Skip to content

fix: redact smallest tts headers and report asr connection status - #2293

Open
harshitajain165 wants to merge 2 commits into
TEN-framework:mainfrom
harshitajain165:fix/smallest-header-redaction-and-connection-status
Open

fix: redact smallest tts headers and report asr connection status#2293
harshitajain165 wants to merge 2 commits into
TEN-framework:mainfrom
harshitajain165:fix/smallest-header-redaction-and-connection-status

Conversation

@harshitajain165

@harshitajain165 harshitajain165 commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

Summary

Addresses both issues raised in #2203 (comment):

  1. Security: SmallestTTSConfig.to_str(sensitive_handling=True) masked only params.api_key; headers (including a supported Authorization auth path merged into the actual HTTP request) were logged in plaintext during KEYPOINT vendor_config logging. Now redacted with the shared ten_ai_base.utils.redact_headers() helper, with test coverage for Authorization and API-key header variants.

  2. Connection status: smallest_asr_python never called the base on_connected() after a successful WebSocket handshake, and never called on_disconnected() on connect failure or an unexpected socket close/error. The base class only emits CONNECTING before start_connection() runs, so the reported connection_status_changed state stayed "connecting" even once the socket was usable or had already failed. Now calls on_connected() immediately after ws_connect() succeeds, and on_disconnected() with the available error/close details before scheduling a reconnect.

Testing

Ran the real pytest suite (not just static checks) inside the project's Linux dev container, since ten_runtime_python is a compiled native extension:

  • smallest_tts_python: 16/16 passed, including 3 new tests for header redaction.
  • smallest_asr_python: 9/10 passed (new test_connection_status.py + all pre-existing tests). The one failure (test_invalid_params) is a pre-existing, unrelated environment issue — the dev container has a real SMALLEST_API_KEY set, which invalidates that specific test's "no key anywhere" assumption. Not touched by this diff (only start_connection() / _process_messages() were changed; test_invalid_params exercises on_init).

@harshitajain165
harshitajain165 force-pushed the fix/smallest-header-redaction-and-connection-status branch from e3dd962 to 5417a45 Compare August 25, 2026 20:43
SmallestTTSConfig.to_str(sensitive_handling=True) only masked
params.api_key; headers (including a supported Authorization auth
path) were logged in plaintext during KEYPOINT vendor_config logging.
Redact headers with the shared ten_ai_base.utils.redact_headers()
helper, and add coverage for Authorization and API-key header
variants.
smallest_asr_python never called the base on_connected() after a
successful WebSocket handshake, and never called on_disconnected() on
connect failure or an unexpected socket close/error. The base class
only emits CONNECTING before start_connection() runs, so the reported
connection_status_changed state stayed "connecting" even once the
socket was usable or had already failed. Call on_connected()
immediately after ws_connect() succeeds, and on_disconnected() with
the available error/close details before scheduling a reconnect.
@harshitajain165
harshitajain165 force-pushed the fix/smallest-header-redaction-and-connection-status branch from 5417a45 to 3256876 Compare August 25, 2026 20:54
@ranchangxin-agora

Copy link
Copy Markdown

Please add the Guarder integration test results to this PR.
for the asr extension, run:

task asr-guarder-test EXTENSION=<asr_extension_name> CONFIG_DIR=tests/configs

for the tts extension, run:

task tts-guarder-test EXTENSION=<tts_extension_name> CONFIG_DIR=tests/configs

Please include the exact command, a summary of passed tests, and any failures.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants