Skip to content

User prompts included in api_request logs despite logPrompts=false #18979

@lp-peg

Description

@lp-peg

What happened?

Even though logPrompts is set to false in the configuration, user prompts are still being recorded in the api_request log as a session's conversation history.

{
  "jsonPayload": {
    "message": "API request to gemini-2.5-flash.",
    "process.runtime.name": "nodejs",
    "request_text": "..., {\"role\":\"user\",\"parts\":[{\"text\":\"hello, are you ready?\"}]},{\"role\":\"model\",\"parts\":...",
    "installation.id": "...",
    "host.name": "...",
    "prompt_id": "...",
    "host.id": "...",
    "event.name": "gemini_cli.api_request",
    "event.timestamp": "2026-02-13T07:42:14.794Z",
    "model": "gemini-2.5-flash",
    "process.runtime.description": "Node.js"
  },
  "timestamp": "2026-02-13T07:42:14.793999910Z",
}

(Some unimportant fields have been removed from sample above)

What did you expect to happen?

The request_text field should be omitted from the gemini_cli.api_request log when logPrompts is false.

Client information

Client Information

Run gemini to enter the interactive CLI, then run the /about command.

> /about


╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│                                                                                                                                         │
│ About Gemini CLI                                                                                                                        │
│                                                                                                                                         │
│ CLI Version                                    0.28.2                                                                                   │
│ Git Commit                                     da5e47ae3                                                                                │
│ Model                                          auto-gemini-2.5                                                                          │
│ Sandbox                                        no sandbox                                                                               │
│ OS                                             darwin                                                                                   │
│ Auth Method                                    Logged in with Google (my Google Account)                                       │
│ GCP Project                                    my-google-cloud-project-id                                                                  │
│ IDE Client                                     VS Code                                                                                  │
│                                                                                                                                         │
╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯

Login information

No response

Anything else we need to know?

  • in toSemanticLog, it seems to check logPrompts flag.

  • (additionally, response_text of gemini_cli.api_response and gen_ai.output.messages of gen_ai.client.inference.operation.details also should likely also be omitted when logPrompts is false.)

If this behavior is not intended, I am happy to submit a PR to fix this by updating ApiRequestEvent.toLogRecord to align with the logic used in toSemanticLogRecord.

Thank you.

Metadata

Metadata

Assignees

No one assigned

    Labels

    area/securityIssues related to securityhelp wantedWe will accept PRs from all issues marked as "help wanted". Thanks for your support!

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions