fix(parallel): protect Responses privacy and interrupted workflows - #562

What was wrong

Parallel's OpenAI-compatible Responses route exported MCP authentication fields and client credentials echoed in errors, re-exported hidden instructions through the response envelope, and could leave high-level SDK stream spans active or mark unfinished generations successful. Task examples also marked local process interrupts successful, and native Search/Extract metadata skipped the advertised credential scrubber.

Fix

• Sanitize telemetry-only MCP copies, including authorization, arbitrary MCP headers, URL userinfo, query strings and fragments. Leave requests, returned SDK objects and exceptions unchanged.
• Restrict Responses output telemetry to response-owned fields; apply the same privacy boundary to typed responses, explicit dictionary parsing and streaming fallbacks. Preserve the exclusion of top-level vendor errors from assistant output.
• Capture request-local credentials, including SDK-resolved callable credentials, and redact span attributes, status descriptions and standard exception events independently of hide-input/error flags.
• Finish high-level responses.stream() and raw HTTP-envelope spans exactly once. Track Responses terminal events separately from close/EOF, preserve genuine completed/failed results, and retain existing synchronous/asynchronous legacy raw close interfaces. Other stream families do not inherit the Responses terminal-event requirement.
• Handle local BaseException aborts in sync/async Task examples and the executable README; re-raise without claiming the remote task was cancelled. Clean native usage names and warning types before truncation.
• Port relevant work from open/conflicting fix(openai): protect Responses privacy and finalize interrupted calls #520 at 722c70ca93a93f893d8a569b0c486ac756f811dd, resolve it against current dev, and revalidate rather than accepting its earlier pass claims. Additional URL privacy and legacy raw-close repairs are included here. fix(openai): protect Responses privacy and finalize interrupted calls #520 is not merged or closed by this PR.
• Require shared core >=1.2.2 for the privacy contract and align the Python floor to >=3.10; keep OpenAI >=1.69.0. Refresh the Poetry lock without unrelated dependency upgrades. CI exercises OpenAI 1.69.0/3.45.0, native Parallel 1.0.1/1.3.7, wheel/sdist installs, and shared provider routes; source directories are removed from import resolution after installation so they cannot shadow the built distributions.

Validation

All execution was in E2B with synthetic credentials, real SDKs, offline MockTransport/loopback providers, and no real provider keys.

• q1104-parallel-fix-r1-before: independently reproduced all seven findings at both SDK bounds: 17 failing cases and 15 passing controls per bound.

• q1104-parallel-fix-r1-final: published core 1.2.2, installed wheel/sdist and no source shadowing: 1,167 package tests passed at the floor (12 explicit SDK/legacy skips), 1,175 passed at latest (4 legacy skips), plus 32 independent controls/regressions passed at each bound. Poetry lock validation, wheel/sdist builds and static checks passed. Python 3.12.16 in E2B; CI additionally exercises 3.10/3.13.

• q1104-parallel-fix-r1-fallibility: the 12 additional MCP-URL and truncated-metadata credential cases all fail on pre-fix installed distributions and pass after the fix, with the tests copied outside both source trees. The original 32 independent cases also pass at both bounds. All sandboxes were deleted and absence verified.

• q1104-parallel-fix-r1-recipe: reproduced the two initial CI recipe failures (six obsolete assertions at each source SDK bound required echoed instructions). Updated those assertions to require their absence on current code, while retaining an exact-version, installed-file-checked historical 0.1.10 compatibility control. 187/187 passed with OpenAI 1.69.0/source, 3.24.0/source, and 3.24.0/historical published packages.

The floor skips cover callable credentials unavailable in OpenAI 1.x and four unsupported legacy DeepSeek Responses cases; latest skips only those four legacy cases. The real shared OpenAI route is tested in both lanes. Failures in older DeepSeek expectations for response.incomplete were changed to explicitly require non-success, not skipped. Existing legacy raw-close tests exposed a real integration regression while porting #520; that interface was repaired and expanded with async close-alias coverage.

Competitor comparison and limits

This is a documented-mechanism comparison, not a paid-service runtime benchmark or an assertion that all competitors are safer.

• Braintrust OpenAI documents Responses create/parse and tool-typed child spans, input/output, request metadata and token metrics. Our current route retains built-in tool data but remains a single LLM span: child-tool hierarchy is still a known gap, not something this privacy/lifecycle PR claims to solve. No Parallel-specific integration is named on that page.
• Arize OpenInference OpenAI uses maintained request-method instrumentation and OTel export, documents sync/async Responses, and currently declares OpenAI >=2.8.0. Our tested floor remains 1.69.0. Its privacy controls cover inputs, outputs and tool definitions; this PR ensures echoed request fields cannot bypass our analogous input boundary. This does not establish a claim about Arize's native Parallel coverage.
• Langfuse's Parallel guide uses application decorators around Task submit+wait/Search and an OpenAI wrapper for compatible calls. Our native Search/Extract instrumentation and application-owned Task span cover these routes while intentionally omitting Task content and retrieved page bodies. Neither approach exposes Parallel's internal research execution. No Task token prices or costs are invented from processor identity or SKU counts.

No product repository, main branch, release workflow, registry or repository settings were changed. This PR is into dev only and is not a release or merge authorization.

🤖 Generated with Claude Code