UAT: Widespread use of standard `logging` module instead of required `structlog` — secrets masking processor bypassed in 100+ source files #3687

New issue

Open

opened 2026-04-05 21:36:54 +00:00 by freemo · 1 comment

freemo commented

2026-04-05 21:36:54 +00:00

Owner

Metadata

Branch: fix/structlog-replace-standard-logging-codewide
Commit Message: fix(logging): replace standard logging with structlog across all production source files
Milestone: v3.7.0
Parent Epic: #362

Bug Report

Feature Area

Error Handling and Logging — Structured Logging (spec §8.3)

Expected Behavior (from spec §8.3)

"All logging throughout the application MUST use the structlog library to ensure structured, context-rich log entries. Raw print() calls or the standard logging library should not be used directly for application logging."

Actual Behavior

Over 100 production source files use import logging and logging.getLogger(__name__) instead of structlog. Key violations include:

src/cleveragents/core/error_handling.py (line 30) — The error handling module itself uses standard logging:
```
import logging
logger = logging.getLogger(__name__)
```
This is particularly critical since wrap_unexpected() logs via logger.error() using the standard library, bypassing the secrets_masking_processor entirely.
src/cleveragents/langgraph/nodes.py (line 6) — Async node execution uses standard logging:
```
import logging
self.logger = logging.getLogger(__name__)
```
All async node execution errors are logged via self.logger.error(), bypassing structlog's structured output and secrets masking.
Many other files including: cli/commands/session.py, cli/commands/resource.py, infrastructure/database/models.py, application/services/skill_service.py, infrastructure/sandbox/git_worktree.py, mcp/client.py, tool/runner.py, tool/lifecycle.py, reactive/application.py, agents/graphs/auto_debug.py, and 90+ more.

Impact

Security: Log entries from these modules bypass the secrets_masking_processor in structlog, potentially leaking API keys and credentials to log files.
Compliance: Log output is not structured JSON in production mode — these modules emit unstructured text, violating spec §8.3.
Reliability: Inconsistent log format makes log aggregation and analysis unreliable.
Root cause: The configure_structlog() function in config/logging.py sets up structlog but these modules bypass it entirely by using the standard library directly.

Steps to Reproduce

grep -r "import logging" src/cleveragents/ --include="*.py" | grep -v "config/logging.py" | wc -l
# Returns 100+

Code Locations

src/cleveragents/core/error_handling.py:30
src/cleveragents/langgraph/nodes.py:6
100+ other production source files

Subtasks

Audit all production source files under src/cleveragents/ for import logging and logging.getLogger usage (excluding config/logging.py which is the configuration module itself)
Replace import logging with import structlog in each violating file
Replace logging.getLogger(__name__) with structlog.get_logger(__name__) (or get_logger() from cleveragents.config.logging) in each violating file
Replace all logger.debug/info/warning/error/critical() call-sites with the structlog equivalents, ensuring keyword arguments are used for structured fields
Fix src/cleveragents/core/error_handling.py first (highest-risk: wrap_unexpected() bypasses secrets masking)
Fix src/cleveragents/langgraph/nodes.py second (async node execution errors bypass secrets masking)
Fix remaining 100+ files systematically
Write/update BDD scenarios in features/ to verify structlog is used (not standard logging) in the fixed modules
Verify nox -e lint passes
Verify nox -e typecheck passes (structlog types differ from standard logging)
Verify nox -e unit_tests passes with coverage >= 97%

Definition of Done

Zero occurrences of import logging / logging.getLogger in production source files under src/cleveragents/ (excluding config/logging.py)
All log call-sites use structlog's structured keyword-argument style
src/cleveragents/core/error_handling.py uses structlog — wrap_unexpected() routes through the secrets_masking_processor
src/cleveragents/langgraph/nodes.py uses structlog — async node errors are structured and masked
BDD scenarios added/updated to cover structlog compliance in the fixed modules
All nox stages pass
Coverage >= 97%

