datadog 2.30.0 → 2.31.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f2983471f43d0c9b3473b3c65d0ca656514c6cf8cd7a32e35ec26826193fe533
-  data.tar.gz: 687d088d90ce4ee0ae5af66d9e604135f058bd7609641f4c7963f1ba32a2bb37
+  metadata.gz: 1328115b16393f9d96152ad1d94cb6190c307d8dd5df341087ffe21e2212ec9b
+  data.tar.gz: f408b1437ae55de02488433b637c868bce087289ea5fc8af4aa808cfc4ee3b73
 SHA512:
-  metadata.gz: 96f3744eadab0292666e18beac7deab2a6b7ef61b0da216ab4490e7621b0cec7839d18a519079b5b0563e2a260388b63ef59b5243a65c3d6ba997f3c7981986c
-  data.tar.gz: a82f01f50d499f1a08309f23144e5453cb9cf79bdc5b0c7daa9b3c9c373e3a41983babe3f86dc027f2dd2e9f056bc4b7645a49f799531e40eae9455ab7e00a6d
+  metadata.gz: faf8598916d674b5da3b3ab57c013060f9ecf92b939d69a51528a81e495d07340e9a8a0ba70bf9498f6d8c303a32c08d3fbf971759199ff35b47f34a25d88b0a
+  data.tar.gz: f7629d50a2537e08c9ceb5da1e81c25b788401c2992a3a70a2f2b29e2a44a3cbda7d2e621a316953202f5a068fa3ec201a4810d01b1b27ee4bab5bd1592a9bbd

data/CHANGELOG.md

@@ -2,6 +2,34 @@
 
 ## [Unreleased]
 
+## [2.31.0] - 2026-04-20
+
+### Added
+
+* Core: Add `app-extended-heartbeat` telemetry event to resend full configuration every 24h for long-running services. ([#5531][])
+* AI Guard: Add multi-model messages support to AI Guard, enabling text and image URL content parts in evaluation SDK ([#5564][])
+* AI Guard: Add evaluation of images in user prompt and tool output for RubyLLM contrib. ([#5573][])
+* AI Guard: Expose Sensitive Data Scanner findings in AI Guard results via `AIGuard::Evaluation::Result#sds_findings`. ([#5579][])
+* AI Guard: Expose tag probabilities in AI Guard results via `AIGuard::Evaluation::Result#tag_probabilities`. ([#5580][])
+* Tracing: Integrations: Add `rails.application` to the process tags. ([#5468][])
+* Tracing: Report and display all configurations used by a service in the 'SDK & Agent Configurations' tab of a Ruby service page in Datadog UI ([#5483][])
+
+### Changed
+
+* Core: Upgrade `libdatadog` dependency to version 30.0.0 ([#5574][])
+* AI Guard: **Breaking change:** AIGuard.evaluate now defaults to `allow_raise: true`. Pass `allow_raise: false` to keep the previous non-raising behavior. ([#5587][])
+* Dynamic Instrumentation: Report exception messages in method probe snapshots. Require the libdatadog_api C extension for Dynamic Instrumentation. ([#5111][])
+
+### Fixed
+
+* Profiling: Detect when `libdatadog` version does not match expected version. ([#5484][])
+* Profiling: Log profiler initialization errors as warnings instead of raising them. ([#5509][])
+* Tracing: Fix `NoMethodError` in `extract_trace_id!` caused by `extract_tags` returning `true`. ([#5499][])
+
+### Removed
+
+* Core: Removed JRuby from the CI test matrix ([#5594][])
+
 ## [2.30.0] - 2026-03-19
 
 ### Added
@@ -3539,7 +3567,8 @@ Release notes: https://github.com/DataDog/dd-trace-rb/releases/tag/v0.3.1
 Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 
 
-[Unreleased]: https://github.com/DataDog/dd-trace-rb/compare/v2.30.0...master
+[Unreleased]: https://github.com/DataDog/dd-trace-rb/compare/v2.31.0...master
+[2.31.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.30.0...v2.31.0
 [2.30.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.29.0...v2.30.0
 [2.29.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.28.0...v2.29.0
 [2.28.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.27.0...v2.28.0
@@ -5193,6 +5222,7 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#5076]: https://github.com/DataDog/dd-trace-rb/issues/5076
 [#5086]: https://github.com/DataDog/dd-trace-rb/issues/5086
 [#5091]: https://github.com/DataDog/dd-trace-rb/issues/5091
+[#5111]: https://github.com/DataDog/dd-trace-rb/issues/5111
 [#5122]: https://github.com/DataDog/dd-trace-rb/issues/5122
 [#5144]: https://github.com/DataDog/dd-trace-rb/issues/5144
 [#5145]: https://github.com/DataDog/dd-trace-rb/issues/5145
@@ -5251,7 +5281,20 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#5448]: https://github.com/DataDog/dd-trace-rb/issues/5448
 [#5449]: https://github.com/DataDog/dd-trace-rb/issues/5449
 [#5461]: https://github.com/DataDog/dd-trace-rb/issues/5461
+[#5468]: https://github.com/DataDog/dd-trace-rb/issues/5468
 [#5469]: https://github.com/DataDog/dd-trace-rb/issues/5469
+[#5483]: https://github.com/DataDog/dd-trace-rb/issues/5483
+[#5484]: https://github.com/DataDog/dd-trace-rb/issues/5484
+[#5499]: https://github.com/DataDog/dd-trace-rb/issues/5499
+[#5509]: https://github.com/DataDog/dd-trace-rb/issues/5509
+[#5531]: https://github.com/DataDog/dd-trace-rb/issues/5531
+[#5564]: https://github.com/DataDog/dd-trace-rb/issues/5564
+[#5573]: https://github.com/DataDog/dd-trace-rb/issues/5573
+[#5574]: https://github.com/DataDog/dd-trace-rb/issues/5574
+[#5579]: https://github.com/DataDog/dd-trace-rb/issues/5579
+[#5580]: https://github.com/DataDog/dd-trace-rb/issues/5580
+[#5587]: https://github.com/DataDog/dd-trace-rb/issues/5587
+[#5594]: https://github.com/DataDog/dd-trace-rb/issues/5594
 [@AdrianLC]: https://github.com/AdrianLC
 [@Azure7111]: https://github.com/Azure7111
 [@BabyGroot]: https://github.com/BabyGroot

data/ext/datadog_profiling_native_extension/datadog_ruby_common.c

@@ -122,6 +122,24 @@ size_t read_ddogerr_string_and_drop(ddog_Error *error, char *string, size_t capa
   return error_msg_size;
 }
 
+static void verify_libdatadog_version(void) {
+  rb_eval_string(
+    "require 'libdatadog';"
+    "expected = '" EXPECTED_LIBDATADOG_VERSION "';"
+    "if expected != Libdatadog::VERSION;"
+      "raise(LoadError, <<MSG\n"
+        "The `datadog` gem needs to be reinstalled whenever the `libdatadog` gem version is changed. "
+        "The currently-installed version of `datadog` was built to work with `libdatadog` gem version #{expected} "
+        "but the currently-loaded version of `libdatadog` is #{Libdatadog::VERSION}. "
+        "To fix this, reinstall the `datadog` gem (e.g. `bundle exec gem pristine datadog`) "
+        "or contact Datadog support for help at <https://docs.datadoghq.com/help/>.\n"
+        "MSG\n"
+      ");"
+    "end"
+  );
+}
+
 void datadog_ruby_common_init(void) {
   telemetry_message_id = rb_intern("@telemetry_message");
+  verify_libdatadog_version();
 }

data/ext/datadog_profiling_native_extension/datadog_ruby_common.h

@@ -102,3 +102,13 @@ static inline VALUE get_error_details_and_drop(ddog_Error *error) {
 // Returns the amount of characters written to string (which are necessarily
 // bounded by capacity - 1 since the string will be null-terminated).
 size_t read_ddogerr_string_and_drop(ddog_Error *error, char *string, size_t capacity);
+
+#define IMEMO_MASK 0x0f
+
+// Returns the imemo type of an imemo object.
+// This mask is the same between Ruby 2.5 and 3.3-preview3. Furthermore, the intention of this method is to be used
+// to call `rb_imemo_name` which correctly handles invalid numbers so even if the mask changes in the future, at most
+// we'll get incorrect results (and never a VM crash)
+static inline int ddtrace_imemo_type(VALUE imemo) {
+  return (RBASIC(imemo)->flags >> FL_USHIFT) & IMEMO_MASK;
+}

data/ext/datadog_profiling_native_extension/extconf.rb

@@ -217,6 +217,8 @@ unless Datadog::LibdatadogExtconfHelpers.configure_libdatadog(extconf_folder: __
   skip_building_extension!(Datadog::Profiling::NativeExtensionHelpers::Supported::FAILED_TO_CONFIGURE_LIBDATADOG)
 end
 
+Datadog::LibdatadogExtconfHelpers.add_libdatadog_version_define
+
 unless have_type("atomic_int", ["stdatomic.h"])
   skip_building_extension!(Datadog::Profiling::NativeExtensionHelpers::Supported::COMPILER_ATOMIC_MISSING)
 end

data/ext/libdatadog_api/crashtracker.c

@@ -51,12 +51,8 @@ static VALUE _native_start_or_update_on_fork(int argc, VALUE *argv, DDTRACE_UNUS
 
   VALUE version = datadog_gem_version();
 
-  // Tags and endpoint are heap-allocated, so after here we can't raise exceptions otherwise we'll leak this memory
+  // Tags are heap-allocated, so after here we can't raise exceptions otherwise we'll leak this memory
   // Start of exception-free zone to prevent leaks {{
-  ddog_Endpoint *endpoint = ddog_endpoint_from_url(char_slice_from_ruby_string(agent_base_url));
-  if (endpoint == NULL) {
-    raise_error(rb_eRuntimeError, "Failed to create endpoint from agent_base_url: %"PRIsVALUE, agent_base_url);
-  }
   ddog_Vec_Tag tags = convert_tags(tags_as_array);
 
   ddog_crasht_Config config = {
@@ -73,7 +69,7 @@ static VALUE _native_start_or_update_on_fork(int argc, VALUE *argv, DDTRACE_UNUS
     // overriding what Ruby set up seems a saner default to keep anyway.
     .create_alt_stack = false,
     .use_alt_stack = true,
-    .endpoint = endpoint,
+    .endpoint = {.url = char_slice_from_ruby_string(agent_base_url)},
     .resolve_frames = DDOG_CRASHT_STACKTRACE_COLLECTION_ENABLED_WITH_SYMBOLS_IN_RECEIVER,
     .timeout_ms = FIX2INT(upload_timeout_seconds) * 1000,
   };
@@ -106,11 +102,12 @@ static VALUE _native_start_or_update_on_fork(int argc, VALUE *argv, DDTRACE_UNUS
       ) :
       ddog_crasht_update_on_fork(config, receiver_config, metadata);
 
-  first_init = false;
+  // We use first_init to know which of [init, reconfigure] needs to be called. BUT if init failed we actually need
+  // to call init next time again, not reconfigure.
+  if (result.tag == DDOG_VOID_RESULT_OK) first_init = false;
 
   // Clean up before potentially raising any exceptions
   ddog_Vec_Tag_drop(tags);
-  ddog_endpoint_drop(endpoint);
   // }} End of exception-free zone to prevent leaks
 
   CHECK_VOID_RESULT("Failed to start/update the crash tracker", result);

data/ext/libdatadog_api/datadog_ruby_common.c

@@ -122,6 +122,24 @@ size_t read_ddogerr_string_and_drop(ddog_Error *error, char *string, size_t capa
   return error_msg_size;
 }
 
