Suppress provider debug logs by default

[mstolarzblaxelai]

Summary

• suppress high-risk provider debug loggers by default when sdk-python logging initializes
• add BL_ALLOW_PROVIDER_DEBUG_LOGS=true as an explicit opt-in for trusted local debugging
• re-apply suppression in the Google ADK/LiteLLM path before model creation and calls
• add unit and Google ADK coverage for forced root DEBUG behavior

Verification

• uv run ruff check .
• uv run pytest tests/core/test_logger.py -q
• BL_WORKSPACE=main uv run --locked --python 3.13 --extra googleadk --group test pytest tests/integration/googleadk/test_model.py -q
• make test (213 passed)

Deployed proof

Fresh temp Google ADK agent deployed with a local SDK wheel and explicit LOG_LEVEL=DEBUG.

• invocations: 13/13 succeeded
• LLM Request: 0
• Request options: 0
• RAW RESPONSE: 0
• X-Blaxel-Authorization: 0
• authorization: 0
• bearer: 0
• JWT-like matches: 0

Temp agent was deleted and verified absent after the scan.

Linear: ENG-2506

---

Note

Suppresses a fixed list of provider loggers (LiteLLM, google-adk, httpx, openai, httpcore) to WARNING by default during init_logger and defensively re-applies suppression around every Google ADK model call. Opt-in via BL_ALLOW_PROVIDER_DEBUG_LOGS=true. Adds unit and integration test coverage.

^{Written by Mendral for commit 2c2f9e0.}

[mstolarzblaxelai]

CI note: the only red check is Integration Tests (livekit), and I verified it is unrelated to this PR.

The same LiveKit target fails on untouched origin/main at c65bea4 with the same error: sandbox-openai rejects reasoning_effort=minimal from the LiveKit path.

All checks relevant to this provider log hygiene change are green, including Google ADK, unit tests across Python 3.10-3.14, CodeQL, Cursor Security Reviewer, and Mendral.

I split the LiveKit compatibility issue into Linear ENG-2508 so this PR can stay focused on ENG-2506.

[mendral-app]

LGTM

Implementation is correct and secure. The suppression logic properly gates all attached handlers, the double suppress_provider_debug_loggers() call in init_logger correctly handles post-basicConfig state, and httpx retains its CRITICAL level because the guard condition won't downgrade it. No issues.

_{Tag @mendral-app with feedback or questions. View session}