datadog 2.4.0 → 2.44.0

data/lib/datadog/ai_guard/contrib/rails/patcher.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+require_relative "../../../core/utils/only_once"
+require_relative "../rack/request_middleware"
+require_relative "../../../tracing/contrib"
+require_relative "../../../tracing/contrib/rack/middlewares"
+
+module Datadog
+  module AIGuard
+    module Contrib
+      module Rails
+        # Patcher for AI Guard on Rails. Inserts the AI Guard Rack middleware
+        # right after the Tracing Rack middleware so the request span is
+        # already active when AI Guard tags the client IP.
+        module Patcher
+          BEFORE_INITIALIZE_ONLY_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
+
+          module_function
+
+          def patched?
+            !!Patcher.instance_variable_get(:@patched)
+          end
+
+          def target_version
+            Integration.version
+          end
+
+          def patch
+            patch_before_initialize
+            Patcher.instance_variable_set(:@patched, true)
+          end
+
+          def patch_before_initialize
+            ::ActiveSupport.on_load(:before_initialize) do
+              Datadog::AIGuard::Contrib::Rails::Patcher.before_initialize(self)
+            end
+          end
+
+          def before_initialize(app)
+            BEFORE_INITIALIZE_ONLY_ONCE_PER_APP[app].run do
+              # Middleware must be added before the application is initialized.
+              # Otherwise the middleware stack will be frozen.
+              add_middleware(app) if Datadog.configuration.tracing[:rails][:middleware]
+            end
+          end
+
+          def add_middleware(app)
+            if include_middleware?(Datadog::Tracing::Contrib::Rack::TraceMiddleware, app)
+              app.middleware.insert_after(
+                Datadog::Tracing::Contrib::Rack::TraceMiddleware,
+                Datadog::AIGuard::Contrib::Rack::RequestMiddleware
+              )
+            else
+              app.middleware.insert_before(0, Datadog::AIGuard::Contrib::Rack::RequestMiddleware)
+            end
+          end
+
+          def include_middleware?(middleware, app)
+            found = false
+
+            # find tracer middleware reference in Rails::Configuration::MiddlewareStackProxy
+            app.middleware.instance_variable_get(:@operations).each do |operation|
+              args = case operation
+              when Array
+                # rails 5.2
+                _op, args = operation
+                args
+              when Proc
+                if operation.binding.local_variables.include?(:args)
+                  # rails 6.0, 6.1
+                  operation.binding.local_variable_get(:args)
+                else
+                  # rails 7.0 uses ... to pass args
+                  # steep:ignore:start
+                  args_getter = Class.new do
+                    def method_missing(_op, *args) # standard:disable Style/MissingRespondToMissing
+                      args
+                    end
+                  end.new
+                  # steep:ignore:end
+                  operation.call(args_getter)
+                end
+              else
+                # unknown, pass through
+                []
+              end
+
+              found = true if args.include?(middleware)
+            end
+
+            found
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/contrib/ruby_llm/chat_instrumentation.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AIGuard
+    module Contrib
+      module RubyLLM
+        # Protects tool calls before RubyLLM executes them locally
+        #
+        # @api private
+        module ChatInstrumentation
+          private
+
+          def provider_completion(usage_recorder:, stream_tracker: nil, &block)
+            @_datadog_ai_guard_evaluate = true
+            super
+          ensure
+            @_datadog_ai_guard_evaluate = false
+          end
+
+          def preprocessed_messages(list = messages)
+            return super unless @_datadog_ai_guard_evaluate
+
+            adapter = MessageAdapter.new(list)
+
+            begin
+              converted_messages = adapter.to_ai_guard
+            rescue JSON::JSONError
+              Metrics::Telemetry.report_error
+              return super
+            rescue => e
+              AIGuard.telemetry&.report(e, description: "AI Guard: Failed to convert RubyLLM messages")
+              return super
+            end
+
+            evaluation = AIGuard.evaluate(*converted_messages)
+
+            begin
+              redacted_messages = adapter.apply_redactions(evaluation.messages)
+            rescue JSON::JSONError => e
+              AIGuard.telemetry&.report(e, description: "AI Guard: Failed to apply RubyLLM redaction")
+              return super
+            end
+
+            super(redacted_messages)
+          end
+
+          def execute_pending_tool_calls(response)
+            response_index = messages.index { |message| message == response }
+            return super unless response_index
+
+            adapter = MessageAdapter.new(messages)
+            begin
+              converted_messages = adapter.to_ai_guard
+            rescue JSON::JSONError
+              Metrics::Telemetry.report_error
+              return super
+            end
+
+            evaluation = AIGuard.evaluate(*converted_messages)
+            begin
+              redacted_messages = adapter.apply_redactions(evaluation.messages)
+            rescue JSON::JSONError => e
+              AIGuard.telemetry&.report(e, description: "AI Guard: Failed to apply RubyLLM redaction")
+              return super
+            end
+
+            super(redacted_messages[response_index])
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/contrib/ruby_llm/integration.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require_relative "../integration"
+require_relative "patcher"
+
+module Datadog
+  module AIGuard
+    module Contrib
+      module RubyLLM
+        # This class provides helper methods that are used when patching RubyLLM
+        class Integration
+          include Datadog::AIGuard::Contrib::Integration
+
+          MINIMUM_VERSION = Gem::Version.new("2.0.0")
+
+          register_as :ruby_llm, auto_patch: false
+
+          def self.version
+            Gem.loaded_specs["ruby_llm"]&.version
+          end
+
+          def self.loaded?
