[rosetta-livekit-bot]

Description

Ports livekit/agents#7267 to refine PII review guidance and reduce false positives around ordinary diagnostics, exception paths, and explicitly redacted telemetry attributes.

Changes Made

• Require a concrete sensitive value, reachable output path, and ineffective redaction before reporting a leak.
• Clarify ordinary diagnostic metadata and JavaScript error, cause, WebSocket, and promise-rejection behavior.
• Preserve requirements for static log messages, PII-marked structured fields, and explicit OpenTelemetry redaction handling.

Source diff coverage

• REVIEW.md: adapted to target REVIEW.md. Ported all policy changes while translating Python-specific references to JavaScript/TypeScript equivalents: .py telemetry paths to .ts; Python exception logging, formatting, chaining, and background task behavior to structured JS errors, String(error), stack traces, cause, and unhandled promise rejections; aiohttp and ClientError examples to WebSocket and Node network errors; and Python logging examples to Pino-style TypeScript.
• No source files were omitted. Source PR #7267 adds or modifies no tests.

Pre-Review Checklist

• Build passes: pnpm build
• AI-generated code reviewed: Adaptation checked against the exact source PR diff
• Changes explained: All changes are documented above
• Scope appropriate: Documentation-only parity port
• Video demo: Not applicable to review-guidance documentation

Testing

• pnpm build
• pnpm lint (passes with existing warnings)
• pnpm exec prettier --check REVIEW.md
• pnpm test: full suite rerun after build; 3,448 passed and 35 skipped, with 6 unrelated failures. Failures require a missing CEREBRAS_API_KEY, external OpenAI/evaluator behavior, or valid LFS-backed Silero model/audio assets (silero_vad.onnx and test WAV content). No package code changed and source PR #7267 contains no tests.

Additional Notes

• No changeset: this is repository-level review documentation and changes no package code.
• Voice pipeline behavior is untouched, so cue-cli runtime validation is not applicable.

---

Ported from livekit/agents#7267

Original PR description

Devin flags ordinary diagnostics and hypothetical exception leaks. Require a concrete sensitive value and reachable, unprotected output while retaining content-redaction requirements.

Adopts @GregHolmes's exception-path diagnosis (#7206) and @davidzhao's metadata distinction (#7128); excludes unused-key findings withdrawn in #7104.

Addresses AGT-3507.

Validation: git diff --check and lint passed. make check stopped on existing formatting in recorder_io.py.

Initial prompt and agent context

Model: GPT-6

The current REVIEW.md misfires on many non sensitive log and errors since the introduction. Take a look at Devin's comments on recently merged PRs and see if there is a pattern we can prevent with a better instruction.

[changeset-bot]

⚠️ No Changeset found

Latest commit: b3a83ee

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.