microsoft-agents-a365-observability-core 0.2.1.dev36__tar.gz → 0.2.1.dev42__tar.gz

{microsoft_agents_a365_observability_core-0.2.1.dev36 → microsoft_agents_a365_observability_core-0.2.1.dev42}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: microsoft-agents-a365-observability-core
-Version: 0.2.1.dev36
+Version: 0.2.1.dev42
 Summary: Telemetry, tracing, and monitoring components for AI agents
 Author-email: Microsoft <support@microsoft.com>
 License: MIT

{microsoft_agents_a365_observability_core-0.2.1.dev36 → microsoft_agents_a365_observability_core-0.2.1.dev42}/microsoft_agents_a365/observability/core/exporters/agent365_exporter.py

@@ -23,6 +23,7 @@ from .utils import (
     hex_span_id,
     hex_trace_id,
     kind_name,
+    parse_retry_after,
     partition_by_identity,
     status_name,
     truncate_span,
@@ -79,9 +80,9 @@ class _Agent365Exporter(SpanExporter):
                 logger.info("No spans with tenant/agent identity found; nothing exported.")
                 return SpanExportResult.SUCCESS
 
-            # Debug: Log number of groups and total span count
+            # Log number of groups and total span count
             total_spans = sum(len(activities) for activities in groups.values())
-            logger.info(
+            logger.debug(
                 f"Found {len(groups)} identity groups with {total_spans} total spans to export"
             )
 
@@ -98,8 +99,8 @@ class _Agent365Exporter(SpanExporter):
 
                 url = build_export_url(endpoint, agent_id, tenant_id, self._use_s2s_endpoint)
 
-                # Debug: Log endpoint being used
-                logger.info(
+                # Log endpoint details at DEBUG to avoid leaking IDs in production logs
+                logger.debug(
                     f"Exporting {len(activities)} spans to endpoint: {url} "
                     f"(tenant: {tenant_id}, agent: {agent_id})"
                 )
@@ -108,10 +109,16 @@ class _Agent365Exporter(SpanExporter):
                 try:
                     token = self._token_resolver(agent_id, tenant_id)
                     if token:
+                        # Warn if sending bearer token over non-HTTPS connection
+                        if not url.lower().startswith("https://"):
+                            logger.warning(
+                                "Bearer token is being sent over a non-HTTPS connection. "
+                                "This may expose credentials in transit."
+                            )
                         headers["authorization"] = f"Bearer {token}"
-                        logger.info(f"Token resolved successfully for agent {agent_id}")
+                        logger.debug(f"Token resolved successfully for agent {agent_id}")
                     else:
-                        logger.info(f"No token returned for agent {agent_id}")
+                        logger.debug(f"No token returned for agent {agent_id}")
                 except Exception as e:
                     # If token resolution fails, treat as failure for this group
                     logger.error(
@@ -174,7 +181,7 @@ class _Agent365Exporter(SpanExporter):
 
                 # 2xx => success
                 if 200 <= resp.status_code < 300:
-                    logger.info(
+                    logger.debug(
                         f"HTTP {resp.status_code} success on attempt {attempt + 1}. "
                         f"Correlation ID: {correlation_id}. "
                         f"Response: {self._truncate_text(resp.text, 200)}"
@@ -186,12 +193,19 @@ class _Agent365Exporter(SpanExporter):
 
                 # Retry transient
                 if resp.status_code in (408, 429) or 500 <= resp.status_code < 600:
+                    # Respect Retry-After header for 429 responses
+                    retry_after = parse_retry_after(resp.headers)
                     if attempt < DEFAULT_MAX_RETRIES:
-                        time.sleep(0.2 * (attempt + 1))
+                        if retry_after is not None:
+                            time.sleep(min(retry_after, 60.0))
+                        else:
+                            # Exponential backoff with base 0.5s
+                            time.sleep(0.5 * (2**attempt))
                         continue
                     # Final attempt failed
                     logger.error(
-                        f"HTTP {resp.status_code} final failure after {DEFAULT_MAX_RETRIES + 1} attempts. "
+                        f"HTTP {resp.status_code} final failure after "
+                        f"{DEFAULT_MAX_RETRIES + 1} attempts. "
                         f"Correlation ID: {correlation_id}. "
                         f"Response: {response_text}"
                     )
@@ -206,12 +220,11 @@ class _Agent365Exporter(SpanExporter):
 
             except requests.RequestException as e:
                 if attempt < DEFAULT_MAX_RETRIES:
-                    time.sleep(0.2 * (attempt + 1))
+                    # Exponential backoff with base 0.5s
+                    time.sleep(0.5 * (2**attempt))
                     continue
                 # Final attempt failed
-                logger.error(
-                    f"Request failed after {DEFAULT_MAX_RETRIES + 1} attempts with exception: {e}"
-                )
+                logger.error(f"Request failed after {DEFAULT_MAX_RETRIES + 1} attempts: {e}")
                 return False
         return False
 

{microsoft_agents_a365_observability_core-0.2.1.dev36 → microsoft_agents_a365_observability_core-0.2.1.dev42}/microsoft_agents_a365/observability/core/exporters/utils.py

@@ -1,6 +1,8 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT License.
 
