fix(pydantic_ai): allowlist kwargs pass-through, drop eager message reshape

[starfolkai]

Summary

Aligns the pydantic_ai integration with .agents/skills/sdk-integrations/SKILL.md, following the same pattern as #606 (openai), #608 (openrouter), and #604/#603/#594 (anthropic/livekit/litellm/mistral). Audit turned up two issues:

• Denylist metadata pass-through (real leak vector). _build_agent_input_and_metadata and _build_direct_model_input_and_metadata did for key, value in kwargs.items(): if key not in [...]: input_data[key] = value — every non-deps / non-{model,messages} kwarg landed in span input. That flowed usage (a mutable counter), event_stream_handler (a callable), infer_name, instrument, and anything pydantic_ai adds in future SDK versions straight into telemetry. deps (user's app-level container — commonly holds API keys / DB connections) was the sole excluded key on the agent path; on the direct-model path there was no exclusion at all.

  Replaced with per-surface allowlist tuples (_AGENT_INPUT_ALLOWLIST, _DIRECT_MODEL_INPUT_ALLOWLIST) covering the known kwargs across Agent.run / run_sync / run_stream / run_stream_events / to_cli_sync and direct.model_request*. Explicitly excludes deps, usage, event_stream_handler, infer_name, instrument.

• Eager message reshaping dropping fields. _shape_message / _shape_content_part / _shape_model_response reshaped every message into shallow dicts via a hard-coded field allowlist (_MESSAGE_FIELDS, _PART_FIELDS, _RESPONSE_FIELDS) even when no binary content needed materialization. That dropped real pydantic_ai v2 fields — instructions, run_id, conversation_id, metadata, state, provider_details, outcome, ... — and burned CPU rebuilding dicts that bt_safe_deep_copy (which already handles dataclasses + Pydantic models) would produce anyway at log time.

  Added _has_binary_leaf walker; the four shape helpers now short-circuit to the raw object when no binary is present. Reshape (and its field allowlist) only runs when a binary attachment actually needs materialization.

Also:

• Extracted _shape_toolset(ts) from a nested 20-line block inside _build_agent_input_and_metadata.
• Trimmed docstrings/comments that just restated the helper name. Kept the ones explaining non-obvious why (portal-thread context propagation, wrapper-vs-leaf token ownership, 1.78.0 ToolManager alias, _system_prompts private-API access).
• Hoisted import inspect from inside _shape_type to module top.

Test plan

• No new mocks/fakes. All provider-behavior coverage stays on the existing @pytest.mark.vcr cassette-backed tests.
• No cassette re-recording. HTTP behavior unchanged; only in-process input/shape logic was touched.
• nox -s "test_pydantic_ai_integration(latest)" — 68/68 pass (pydantic-ai==2.13.0)
• nox -s "test_pydantic_ai_integration(1.10.0)" — 68/68 pass (min-supported matrix version)
• nox -s "test_pydantic_ai_wrap_openai(latest)" — green
• nox -s "test_pydantic_ai_logfire(latest)" — 1/1 pass

Two new tests pin the security invariant:

• test_agent_input_kwargs_are_allowlisted — asserts deps / usage / event_stream_handler / infer_name never land in span input; allowlisted kwargs (instructions, usage_limits, retries, conversation_id, metadata) do.
• test_direct_model_request_kwargs_are_allowlisted — asserts instrument never leaks; model_settings / model_request_parameters do.

One existing test replaced: test_v2_message_and_response_fields_are_shaped → test_shape_message_and_response_pass_through_when_no_binary — the old test was locking in the reshape that was losing v2 fields.

🤖 Generated with Claude Code

Created by abhijeet

Slack thread