openbox-langgraph-sdk-python 0.1.1__py3-none-any.whl → 0.1.2__py3-none-any.whl

openbox_langgraph/config.py

@@ -250,9 +250,12 @@ def initialize(
     validate_url_security(api_url)
 
     if not validate_api_key_format(api_key):
+        # Show only the structural prefix, never actual secret chars
+        parts = api_key.split("_", 2)
+        prefix_hint = "_".join(parts[:2]) + "_..." if len(parts) >= 2 else "???"
         msg = (
             f"Invalid API key format. Expected 'obx_live_*' or 'obx_test_*', "
-            f"got: '{api_key[:15]}...' (showing first 15 chars)"
+            f"got prefix: '{prefix_hint}'"
         )
         raise OpenBoxAuthError(msg)
 

openbox_langgraph/file_governance_hooks.py

@@ -72,8 +72,14 @@ def _build_file_span_data(
     }
 
     # Only include optional fields if they have values
+    # Truncate file content to prevent oversized governance payloads
+    _MAX_FILE_DATA = 4096
     if data is not None:
-        result["data"] = data
+        data_str = str(data)
+        if len(data_str) > _MAX_FILE_DATA:
+            result["data"] = data_str[:_MAX_FILE_DATA] + "...[truncated]"
+        else:
+            result["data"] = data_str
     if bytes_read is not None:
         result["bytes_read"] = bytes_read
     if bytes_written is not None:

openbox_langgraph/http_governance_hooks.py

@@ -64,6 +64,34 @@ _TEXT_CONTENT_TYPES = (
     "application/x-www-form-urlencoded",
 )
 
+# Headers that must be redacted before sending to governance API
+_SENSITIVE_HEADERS = frozenset({
+    "authorization", "cookie", "set-cookie", "x-api-key",
+    "x-auth-token", "proxy-authorization", "www-authenticate",
+})
+
+# Max body size sent to governance API (bytes of string repr)
+_MAX_BODY_CAPTURE = 8192
+
+
+def _sanitize_headers(headers: dict | None) -> dict | None:
+    """Redact sensitive headers (auth tokens, cookies) before governance."""
+    if not headers:
+        return headers
+    return {
+        k: "[REDACTED]" if k.lower() in _SENSITIVE_HEADERS else v
+        for k, v in headers.items()
+    }
+
+
+def _truncate_body(body: str | None) -> str | None:
+    """Truncate body to _MAX_BODY_CAPTURE to prevent oversized payloads."""
+    if body is None:
+        return None
+    if len(body) > _MAX_BODY_CAPTURE:
+        return body[:_MAX_BODY_CAPTURE] + "...[truncated]"
+    return body
+
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # Shared HTTP utilities
@@ -136,10 +164,10 @@ def _build_http_span_data(
         # HTTP-specific root fields
         "http_method": http_method,
         "http_url": http_url,
-        "request_body": request_body,
-        "request_headers": request_headers,
-        "response_body": response_body,
-        "response_headers": response_headers,
+        "request_body": _truncate_body(request_body),
+        "request_headers": _sanitize_headers(request_headers),
+        "response_body": _truncate_body(response_body),
+        "response_headers": _sanitize_headers(response_headers),
         "http_status_code": http_status_code,
         "error": error,
     }

{openbox_langgraph_sdk_python-0.1.1.dist-info → openbox_langgraph_sdk_python-0.1.2.dist-info}/METADATA

@@ -1,11 +1,11 @@
 Metadata-Version: 2.4
 Name: openbox-langgraph-sdk-python
-Version: 0.1.1
+Version: 0.1.2
 Summary: OpenBox governance and observability SDK for LangGraph
 License: MIT
 Requires-Python: >=3.11
 Requires-Dist: httpx>=0.27.0
-Requires-Dist: langchain-core>=0.3.0
+Requires-Dist: langchain-core>=1.2.22
 Requires-Dist: langgraph>=0.2.0
 Requires-Dist: opentelemetry-api>=1.20.0
 Requires-Dist: opentelemetry-instrumentation-asyncpg>=0.41b0

