datadog 2.43.0 → 2.45.0

data/ext/datadog_profiling_native_extension/time_helpers.c

@@ -28,10 +28,8 @@ long monotonic_to_system_epoch_ns(monotonic_to_system_epoch_state *state, long m
     (state->delta_to_epoch_ns + monotonic_wall_time_ns > state->system_epoch_ns_reference + SECONDS_AS_NS(60));
 
   if (reference_needs_update) {
-    state->system_epoch_ns_reference = system_epoch_time_now_ns(RAISE_ON_FAILURE);
-    long current_monotonic_wall_time_ns = monotonic_wall_time_now_ns(RAISE_ON_FAILURE);
-
-    state->delta_to_epoch_ns = state->system_epoch_ns_reference - current_monotonic_wall_time_ns;
+    state->system_epoch_ns_reference = system_epoch_time_now_ns();
+    state->delta_to_epoch_ns = state->system_epoch_ns_reference - monotonic_wall_time_now_ns();
   }
 
   return state->delta_to_epoch_ns + monotonic_wall_time_ns;

data/ext/datadog_profiling_native_extension/time_helpers.h

@@ -1,17 +1,15 @@
 #pragma once
 
-#include <stdbool.h>
+#include <ruby.h>
 #include <errno.h>
+#include <stdbool.h>
 #include <time.h>
 
 #include "extconf.h"
-#include "ruby_helpers.h"
-
-#define SECONDS_AS_NS(value) (value * 1000 * 1000 * 1000L)
-#define MILLIS_AS_NS(value) (value * 1000 * 1000L)
-#define MICROS_AS_NS(value) (value * 1000L)
 
-typedef enum { RAISE_ON_FAILURE, DO_NOT_RAISE_ON_FAILURE } raise_on_failure_setting;
+#define SECONDS_AS_NS(value) ((value) * 1000L * 1000L * 1000L)
+#define MILLIS_AS_NS(value)  ((value) * 1000L * 1000L)
+#define MICROS_AS_NS(value)  ((value) * 1000L)
 
 #define INVALID_TIME -1
 
@@ -23,12 +21,13 @@ typedef struct {
 
 #define MONOTONIC_TO_SYSTEM_EPOCH_INITIALIZER {.system_epoch_ns_reference = INVALID_TIME}
 
-static inline long retrieve_clock_as_ns(clockid_t clock_id, raise_on_failure_setting raise_on_failure) {
+// clock_id MUST be one of CLOCK_REALTIME/CLOCK_MONOTONIC_FOR_PROFILING/CLOCK_MONOTONIC_COARSE_FOR_PROFILING
+// as for those we're guaranteed to never see failures here unless something is really off
+static inline long retrieve_clock_as_ns(clockid_t clock_id) {
   struct timespec clock_value;
 
-  if (clock_gettime(clock_id, &clock_value) != 0) {
-    if (raise_on_failure == RAISE_ON_FAILURE) ENFORCE_SUCCESS_GVL(errno);
-    return 0;
+  if (RB_UNLIKELY(clock_gettime(clock_id, &clock_value) != 0)) {
+    rb_bug("[ddtrace] clock_gettime(%d) unexpectedly failed (errno=%d) but it should always succeed, libc/kernel bug?", (int) clock_id, errno);
   }
 
   return clock_value.tv_nsec + SECONDS_AS_NS(clock_value.tv_sec);
@@ -43,8 +42,8 @@ static inline long retrieve_clock_as_ns(clockid_t clock_id, raise_on_failure_set
   #define CLOCK_MONOTONIC_COARSE_FOR_PROFILING CLOCK_MONOTONIC_COARSE
 #endif
 
-static inline long monotonic_wall_time_now_ns(raise_on_failure_setting raise_on_failure) { return retrieve_clock_as_ns(CLOCK_MONOTONIC_FOR_PROFILING, raise_on_failure); }
-static inline long system_epoch_time_now_ns(raise_on_failure_setting raise_on_failure)   { return retrieve_clock_as_ns(CLOCK_REALTIME,  raise_on_failure); }
+static inline long monotonic_wall_time_now_ns(void) { return retrieve_clock_as_ns(CLOCK_MONOTONIC_FOR_PROFILING); }
+static inline long system_epoch_time_now_ns(void)   { return retrieve_clock_as_ns(CLOCK_REALTIME); }
 
