Python: Sanitize unexpected streaming response failures

[Jose Alvarez (jpalvarezl)]

Motivation & Context

Unexpected locally synthesized streaming failures could include implementation exception text in client-visible response.failed payloads. Hosting should return a stable public failure message while retaining enough correlated server-side diagnostics to investigate failures under the existing sensitive-data policy.

Description & Review Guide

• What are the major changes? Both hosting-responses and foundry-hosting now use the same stable message for unexpected synthesized streaming failures. Foundry makes generic serialization the default at the terminal failure boundary and uses a private explicit marker only for established, vetted client-safe validation messages. Correlated diagnostics include the failure phase, response ID, and exception type, while full exception details and tracebacks are logged only when sensitive-data capture is enabled. Tests cover iterator, finalizer, projection, status, developer option hooks, session-store failures, partial output, terminal event ordering, response IDs, safe validation compatibility, and diagnostics in both sensitive-data modes.
• What is the impact of these changes? Existing HTTP status, server_error code, event ordering, IDs, partial output, usage, terminal lifecycle behavior, and established safe validation messages are preserved. Unmarked unexpected failures are always made generic.
• What do you want reviewers to focus on? The explicit safe-public validation boundary, generic fallback behavior, and preservation of streaming lifecycle semantics.

Related Issue

N/A - trivial change. This is a narrowly scoped correction to synthesized failure output whose expected public behavior is not reasonably in dispute. No competing open PR was found.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: Implementation, tests, validation, and PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and the title prefix in sync automatically.

[github-code-quality]

Code coverage overview

Languages: Python

Python / code-coverage/python

main 9127b89	jpalvarezl-fix-strea... 4862c66	+/-
92%	92%	0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated October 16, 2026 15:46 UTC}

[Copilot]

🟡 Changes recommended

Some unexpected Foundry failures still expose exception details, while OAuth continuation handling hides established safe validation messages.

2 open findings

• Prevent exception detail leaks in agent failure responses · New
• Preserve safe OAuth validation messages when handling failures · New

What changed in this PR

This PR sanitizes unexpected response failures in Python hosting and adds correlated diagnostics governed by sensitive-data settings.

Changes:

• Introduces generic public failure messages and Foundry exception wrappers.
• Adds conditional exception-detail logging.
• Extends tests for redaction, diagnostics, and streaming behavior.

File	Description
python/​packages/​hosting-responses/​tests/​hosting_responses/​test_parsing.py	Tests sanitized failures and conditional diagnostics.
python/​packages/​hosting-responses/​agent_framework_hosting_responses/​_parsing.py	Sanitizes streaming failures and logs correlated diagnostics.
python/​packages/​foundry_hosting/​tests/​test_responses.py	Updates failure expectations and tests sensitive-data handling.
python/​packages/​foundry_hosting/​agent_framework_foundry_hosting/​_responses.py	Adds failure classification, redaction, and conditional diagnostics.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 66da160c7cd0
Model: gpt-5.6-sol

Overview

The PR adds stable public failure messages and sensitive-data-gated diagnostics across both streaming hosts, with strong tests for iterator, finalizer, projection, lifecycle, ID, partial-output, and event-ordering behavior. The broad hosting-responses exception boundary and Foundry's explicit wrappers protect the principal agent and workflow execution paths. Foundry's central serializer still exposes unwrapped exception text, however, so preparation and storage failures can continue to disclose implementation details.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: python/packages/foundry_hosting/agent_framework_foundry_hosting/_responses.py