Skip to content

fix(otel): honor RUST_LOG directives for logs - #11360

Merged
michaelneale merged 1 commit into
mainfrom
jbg/security-otlp-log-filter
Aug 20, 2026
Merged

michaelneale merged 1 commit into
mainfrom
jbg/security-otlp-log-filter

Conversation

@jbg

@jbg jbg commented Aug 19, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

  • honor directive-style RUST_LOG values in the OTLP log bridge
  • preserve OTEL_LOG_LEVEL and INFO fallback behavior for absent or invalid filters
  • keep sensitive rmcp::service targets suppressed regardless of user directives

Security invariant

The OTLP log exporter applies the operator's valid RUST_LOG filter without silently broadening telemetry when target directives are used.

Verification

  • cargo fmt --all -- --check
  • cargo test -p goose --features otel otlp_logs_filter --lib (6 passed)
  • cargo build -p goose --features otel
  • cargo clippy -p goose --all-targets --features otel -- -D warnings
  • git diff origin/main...HEAD --check

This finding was discovered by Project Loupe

Signed-off-by: Jasper Hugo <jasper@spiral.xyz>
@michaelneale
michaelneale added this pull request to the merge queue Aug 19, 2026
Merged via the queue into main with commit b7eef32 Aug 20, 2026
24 checks passed
@michaelneale
michaelneale deleted the jbg/security-otlp-log-filter branch August 20, 2026 01:54
michaelneale added a commit that referenced this pull request Aug 20, 2026
* origin/main:
  fix: bound retry command diagnostics (#11365)
  Disable thinking for tool call labels (#11207)
  fix(review): contain REVIEW.md discovery (#11367)
  fix(acp): preserve tool result audience metadata (#11375)
  test(providers): isolate environment-proxy test in its own binary (#11262)
  fix(security): bind Foundry API keys to request origin (#11347)
  fix: canonicalize mangled tool names before permission inspection (follow-up to #10230) (#10285)
  feat(providers): add Lynkr as a declarative OpenAI-compatible provider (#11372)
  fix: sanitize Pi imported output (#10990)
  fix(otel): honor RUST_LOG directives for logs (#11360)
  feat(skills): add web-search and browser-use built-in skills (#11233)
  feat(dictation): add model-native audio transcription provider (#10589)
  feat(aws_bedrock): route OpenAI GPT-5.6 (sol/terra/luna) via Bedrock … (#10502)
  refactor(goose-local-inference): move mlx deps under macos (#11328)
  feat(providers): add PleumRouter declarative provider (#10479)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants