feat(logger): dispatch Python logging through the Rust diagnostics processor

.github/workflows/test-rust.yml

@@ -105,6 +105,16 @@ jobs:
         with:
           python-version: "3.12"
 
+      - uses: ./.github/actions/setup-uv-with-retries
+        with:
+          version: "0.10.9"
+
+      - name: Install Python dependencies for the bridge tests
+        working-directory: .
+        run: |
+          uv sync --frozen --no-install-project
+          echo "PYTHONPATH=$PWD/.venv/lib/$(ls .venv/lib)/site-packages" >> "$GITHUB_ENV"
+
       - run: rustup toolchain install --no-self-update
 
       - uses: taiki-e/install-action@d438492cf8a250514fa2d34b30bc3c0dc37c65ff # v2.87.8

litellm-rust/Cargo.toml

@@ -9,6 +9,8 @@ license = "MIT"
 repository = "https://github.com/BerriAI/litellm"
 
 [workspace.dependencies]
+litellm-tracing = { path = "crates/tracing" }
+tracing = "0.1"
 litellm-core = { path = "crates/core" }
 litellm-host = { path = "crates/host" }
 litellm-callbacks-legacy-python = { path = "crates/callbacks-legacy-python" }

litellm-rust/crates/core-utils/Cargo.toml

@@ -7,6 +7,7 @@ repository.workspace = true
 
 [dependencies]
 fancy-regex.workspace = true
+litellm-tracing.workspace = true
 litellm-types.workspace = true
 serde.workspace = true
 serde_json.workspace = true