+static void verify_libdatadog_version(void) {
+  rb_eval_string(
+    "require 'libdatadog';"
+    "expected = '" EXPECTED_LIBDATADOG_VERSION "';"
+    "if expected != Libdatadog::VERSION;"
+      "raise(LoadError, <<MSG\n"
+        "The `datadog` gem needs to be reinstalled whenever the `libdatadog` gem version is changed. "
+        "The currently-installed version of `datadog` was built to work with `libdatadog` gem version #{expected} "
+        "but the currently-loaded version of `libdatadog` is #{Libdatadog::VERSION}. "
+        "To fix this, reinstall the `datadog` gem (e.g. `bundle exec gem pristine datadog`) "
+        "or contact Datadog support for help at <https://docs.datadoghq.com/help/>.\n"
+        "MSG\n"
+      ");"
+    "end"
+  );
+}
+
 void datadog_ruby_common_init(void) {
   telemetry_message_id = rb_intern("@telemetry_message");
+  verify_libdatadog_version();
 }

data/ext/libdatadog_api/datadog_ruby_common.h

@@ -102,3 +102,13 @@ static inline VALUE get_error_details_and_drop(ddog_Error *error) {
 // Returns the amount of characters written to string (which are necessarily
 // bounded by capacity - 1 since the string will be null-terminated).
 size_t read_ddogerr_string_and_drop(ddog_Error *error, char *string, size_t capacity);
+
+#define IMEMO_MASK 0x0f
+
+// Returns the imemo type of an imemo object.
+// This mask is the same between Ruby 2.5 and 3.3-preview3. Furthermore, the intention of this method is to be used
+// to call `rb_imemo_name` which correctly handles invalid numbers so even if the mask changes in the future, at most
+// we'll get incorrect results (and never a VM crash)
+static inline int ddtrace_imemo_type(VALUE imemo) {
+  return (RBASIC(imemo)->flags >> FL_USHIFT) & IMEMO_MASK;
+}

data/ext/libdatadog_api/di.c

@@ -0,0 +1,79 @@
+#include <stdbool.h>
+
+#include "datadog_ruby_common.h"
+
+// Prototypes for Ruby functions declared in internal Ruby headers.
+VALUE rb_iseqw_new(const void *iseq);
+int rb_objspace_internal_object_p(VALUE obj);
+void rb_objspace_each_objects(
+    int (*callback)(void *start, void *end, size_t stride, void *data),
+    void *data);
+
+#define IMEMO_TYPE_ISEQ 7
+
+// The ID value of the string "mesg" which is used in Ruby source as
+// id_mesg or idMesg, and is used to set and retrieve the exception message
+// from standard library exception classes like NameError.
+static ID id_mesg;
+
+// Returns whether the argument is an IMEMO of type ISEQ.
+static bool ddtrace_imemo_iseq_p(VALUE v) {
+  return rb_objspace_internal_object_p(v) && RB_TYPE_P(v, T_IMEMO) && ddtrace_imemo_type(v) == IMEMO_TYPE_ISEQ;
+}
+
+static int ddtrace_di_os_obj_of_i(void *vstart, void *vend, size_t stride, void *data)
+{
+  VALUE *array = (VALUE *)data;
+
+  VALUE v = (VALUE)vstart;
+  for (; v != (VALUE)vend; v += stride) {
+    if (ddtrace_imemo_iseq_p(v)) {
+      VALUE iseq = rb_iseqw_new((void *) v);
+      rb_ary_push(*array, iseq);
+    }
+  }
+
+  return 0;
+}
+
+/*
+Returns all RubyVM::InstructionSequence objects existing in the current process.
+
+This uses the same approach as ruby/debug's iseq_collector.c:
+https://github.com/ruby/debug/blob/master/ext/debug/iseq_collector.c
+*/
+static VALUE all_iseqs(DDTRACE_UNUSED VALUE _self) {
+  VALUE array = rb_ary_new();
+  rb_objspace_each_objects(ddtrace_di_os_obj_of_i, &array);
+  return array;
+}
+
+/*
+ * call-seq:
+ *   DI.exception_message(exception) -> String | Object
+ *
+ * Returns the exception message associated with the exception via the
+ * exception's constructor.
+ *
+ * This method does not invoke Ruby code and as such will not call
+ * the +message+ method, if one is defined on the exception object.
+ *
+ * Normally, the exception message is a string, however there is no
+ * type enforcement done by Ruby for the messages and objects of arbitrary
+ * classes can be passed to exception constructors and will, subsequently,
+ * be returned by this method.
+ *
+ * @param exception [Exception] The exception object
+ * @return [String | Object] The exception message
+ */
+static VALUE exception_message(DDTRACE_UNUSED VALUE _self, VALUE exception) {
+  return rb_ivar_get(exception, id_mesg);
+}
+
+void di_init(VALUE datadog_module) {
+  id_mesg = rb_intern("mesg");
+
+  VALUE di_module = rb_define_module_under(datadog_module, "DI");
+  rb_define_singleton_method(di_module, "all_iseqs", all_iseqs, 0);
+  rb_define_singleton_method(di_module, "exception_message", exception_message, 1);
+}

