unique-sdk 2026.32.0.dev6__tar.gz → 2026.32.0.dev8__tar.gz

{unique_sdk-2026.32.0.dev6 → unique_sdk-2026.32.0.dev8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: unique-sdk
-Version: 2026.32.0.dev6
+Version: 2026.32.0.dev8
 Summary: 
 Author: Martin Fadler, Konstantin Krauss, Andreas Hauri
 Author-email: Martin Fadler <martin.fadler@unique.ch>, Konstantin Krauss <konstantin@unique.ch>, Andreas Hauri <andreas@unique.ch>

{unique_sdk-2026.32.0.dev6 → unique_sdk-2026.32.0.dev8}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "unique_sdk"
-version = "2026.32.0.dev6"
+version = "2026.32.0.dev8"
 description = ""
 readme = "README.md"
 license = { text = "MIT" }

{unique_sdk-2026.32.0.dev6 → unique_sdk-2026.32.0.dev8}/unique_sdk/_api_requestor.py

@@ -194,8 +194,7 @@ class APIRequestor(object):
         )
 
         _util.log_info("Request to Unique", method=method, path=abs_url)
-        _util.log_debug(
-            "Request details",
+        _util.log_request_details(
             data=post_data,
             headers=headers,
             api_version=self.api_version,
@@ -206,7 +205,7 @@ class APIRequestor(object):
         )
 
         _util.log_info("Unique response", path=abs_url, status=rcode)
-        _util.log_debug("Unique response body", body=rcontent)
+        _util.log_response_body(body=rcontent)
 
         if "Request-Id" in rheaders:
             request_id = rheaders["Request-Id"]
@@ -230,11 +229,11 @@ class APIRequestor(object):
         )
 
         _util.log_info("Async request to Unique", method=method, path=abs_url)
-        _util.log_debug(
-            "Async request details",
+        _util.log_request_details(
             data=post_data,
             headers=headers,
             api_version=self.api_version,
+            message="Async request details",
         )
 
         rcontent, rcode, rheaders = await self._client.request_async(
@@ -242,7 +241,7 @@ class APIRequestor(object):
         )
 
         _util.log_info("Unique response", path=abs_url, status=rcode)
-        _util.log_debug("Unique response body", body=rcontent)
+        _util.log_response_body(body=rcontent)
 
         if "Request-Id" in rheaders:
             request_id = rheaders["Request-Id"]
@@ -364,7 +363,8 @@ class APIRequestor(object):
         except Exception as e:
             raise _error.APIError(
                 "Invalid response body from API: %s "
-                "(HTTP response code was %d)" % (rbody, rcode),
+                "(HTTP response code was %d)"
+                % (_util.redacted_body_for_error_message(rbody), rcode),
                 cast(bytes, rbody),
                 rcode,
                 rheaders,
@@ -399,7 +399,7 @@ class APIRequestor(object):
             error_code=status,
             error_type=error_data.get("type"),
             error_message=error_data.get("message"),
-            error_params=error_data.get("params"),
+            error_params=_util.redacted_error_params(error_data.get("params")),
         )
 
         error = cause.get("error", {}) if cause else {}

{unique_sdk-2026.32.0.dev6 → unique_sdk-2026.32.0.dev8}/unique_sdk/_util.py

@@ -9,6 +9,7 @@ import random
 import re
 import sys
 import time
+from collections.abc import Mapping
 from functools import wraps
 from typing import (
     Any,
@@ -33,6 +34,8 @@ UNIQUE_LOG = os.environ.get("UNIQUE_LOG")
 
 logger: logging.Logger = logging.getLogger("unique")
 
+_REDACTED = "<redacted>"
+
 
 def _console_log_level():
     if unique_sdk.log in ["debug", "info"]:
@@ -42,6 +45,42 @@ def _console_log_level():
     return None
 
 
+def _insecure_log_payloads_enabled() -> bool:
+    return os.environ.get("INSECURE_UNIQUE_SDK_LOG_PAYLOADS") == "true"
+
+
+def _payload_byte_size(value: Any) -> int:
+    if value is None:
+        return 0
+    if isinstance(value, (bytes, bytearray)):
+        return len(value)
+    if isinstance(value, str):
+        return len(value.encode("utf-8"))
+    return len(str(value).encode("utf-8"))
+
+
+def _headers_for_log(headers: Mapping[str, str] | None) -> dict[str, str] | str | None:
+    """Return headers for debug logs; Authorization is always redacted."""
+    if not _insecure_log_payloads_enabled():
+        return _REDACTED
+    if headers is None:
+        return None
+    try:
+        sanitized = dict(headers)
+    except (TypeError, ValueError):
+        return _REDACTED
+    for key in list(sanitized):
+        if str(key).lower() == "authorization":
+            sanitized[key] = _REDACTED
+    return sanitized
+
+
+def _body_for_log(body: Any) -> Any:
+    if _insecure_log_payloads_enabled():
+        return body
+    return _REDACTED
+
+
 def log_debug(message, **params):
     msg = logfmt(dict(message=message, **params))
     if _console_log_level() == "debug":
@@ -56,6 +95,65 @@ def log_info(message, **params):
     logger.info(msg)
 
