feat(otel): warn when mask cannot cover third-party span attributes

[yagosamu]

Log a one-time warning at the export stage when mask is set without mask_otel_spans and exported spans carry input or output attributes from other OpenTelemetry instrumentations. The warning names attribute keys, never values, and does not change what is exported.

What does this PR do?

Addresses langfuse/langfuse#15372 on the SDK side.

When mask is configured and mask_otel_spans is not, spans from other OpenTelemetry instrumentations can be exported with raw input/output attributes (for example input.value or llm.input_messages.*), because mask only runs when Langfuse SDK attributes are created. Today this happens silently.

This PR logs a one-time warning at the export stage when that situation is detected. The warning names the attribute keys (never values) and points to mask_otel_spans. What gets exported does not change.

langfuse/langfuse#17509 adds a signal on the ingestion side. This is the client-side counterpart: it fires before the data leaves the process and is visible to the user who configured mask.

How it works:

• LangfuseSpanProcessor accepts mask and passes mask_configured to LangfuseTransformingSpanExporter. LangfuseResourceManager forwards the client's mask.
• When mask_otel_spans is not set, the exporter checks for string attributes that the existing _media_field_for_attribute mapping classifies as input or output, excluding langfuse.* keys.
• Detection keys on attributes rather than instrumentation scope, because instrumentations wired through the Langfuse tracer keep the langfuse-sdk scope, as @Allgoodok showed in the issue.

Limitations: only keys already mapped as input/output are considered, to keep false positives low. The warning is logged once per exporter instance.

Type of change

• Bug fix
• New feature
• Breaking change
• Refactor
• Documentation update
• Tooling, CI, or repo maintenance

Verification

List the main commands you ran:

uv run --frozen pytest tests/unit/test_mask_coverage_warning.py
uv run --frozen pytest tests/unit/test_mask_otel_spans.py tests/unit/test_mask_coverage_warning.py tests/unit/test_resource_manager.py
uv run --frozen pytest -n auto --dist worksteal tests/unit
uv run --frozen ruff check .
uv run --frozen ruff format --check langfuse/_client tests/unit/test_mask_coverage_warning.py
uv run --frozen mypy langfuse --no-error-summary

• New tests were written first and confirmed failing before the change; 8 pass after it.
• Masking and resource manager tests: 71 passed.
• Full unit suite: 675 passed, 2 skipped. 3 failures and 18 errors in test_prompt.py, test_prompt_atexit.py and test_serializer.py::test_path reproduce identically on unmodified main on Windows, and are unrelated to this change.
• e2e and live-provider suites were not run: they need a Langfuse server and provider keys, and the behavior is covered by exporter-local unit tests.

Checklist

• I self-reviewed the diff using code_review.md.
• I added or updated tests for behavior changes.
• I updated docs, examples, or .env.template if needed.
• I did not hand-edit generated files; if generated files changed, I used the upstream regeneration path.
• I did not commit secrets or credentials.

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[CLAassistant]

All committers have signed the CLA.