security: fix sensitive data logging, context leak, unbounded memory, asserts, and more

- Fix #1: Downgrade sensitive data logging from INFO to DEBUG in agent365_exporter.py
- Fix #2: Fix unpaired context.attach() in opentelemetry_scope.py add_baggage() by storing
  and detaching baggage tokens on scope end
- Fix #3: Add bounded OrderedDict caps to unbounded dicts in OpenAI trace_processor.py
- Fix #4: Replace 30 assert statements with proper TypeError raises in LangChain utils.py
- Fix #5: Log security warning when HTTP domain override is detected
- Fix #6: Warn when bearer token sent over non-HTTPS connection
- Fix #10: Respect Retry-After header and use exponential backoff in retries
- Fix #13: Rename reset() to _reset() in ObservabilityHostingManager
- Fix #15: Replace print() with logger.warning() in LangChain tracer_instrumentor.py

Co-authored-by: nikhilNava <211831449+nikhilNava@users.noreply.github.com>

Author: Copilot

libraries/microsoft-agents-a365-observability-core/microsoft_agents_a365/observability/core/exporters/agent365_exporter.py

@@ -238,8 +238,7 @@ def _post_with_retries(self, url: str, body: str, headers: dict[str, str]) -> bo
                     continue
                 # Final attempt failed
                 logger.error(
-                    f"Request failed after {DEFAULT_MAX_RETRIES + 1} attempts: "
-                    f"{type(e).__name__}"
+                    f"Request failed after {DEFAULT_MAX_RETRIES + 1} attempts: {type(e).__name__}"
                 )
                 return False
         return False

libraries/microsoft-agents-a365-observability-core/microsoft_agents_a365/observability/core/exporters/utils.py

@@ -194,6 +194,13 @@ def get_validated_domain_override() -> str | None:
         logger.warning(f"Invalid domain override '{domain_override}': {e}")
         return None
 
+    # Warn when using insecure HTTP — telemetry data and bearer tokens may be exposed
+    if domain_override.lower().startswith("http://"):
+        logger.warning(
+            "Domain override uses insecure HTTP. Telemetry data (including "
+            "bearer tokens) will be transmitted in cleartext."
+        )
+
     return domain_override
 
 

libraries/microsoft-agents-a365-observability-extensions-langchain/microsoft_agents_a365/observability/extensions/langchain/tracer_instrumentor.py

@@ -3,6 +3,7 @@
 
 from __future__ import annotations
 
+import logging
 from collections.abc import Callable, Collection
 from typing import Any
 from uuid import UUID
@@ -21,6 +22,8 @@
 
 from microsoft_agents_a365.observability.extensions.langchain.tracer import CustomLangChainTracer
 
+logger = logging.getLogger(__name__)
+
 _INSTRUMENTS: str = "langchain_core >= 1.2.0"
 
 
@@ -86,7 +89,7 @@ def _uninstrument(self, **kwargs: Any) -> None:
     def get_span(self, run_id: UUID) -> Span | None:
         """Return the span for a specific LangChain run_id, if available."""
         if not self._tracer:
-            print("Missing tracer; call InstrumentorForLangChain().instrument() first.")
+            logger.warning("Missing tracer; call InstrumentorForLangChain().instrument() first.")
             return None
         # TraceForLangChain is expected to expose get_span(run_id).
         get_span_fn = getattr(self._tracer, "get_span", None)
@@ -95,7 +98,7 @@ def get_span(self, run_id: UUID) -> Span | None:
     def get_ancestors(self, run_id: UUID) -> list[Span]:
         """Return ancestor spans from the run’s parent up to the root (nearest first)."""
         if not self._tracer:
-            print("Missing tracer; call InstrumentorForLangChain().instrument() first.")
+            logger.warning("Missing tracer; call InstrumentorForLangChain().instrument() first.")
             return []
 
         # Expect the processor to keep a run_map with parent linkage (string keys).

libraries/microsoft-agents-a365-observability-hosting/microsoft_agents_a365/observability/hosting/middleware/observability_hosting_manager.py

@@ -96,6 +96,6 @@ def configure(
         return instance
 
     @classmethod
-    def reset(cls) -> None:
+    def _reset(cls) -> None:
         """Reset the singleton instance. Intended for testing only."""
         cls._instance = None

tests/observability/core/test_agent365_exporter.py

@@ -313,25 +313,25 @@ def test_export_logging(self, mock_logger):
             self.assertEqual(result, SpanExportResult.SUCCESS)
 
             # Verify logging calls - should use default endpoint URL
-            expected_log_calls = [
-                # Should log groups found
-                unittest.mock.call.info("Found 1 identity groups with 2 total spans to export"),
-                # Should log endpoint being used (default endpoint)
-                unittest.mock.call.info(
+            expected_debug_calls = [
+                # Should log groups found at DEBUG
+                unittest.mock.call.debug("Found 1 identity groups with 2 total spans to export"),
+                # Should log endpoint being used at DEBUG (default endpoint)
+                unittest.mock.call.debug(
                     f"Exporting 2 spans to endpoint: {DEFAULT_ENDPOINT_URL}/observability/tenants/test-tenant-123/agents/test-agent-456/traces?api-version=1 "
                     "(tenant: test-tenant-123, agent: test-agent-456)"
                 ),
-                # Should log token resolution success
-                unittest.mock.call.info("Token resolved successfully for agent test-agent-456"),
-                # Should log HTTP success
-                unittest.mock.call.info(
-                    "HTTP 200 success on attempt 1. Correlation ID: test-correlation-123. Response: success"
+                # Should log token resolution success at DEBUG
+                unittest.mock.call.debug("Token resolved successfully."),
+                # Should log HTTP success at DEBUG
+                unittest.mock.call.debug(
+                    "HTTP 200 success on attempt 1. Correlation ID: test-correlation-123."
                 ),
             ]
 
-            # Check that all expected info calls were made
-            for expected_call in expected_log_calls:
-                self.assertIn(expected_call, mock_logger.info.call_args_list)
+            # Check that all expected debug calls were made
+            for expected_call in expected_debug_calls:
+                self.assertIn(expected_call, mock_logger.debug.call_args_list)
 
     @patch("microsoft_agents_a365.observability.core.exporters.agent365_exporter.logger")
     def test_export_error_logging(self, mock_logger):

tests/observability/hosting/middleware/test_observability_hosting_manager.py

@@ -19,9 +19,9 @@
 @pytest.fixture(autouse=True)
 def _reset_singleton():
     """Reset the singleton before and after each test."""
-    ObservabilityHostingManager.reset()
+    ObservabilityHostingManager._reset()
     yield
-    ObservabilityHostingManager.reset()
+    ObservabilityHostingManager._reset()
 
 
 def test_configure_is_singleton():