data/ext/libdatadog_api/extconf.rb

@@ -81,6 +81,8 @@ unless Datadog::LibdatadogExtconfHelpers.configure_libdatadog(extconf_folder: __
   skip_building_extension!('there was a problem in setting up the `libdatadog` dependency')
 end
 
+Datadog::LibdatadogExtconfHelpers.add_libdatadog_version_define
+
 # Tag the native extension library with the Ruby version and Ruby platform.
 # This makes it easier for development (avoids "oops I forgot to rebuild when I switched my Ruby") and ensures that
 # the wrong library is never loaded.

data/ext/libdatadog_api/init.c

@@ -1,12 +1,14 @@
 #include <ruby.h>
 
 #include "datadog_ruby_common.h"
+
 #include "crashtracker.h"
-#include "process_discovery.h"
-#include "library_config.h"
 #include "feature_flags.h"
+#include "library_config.h"
+#include "process_discovery.h"
 
 void ddsketch_init(VALUE core_module);
+void di_init(VALUE datadog_module);
 
 void DDTRACE_EXPORT Init_libdatadog_api(void) {
   VALUE datadog_module = rb_define_module("Datadog");
@@ -21,4 +23,5 @@ void DDTRACE_EXPORT Init_libdatadog_api(void) {
   library_config_init(core_module);
   ddsketch_init(core_module);
   feature_flags_init(core_module);
+  di_init(datadog_module);
 }

data/ext/libdatadog_extconf_helpers.rb

@@ -10,7 +10,7 @@ module Datadog
   module LibdatadogExtconfHelpers
     # Used to make sure the correct gem version gets loaded, as extconf.rb does not get run with "bundle exec" and thus
     # may see multiple libdatadog versions. See https://github.com/DataDog/dd-trace-rb/pull/2531 for the horror story.
-    LIBDATADOG_VERSION = '~> 29.0.0.1.0'
+    LIBDATADOG_VERSION = '~> 30.0.0.1.0'
 
     # Used as an workaround for a limitation with how dynamic linking works in environments where the datadog gem and
     # libdatadog are moved after the extension gets compiled.
@@ -162,6 +162,14 @@ module Datadog
       end
     end
 
+    # Adds a C preprocessor define with the libdatadog version used at compile time.
+    # This allows runtime verification that the loaded libdatadog matches what was compiled against.
+    # rubocop:disable Style/GlobalVars
+    def self.add_libdatadog_version_define
+      $defs << %(-DEXPECTED_LIBDATADOG_VERSION=\\"#{Libdatadog::VERSION}\\")
+    end
+    # rubocop:enable Style/GlobalVars
+
     # Note: This helper is currently only used in the `libdatadog_api/extconf.rb` BUT still lives here to enable testing.
     def self.load_libdatadog_or_get_issue
       try_loading_libdatadog do |exception|

data/lib/datadog/ai_guard/component.rb

@@ -7,6 +7,8 @@ require_relative 'evaluation/result'
 require_relative 'evaluation/no_op_result'
 require_relative 'evaluation/message'
 require_relative 'evaluation/tool_call'
+require_relative 'evaluation/content_part'
+require_relative 'evaluation/content_builder'
 require_relative 'ext'
 
 module Datadog

data/lib/datadog/ai_guard/contrib/ruby_llm/chat_instrumentation.rb

@@ -14,13 +14,51 @@ module Datadog
                     AIGuard.assistant(id: tool_call_id, tool_name: tool_call.name, arguments: tool_call.arguments.to_s)
                   end
                 elsif message.tool_result?
-                  AIGuard.tool(tool_call_id: message.tool_call_id, content: message.content)
+                  build_ai_guard_tool(message)
                 else
-                  AIGuard.message(role: message.role, content: message.content)
+                  build_ai_guard_message(message)
                 end
               end
 
-              AIGuard.evaluate(*ai_guard_messages, allow_raise: true)
+              AIGuard.evaluate(*ai_guard_messages)
+            end
+
+            private
+
+            def build_ai_guard_message(message)
+              content = message.content
+
+              case content
+              when ::RubyLLM::Content
+                AIGuard.message(role: message.role) do |m|
+                  m.text(content.text.to_s) if content.text
+
+                  # Calling attachment.for_llm triggers lazy loading of file contents.
+                  # The result is memoized, so providers won't re-read.
+                  content.attachments.each do |attachment|
+                    case attachment.type
+                    when :image
+                      m.image_url(attachment.for_llm)
+                    when :text
+                      m.text(attachment.for_llm)
+                    end
+                    # Skip :pdf, :audio, :video, :unknown — not supported by AIGuard
+                  end
+                end
+              else
+                AIGuard.message(role: message.role, content: content)
+              end
+            end
+
+            def build_ai_guard_tool(message)
+              content = message.content
+              # Tools can return Content or Content::Raw objects (e.g. with attachments),
+              # but AIGuard.tool expects a String. Extract text when content is a Content object.
+              case content
+              when ::RubyLLM::Content
+                content = content.text.to_s
+              end
+              AIGuard.tool(tool_call_id: message.tool_call_id, content: content)
             end
           end
 

data/lib/datadog/ai_guard/evaluation/content_builder.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AIGuard
+    module Evaluation
+      # Builder for collecting content parts inside a message block.
+      #
+      # Used via the block form of {Datadog::AIGuard.message}:
+      #
+      #   Datadog::AIGuard.message(role: :user) do |m|
+      #     m.text("What's in this image?")
+      #     m.image_url("https://example.com/img.png")
+      #   end
+      class ContentBuilder
+        attr_reader :parts
+
+        def initialize
+          @parts = []
+        end
+
+        def text(text)
+          @parts << ContentPart::Text.new(text)
+        end
+
+        def image_url(url)
+          @parts << ContentPart::ImageURL.new(url)
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/evaluation/content_part.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AIGuard
+    module Evaluation
+      # Namespace for content part types used in multi-modal messages.
+      module ContentPart
+        # A text content part.
+        class Text
+          attr_reader :text
+
+          def initialize(text)
+            @text = text
+          end
+
+          def type
+            :text
+          end
+        end
+
+        # An image URL content part. Accepts an absolute URL or a base64 data URI.
+        class ImageURL
+          attr_reader :url
+
+          def initialize(url)
+            @url = url
+          end
+
+          def type
+            :image_url
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/evaluation/no_op_result.rb

@@ -5,12 +5,14 @@ module Datadog
     module Evaluation
       # Class for emulating AI Guard evaluation result when AI Guard is disabled.
       class NoOpResult
-        attr_reader :action, :reason, :tags
+        attr_reader :action, :reason, :tags, :sds_findings, :tag_probabilities
 
         def initialize
           @action = Result::ALLOW_ACTION
           @reason = "AI Guard is disabled"
           @tags = []
+          @sds_findings = []
+          @tag_probabilities = {}
         end
 
         def allow?

