fix(telemetry): gate request_text/response_text on logPrompts

packages/core/src/core/loggingContentGenerator/loggingContentGenerator.test.ts

@@ -327,6 +327,8 @@ const createConfig = (overrides: Record<string, unknown> = {}): Config => {
     getWorkingDir: () => process.cwd(),
     getTelemetryIncludeSensitiveSpanAttributes: () =>
       Boolean(configContent['includeSensitiveSpanAttributes']),
+    getTelemetryLogPromptsEnabled: () =>
+      Boolean(configContent['logPrompts'] ?? true),
     getTelemetrySensitiveSpanAttributeMaxLength: () =>
       (configContent['sensitiveSpanAttributeMaxLength'] as number) ??
       1024 * 1024,
@@ -844,6 +846,78 @@ describe('LoggingContentGenerator', () => {
     expect(openaiError).toBeUndefined();
   });
 
+  it('omits request_text and response_text from API telemetry when logPrompts is false', async () => {
+    const wrapped = createWrappedGenerator(
+      vi.fn().mockResolvedValue(
+        createResponse('resp-noprompts', 'test-model', [
+          { text: 'SENSITIVE_RESPONSE_MARKER' },
+        ]),
+      ),
+      vi.fn(),
+    );
+    const generator = new LoggingContentGenerator(
+      wrapped,
+      createConfig({ logPrompts: false }),
+      {
+        model: 'test-model',
+        authType: AuthType.USE_OPENAI,
+      },
+    );
+
+    await generator.generateContent(
+      {
+        model: 'test-model',
+        contents: [
+          { role: 'user', parts: [{ text: 'SENSITIVE_REQUEST_MARKER' }] },
+        ],
+      } as unknown as GenerateContentParameters,
+      'prompt-noprompts',
+    );
+
+    expect(logApiRequest).toHaveBeenCalledTimes(1);
+    const [, requestEvent] = vi.mocked(logApiRequest).mock.calls[0];
+    expect(requestEvent.request_text).toBeUndefined();
+
+    expect(logApiResponse).toHaveBeenCalledTimes(1);
+    const [, responseEvent] = vi.mocked(logApiResponse).mock.calls[0];
+    expect(responseEvent.response_text).toBeUndefined();
+  });
+
+  it('keeps request_text and response_text in API telemetry when logPrompts is true', async () => {
+    const wrapped = createWrappedGenerator(
+      vi.fn().mockResolvedValue(
+        createResponse('resp-prompts', 'test-model', [
+          { text: 'KEEP_RESPONSE_MARKER' },
+        ]),
+      ),
+      vi.fn(),
+    );
+    const generator = new LoggingContentGenerator(
+      wrapped,
+      createConfig({ logPrompts: true }),
+      {
+        model: 'test-model',
+        authType: AuthType.USE_OPENAI,
+      },
+    );
+
+    await generator.generateContent(
+      {
+        model: 'test-model',
+        contents: [
+          { role: 'user', parts: [{ text: 'KEEP_REQUEST_MARKER' }] },
+        ],
+      } as unknown as GenerateContentParameters,
+      'prompt-prompts',
+    );
+
+    const [, requestEvent] = vi.mocked(logApiRequest).mock.calls[0];
+    expect(requestEvent.request_text).toContain('KEEP_REQUEST_MARKER');
+
+    const [, responseEvent] = vi.mocked(logApiResponse).mock.calls[0];
+    expect(responseEvent.response_text).toBe('KEEP_RESPONSE_MARKER');
+  });
+
   it('creates and closes the non-stream API span on success', async () => {
     const wrapped = createWrappedGenerator(
       vi

packages/core/src/core/loggingContentGenerator/loggingContentGenerator.ts

@@ -235,7 +235,9 @@ export class LoggingContentGenerator implements ContentGenerator {
     promptId: string,
     sessionId: string,
   ): void {
-    const requestText = JSON.stringify(contents);
+    const requestText = this.config.getTelemetryLogPromptsEnabled()
+      ? JSON.stringify(contents)
+      : undefined;
     logApiRequest(
       this.config,
       new ApiRequestEvent(
@@ -268,7 +270,7 @@ export class LoggingContentGenerator implements ContentGenerator {
         prompt_id,
         this.generatorAuthType,
         usageMetadata,
-        responseText,
+        this.config.getTelemetryLogPromptsEnabled() ? responseText : undefined,
         subagentNameContext.getStore(),
         ttftMs,
       ),

packages/core/src/telemetry/log-to-span-processor.test.ts

@@ -173,6 +173,7 @@ describe('LogToSpanProcessor', () => {
         error_message: 'secret upstream error',
         prompt: 'secret prompt',
         function_args: '{"token":"secret"}',
+        request_text: 'secret request',
         response_text: 'secret response',
         error_type: 'RateLimitError',
         safe: 'visible',
@@ -188,6 +189,7 @@ describe('LogToSpanProcessor', () => {
     expect(attrs).not.toHaveProperty('error_message');
     expect(attrs).not.toHaveProperty('prompt');
     expect(attrs).not.toHaveProperty('function_args');
+    expect(attrs).not.toHaveProperty('request_text');
     expect(attrs).not.toHaveProperty('response_text');
     expect(attrs['error_type']).toBe('RateLimitError');
     expect(attrs['safe']).toBe('visible');
@@ -210,6 +212,7 @@ describe('LogToSpanProcessor', () => {
         error_message: 'secret upstream error',
         prompt: 'secret prompt',
         function_args: '{"token":"secret"}',
+        request_text: 'secret request',
         response_text: 'secret response',
         safe: 'visible',
       },
@@ -224,6 +227,7 @@ describe('LogToSpanProcessor', () => {
     expect(attrs['error_message']).toBe('secret upstream error');
     expect(attrs['prompt']).toBe('secret prompt');
     expect(attrs['function_args']).toBe('{"token":"secret"}');
+    expect(attrs['request_text']).toBe('secret request');
     expect(attrs['response_text']).toBe('secret response');
     expect(attrs['safe']).toBe('visible');
     expect(attrs['log.bridge']).toBe(true);

packages/core/src/telemetry/log-to-span-processor.ts

@@ -61,6 +61,7 @@ const SENSITIVE_ATTRIBUTE_KEYS = new Set([
   'error_message',
   'prompt',
   'function_args',
+  'request_text',
   'response_text',
 ]);