{openbox_langgraph_sdk_python-0.1.1.dist-info → openbox_langgraph_sdk_python-0.1.2.dist-info}/RECORD

@@ -1,18 +1,18 @@
 openbox_langgraph/__init__.py,sha256=_hLVtJi-ERJ_GQJImJOMsSzu8RKse52kA-Lsk-hskgs,3581
 openbox_langgraph/client.py,sha256=YpTvZEruBuhYPHbOlt9Hq1YsB_b3Ak9cwuTXYdVr2_M,13356
-openbox_langgraph/config.py,sha256=p3PqUneLTWVy-3zsApNDPVcvG66itiVELu_yA_3hBBU,11477
+openbox_langgraph/config.py,sha256=xWMqcntzY6yveP2roqsC2gdkc66n9F8c903ATt415f4,11643
 openbox_langgraph/db_governance_hooks.py,sha256=9Cj3Afsr3WUl1HYqOC8Q1P8OWMOR0lSOZhO5OxrpOl8,40120
 openbox_langgraph/errors.py,sha256=ZEE6gUBf6KSEUqwOU887ocMoJuqX9Jt3U12u93BevQk,3712
-openbox_langgraph/file_governance_hooks.py,sha256=rbHkpIZ_WJyy4Ww0SJI7tl9NcK9PCpo0WoQtCX103GA,15837
+openbox_langgraph/file_governance_hooks.py,sha256=ddPZEF8yu8iq48rfU3OhI867P6G_I9Kt_ajfPo_6izc,16100
 openbox_langgraph/hitl.py,sha256=p8Xyxp9vvIBciumghM2RGJ53deIIwbufLRmw-PPLteU,2751
 openbox_langgraph/hook_governance.py,sha256=ZDAcyjTBQnFkwG6fv6XOAwiMtwXRQAQCTgTWiD6np40,13946
-openbox_langgraph/http_governance_hooks.py,sha256=2wC9qaGuABNnM31_jX2fUuvoKnVd9IRc4YkdQvLTrx0,27202
+openbox_langgraph/http_governance_hooks.py,sha256=DbY1p_ZipUxJqR6jrc9FjLVA4RkYRVx6p-Nrlf0hzt8,28170
 openbox_langgraph/langgraph_handler.py,sha256=BD61U9F2ESLzSTDJ-wXLS5tNFjvoaeSLHqoj2ABYfQQ,72177
 openbox_langgraph/otel_setup.py,sha256=ti9hQ8pWVj8gQk8E4WMw9gDPqGUlGSzoJLoav38EJno,17305
 openbox_langgraph/span_processor.py,sha256=tY3OXXIq9b47vjmA1oZy2Uu7N1Y5gSaxBOI1RgZK09Q,13289
 openbox_langgraph/tracing.py,sha256=818uke3pRRRFLuO5Ca-Tj3p-LA2QCVjRiI41gQcs5yU,12590
 openbox_langgraph/types.py,sha256=EUozIU3pCimjXItwKLaZ-NLLpHGAD06SgBRxgK1rHHg,18591
 openbox_langgraph/verdict_handler.py,sha256=YmZjBxzOa2RBbkF13xDCPUAGzz7m1hwdMErwOVDl2WM,8323
-openbox_langgraph_sdk_python-0.1.1.dist-info/METADATA,sha256=NNF802Q_v_EM3zKeRULtJ8I6AryWty5bnkpv1b1P1KE,20962
-openbox_langgraph_sdk_python-0.1.1.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-openbox_langgraph_sdk_python-0.1.1.dist-info/RECORD,,
+openbox_langgraph_sdk_python-0.1.2.dist-info/METADATA,sha256=V3opgqntXab1KFXSYKwjc-0uEUpq4uDNcVYXzMkzeD4,20963
+openbox_langgraph_sdk_python-0.1.2.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+openbox_langgraph_sdk_python-0.1.2.dist-info/RECORD,,