litellm-rust/crates/core-utils/src/secret_redaction.rs

@@ -1,109 +1 @@
-use fancy_regex::Regex;
-
-pub const REDACTED: &str = "REDACTED";
-
-const DEFAULT_MINIMUM_CUSTOM_KEY_LENGTH: usize = 16;
-
-fn minimum_custom_key_length() -> usize {
-    std::env::var("MINIMUM_CUSTOM_KEY_LENGTH")
-        .ok()
-        .and_then(|value| value.trim().parse().ok())
-        .unwrap_or(DEFAULT_MINIMUM_CUSTOM_KEY_LENGTH)
-}
-
-fn secret_patterns(minimum_custom_key_length: usize) -> String {
-    let sk_suffix_length = minimum_custom_key_length.saturating_sub("sk-".len());
-    [
-        r"-----BEGIN[A-Z \-]*PRIVATE KEY-----[\s\S]*?-----END[A-Z \-]*PRIVATE KEY-----",
-        r"\bya29\.[A-Za-z0-9_.~+/-]+",
-        r#"(?:client_secret|azure_password|azure_username)\s+[^\s,'"})\]{}>]+"#,
-        r"(?:AKIA|ASIA)[0-9A-Z]{16}",
-        r"Bearer\s+[A-Za-z0-9\-._~+/]{10,}=*",
-        r"Basic\s+[A-Za-z0-9+/]{10,}={0,2}",
-        &format!(r"sk-[A-Za-z0-9\-_]{{{sk_suffix_length},}}"),
-        r#"(?<=[?&])(?:api[_-]?key|\w*(?:token|password|passwd|client_secret|secret_key|_secret))=[^\s&'"]+"#,
-        r#"(?:api[_-]?key)['"]?\s*[:=]\s*['"]?[^\s,'"})\]{}>]{8,}"#,
-        r#"(?:x-api-key|api-key)['"]?\s*[:=]\s*['"]?[^\s,'"})\]{}>]+"#,
-        r"x-ak-[A-Za-z0-9\-_]{20,}",
-        r"AIza[0-9A-Za-z\-_]{35}",
-        r#"(?<=[?&])key=[^\s&'"]{8,}"#,
-        r#"(?:^|(?<=\W))\w*(?:password|passwd|client_secret|secret_key|_secret)['"]?\s*[:=]\s*['"]?[^\s,'"})\]{}>]+"#,
-        r#"(?<=://)[^\s'":]{0,4096}:[^\s'"]{1,4096}(?=@)"#,
-        r"dapi[0-9a-f]{32}",
-        r#"litellm\.[A-Za-z0-9_]*_key['"]?\s*[:=]\s*['"]?[^\s,'"})\]{}>]+"#,
-        r#"private_key['"]?\s*[:=]\s*['"]?(?:-----BEGIN[A-Z \-]*PRIVATE KEY-----[\s\S]*?-----END[A-Z \-]*PRIVATE KEY-----|[^\s,'"})\]{}>]+)"#,
-        concat!(
-            r"(?:master_key|xai_key|database_url|db_url|connection_string|",
-            r"aws_secret_access_key|aws_session_token|aws_access_key_id|",
-            r"signing_key|encryption_key|",
-            r"auth_token|access_token|refresh_token|",
-            r"slack_webhook_url|webhook_url|",
-            r"database_connection_string|",
-            r"huggingface_token|jwt_secret)",
-            r#"['"]?\s*[:=]\s*['"]?[^\s,'"})\]{}>]+"#,
-        ),
-        r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*",
-        r"(?<=[?&])sig=[A-Za-z0-9%+/=]+",
-        r#"\{[^{}]*"type"\s*:\s*"service_account"[^{}]*(?:\{[^{}]*\}[^{}]*)*\}"#,
-    ]
-    .join("|")
-}
-
-/// Python's `_ENABLE_SECRET_REDACTION` pattern set, compiled once per configuration.
-#[derive(Clone, Debug)]
-pub struct SecretRedactor {
-    pattern: Regex,
-}
-
-impl SecretRedactor {
-    pub fn new(minimum_custom_key_length: usize) -> Self {
-        let pattern = Regex::new(&format!(
-            "(?i){}",
-            secret_patterns(minimum_custom_key_length)
-        ))
-        .expect("secret redaction patterns compile");
-        Self { pattern }
-    }
-
-    /// `None` when `LITELLM_DISABLE_REDACT_SECRETS` turns redaction off.
-    pub fn from_env() -> Option<Self> {
-        let disabled = std::env::var("LITELLM_DISABLE_REDACT_SECRETS")
-            .is_ok_and(|value| value.eq_ignore_ascii_case("true"));
-        (!disabled).then(|| Self::new(minimum_custom_key_length()))
-    }
-
-    pub fn redact(&self, value: &str) -> String {
-        self.pattern.replace_all(value, REDACTED).into_owned()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[rstest::rstest]
-    #[case::bearer("auth failed: Bearer abcdefghijklmnop", "auth failed: REDACTED")]
-    #[case::sk_key("key sk-abcdefghijklmnopqrstuvwxyz rejected", "key REDACTED rejected")]
-    #[case::short_sk_key_is_kept("sk-abc", "sk-abc")]
-    #[case::query_param("GET /v1?api_key=secret123&x=1", "GET /v1?REDACTED&x=1")]
-    #[case::dict_repr("{'api_key': 'abcdefghij'}", "{'REDACTED'}")]
-    #[case::url_credentials("postgres://user:pass@host/db", "postgres://REDACTED@host/db")]
-    #[case::case_insensitive("BEARER ABCDEFGHIJKLMNOP", "REDACTED")]
-    #[case::aws_key("AKIAABCDEFGHIJKLMNOP", "REDACTED")]
-    #[case::sas_signature("https://x.blob/a?sv=1&sig=abc%2B=", "https://x.blob/a?sv=1&REDACTED")]
-    #[case::password_needs_word_boundary("db_password=hunter2", "REDACTED")]
-    #[case::plain_text_is_kept(r#"{"message": "rejected"}"#, r#"{"message": "rejected"}"#)]
-    fn redacts_the_same_spans_as_the_python_patterns(#[case] input: &str, #[case] expected: &str) {
-        assert_eq!(
-            SecretRedactor::new(DEFAULT_MINIMUM_CUSTOM_KEY_LENGTH).redact(input),
-            expected
-        );
-    }
-
-    #[test]
-    fn sk_threshold_follows_the_minimum_custom_key_length() {
-        let redactor = SecretRedactor::new(8);
-        assert_eq!(redactor.redact("sk-abcde"), REDACTED);
-        assert_eq!(redactor.redact("sk-abcd"), "sk-abcd");
-    }
-}
+pub use litellm_tracing::{REDACTED, SecretRedactor};