+            !defined?(::RubyLLM).nil?
+          end
+
+          def self.compatible?
+            super && !!(version&.>= MINIMUM_VERSION)
+          end
+
+          def self.auto_instrument?
+            false
+          end
+
+          def patcher
+            Patcher
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/contrib/ruby_llm/message_adapter.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require_relative "redaction_change_set"
+
+module Datadog
+  module AIGuard
+    module Contrib
+      module RubyLLM
+        # RubyLLM messages paired with their AI Guard representation
+        #
+        # @api private
+        class MessageAdapter
+          def initialize(messages)
+            @ruby_llm_messages = messages
+          end
+
+          def to_ai_guard
+            @ai_guard_messages ||= @ruby_llm_messages.map { |message| build_ai_guard_message(message) }
+          end
+
+          def apply_redactions(redacted_messages)
+            ai_guard_messages = to_ai_guard
+            return @ruby_llm_messages if redacted_messages == ai_guard_messages
+
+            @ruby_llm_messages.each_with_index.map do |message, index|
+              original_message = ai_guard_messages[index]
+              redacted_message = redacted_messages[index]
+              next message if redacted_message == original_message
+
+              RedactionChangeSet.new(original_message, redacted_message).apply_to(message)
+            end
+          end
+
+          private
+
+          def build_ai_guard_message(message)
+            builder = Evaluation::MessageBuilder.new
+
+            # NOTE: Hash block arguments are misinterpreted by Steep after `nil.to_h`
+            # steep:ignore:start
+            message.tool_calls.to_h.each do |id, tool_call|
+              builder.tool_call(name: tool_call.name, id: id, arguments: tool_call.arguments)
+            end
+            # steep:ignore:end
+
+            if message.attachments.empty?
+              content = message.content
+            else
+              builder.text(message.content) if message.content && !message.content.empty?
+
+              message.attachments.each do |attachment|
+                next if attachment.provider_file?
+
+                case attachment.type
+                when :text
+                  builder.text(attachment.content)
+                when :image
+                  # NOTE: Local images are Base64-encoded here by `#for_llm`
+                  #       and again when RubyLLM builds the provider request
+                  url = attachment.url? ? attachment.source.to_s : attachment.for_llm
+                  builder.image_url(url)
+                end
+              end
+
+              content = builder.content
+            end
+
+            Evaluation::Message.new(
+              role: message.role, content: content, tool_calls: builder.tool_calls, tool_call_id: message.tool_call_id
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/contrib/ruby_llm/patcher.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require_relative "message_adapter"
+require_relative "chat_instrumentation"
+
+module Datadog
+  module AIGuard
+    module Contrib
+      module RubyLLM
+        # AIGuard patcher module for RubyLLM
+        module Patcher
+          module_function
+
+          def patched?
+            !!Patcher.instance_variable_get(:@patched)
+          end
+
+          def target_version
+            Integration.version
+          end
+
+          def patch
+            ::RubyLLM::Chat.prepend(ChatInstrumentation)
+
+            Patcher.instance_variable_set(:@patched, true)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/contrib/ruby_llm/redaction_change_set.rb

@@ -0,0 +1,135 @@
+# frozen_string_literal: true
+
+require "json"
+require "stringio"
+
+module Datadog
+  module AIGuard
+    module Contrib
+      module RubyLLM
+        # Changes required to redact a RubyLLM message
+        #
+        # @api private
+        class RedactionChangeSet
+          def initialize(original_message, redacted_message)
+            @content_replacement = content_replacement(original_message.content, redacted_message.content)
+            @content_part_replacements = content_part_replacements(original_message.content, redacted_message.content)
+            @tool_call_replacements = tool_call_replacements(original_message.tool_calls, redacted_message.tool_calls)
+          end
+
+          def apply_to(message)
+            return message unless changed?
