Python: improve logging in declarative code

[moonbox3]

Potential fix for https://github.com/microsoft/agent-framework/security/code-scanning/49

In general, to fix clear‑text logging of sensitive information, remove or mask sensitive values from log messages. Logs should contain enough context (such as an identifier or generic description) to debug issues without exposing secrets (passwords, API keys, tokens, etc.).

In this specific case, the problem is the two logger.debug calls in _try_powerfx_eval that interpolate value (or value[:5]) directly into the log message. The best fix while preserving functionality is:

• Keep the detailed exception message (exc) and note that some value failed evaluation.
• Remove value entirely from logs, or replace it with a constant placeholder such as '<redacted>'.
• Continue to use the log_value flag only to control the presence of any value-specific hint vs. a more generic message, but no longer log actual characters of the value.

Given we must not assume any broader project context or modify other files, the change will be localized to _try_powerfx_eval in python/packages/declarative/agent_framework_declarative/_models.py. We will replace:

if log_value:
    logger.debug(f"PowerFx evaluation failed for value '{value}': {exc}")
else:
    logger.debug(f"PowerFx evaluation failed for value (first five characters shown) '{value[:5]}': {exc}")

with something like:

if log_value:
    logger.debug("PowerFx evaluation failed for a value: %s", exc)
else:
    logger.debug("PowerFx evaluation failed for a value (details redacted): %s", exc)

or equivalent f-strings that do not include value. This avoids logging any part of the possibly sensitive data while still preserving error information via the exception.

No new imports or additional helper methods are required.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[markwallace-microsoft]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	16250	1982	87%

report-only-changed-files is enabled. No files were changed during this commit :)

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
3742	221 💤	0 ❌	0 🔥	1m 8s ⏱️

[Copilot]

Pull request overview

This PR addresses a security vulnerability where sensitive information (such as API keys) could be logged in clear text during PowerFx evaluation failures. The fix redacts the actual values from log messages while preserving exception information for debugging.

Changes:

• Updated the log_value parameter documentation to reflect its new purpose of controlling additional context rather than logging the actual value
• Replaced direct value logging in error messages with generic placeholders that don't expose sensitive data
• Maintained differentiation between regular fields and sensitive fields through distinct log messages