fix(tracing): truncate oversized span input/output for OpenAI ingest

[OiPunk]

Summary

Fixes #260 by making OpenAI tracing sanitization fail-safe for oversized span_data.input / span_data.output payloads.

What changed

• Extended _sanitize_for_openai_tracing_api to also sanitize input and output fields (not just generation usage keys).
• Added byte-size based truncation helpers:
  • Strings are truncated with a stable suffix (... [truncated]) while staying under the ingest limit.
  • Non-string oversized payloads are replaced with a compact metadata object (truncated, original_type, preview).
• Kept behavior endpoint-aware: sanitization is only applied for the OpenAI tracing ingest endpoint, existing custom endpoint behavior is unchanged.

Tests

• uv run ruff check src/agents/tracing/processors.py tests/test_trace_processor.py
• uv run mypy src/agents/tracing/processors.py tests/test_trace_processor.py
• uv run pytest tests/test_trace_processor.py -q
• make format-check

Added test coverage for:

• large string truncation
• large non-string replacement
• custom endpoint passthrough
• unchanged small input path
• helper edge-cases (within limit, suffix too large)

[OiPunk]

Addressed in commit aba2a66.

What changed:

• Reworked _truncate_string_for_json_limit to use a proportional size estimate plus overflow-based trimming, instead of a binary search that repeatedly serializes many candidates.
• This reduces repeated json.dumps() calls in the hot truncation path while preserving the same safety guarantee (<= max bytes).
• Added regression coverage for escape-heavy strings to validate byte-limit behavior with JSON escaping.

Local verification:

• uv run ruff check src/agents/tracing/processors.py tests/test_trace_processor.py
• uv run mypy src/agents/tracing/processors.py
• env -u ALL_PROXY -u all_proxy -u HTTPS_PROXY -u https_proxy -u HTTP_PROXY -u http_proxy -u NO_PROXY -u no_proxy uv run pytest tests/test_trace_processor.py -k "truncate_string_for_json_limit or truncates_large_input_for_openai_tracing" -q

[OiPunk]

Added one follow-up test commit (3f5a86c) to cover the max_bytes == suffix_size branch in _truncate_string_for_json_limit, so the updated truncation logic is fully exercised by the targeted trace run.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3f5a86cc97

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid materializing full preview for oversized non-string fields

When span_data.input/output is an oversized non-string value, this path computes preview = str(value) before truncating it, which forces Python to stringify the entire object first. For very large dict/list payloads (the exact case this sanitization is meant to handle), that can allocate a huge temporary string and add significant CPU/memory pressure, potentially stalling or crashing export before the truncated payload is sent.

Useful? React with 👍 / 👎.