+from .redaction import (
+    DEFAULT_REDACT_FIELDS,
+    UnsafeTelemetry,
+    has_safe_event_identity,
+    redact_value,
+    sanitize_telemetry,
+)
 from .suppression import EventSuppressionTracker
 from .transport import HttpTransport, Transport, coerce_transport_response
 from .trigger_token import resolve_request_trigger_directives
@@ -322,7 +328,12 @@ class DebugBundleSdk:
 
     def set_context(self, key: str, value: object) -> None:
         with self._lock:
-            self._context[key] = redact_value({key: value}, self._redact_fields)[key]
+            try:
+                protected = sanitize_telemetry({key: value}, self._redact_fields)
+                if isinstance(protected, dict):
+                    self._context[key] = protected.get(key)
+            except UnsafeTelemetry:
+                return
 
     def _bind_scoped_context(self, context: Mapping[str, object]) -> Token[dict[str, object] | None]:
         scoped_context = dict(self._scoped_context.get() or {})
@@ -330,7 +341,11 @@ class DebugBundleSdk:
             if value is None:
                 continue
             scoped_context[str(key)] = value
-        return self._scoped_context.set(cast(dict[str, object], redact_value(scoped_context, self._redact_fields)))
+        try:
+            protected = sanitize_telemetry(scoped_context, self._redact_fields)
+            return self._scoped_context.set(cast(dict[str, object], protected))
+        except UnsafeTelemetry:
+            return self._scoped_context.set({})
 
     def _reset_scoped_context(self, token: Token[dict[str, object] | None]) -> None:
         self._scoped_context.reset(token)
@@ -433,11 +448,17 @@ class DebugBundleSdk:
             if label not in self._probe_buffers and len(self._probe_buffers) >= self._max_probe_labels:
                 return
 
-            value = data() if callable(data) else data
-            if not isinstance(value, Mapping):
-                value = {"value": value}
-
-            redacted_value = redact_mapping(dict(value), self._redact_fields)
+            try:
+                protected_label = sanitize_telemetry(label, self._redact_fields)
+                value = data() if callable(data) else data
+                if not isinstance(value, Mapping):
+                    value = {"value": value}
+                redacted_value = sanitize_telemetry(dict(value), self._redact_fields)
+                if not isinstance(protected_label, str) or not isinstance(redacted_value, dict):
+                    return
+                label = protected_label
+            except Exception:
+                return
 
             if is_heavy:
                 self._emit_probe_events(label, redacted_value, matching_directives)
@@ -613,8 +634,23 @@ class DebugBundleSdk:
             merged.update({str(key): value for key, value in context.items()})
         return cast(dict[str, object], redact_value(merged, self._redact_fields))
 
+    def _protect_event(self, event: dict[str, object]) -> dict[str, object] | None:
+        try:
+            if not has_safe_event_identity(event, self._redact_fields):
+                return None
+            candidate = dict(event)
+            for key in ("payload", "context", "service"):
+                if key in candidate:
+                    candidate[key] = sanitize_telemetry(candidate[key], self._redact_fields)
+            return candidate
+        except UnsafeTelemetry:
+            return None
+
     def _enqueue_event(self, event: dict[str, object]) -> None:
-        self._buffer.append(event)
+        protected = self._protect_event(event)
+        if protected is None:
+            return
+        self._buffer.append(protected)
         if len(self._buffer) >= self._batch_size:
             self.flush()
             return
@@ -638,14 +674,20 @@ class DebugBundleSdk:
             aggregate.update(self._base_event(event_type, cast(dict[str, object], payload)))
             prepared = self._apply_before_send_event(aggregate)
             if prepared is not None:
-                self._buffer.append(prepared)
+                protected = self._protect_event(prepared)
+                if protected is not None:
+                    self._buffer.append(protected)
 