litellm-rust/crates/python-bridge/Cargo.toml

@@ -19,6 +19,9 @@ huggingface = ["litellm-token-counter/huggingface"]
 tiktoken = ["litellm-token-counter/tiktoken"]
 
 [dependencies]
+fancy-regex.workspace = true
+litellm-tracing.workspace = true
+litellm-host.workspace = true
 bytes.workspace = true
 futures-util.workspace = true
 litellm-cache.workspace = true

litellm-rust/crates/python-bridge/src/cache/activation.rs

@@ -1,6 +1,7 @@
+use crate::logger::run_sync_value;
 use litellm_cache_gcs::{DEFAULT_ENDPOINT, GcsConfig};
 use litellm_cache_redis_semantic::RedisSemanticConfig;
-use litellm_host_python::{release_gil, run_sync_value};
+use litellm_host_python::release_gil;
 use litellm_http::ClientVariant;
 use pyo3::prelude::*;
 

litellm-rust/crates/python-bridge/src/cache/binding.rs

@@ -1,5 +1,6 @@
+use crate::logger::run_async;
 use litellm_cache_response::PartialHits;
-use litellm_host_python::{ExecutionStep, from_py, release_gil, run_async, to_py};
+use litellm_host_python::{ExecutionStep, from_py, release_gil, to_py};
 use pyo3::{
     PyTraverseError, PyVisit,
     exceptions::{PyRuntimeError, PyValueError},

litellm-rust/crates/python-bridge/src/cache/handle.rs

@@ -1,10 +1,11 @@
+use crate::logger::run_sync_value;
 use litellm_auth_aws::AwsAuthConfig;
 use litellm_cache_gcs::{DEFAULT_ENDPOINT, GcsConfig};
 use litellm_cache_qdrant_semantic::{OpenAiEmbedderConfig, Quantization};
 use litellm_cache_redis::{RedisNode, RedisTopology};
 use litellm_cache_redis_semantic::RedisSemanticConfig;
 use litellm_cache_s3::{S3CacheConfig, S3Endpoint};
-use litellm_host_python::{release_gil, run_sync_value};
+use litellm_host_python::release_gil;
 use litellm_http::ClientVariant;
 use pyo3::{
     PyTraverseError, PyVisit,

litellm-rust/crates/python-bridge/src/cache/native.rs

@@ -470,7 +470,7 @@ impl NativeResponseCache {
         match self {
             Self::Exact(_) | Self::QdrantSemantic(_) => {
                 let service = self.clone();
-                litellm_host_python::run_async(
+                crate::logger::run_async(
                     py,
                     async move {
                         service
@@ -495,7 +495,7 @@ impl NativeResponseCache {
         match self {
             Self::Exact(_) | Self::QdrantSemantic(_) => {
                 let service = self.clone();
-                litellm_host_python::run_async(
+                crate::logger::run_async(
                     py,
                     async move { service.async_lookup(&request, now()).await },
                     super::cache_error,
@@ -550,7 +550,7 @@ impl NativeResponseCache {
         match self {
             Self::Exact(_) | Self::QdrantSemantic(_) => {
                 let service = self.clone();
-                litellm_host_python::run_async(
+                crate::logger::run_async(
                     py,
                     async move { service.async_store(&request, response, now()).await },
                     super::cache_error,
@@ -619,7 +619,7 @@ impl NativeResponseCache {
         match self {
             Self::Exact(_) | Self::QdrantSemantic(_) => {
                 let service = self.clone();
-                litellm_host_python::run_async(
+                crate::logger::run_async(
                     py,
                     async move { service.async_store_batch(entries, now()).await },
                     super::cache_error,