Automated by CleverAgents Bot
Supervisor: Acting on behalf of: UAT Testing | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/structlog-replace-standard-logging-codewide` - **Commit Message**: `fix(logging): replace standard logging with structlog across all production source files` - **Milestone**: v3.7.0 - **Parent Epic**: #362 ## Bug Report ### Feature Area Error Handling and Logging — Structured Logging (spec §8.3) ### Expected Behavior (from spec §8.3) > "All logging throughout the application MUST use the `structlog` library to ensure structured, context-rich log entries. Raw `print()` calls or the standard `logging` library should not be used directly for application logging." ### Actual Behavior Over 100 production source files use `import logging` and `logging.getLogger(__name__)` instead of `structlog`. Key violations include: 1. **`src/cleveragents/core/error_handling.py`** (line 30) — The error handling module itself uses standard logging: ```python import logging logger = logging.getLogger(__name__) ``` This is particularly critical since `wrap_unexpected()` logs via `logger.error()` using the standard library, bypassing the `secrets_masking_processor` entirely. 2. **`src/cleveragents/langgraph/nodes.py`** (line 6) — Async node execution uses standard logging: ```python import logging self.logger = logging.getLogger(__name__) ``` All async node execution errors are logged via `self.logger.error()`, bypassing structlog's structured output and secrets masking. 3. **Many other files** including: `cli/commands/session.py`, `cli/commands/resource.py`, `infrastructure/database/models.py`, `application/services/skill_service.py`, `infrastructure/sandbox/git_worktree.py`, `mcp/client.py`, `tool/runner.py`, `tool/lifecycle.py`, `reactive/application.py`, `agents/graphs/auto_debug.py`, and 90+ more. ### Impact - **Security**: Log entries from these modules bypass the `secrets_masking_processor` in structlog, potentially leaking API keys and credentials to log files. - **Compliance**: Log output is not structured JSON in production mode — these modules emit unstructured text, violating spec §8.3. - **Reliability**: Inconsistent log format makes log aggregation and analysis unreliable. - **Root cause**: The `configure_structlog()` function in `config/logging.py` sets up structlog but these modules bypass it entirely by using the standard library directly. ### Steps to Reproduce ```bash grep -r "import logging" src/cleveragents/ --include="*.py" | grep -v "config/logging.py" | wc -l # Returns 100+ ``` ### Code Locations - `src/cleveragents/core/error_handling.py:30` - `src/cleveragents/langgraph/nodes.py:6` - 100+ other production source files ## Subtasks - [ ] Audit all production source files under `src/cleveragents/` for `import logging` and `logging.getLogger` usage (excluding `config/logging.py` which is the configuration module itself) - [ ] Replace `import logging` with `import structlog` in each violating file - [ ] Replace `logging.getLogger(__name__)` with `structlog.get_logger(__name__)` (or `get_logger()` from `cleveragents.config.logging`) in each violating file - [ ] Replace all `logger.debug/info/warning/error/critical()` call-sites with the structlog equivalents, ensuring keyword arguments are used for structured fields - [ ] Fix `src/cleveragents/core/error_handling.py` first (highest-risk: `wrap_unexpected()` bypasses secrets masking) - [ ] Fix `src/cleveragents/langgraph/nodes.py` second (async node execution errors bypass secrets masking) - [ ] Fix remaining 100+ files systematically - [ ] Write/update BDD scenarios in `features/` to verify structlog is used (not standard logging) in the fixed modules - [ ] Verify `nox -e lint` passes - [ ] Verify `nox -e typecheck` passes (structlog types differ from standard logging) - [ ] Verify `nox -e unit_tests` passes with coverage >= 97% ## Definition of Done - [ ] Zero occurrences of `import logging` / `logging.getLogger` in production source files under `src/cleveragents/` (excluding `config/logging.py`) - [ ] All log call-sites use structlog's structured keyword-argument style - [ ] `src/cleveragents/core/error_handling.py` uses structlog — `wrap_unexpected()` routes through the `secrets_masking_processor` - [ ] `src/cleveragents/langgraph/nodes.py` uses structlog — async node errors are structured and masked - [ ] BDD scenarios added/updated to cover structlog compliance in the fixed modules - [ ] All nox stages pass - [ ] Coverage >= 97% --- **Automated by CleverAgents Bot** Supervisor: Acting on behalf of: UAT Testing | Agent: ca-new-issue-creator

freemo commented

2026-04-05 22:11:17 +00:00

Author

Owner

Label compliance fix applied:

Added missing labels: Type/Bug, State/Unverified, Priority/Backlog
Reason: Issue had no labels. Per CONTRIBUTING.md, every issue must have exactly one State/*, one Type/*, and one Priority/* label. This is a UAT bug report about widespread logging module usage, so Type/Bug is correct. The issue body notes it targets v3.7.0 but has no milestone assigned — Priority/Backlog and State/Unverified are appropriate defaults.

Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

Label compliance fix applied: - Added missing labels: `Type/Bug`, `State/Unverified`, `Priority/Backlog` - Reason: Issue had no labels. Per CONTRIBUTING.md, every issue must have exactly one `State/*`, one `Type/*`, and one `Priority/*` label. This is a UAT bug report about widespread `logging` module usage, so `Type/Bug` is correct. The issue body notes it targets v3.7.0 but has no milestone assigned — `Priority/Backlog` and `State/Unverified` are appropriate defaults. --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

freemo referenced this issue

2026-04-05 22:13:37 +00:00

[Automated] CleverAgents Build Session - 2026-04-05 (Resumed) #3654

freemo referenced this issue

2026-04-05 22:20:24 +00:00

[Automated] CleverAgents Build Session - 2026-04-05 (Resumed) #3654

freemo referenced this issue

2026-04-05 22:33:37 +00:00

[Automated] CleverAgents Build Session - 2026-04-05 (Resumed) #3654