     def _apply_before_send_event(self, event: dict[str, object]) -> dict[str, object] | None:
-        return apply_before_send(
-            event,
+        protected = self._protect_event(event)
+        if protected is None:
+            return None
+        result = apply_before_send(
+            protected,
             self._before_send,
             lambda code, message: self._emit_diagnostic(code, message),
         )
+        return self._protect_event(result) if result is not None else None
 
     def _build_probe_data(self) -> dict[str, object] | None:
         items: list[dict[str, object]] = []
@@ -780,7 +822,10 @@ class DebugBundleSdk:
             return
         diagnostic: dict[str, object] = {"code": code, "message": message}
         if metadata is not None:
-            diagnostic["metadata"] = metadata
+            try:
+                diagnostic["metadata"] = sanitize_telemetry(metadata, self._redact_fields)
+            except UnsafeTelemetry:
+                pass
         try:
             self._on_diagnostic(diagnostic)
         except Exception:

debugbundle/event_support.py

@@ -264,7 +264,7 @@ def sdk_version() -> str:
     try:
         return metadata.version("debugbundle-python")
     except metadata.PackageNotFoundError:
-        return "1.4.2"
+        return "1.5.0"
 
 
 def sdk_config_endpoint(events_endpoint: str) -> str:

debugbundle/redaction.py

@@ -1,7 +1,10 @@
 from __future__ import annotations
 
+import json
+import re
 from collections.abc import Mapping, Sequence
 from typing import Any
+from urllib.parse import parse_qsl, unquote, urlencode, urlsplit, urlunsplit
 
 DEFAULT_REDACT_FIELDS = {
     "authorization",
@@ -14,6 +17,200 @@ DEFAULT_REDACT_FIELDS = {
 }
 
