pixie-qa 0.1.11__tar.gz → 0.1.12__tar.gz

{pixie_qa-0.1.11 → pixie_qa-0.1.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pixie-qa
-Version: 0.1.11
+Version: 0.1.12
 Summary: Automated quality assurance for AI applications
 Project-URL: Homepage, https://github.com/yiouli/pixie-qa
 Project-URL: Repository, https://github.com/yiouli/pixie-qa

pixie_qa-0.1.12/changelogs/observe-sensitive-field-stripping.md

@@ -0,0 +1,22 @@
+# @observe: Strip `self` and `cls` from captured input
+
+## What changed
+
+The `@observe` decorator now automatically removes `self` and `cls` from the
+captured function arguments before serialization. Previously, decorating a
+method with `@observe` would serialize the entire instance (including API keys,
+client objects, and other sensitive state) into `eval_input` via jsonpickle.
+
+## Files affected
+
+- `pixie/instrumentation/observation.py` — `sync_wrapper` and `async_wrapper`
+  now pop `self`/`cls` from `bound.arguments` before calling `_serialize()`.
+- `tests/pixie/instrumentation/test_observation.py` — Two new tests:
+  `test_self_excluded_from_input` and `test_cls_excluded_from_input`.
+
+## Migration notes
+
+No API changes. This is a backward-compatible fix. Existing `@observe` usage on
+functions (not methods) is unaffected. Methods that previously leaked `self` into
+`eval_input` will now produce cleaner, smaller input data containing only the
+semantic arguments.

{pixie_qa-0.1.11 → pixie_qa-0.1.12}/pixie/instrumentation/observation.py

@@ -58,7 +58,10 @@ def observe(
                 sig = inspect.signature(fn)
                 bound = sig.bind(*args, **kwargs)
                 bound.apply_defaults()
-                serialized_input = _serialize(dict(bound.arguments))
+                arguments = dict(bound.arguments)
+                arguments.pop("self", None)
+                arguments.pop("cls", None)
+                serialized_input = _serialize(arguments)
 
                 with start_observation(
                     input=serialized_input, name=span_name
@@ -76,7 +79,10 @@ def observe(
                 sig = inspect.signature(fn)
                 bound = sig.bind(*args, **kwargs)
                 bound.apply_defaults()
-                serialized_input = _serialize(dict(bound.arguments))
+                arguments = dict(bound.arguments)
+                arguments.pop("self", None)
+                arguments.pop("cls", None)
+                serialized_input = _serialize(arguments)
 
                 with start_observation(
                     input=serialized_input, name=span_name

{pixie_qa-0.1.11 → pixie_qa-0.1.12}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pixie-qa"
-version = "0.1.11"
+version = "0.1.12"
 description = "Automated quality assurance for AI applications"
 readme = "README.md"
 requires-python = ">=3.11"

{pixie_qa-0.1.11 → pixie_qa-0.1.12}/tests/pixie/instrumentation/test_observation.py

@@ -148,3 +148,49 @@ class TestObserveDecorator:
         # Both positional args should appear in the serialized input
         assert "a" in obs.input
         assert "b" in obs.input
+
+    def test_self_excluded_from_input(
+        self, recording_handler: RecordingHandler
+    ) -> None:
+        """@observe on a method strips 'self' from captured input."""
+        px.init()
+        px.add_handler(recording_handler)
+
+        class Agent:
+            secret_key = "sk-SHOULD-NOT-APPEAR"
+
+            @observe()
+            def respond(self, message: str) -> str:
+                return f"Got: {message}"
+
+        agent = Agent()
+        result = agent.respond("hello")
+        px.flush()
+
+        assert result == "Got: hello"
+        obs = recording_handler.observe_spans[0]
+        assert "hello" in obs.input
+        assert "self" not in obs.input
+        assert "sk-SHOULD-NOT-APPEAR" not in obs.input
+
+    def test_cls_excluded_from_input(self, recording_handler: RecordingHandler) -> None:
+        """@observe on a classmethod strips 'cls' from captured input."""
+        px.init()
+        px.add_handler(recording_handler)
+
+        class Service:
+            api_key = "sk-SECRET"
+
+            @classmethod
+            @observe()
+            def handle(cls, query: str) -> str:
+                return f"Handled: {query}"
+
+        result = Service.handle("test")
+        px.flush()
+
+        assert result == "Handled: test"
+        obs = recording_handler.observe_spans[0]
+        assert "test" in obs.input
+        assert "cls" not in obs.input
+        assert "sk-SECRET" not in obs.input