 // Coarse instants use CLOCK_MONOTONIC_COARSE on Linux which is expected to provide resolution in the millisecond range:
 // https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_for_real_time/7/html/reference_guide/sect-posix_clocks#Using_clock_getres_to_compare_clock_resolution
@@ -57,7 +56,7 @@ typedef struct {
 static inline coarse_instant to_coarse_instant(long timestamp_ns) { return (coarse_instant) {.timestamp_ns = timestamp_ns}; }
 
 static inline coarse_instant monotonic_coarse_wall_time_now_ns(void) {
-  return to_coarse_instant(retrieve_clock_as_ns(CLOCK_MONOTONIC_COARSE_FOR_PROFILING, DO_NOT_RAISE_ON_FAILURE));
+  return to_coarse_instant(retrieve_clock_as_ns(CLOCK_MONOTONIC_COARSE_FOR_PROFILING));
 }
 
 long monotonic_to_system_epoch_ns(monotonic_to_system_epoch_state *state, long monotonic_wall_time_ns);

data/ext/libdatadog_api/di.c

@@ -2,6 +2,9 @@
 
 #include "datadog_ruby_common.h"
 
+// rb_iseq is CRuby-specific
+#ifndef TRUFFLERUBY
+
 // Prototypes for Ruby functions declared in internal Ruby headers.
 // rb_iseqw_new wraps an internal iseq pointer into a Ruby-visible
 // RubyVM::InstructionSequence object.
@@ -207,7 +210,9 @@ void di_init(VALUE datadog_module) {
   rb_define_singleton_method(di_module, "enter_probe", enter_probe, 0);
   rb_define_singleton_method(di_module, "leave_probe", leave_probe, 0);
   rb_define_singleton_method(di_module, "hash?", is_hash, 1);
-#ifdef HAVE_RB_ISEQ_TYPE
-  rb_define_singleton_method(di_module, "iseq_type", iseq_type, 1);
-#endif
+  #ifdef HAVE_RB_ISEQ_TYPE
+    rb_define_singleton_method(di_module, "iseq_type", iseq_type, 1);
+  #endif
 }
+
+#endif // TRUFFLERUBY

data/ext/libdatadog_api/extconf.rb

@@ -24,7 +24,7 @@ end
 if ENV["DD_NO_EXTENSION"].to_s.strip.downcase == "true"
   skip_building_extension!("the `DD_NO_EXTENSION` environment variable is/was set to `true` during installation")
 end
-skip_building_extension!("current Ruby VM is not supported") if RUBY_ENGINE != "ruby"
+skip_building_extension!("current Ruby VM is not supported") unless %w[ruby truffleruby].include?(RUBY_ENGINE)
 skip_building_extension!("Microsoft Windows is not supported") if Gem.win_platform?
 
 libdatadog_issue = Datadog::LibdatadogExtconfHelpers.load_libdatadog_or_get_issue

data/ext/libdatadog_api/feature_flags.c

@@ -13,6 +13,7 @@
 // Forward declarations
 static VALUE configuration_new(VALUE klass, VALUE json_str);
 static void configuration_free(void *ptr);
+static VALUE configuration_get_observe_full_evaluation_data(VALUE self);
 static VALUE configuration_get_assignment(
   VALUE self, VALUE flag_key, VALUE expected_type, VALUE context);
 
@@ -94,6 +95,7 @@ void feature_flags_init(VALUE core_module) {
   rb_undef_alloc_func(configuration_class);
   rb_define_singleton_method(configuration_class, "new", configuration_new, 1);
   rb_define_method(configuration_class, "get_assignment", configuration_get_assignment, 3);
+  rb_define_method(configuration_class, "observe_full_evaluation_data", configuration_get_observe_full_evaluation_data, 0);
 
   rb_gc_register_address(&resolution_details_class);
   resolution_details_class = rb_define_class_under(feature_flags_module, "ResolutionDetails", rb_cObject);
@@ -137,6 +139,12 @@ static VALUE configuration_new(VALUE klass, VALUE json_str) {
   return TypedData_Wrap_Struct(klass, &configuration_data_type, result.ok);
 }
 
+static VALUE configuration_get_observe_full_evaluation_data(VALUE self) {
+  ddog_ffe_Handle_Configuration configuration =
+    (ddog_ffe_Handle_Configuration)rb_check_typeddata(self, &configuration_data_type);
+  return ddog_ffe_configuration_get_observe_full_evaluation_data(configuration) ? Qtrue : Qfalse;
+}
+
 static void configuration_free(void *ptr) {
   ddog_ffe_Handle_Configuration config = (ddog_ffe_Handle_Configuration)ptr;
   ddog_ffe_configuration_drop(&config);

data/ext/libdatadog_api/init.c

@@ -25,7 +25,9 @@ void DDTRACE_EXPORT Init_libdatadog_api(void) {
   library_config_init(core_module);
   ddsketch_init(core_module);
   feature_flags_init(core_module);
-  di_init(datadog_module);
+  #ifndef TRUFFLERUBY
+    di_init(datadog_module);
+  #endif
 