 REDACTED_VALUE = "[REDACTED]"
+MANDATORY_FIELDS = DEFAULT_REDACT_FIELDS | {
+    "api_key", "apikey", "access_token", "refresh_token", "private_key", "bearer", "session_id",
+    "passwd", "card_number", "cvv", "cvc", "pin", "expiry", "phone", "otp", "verification_code",
+}
+_HEADER = re.compile(r"\b(Authorization|Proxy-Authorization|Cookie|Set-Cookie)\s*:\s*[^\r\n]*", re.I)
+_BEARER = re.compile(r"\b(Bearer|Basic)\s+[A-Za-z0-9._~+/-]{6,}", re.I)
+_TOKEN = re.compile(r"\bdbundle_(?:proj|mem|probe|agent)_[A-Za-z0-9_-]+\b")
+_PEM = re.compile(
+    r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----",
+    re.I,
+)
+_PEM_START = re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----", re.I)
+_CARD = re.compile(r"(?<![A-Za-z0-9_-])(?:\d[ -]?){12,18}\d(?![A-Za-z0-9_-])")
+_URL = re.compile(r"\bhttps?://[^\s<>\"']+", re.I)
+_LABELS = MANDATORY_FIELDS | {"client_secret", "x_api_key", "accessToken", "refreshToken", "privateKey", "clientSecret"}
+_ASSIGNMENT = re.compile(
+    r"\b(" + "|".join(re.escape(key) for key in sorted(_LABELS, key=len, reverse=True)) +
+    r")\b([\"']?\s*[:=]\s*)(?:\"[^\"]*\"|'[^']*'|[^\s&,;]+)", re.I,
+)
+
+
+class UnsafeTelemetry(ValueError):
+    """A fixed safe failure marker; never includes caller content."""
+
+
+def _sensitive_key(key: str, fields: set[str]) -> bool:
+    normalized = re.sub(r"([a-z0-9])([A-Z])", r"\1_\2", key.strip()).lower()
+    segments = [segment for segment in re.split(r"[^a-z0-9]+", normalized) if segment]
+    canonical = {re.sub(r"[^a-z0-9]", "", field.lower()) for field in fields}
+    for start in range(len(segments)):
+        combined = ""
+        for segment in segments[start:]:
+            combined += segment
+            if combined in canonical:
+                return True
+    return False
+
+
+def _luhn(candidate: str) -> bool:
+    digits = re.sub(r"[^0-9]", "", candidate)
+    if not 13 <= len(digits) <= 19 or len(set(digits)) == 1:
+        return False
+    total = 0
+    for index, char in enumerate(reversed(digits)):
+        digit = int(char)
+        if index % 2:
+            digit *= 2
+            if digit > 9:
+                digit -= 9
+        total += digit
+    return total % 10 == 0
+
+
+def _scrub_url(raw: str, fields: set[str]) -> str:
+    try:
+        parsed = urlsplit(raw)
+        if not parsed.scheme or not parsed.hostname:
+            raise ValueError("invalid_url")
+        _ = parsed.port  # Invalid ports make the entire URL unscannable.
+        host = parsed.netloc.rsplit("@", 1)[-1]
+        authority = f"REDACTED@{host}" if parsed.username or parsed.password else host
+        query = urlencode([
+            (key, REDACTED_VALUE if _sensitive_key(key, fields)
+             or _scrub_text(value, fields, False) != value else value)
+            for key, value in parse_qsl(parsed.query, keep_blank_values=True)
+            if len(key) <= 128 and _scrub_text(key, fields, False) == key
+        ])
+        return urlunsplit((parsed.scheme.lower(), authority, parsed.path or "/", query, ""))
+    except ValueError:
+        return REDACTED_VALUE
+
+
+def _scrub_text(value: str, extra: set[str], scan_urls: bool = True) -> str:
+    if _PEM_START.search(value) and not _PEM.search(value):
+        return REDACTED_VALUE
+    if re.search(r"(?:password|token|secret|authorization|cookie)%3[ad]", value, re.I):
+        try:
+            value = unquote(value, errors="strict")
+        except UnicodeError:
+            return REDACTED_VALUE
+    result = _PEM.sub(REDACTED_VALUE, value)
+    result = _HEADER.sub(lambda match: f"{match.group(1)}: {REDACTED_VALUE}", result)
+    result = _BEARER.sub(lambda match: f"{match.group(1)} {REDACTED_VALUE}", result)
+    result = _TOKEN.sub(REDACTED_VALUE, result)
+    result = _ASSIGNMENT.sub(lambda match: f"{match.group(1)}{match.group(2)}{REDACTED_VALUE}", result)
+    for field in extra:
+        named = re.compile(r"\b(" + re.escape(field) + r")\b([\"']?\s*[:=]\s*)(?:\"[^\"]*\"|'[^']*'|[^\s&,;]+)", re.I)
+        result = named.sub(lambda match: f"{match.group(1)}{match.group(2)}{REDACTED_VALUE}", result)
+    result = _CARD.sub(lambda match: REDACTED_VALUE if _luhn(match.group(0)) else match.group(0), result)
+
+    if not scan_urls:
+        return result
+
+    def replace_url(match: re.Match[str]) -> str:
+        raw = match.group(0)
+        suffix = re.search(r"[).,;]+$", raw)
+        trailing = suffix.group(0) if suffix else ""
