From bf90934d059ea157593babdd140c330782db8681 Mon Sep 17 00:00:00 2001 From: itz-puneet Date: Fri, 4 Sep 2026 02:59:45 +0530 Subject: [PATCH 1/2] test(node): Assert absence of PII attributes in OpenAI integration tests The OpenAI integration tests assert which attributes are present when `sendDefaultPii` is disabled, but never assert that the PII-gated attributes are absent. A regression which leaked prompt or response content onto spans would therefore pass the existing suite. Adds an explicit check over every span in the envelope, for both `instrument.mjs` (recording disabled) scenarios, covering the four content-bearing attributes which the paired `instrument-with-pii.mjs` tests assert are present: - `gen_ai.input_messages` - `gen_ai.system_instructions` - `gen_ai.response.text` - `gen_ai.embeddings.input` Iterating the whole envelope rather than the individually inspected spans also catches content leaking onto spans the tests do not assert against directly. The same gap exists in the anthropic, langchain and google-genai suites; happy to follow up in a separate PR. Co-Authored-By: Claude Opus 5 --- .../suites/tracing/openai/test.ts | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/dev-packages/node-integration-tests/suites/tracing/openai/test.ts b/dev-packages/node-integration-tests/suites/tracing/openai/test.ts index 4b166d7a38d2..1026b1257e34 100644 --- a/dev-packages/node-integration-tests/suites/tracing/openai/test.ts +++ b/dev-packages/node-integration-tests/suites/tracing/openai/test.ts @@ -322,6 +322,16 @@ describe('OpenAI integration', () => { type: 'string', value: 'auto.ai.openai', }); + + // PII attributes must never be recorded when `sendDefaultPii` is disabled. + // Asserting over every span in the envelope catches attributes leaking onto + // spans which are not individually inspected above. + for (const span of container.items) { + expect(span.attributes[GEN_AI_INPUT_MESSAGES]).toBeUndefined(); + expect(span.attributes[GEN_AI_SYSTEM_INSTRUCTIONS]).toBeUndefined(); + expect(span.attributes[GEN_AI_RESPONSE_TEXT]).toBeUndefined(); + expect(span.attributes[GEN_AI_EMBEDDINGS_INPUT]).toBeUndefined(); + } }, }) .start() @@ -845,6 +855,16 @@ describe('OpenAI integration', () => { type: 'integer', value: 10, }); + + // PII attributes must never be recorded when `sendDefaultPii` is disabled. + // Asserting over every span in the envelope catches attributes leaking onto + // spans which are not individually inspected above. + for (const span of container.items) { + expect(span.attributes[GEN_AI_INPUT_MESSAGES]).toBeUndefined(); + expect(span.attributes[GEN_AI_SYSTEM_INSTRUCTIONS]).toBeUndefined(); + expect(span.attributes[GEN_AI_RESPONSE_TEXT]).toBeUndefined(); + expect(span.attributes[GEN_AI_EMBEDDINGS_INPUT]).toBeUndefined(); + } }, }) .start() From a987dedac8a8dd2f8484d869718a6c7e464bfb57 Mon Sep 17 00:00:00 2001 From: Puneet Deshwani Date: Tue, 15 Sep 2026 23:43:35 +0530 Subject: [PATCH 2/2] test(node): Reference dataCollection instead of removed sendDefaultPii in OpenAI assertions sendDefaultPii was removed in v11 in favour of dataCollection. The disabled scenarios now opt out via dataCollection.genAI, so the comment describing the absence assertions is updated to match. --- .../node-integration-tests/suites/tracing/openai/test.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dev-packages/node-integration-tests/suites/tracing/openai/test.ts b/dev-packages/node-integration-tests/suites/tracing/openai/test.ts index 1026b1257e34..0a2be19dbc3f 100644 --- a/dev-packages/node-integration-tests/suites/tracing/openai/test.ts +++ b/dev-packages/node-integration-tests/suites/tracing/openai/test.ts @@ -323,7 +323,7 @@ describe('OpenAI integration', () => { value: 'auto.ai.openai', }); - // PII attributes must never be recorded when `sendDefaultPii` is disabled. + // GenAI inputs and outputs must never be recorded when `dataCollection.genAI` disables them. // Asserting over every span in the envelope catches attributes leaking onto // spans which are not individually inspected above. for (const span of container.items) { @@ -856,7 +856,7 @@ describe('OpenAI integration', () => { value: 10, }); - // PII attributes must never be recorded when `sendDefaultPii` is disabled. + // GenAI inputs and outputs must never be recorded when `dataCollection.genAI` disables them. // Asserting over every span in the envelope catches attributes leaking onto // spans which are not individually inspected above. for (const span of container.items) {