+
+            # NOTE: Preserve `raw_content` after provider-specific redaction is implemented.
+            #       Unchanged raw content could bypass redaction
+            if message.raw_content
+              Datadog.logger.warn("AI Guard omitted RubyLLM raw content because it may contain sensitive data")
+            end
+
+            content = build_content(message)
+            attachments = build_attachments(message)
+            tool_calls = build_tool_calls(message)
+
+            changed_message = ::RubyLLM::Message.new(
+              content: content, attachments: attachments, tool_calls: tool_calls,
+              role: message.role, model: message.model, tool_call_id: message.tool_call_id,
+              raw: message.raw, thinking: message.thinking, citations: message.citations,
+              finish_reason: message.finish_reason, server_tool_calls: message.server_tool_calls,
+              raw_reasoning: message.raw_reasoning, cache_until_here: message.cache_until_here?
+            )
+            changed_message.conversation = message.conversation
+            changed_message
+          end
+
+          private
+
+          # NOTE: Steep treats original and redacted content shapes as independent
+          def content_replacement(original_content, redacted_content) # steep:ignore MethodBodyTypeMismatch
+            return if original_content.is_a?(Array) || redacted_content == original_content
+
+            redacted_content
+          end
+
+          def content_part_replacements(original_content, redacted_content)
+            return {} unless original_content.is_a?(Array)
+
+            replacements = {}
+            original_content.each_with_index do |content_part, index|
+              next if content_part == redacted_content[index] # steep:ignore NoMethod
+
+              replacements[index] = redacted_content[index] # steep:ignore NoMethod
+            end
+
+            replacements
+          end
+
+          def tool_call_replacements(original_tool_calls, redacted_tool_calls)
+            replacements = {}
+            original_tool_calls.each_with_index do |tool_call, index|
+              next if redacted_tool_calls[index] == tool_call
+
+              replacements[tool_call.id] = redacted_tool_calls[index]
+            end
+
+            replacements
+          end
+
+          def changed?
+            !!@content_replacement || !@content_part_replacements.empty? ||
+              !@tool_call_replacements.empty?
+          end
+
+          def build_content(message)
+            return @content_replacement if @content_replacement
+            return message.content if message.content.to_s.empty?
+
+            replacement = @content_part_replacements[0]
+            replacement ? replacement.text : message.content
+          end
+
+          def build_attachments(message)
+            return message.attachments if @content_part_replacements.empty?
+
+            content_part_index = message.content.to_s.empty? ? 0 : 1
+            # @type var attachments: Array[::RubyLLM::Attachment]?
+            attachments = nil
+
+            message.attachments.each_with_index do |attachment, attachment_index|
+              next if attachment.provider_file?
+              next unless attachment.type == :text || attachment.type == :image
+
+              replacement = @content_part_replacements[content_part_index]
+              content_part_index += 1
+
+              next unless replacement && attachment.type == :text
+
+              attachments ||= message.attachments.dup
+              attachments[attachment_index] = ::RubyLLM::Attachment.new( # steep:ignore NoMethod
+                StringIO.new(replacement.text), filename: attachment.filename, config: attachment.config
+              )
+            end
+
+            attachments || message.attachments
+          end
+
+          def build_tool_calls(message)
+            return message.tool_calls if @tool_call_replacements.empty?
+
+            # @type var tool_calls: Hash[String, ::RubyLLM::ToolCall]
+            tool_calls = message.tool_calls.dup # steep:ignore IncompatibleAssignment
+            @tool_call_replacements.each do |id, replacement|
+              tool_call = tool_calls.fetch(id)
+              tool_calls[id] = ::RubyLLM::ToolCall.new(
+                id: tool_call.id, name: tool_call.name, remote: tool_call.remote?,
+                thought_signature: tool_call.thought_signature,
+                arguments: JSON.parse(replacement.arguments)
+              )
+            end
+
+            tool_calls
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/evaluation/client.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AIGuard
+    module Evaluation
+      # Client for evaluation API requests
+      #
+      # @api private
+      module Client
+        def self.evaluate(messages)
+          request = Request.new(messages)
+          http_client = AIGuard.http_client
+
+          # This should never happen, as we are only calling this method when AI Guard is enabled,
+          # and this means the HTTP client was not initialized properly.