+        return _scrub_url(raw[:len(raw) - len(trailing)] if trailing else raw, MANDATORY_FIELDS | extra) + trailing
+
+    return _URL.sub(replace_url, result)
+
+
+def sanitize_telemetry(value: Any, additional_fields: set[str] | None = None) -> Any:
+    """Mandatory bounded telemetry policy. Failure withholds the input, never returns its original."""
+    extra = additional_fields or set()
+    if len(extra) > 128 or any(not isinstance(field, str) or not 0 < len(field) <= 64 for field in extra):
+        raise UnsafeTelemetry("unsafe_input")
+    state = {"nodes": 0, "bytes": 0}
+    seen: set[int] = set()
+    fields = MANDATORY_FIELDS | extra
+
+    def visit(candidate: Any, depth: int, structured: bool) -> Any:
+        state["nodes"] += 1
+        if state["nodes"] > 4096:
+            raise UnsafeTelemetry("budget_exceeded")
+        if depth > 16:
+            return REDACTED_VALUE
+        if isinstance(candidate, str):
+            if len(candidate) > 16 * 1024:
+                return REDACTED_VALUE
+            try:
+                length = len(candidate.encode("utf-8"))
+            except UnicodeError as error:
+                raise UnsafeTelemetry("unsafe_input") from error
+            if length > 16 * 1024:
+                return REDACTED_VALUE
+            state["bytes"] += length
+            if state["bytes"] > 256 * 1024:
+                raise UnsafeTelemetry("budget_exceeded")
+            if structured and candidate.startswith(("{", "[")):
+                try:
+                    nested = json.loads(candidate)
+                except (ValueError, TypeError):
+                    nested = None
+                if isinstance(nested, (dict, list)):
+                    return json.dumps(visit(nested, 0, False), separators=(",", ":"), ensure_ascii=False)
+            result = _scrub_text(candidate, extra)
+            if candidate.startswith(("{", "[")) and result == candidate and re.search(
+                r"(?:password|token|secret|authorization|cookie)[\"']?\s*[:=]", candidate, re.I
+            ):
+                return REDACTED_VALUE
+            return result
+        if candidate is None or isinstance(candidate, (bool, int, float)):
+            return candidate
+        identity = id(candidate)
+        if identity in seen:
+            return "[Circular]"
+        seen.add(identity)
+        try:
+            if isinstance(candidate, (list, tuple)):
+                if len(candidate) > 256:
+                    return REDACTED_VALUE
+                return [visit(item, depth + 1, structured) for item in candidate]
+            if isinstance(candidate, Mapping):
+                if len(candidate) > 256:
+                    return REDACTED_VALUE
+                output: dict[str, Any] = {}
+                for key, nested in candidate.items():
+                    if not isinstance(key, str):
+                        raise UnsafeTelemetry("unsafe_input")
+                    if len(key) > 128:
+                        continue
+                    state["bytes"] += len(key.encode("utf-8"))
+                    if state["bytes"] > 256 * 1024:
+                        raise UnsafeTelemetry("budget_exceeded")
+                    if _scrub_text(key, extra) != key:
+                        continue
+                    output[key] = (
+                        REDACTED_VALUE if _sensitive_key(key, fields) else visit(nested, depth + 1, structured)
+                    )
+                return output
+            raise UnsafeTelemetry("unsafe_input")
+        finally:
+            seen.remove(identity)
+
+    try:
+        sanitized = visit(value, 0, True)
+        if len(json.dumps(sanitized, separators=(",", ":"), ensure_ascii=False).encode("utf-8")) > 256 * 1024:
+            raise UnsafeTelemetry("budget_exceeded")
+        return sanitized
+    except UnsafeTelemetry:
+        raise
+    except (TypeError, ValueError, UnicodeError, RuntimeError, OverflowError) as error:
+        raise UnsafeTelemetry("unsafe_input") from error
+
+
+def has_safe_event_identity(event: Mapping[str, Any], extra: set[str] | None = None) -> bool:
+    correlation = event.get("correlation") or {}
+    if not isinstance(correlation, dict) or len(correlation) > 8:
+        return False
+    values = [event.get(key) for key in ("schema_version", "sdk_name", "sdk_version")]
+    values.extend(correlation.values())
+    return all(value is None or isinstance(value, str)
+               and sanitize_telemetry(value, extra) == value for value in values)
 