 
+def log_request_details(
+    *,
+    data: Any,
+    headers: Mapping[str, str] | None,
+    api_version: str | None,
+    message: str = "Request details",
+) -> None:
+    if _insecure_log_payloads_enabled():
+        log_debug(
+            message,
+            data=data,
+            headers=_headers_for_log(headers),
+            api_version=api_version,
+        )
+        return
+    log_debug(
+        message,
+        data=_REDACTED,
+        headers=_REDACTED,
+        api_version=api_version,
+        payload_bytes=_payload_byte_size(data),
+    )
+
+
+def log_response_body(*, body: Any) -> None:
+    if _insecure_log_payloads_enabled():
+        log_debug("Unique response body", body=body)
+        return
+    log_debug(
+        "Unique response body",
+        body=_body_for_log(body),
+        payload_bytes=_payload_byte_size(body),
+    )
+
+
+def redacted_body_for_error_message(body: Any) -> Any:
+    """Body representation safe to embed in exception *messages*.
+
+    Exception messages surface at ERROR (retry logs, tracebacks) regardless
+    of LOG_LEVEL, so the raw body must not be embedded unless the insecure
+    opt-in is set. The full body stays available programmatically on the
+    exception's ``http_body`` attribute.
+    """
+    if _insecure_log_payloads_enabled():
+        return body
+    return f"<redacted {_payload_byte_size(body)} bytes>"
+
+
+def redacted_error_params(params: Any) -> Any:
+    """Error ``params`` for the INFO-level 'Unique error received' log.
+
+    API validation errors commonly echo submitted values in ``params``, so
+    they are redacted unless the insecure opt-in is set.
+    """
+    if params is None or _insecure_log_payloads_enabled():
+        return params
+    return _REDACTED
+
+
 def logfmt(props):
     def fmt(key, val):
         # Handle case where val is a bytes or bytesarray

{unique_sdk-2026.32.0.dev6 → unique_sdk-2026.32.0.dev8}/unique_sdk/cli/commands/web_search.py

@@ -67,6 +67,29 @@ def _next_source_number(entries: list[dict[str, Any]]) -> int:
     return max(source_numbers, default=0) + 1
 
 
+def _fetch_error_message(content: Any) -> str | None:
+    """Extract the failure message when ``content`` is a crawl-error payload.
+
+    The web-search backend reports per-URL fetch failures in-band: proxy
+    crawlers return ``"URL: <url>\\n\\nError: <message>"``, Tavily/Jina a
+    bare ``"Error: <message>"``. Returns the message for error payloads and
+    ``None`` for real page content.
+
+    Any leading ``URL: …`` line is skipped without matching it against the
+    result's own URL — redirects or normalization can make the reported URL
+    differ from the requested one.
+    """
+    if not isinstance(content, str):
+        return None
+    stripped = content.strip()
+    first_line, _, rest = stripped.partition("\n")
+    if first_line.startswith("URL:"):
+        stripped = rest.lstrip()
+    if stripped.startswith("Error:"):
+        return stripped[len("Error:") :].strip() or "unknown crawl error"
+    return None
+
+
 def _annotate_web_results_for_citations(
     payload: dict[str, Any],
     *,
@@ -78,6 +101,14 @@ def _annotate_web_results_for_citations(
     ``sourceNumber`` across consecutive ``search`` / ``crawl`` calls in
     the same turn, so the crawled-content row carries the same citation
     marker the search-snippet row already advertised.
+
+    Crawl-error payloads (``_fetch_error_message``) are kept out of the
+    manifest's ``content`` field and recorded under ``error`` instead: the
+    platform grounds the hallucination judge on manifest ``content``, so an
+    in-band fetch error stored as content turns a correctly cited,
+    snippet-verifiable source into a false "high hallucination" verdict
+    (UN-23356). The on-screen result still shows the error text so the
+    agent can react to the failed fetch.
     """
     refs_log_path = refs_log_path or (Path.cwd() / _WEB_REFS_LOG_RELATIVE_PATH)
     with _locked_turn_refs_manifest(
@@ -109,13 +140,19 @@ def _annotate_web_results_for_citations(
 
             result["sourceNumber"] = source_number
             result["citation"] = f"websource{source_number}"
+            content = result.get("content")
+            error = result.get("error")
+            fetch_error = _fetch_error_message(content)
+            if fetch_error is not None:
+                content = None
+                error = error or fetch_error
             manifest_entry = {
                 "sourceNumber": source_number,
                 "url": url,
                 "title": result.get("title"),
                 "snippet": result.get("snippet"),
-                "content": result.get("content"),
-                "error": result.get("error"),
+                "content": content,
+                "error": error,
             }
             _append_turn_refs_manifest_entry(refs_log_path, manifest_entry)
             annotated_results.append(result)