fix(provider): redact promptfoo model logs

[ianw-oai]

Stops PromptfooModel debug logs from including request payloads or response content.

[promptfoo-scanner]

👍 All Clear

I reviewed the changes to the PromptfooModelProvider logging and the accompanying tests. The PR replaces verbose logging of full request/response bodies with redacted, metadata-only fields and adds tests to ensure prompts, configs, and response contents are not logged. Based on the diff, no new LLM-related security risks are introduced; this is a net hardening change.

_{Minimum severity threshold: 🟡 Medium | To re-scan after changes, comment @promptfoo-scanner
Learn more}

---

_{Was this helpful?  👍 Yes  |  👎 No} 

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 308f1b05-bb11-471e-858b-b57fe8e7cc03

📥 Commits

Reviewing files that changed from the base of the PR and between 3517c0f and 217291e.

📒 Files selected for processing (2)

• src/providers/promptfooModel.ts
• test/providers/promptfooModel.test.ts

---

📝 Walkthrough

Walkthrough

This pull request refactors debug logging in PromptfooModelProvider.callApi to reduce verbosity and remove sensitive information from logs. The "Sending request" log now records the model name, message count, and config key count instead of the full payload. The "Received response" log emits a structured summary containing the resolved model, provider, choice count, finish reason, and token usage statistics instead of the complete response object. A new unit test validates that sensitive sentinel values (API keys, prompts, response content) do not appear in debug logs while expected lifecycle markers and metadata remain present.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'fix(provider): redact promptfoo model logs' accurately summarizes the main change: redacting sensitive information from debug logs in the PromptfooModel provider.
Description check	✅ Passed	The description clearly states that the PR stops PromptfooModel debug logs from including request payloads or response content, which directly relates to the changeset's purpose of redacting logs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jimothy/redact-promptfoo-model-logs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR reduces the risk of leaking sensitive data by changing PromptfooModelProvider debug logging to avoid emitting request payloads (prompt/config) and response content, and adds a regression test to ensure these secrets aren’t logged.

Changes:

• Replace request debug logging to include only non-sensitive metadata (model, message count, config key count).
• Replace response debug logging to include only non-sensitive metadata (provider, counts, finish reason, token usage).
• Add a test asserting prompts/config/response content are not present in [PromptfooModel] debug logs.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/providers/promptfooModel.ts	Redacts debug logs by logging only request/response metadata instead of payload/content.
test/providers/promptfooModel.test.ts	Adds a regression test ensuring secret prompt/config/response strings are not logged.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.