 
 def redact_value(value: Any, redact_fields: set[str]) -> Any:

debugbundle/relay.py

@@ -6,6 +6,7 @@ from collections.abc import Callable, Mapping
 from dataclasses import dataclass, field
 from typing import Any
 
+from .redaction import UnsafeTelemetry, has_safe_event_identity, sanitize_telemetry
 from .relay_delivery import (
     AtomicRelayFileTransport,
     RelayForwardTransport,
@@ -392,4 +393,11 @@ def _sanitize_event(
         if normalized_correlation:
             sanitized["correlation"] = normalized_correlation
 
+    try:
+        if not has_safe_event_identity(sanitized):
+            return None
+        sanitized["payload"] = sanitize_telemetry(sanitized["payload"])
+        sanitized["service"] = sanitize_telemetry(sanitized["service"])
+    except UnsafeTelemetry:
+        return None
     return sanitized

{debugbundle_python-1.4.2.dist-info → debugbundle_python-1.5.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: debugbundle-python
-Version: 1.4.2
+Version: 1.5.0
 Summary: DebugBundle SDK for Python
 Author: DebugBundle
 License-Expression: Apache-2.0
@@ -17,6 +17,8 @@ Classifier: Programming Language :: Python :: 3 :: Only
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Typing :: Typed
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -24,7 +26,7 @@ License-File: LICENSE
 Requires-Dist: httpx<0.29,>=0.27
 Provides-Extra: dev
 Requires-Dist: build<2,>=1; extra == "dev"
-Requires-Dist: django<6,>=5; extra == "dev"
+Requires-Dist: django<7,>=5; extra == "dev"
 Requires-Dist: fastapi<1,>=0.115; extra == "dev"
 Requires-Dist: flask<4,>=3; extra == "dev"
 Requires-Dist: jsonschema<5,>=4.23; extra == "dev"
@@ -263,8 +265,8 @@ There is no zero-install fallback for the Python SDK itself in V1. The nearest l
 
 | Surface | Minimum compatibility version | Recommended production version | Installed-base compatibility lane | Rolling CI lane | Out of scope |
 | --- | --- | --- | --- | --- | --- |
-| Python runtime | 3.10 | 3.12 | 3.10 and 3.11 remain supported for installed-base coverage | 3.12 | 3.9 and older |
-| Django | 5.x | latest 5.x patch | 5.x compatibility support | repo release smoke and tests install Django 5.x | Django 4.x and older |
+| Python runtime | 3.10 | 3.14 | 3.10 through 3.13 remain supported for installed-base coverage | 3.10 through 3.14 | 3.9 and older |
+| Django | 5.x | latest 6.1 patch | 5.x compatibility support | Python 3.14 suite exercises Django 6.1 | Django 4.x and older |
 | Flask | 3.x | latest 3.x patch | 3.x compatibility support | repo release smoke installs Flask 3.x | Flask 2.x and older |
 | FastAPI | 0.115+ | latest 0.115+ patch line | 0.115+ compatibility support | repo tests install FastAPI 0.115+ | standalone Starlette, older FastAPI lines |
 
@@ -275,7 +277,7 @@ Post-V1 planned expansions from `spec/sdk-language-targets.md` remain out of sco
 `debugbundle-python` ships as one package in V1, so there is no multi-package version-alignment step like a BOM or plugin family lock.
 
 - Pin one `debugbundle-python` version across your service and worker repos when you want identical SDK behavior everywhere.
-- Keep framework dependencies inside the supported lanes above: Django 5.x, Flask 3.x, and FastAPI 0.115+.
+- Keep framework dependencies inside the supported lanes above: Django 5.x or 6.x, Flask 3.x, and FastAPI 0.115+.
 - The packaged HTTP client dependency is `httpx>=0.27,<0.29`; if you override transport behavior in tests or wrappers, stay inside that range unless you retest the SDK.
 