litellm-rust/crates/python-bridge/src/cache/semantic.rs

@@ -1,7 +1,8 @@
+use crate::logger::run_async;
 use std::{collections::VecDeque, time::Duration};
 
 use litellm_cache::Error;
-use litellm_host_python::{Execution, ExecutionBody, ExecutionStep, run_async};
+use litellm_host_python::{Execution, ExecutionBody, ExecutionStep};
 use pyo3::{
     PyTraverseError, PyVisit,
     exceptions::{PyException, PyRuntimeError},

litellm-rust/crates/python-bridge/src/http.rs

@@ -102,7 +102,7 @@ pub(crate) fn call_config(
     .without_missing_files(&|path: &Path| path.exists());
     let resolution = Resolution::from(&settings);
     for unsupported in unreported(&REPORTED_UNSUPPORTED, resolution.unsupported) {
-        PythonSettings::warn(py, &unsupported.to_string())?;
+        crate::logger::capture(py).scope(|| litellm_tracing::warn!("{unsupported}"));
     }
     Ok(resolution.config)
 }

litellm-rust/crates/python-bridge/src/lib.rs

@@ -4,6 +4,7 @@ mod credentials;
 mod diagnostics;
 mod errors;
 mod http;
+mod logger;
 mod marshal;
 mod python_settings;
 mod routes;
@@ -25,6 +26,8 @@ mod _native {
     #[pymodule_export]
     use crate::errors::{RustBridgeDeclined, RustUpstreamError};
     #[pymodule_export]
+    use crate::logger::NativeDiagnosticProcessor;
+    #[pymodule_export]
     use crate::routes::audio_transcription::{atranscription, transcription};
     #[pymodule_export]
     use crate::routes::chat_completions::{
@@ -87,6 +90,7 @@ mod tests {
                 "chat_completions",
                 "achat_completions",
                 "ResponsesWebSocketConnection",
+                "NativeDiagnosticProcessor",
                 "TokenCounter",
                 "Tokenizer",
                 "gil_stats",

litellm-rust/crates/python-bridge/src/logger/execution.rs

@@ -0,0 +1,46 @@
+use std::future::Future;
+
+use pyo3::prelude::*;
+use serde::Serialize;
+
+pub(crate) fn run_sync<T, E, F>(
+    py: Python<'_>,
+    future: F,
+    map_error: fn(E) -> PyErr,
+) -> PyResult<Py<PyAny>>
+where
+    T: Serialize + Send + 'static,
+    E: Send + 'static,
+    F: Future<Output = Result<T, E>> + Send + 'static,
+{
+    litellm_host_python::run_sync(py, super::capture(py).instrument(future), map_error)
+}
+
+pub(crate) fn run_async<T, E, F>(
+    py: Python<'_>,
+    future: F,
+    map_error: fn(E) -> PyErr,
+) -> PyResult<Bound<'_, PyAny>>
+where
+    T: Serialize + Send + 'static,
+    E: Send + 'static,
+    F: Future<Output = Result<T, E>> + Send + 'static,
+{
+    litellm_host_python::run_async(py, super::capture(py).instrument(future), map_error)
+}
+
+pub(crate) fn run_sync_value<T, F>(py: Python<'_>, future: F) -> PyResult<T>
+where
+    T: Send + 'static,
+    F: Future<Output = PyResult<T>> + Send + 'static,
+{
+    litellm_host_python::run_sync_value(py, super::capture(py).instrument(future))
+}
+
+pub(crate) fn run_async_value<T, F>(py: Python<'_>, future: F) -> PyResult<Bound<'_, PyAny>>
+where
+    T: for<'py> IntoPyObject<'py> + Send + 'static,
+    F: Future<Output = PyResult<T>> + Send + 'static,
+{
+    litellm_host_python::run_async_value(py, super::capture(py).instrument(future))
+}