data/lib/datadog/ai_guard/evaluation/request.rb

@@ -44,15 +44,7 @@ module Datadog
         end
 
         def serialize_messages(messages)
-          serialized_messages = []
-
-          messages.each do |message|
-            serialized_messages << serialize_message(message)
-
-            break if serialized_messages.count == Datadog.configuration.ai_guard.max_messages_length
-          end
-
-          serialized_messages
+          messages.map { |message| serialize_message(message) }
         end
 
         def serialize_message(message)
@@ -69,12 +61,25 @@ module Datadog
                 }
               ]
             }
+          elsif message.content.is_a?(::Array)
+            {role: message.role, content: serialize_content_parts(message.content)}
           elsif message.tool_call_id
             {role: message.role, tool_call_id: message.tool_call_id, content: message.content}
           else
             {role: message.role, content: message.content}
           end
         end
+
+        def serialize_content_parts(parts)
+          parts.map do |part|
+            case part
+            when ContentPart::Text
+              {type: "text", text: part.text}
+            when ContentPart::ImageURL
+              {type: "image_url", image_url: {url: part.url}}
+            end
+          end
+        end
       end
     end
   end

data/lib/datadog/ai_guard/evaluation/result.rb

@@ -9,7 +9,7 @@ module Datadog
         DENY_ACTION = "DENY"
         ABORT_ACTION = "ABORT"
 
-        attr_reader :action, :reason, :tags
+        attr_reader :action, :reason, :tags, :sds_findings, :tag_probabilities
 
         def initialize(raw_response)
           attributes = raw_response.fetch("data").fetch("attributes")
@@ -17,7 +17,9 @@ module Datadog
           @action = attributes.fetch("action")
           @reason = attributes.fetch("reason")
           @tags = attributes.fetch("tags")
+          @tag_probabilities = attributes.fetch("tag_probs")
           @is_blocking_enabled = attributes.fetch("is_blocking_enabled")
+          @sds_findings = attributes.fetch("sds_findings", [])
         rescue KeyError => e
           raise AIGuardClientError, "Missing key: \"#{e.key}\""
         end

data/lib/datadog/ai_guard/evaluation.rb

@@ -6,10 +6,16 @@ module Datadog
     # and creating `ai_guard` span with required tags
     module Evaluation
       class << self
-        def perform(messages, allow_raise: false)
+        def perform(messages, allow_raise: true)
           raise ArgumentError, "Messages must not be empty" if messages&.empty?
 
           Tracing.trace(Ext::SPAN_NAME) do |span, trace|
+            trace.keep!
+            trace.set_tag(
+              Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER,
+              Tracing::Sampling::Ext::Decision::AI_GUARD
+            )
+
             if (last_message = messages.last)
               if last_message.tool_call
                 span.set_tag(Ext::TARGET_TAG, "tool")
@@ -34,8 +40,10 @@ module Datadog
             span.set_metastruct_tag(
               Ext::METASTRUCT_TAG,
               {
-                messages: truncate_content(request.serialized_messages),
-                attack_categories: result.tags
+                messages: truncate_content(truncate_messages(request.serialized_messages)),
+                attack_categories: result.tags,
+                sds: result.sds_findings,
+                tag_probs: result.tag_probabilities
               }
             )
 
@@ -56,14 +64,35 @@ module Datadog
 
         private
 
+        def truncate_messages(serialized_messages)
+          max_length = Datadog.configuration.ai_guard.max_messages_length
+          serialized_messages.first(max_length)
+        end
+
+        # Truncates content in serialized messages to stay within the configured byte limit.
+        # For multi-modal messages, only text parts are truncated; image URLs are left intact.
         def truncate_content(serialized_messages)
+          max_bytes = Datadog.configuration.ai_guard.max_content_size_bytes
+
           serialized_messages.map do |message| # steep:ignore
             next message unless message[:content]
 
-            {
-              **message,
-              content: message[:content].byteslice(0, Datadog.configuration.ai_guard.max_content_size_bytes)
-            }
+            if message[:content].is_a?(::Array)
+              serialized_content = message[:content].map do |part|
+                if part[:text]
+                  {**part, text: part[:text].to_s.byteslice(0, max_bytes)}
+                else
+                  part
+                end
+              end
+
+              {**message, content: serialized_content}
+            else
+              {
+                **message,
+                content: message[:content].byteslice(0, max_bytes)
+              }
+            end
           end
         end
       end