+from __future__ import annotations
+
 import json
 import logging
 import os
@@ -194,6 +196,13 @@ def get_validated_domain_override() -> str | None:
         logger.warning(f"Invalid domain override '{domain_override}': {e}")
         return None
 
+    # Warn when using insecure HTTP — telemetry data and bearer tokens may be exposed
+    if domain_override.lower().startswith("http://"):
+        logger.warning(
+            "Domain override uses insecure HTTP. Telemetry data (including "
+            "bearer tokens) will be transmitted in cleartext."
+        )
+
     return domain_override
 
 
@@ -223,6 +232,31 @@ def build_export_url(
     return f"https://{endpoint}{endpoint_path}?api-version=1"
 
 
+def parse_retry_after(headers: dict[str, str]) -> float | None:
+    """Parse the ``Retry-After`` header value.
+
+    Only numeric (seconds) values are supported.  HTTP-date values
+    (e.g. ``Wed, 21 Oct 2025 07:28:00 GMT``) are intentionally ignored
+    and treated as absent, falling back to exponential backoff.
+
+    Args:
+        headers: Response headers mapping.
+
+    Returns:
+        The number of seconds to wait, or ``None`` if the header is
+        absent, non-numeric, or otherwise invalid.
+    """
+    retry_after = headers.get("Retry-After")
+    if retry_after is None:
+        return None
+    try:
+        return float(retry_after)
+    except (ValueError, TypeError):
+        # Intentionally ignore HTTP-date formatted Retry-After values;
+        # callers should fall back to exponential backoff.
+        return None
+
+
 def is_agent365_exporter_enabled() -> bool:
     """Check if Agent 365 exporter is enabled."""
     # Check environment variable

{microsoft_agents_a365_observability_core-0.2.1.dev36 → microsoft_agents_a365_observability_core-0.2.1.dev42}/microsoft_agents_a365/observability/core/opentelemetry_scope.py

@@ -9,7 +9,7 @@ from datetime import datetime
 from threading import Lock
 from typing import TYPE_CHECKING, Any
 
-from opentelemetry import baggage, context, trace
+from opentelemetry import context, trace
 from opentelemetry.trace import (
     Span,
     SpanKind,
@@ -241,21 +241,6 @@ class OpenTelemetryScope:
         if value is not None and self._span and self._is_telemetry_enabled():
             self._span.set_attribute(name, value)
 
-    def add_baggage(self, key: str, value: str) -> None:
-        """Add baggage to the current context.
-
-        Args:
-            key: The baggage key
-            value: The baggage value
-        """
-        # Set baggage in the current context
-        if self._is_telemetry_enabled():
-            # Set baggage on the current context
-            # This will be inherited by child spans created within this context
-            baggage_context = baggage.set_baggage(key, value)
-            # The context needs to be made current for child spans to inherit the baggage
-            context.attach(baggage_context)
-
     def record_attributes(self, attributes: dict[str, Any] | list[tuple[str, Any]]) -> None:
         """Record multiple attribute key/value pairs for telemetry tracking.
 

{microsoft_agents_a365_observability_core-0.2.1.dev36 → microsoft_agents_a365_observability_core-0.2.1.dev42}/microsoft_agents_a365/observability/core/spans_scopes/output_scope.py

@@ -16,6 +16,8 @@ OUTPUT_OPERATION_NAME = "output_messages"
 class OutputScope(OpenTelemetryScope):
     """Provides OpenTelemetry tracing scope for output messages."""
 
+    _MAX_OUTPUT_MESSAGES = 5000
+
     @staticmethod
     def start(
         agent_details: AgentDetails,
@@ -82,9 +84,12 @@ class OutputScope(OpenTelemetryScope):
         """Records the output messages for telemetry tracking.
 
         Appends the provided messages to the accumulated output messages list.
+        The list is capped at _MAX_OUTPUT_MESSAGES to prevent unbounded memory growth.
 
         Args:
             messages: List of output messages to append
         """
         self._output_messages.extend(messages)
+        if len(self._output_messages) > self._MAX_OUTPUT_MESSAGES:
+            self._output_messages = self._output_messages[-self._MAX_OUTPUT_MESSAGES :]
         self.set_tag_maybe(GEN_AI_OUTPUT_MESSAGES_KEY, safe_json_dumps(self._output_messages))

{microsoft_agents_a365_observability_core-0.2.1.dev36 → microsoft_agents_a365_observability_core-0.2.1.dev42}/microsoft_agents_a365_observability_core.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: microsoft-agents-a365-observability-core
-Version: 0.2.1.dev36
+Version: 0.2.1.dev42
 Summary: Telemetry, tracing, and monitoring components for AI agents
 Author-email: Microsoft <support@microsoft.com>
 License: MIT