+          #
+          # Please report this at https://github.com/datadog/dd-trace-rb/blob/master/CONTRIBUTING.md#found-a-bug
+          raise "AI Guard HTTP client not initialized" unless http_client
+
+          response = Response.new(
+            http_client.post(Request::REQUEST_PATH, body: request.body)
+          )
+
+          redaction =
+            if Datadog.configuration.ai_guard.redaction_enabled
+              Redaction.perform(messages, replacements: response.redaction_replacements)
+            else
+              Redaction.skip(messages)
+            end
+
+          result = Result.new(
+            redaction.messages,
+            action: response.action,
+            reason: response.reason,
+            tags: response.tags,
+            sds_findings: response.sds_findings,
+            tag_probabilities: response.tag_probabilities,
+            redaction_replacements: response.redaction_replacements
+          )
+
+          Outcome.new(
+            result: result,
+            redaction: redaction,
+            blocking_enabled: response.blocking_enabled?
+          )
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/evaluation/content_part.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AIGuard
+    module Evaluation
+      # Namespace for content part types used in multi-modal messages.
+      module ContentPart
+        # A text content part.
+        class Text
+          attr_reader :text
+
+          def initialize(text)
+            @text = text
+          end
+
+          def type
+            :text
+          end
+
+          def copy(text:)
+            Text.new(text)
+          end
+
+          def to_h
+            {type: type.to_s, text: text}
+          end
+        end
+
+        # An image URL content part. Accepts an absolute URL or a base64 data URI.
+        class ImageURL
+          attr_reader :url
+
+          def initialize(url)
+            @url = url
+          end
+
+          def type
+            :image_url
+          end
+
+          def to_h
+            {type: type.to_s, image_url: {url: url}}
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/evaluation/message.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AIGuard
+    module Evaluation
+      # Represents a message submitted for evaluation
+      class Message
+        attr_reader :role, :content, :tool_calls, :tool_call_id
+
+        def initialize(role:, content: nil, tool_calls: [], tool_call_id: nil)
+          raise ArgumentError, "Role must be set to a non-empty value" if role.to_s.empty?
+          raise ArgumentError, "Tool calls must be an Array" unless tool_calls.is_a?(::Array)
+
+          if tool_calls.any? { |tool_call| !tool_call.is_a?(ToolCall) }
+            raise ArgumentError, "Tool calls must contain only #{ToolCall.name} instances"
+          end
+
+          @role = role.to_sym
+          @content = content
+          @tool_calls = tool_calls
+          @tool_call_id = tool_call_id
+        end
+
+        def copy(content: self.content, tool_calls: self.tool_calls)
+          Message.new(role: role, content: content, tool_calls: tool_calls, tool_call_id: tool_call_id)
+        end
+
+        def to_h
+          serialized = {
+            role: role,
+            content: content.is_a?(::Array) ? content.map(&:to_h) : content,
+            tool_call_id: tool_call_id,
+          }
+
+          serialized[:tool_calls] = tool_calls.map(&:to_h) unless tool_calls.empty?
+          serialized.compact!
+
+          serialized
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/evaluation/message_builder.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AIGuard
+    module Evaluation
+      # Builds a message from content parts and tool calls
+      #
+      # @public_api
+      class MessageBuilder
+        attr_reader :content, :tool_calls
+
+        def initialize
+          @content = []
+          @tool_calls = []
+        end
+
+        def text(text)
+          @content << ContentPart::Text.new(text)
+        end
+
+        def image_url(url)
+          @content << ContentPart::ImageURL.new(url)
+        end
+
+        def tool_call(name:, id:, arguments:)
+          @tool_calls << ToolCall.new(name, id: id.to_s, arguments: arguments)
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/evaluation/no_op_result.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AIGuard
+    module Evaluation
+      # Class for emulating AI Guard evaluation result when AI Guard is disabled.
+      class NoOpResult
+        attr_reader :action, :reason, :tags, :sds_findings, :redaction_replacements,
+          :tag_probabilities, :messages
+
+        def initialize(messages)
+          @action = Result::ALLOW_ACTION
+          @reason = "AI Guard is disabled"
+
+          @tags = []
+          @messages = messages
+          @sds_findings = []
+          @tag_probabilities = {}
+          @redaction_replacements = []
+        end
+
+        def allow?
+          true
+        end
+
+        def deny?
+          false
+        end
+
+        def abort?
+          false
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/evaluation/outcome.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AIGuard
+    module Evaluation
+      # Internal outcome of an evaluation request
+      #
+      # @api private
+      class Outcome
+        attr_reader :result, :redaction
+
+        def initialize(result:, redaction:, blocking_enabled:)
+          @result = result
+          @redaction = redaction
+          @blocking_enabled = blocking_enabled
+        end
+
+        def block?
+          @blocking_enabled && (result.deny? || result.abort?)
+        end
+      end
+    end
+  end
+end