Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 31694e79bf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Pull request overview
This PR adds configurable privacy controls to the Langfuse tracing integration so operators can keep operational telemetry (timing/model/usage/cost/errors) while preventing conversation/tool/media content from being exported off-server, with a fail-closed safeguard when the installed tracing runtime can’t enforce masking.
Changes:
- Extends
librechat.yamlLangfuse config schema with a newlangfuse.privacyblock (full|metricsOnly, optionalredactionText). - Adds backend policy/config plumbing to attach
metricsOnlyprivacy to the Langfuse run config and disable export when masking support is unavailable. - Adds/updates Jest coverage and documents the new config in
librechat.example.yaml.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/data-provider/src/config.ts | Adds langfuse.privacy config schema to validate privacy mode and redaction marker. |
| packages/data-provider/specs/config-schemas.spec.ts | Validates the new schema behavior via config schema unit tests. |
| packages/api/src/langfuse/policy.ts | Detects whether the installed @librechat/agents runtime supports privacy masking (capability probe). |
| packages/api/src/langfuse/policy.spec.ts | Tests the capability probe behavior via mocked agents runtime exports. |
| packages/api/src/langfuse/config.ts | Attaches metricsOnly privacy policy to run config and fails closed when unsupported. |
| packages/api/src/langfuse/config.spec.ts | Adds unit tests for metricsOnly attachment and fail-closed behavior. |
| librechat.example.yaml | Documents the new langfuse.privacy configuration block for operators. |
Suppressed comments (2)
packages/api/src/langfuse/config.spec.ts:965
- New test case uses
as unknown as AppConfig. SinceAppConfighas a small required core shape, prefer constructing a minimalAppConfigobject directly (avoidsas unknown as Tper CLAUDE.md Type Safety guidance).
appConfig: {
langfuse: { privacy: { mode: 'metricsOnly' } },
} as unknown as AppConfig,
}),
packages/api/src/langfuse/config.spec.ts:987
- New test adds another
as unknown as AppConfigassertion. Consider using a minimalAppConfigliteral (withconfig,fileStrategy,imageOutputType) to keep tests type-safe without the double cast.
appConfig: {
langfuse: { privacy: { mode: 'full' } },
} as unknown as AppConfig,
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
@codex review |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. Keep it up! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
danny-avila
added
area/LLM provider integration and observability
🗺️ Observability
Langfuse tracing exported conversation content, tool arguments and outputs, trace metadata, and media with no way to suppress any of it, which blocks deployments under GDPR-style data-protection requirements that want operational telemetry without conversation content. Add a langfuse.privacy block to librechat.yaml. mode metricsOnly replaces message, tool, and metadata content with a redaction marker on every export destination and disables media upload, while trace structure, timing, model, token usage, cost, and error status stay exported. Tenant trace metadata and tags are skipped at the source in that mode since the SDK mask does not cover tags. The policy fails closed: when the installed @librechat/agents runtime cannot enforce masking (detected through its LANGFUSE_PRIVACY_MASKING_SUPPORTED export), trace export is disabled for the run and the operator is warned once, rather than degrading into a full export. Closes #14362
Review follow-up: metricsOnly now also applies to Langfuse feedback scores. The score comment (feedback tag and free text) is omitted, the tag and the sender display name are dropped from score metadata, and the rating plus correlation ids stay. Also trim langfuse.privacy.redactionText in the schema so whitespace-only values are rejected at load instead of silently falling back to the default marker at runtime. The feedback comment separator changes from an em dash to a colon.
codegraph-librechat
Bot
added
the
🗺️ Backend Platform
3a80a3f to
ca99b84
Compare
|
@codex review Please review the current PR head 5d29cde. State the exact reviewed commit and ignore findings that apply only to earlier heads. Purpose supplied by the requester: Head 5d29cde never reviewed: rebase onto dev plus 302d64e (metricsOnly suppresses trace identity fields) and 2 e2e spec commits since reviewed head 3a80a3f |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5d29cde9ee
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
codegraph-librechat
Bot
added
🗺️ Server Core
Summary
Langfuse tracing exported conversation content, tool arguments and outputs, trace metadata, and media with no way to suppress any of it, which blocks deployments that need operational telemetry (latency, model, token usage, cost, errors) without conversation content leaving the server. Resolves #14362.
This adds a
langfuse.privacyblock tolibrechat.yamlwith amode(fulldefault, ormetricsOnly) and a configurableredactionText. InmetricsOnly, message content, tool arguments, tool outputs, and trace/observation metadata are replaced with the redaction marker before trace data leaves the server on every export destination, media upload is disabled, and tenant trace metadata and tags are skipped at the source. Trace structure, timing, model, token usage, cost, and error status remain available.The policy fails closed: when the installed
@librechat/agentsruntime cannot enforce masking, trace export is disabled for the run and the operator is warned once per process. Masking is enforced by the tracing runtime in LibreChat-AI/agents#440, which no@librechat/agentsrelease includes yet (4.0.1, the latest, does not); merging earlier is safe because of the fail-closed gate. Theredactedmode from the issue is not accepted by the schema yet, since no rules engine exists.Change Type
Testing
cd packages/data-provider && npx jest specs/config-schemas.spec.ts: 108 passedcd packages/api && npx jest src/langfuse/: config 49, policy 16, feedback suites greencd packages/api && npx jest src/admin/secrets.spec.ts src/admin/config.handler.spec.ts: 190 passedcd api && npx jest server/services/Config/loadCustomConfig.spec.js: 22 passedcd packages/api && npx tsc --noEmit -p tsconfig.json, plus eslint on touched filesManual checks: schema accepts
metricsOnlyand rejects unknown modes and blank redaction text;buildLangfuseConfigattaches the policy with trimmed redaction text, suppresses tenant metadata and tags, and produces a full export infullmode; the fail-closed path disables export when the runtime lacks the capability export. Not run: a live round-trip against a real Langfuse instance (the masking path is verified in LibreChat-AI/agents#440 against the real span processor).Test Configuration:
Node v24.16.0, local MongoDB,
@librechat/agents4.0.1 installed (exercises the fail-closed path), agents branch built locally for the supported-path unit tests.Checklist