 ## Safety Defaults

{debugbundle_python-1.4.2.dist-info → debugbundle_python-1.5.0.dist-info}/RECORD

@@ -2,12 +2,12 @@ debugbundle/__init__.py,sha256=QH5RY2Cdp3Ry5PNSAhiV9akOMoS2pERRqowFnZ94roc,5131
 debugbundle/acknowledgement.py,sha256=tyI8XLRG9N3-Weo6uiGrAlf_O4tjptVe1x1cG7RjrMc,2314
 debugbundle/before_send.py,sha256=_tmV6ovHUBIxfQPMQ8a0C6r91IAnd4DVs8UcjsKhqX0,7792
 debugbundle/config.py,sha256=ENRSR5jUI7xYdBqUakWws3GIjBk00GWFmwXVE_iQp2Y,9296
-debugbundle/core.py,sha256=ox4fNADe2kRic9aUePB_RJmT81vCQ9SFW6PaCSL-YL0,32888
-debugbundle/event_support.py,sha256=qsoqY3kUi9wdxDwLH2X5JpVid_KDyddpQ1J-yiTR6ds,9046
+debugbundle/core.py,sha256=XnaHLLfo9cNHNy8n-Q2rG5SRQx9pXE3t5-hwpw2F93Y,34639
+debugbundle/event_support.py,sha256=TSaqYXla6NACknU1nIofe4gVPQAkUkB-yrav09FTvpA,9046
 debugbundle/logger_integrations.py,sha256=T6LR10_DgDS8C-CUPxtC1kZz3qfX5j0B2YUV7LxDovk,3572
 debugbundle/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-debugbundle/redaction.py,sha256=QTaPkSsYv54yR1mz8SB6Q4vWjvp7Ddcui4WXaH2RVz8,736
-debugbundle/relay.py,sha256=p5-tFXsgH8TZfB7Va3C2XFJsi8mYOMnGjr01W_kApME,14366
+debugbundle/redaction.py,sha256=mxJgtILpVDUaj8LAhzswfaX1M4Ppyx87lfkhFqbMR8M,9663
+debugbundle/relay.py,sha256=9HkEEVZpqrebzH6A-sSuFVuFjyLg07JuTMpMG8pu7SY,14726
 debugbundle/relay_delivery.py,sha256=VL-nIgJR6mYXqKy-EbA0USWeY_iS_uAr1KBzrnwBnnk,4676
 debugbundle/structlog_integration.py,sha256=hDwCGXTQ8GAjnx2jwlRbpnvLE0y798kFFMsSB3iqOrM,6061
 debugbundle/suppression.py,sha256=XMn0GfF_-WZk2wHWk3KfbO5_u5QhEunues5h3jOInLs,4098
@@ -21,8 +21,8 @@ debugbundle/integrations/flask.py,sha256=cgyHbsAH96gpNPf_5IGJYzp2va28JdDgXROBsF-
 debugbundle/integrations/relay_django.py,sha256=Wj8BE9D5otU2KmtjgqdKIJ-BvXVcagCKgpLYvnPZ6WE,2281
 debugbundle/integrations/relay_fastapi.py,sha256=-Zl6bvhYMLii__mP6-UvSdwxS5VKsb9OZvk-yy-3hEw,2227
 debugbundle/integrations/relay_flask.py,sha256=VFHkDTJy4LkZzL_Ry_Ba-e_gW6UTG4PBwnLcvB_oXuQ,2011
-debugbundle_python-1.4.2.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-debugbundle_python-1.4.2.dist-info/METADATA,sha256=JB2zaShchgs9NJNvZotd2ETh3em8XHhxU776FvbeOSo,14452
-debugbundle_python-1.4.2.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-debugbundle_python-1.4.2.dist-info/top_level.txt,sha256=RCB9STTFnl1OKdojxz-xhaks2zkRFs1meZXsKnm18LM,12
-debugbundle_python-1.4.2.dist-info/RECORD,,
+debugbundle_python-1.5.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+debugbundle_python-1.5.0.dist-info/METADATA,sha256=X1Q7PLLF5B1H2GYePJjV3wCuvkU2_s_q0ynr46dJO74,14569
+debugbundle_python-1.5.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+debugbundle_python-1.5.0.dist-info/top_level.txt,sha256=RCB9STTFnl1OKdojxz-xhaks2zkRFs1meZXsKnm18LM,12
+debugbundle_python-1.5.0.dist-info/RECORD,,