   VALUE tracing_module = rb_define_module_under(datadog_module, "Tracing");
   trace_exporter_init(tracing_module);

data/ext/libdatadog_api/otel_thread_context.c

@@ -4,7 +4,12 @@
 #include "datadog_ruby_common.h"
 #include "otel_thread_context.h"
 
-#ifdef __linux__
+// Relies on a :fiber_switch TracePoint that TruffleRuby does not support yet
+#if defined(__linux__) && !defined(TRUFFLERUBY)
+  #define OTEL_THREAD_CONTEXT_SUPPORTED
+#endif
+
+#ifdef OTEL_THREAD_CONTEXT_SUPPORTED
   #include <datadog/otel-thread-ctx.h>
   extern __thread const uint8_t *otel_thread_ctx_v1;
 
@@ -32,18 +37,18 @@ static VALUE native_read(VALUE _self);
 void otel_thread_context_init(VALUE tracing_module) {
   fiber_context_slot = rb_intern("__dd_otel_fiber_context");
 
-  VALUE otel_thread_context_module = rb_define_module_under(tracing_module, "OTelThreadContext");
+  VALUE otel_thread_context_class = rb_define_class_under(tracing_module, "OTelThreadContext", rb_cObject);
 
-  rb_define_singleton_method(otel_thread_context_module, "_native_enable", native_enable, 0);
-  rb_define_singleton_method(otel_thread_context_module, "_native_set", native_set, 3);
-  rb_define_singleton_method(otel_thread_context_module, "_native_clear", native_clear, 0);
-  rb_define_singleton_method(otel_thread_context_module, "_native_supported?", native_supported_p, 0);
+  rb_define_method(otel_thread_context_class, "_native_enable", native_enable, 0);
+  rb_define_method(otel_thread_context_class, "_native_set", native_set, 3);
+  rb_define_method(otel_thread_context_class, "_native_clear", native_clear, 0);
+  rb_define_method(otel_thread_context_class, "_native_supported?", native_supported_p, 0);
 
-  VALUE testing_module = rb_define_module_under(otel_thread_context_module, "Testing");
+  VALUE testing_module = rb_define_module_under(otel_thread_context_class, "Testing");
   rb_define_singleton_method(testing_module, "_native_read", native_read, 0);
 }
 
-#ifdef __linux__
+#ifdef OTEL_THREAD_CONTEXT_SUPPORTED
   static ddog_ThreadContextHandle *get_fiber_handle_for(VALUE thread) {
     VALUE obj = rb_thread_local_aref(thread, fiber_context_slot);
 
@@ -56,6 +61,22 @@ void otel_thread_context_init(VALUE tracing_module) {
     return get_fiber_handle_for(rb_thread_current());
   }
 
+  static void pack_span_id(VALUE id, uint8_t bytes[8]) {
+    // Tracing::Utils.next_id caps generated span IDs at (1 << 62) - 1, which fits
+    // in a Fixnum on 64-bit Ruby. Packing them directly avoids rb_integer_pack's
+    // generic conversion and format checks on each context update.
+    // https://github.com/DataDog/dd-trace-rb/blob/0b10368e0a2940c1f4d50c9739b9973b4f8bc32a/lib/datadog/tracing/utils.rb#L20-L37
+    if (FIXNUM_P(id)) {
+      uint64_t number = (uint64_t) FIX2LONG(id);
+      for (int i = 7; i >= 0; i--) {
+        bytes[i] = (uint8_t) number;
+        number >>= 8;
+      }
+    } else {
+      rb_integer_pack(id, bytes, 1, sizeof(uint64_t), 0, INTEGER_PACK_BIG_ENDIAN);
+    }
+  }
+
   static void store_current_fiber_handle(ddog_ThreadContextHandle *handle) {
     VALUE obj = TypedData_Wrap_Struct(rb_cObject, &otel_ctx_handle_t, handle);
     rb_thread_local_aset(rb_thread_current(), fiber_context_slot, obj);
@@ -137,7 +158,7 @@ void otel_thread_context_init(VALUE tracing_module) {
 #endif
 
 static VALUE native_enable(DDTRACE_UNUSED VALUE _self) {
-  #ifdef __linux__
+  #ifdef OTEL_THREAD_CONTEXT_SUPPORTED
     if (otel_context_enabled) return Qtrue;
     otel_context_enabled = true;
 
@@ -163,7 +184,7 @@ static VALUE native_enable(DDTRACE_UNUSED VALUE _self) {
 }
 
 static VALUE native_supported_p(DDTRACE_UNUSED VALUE _self) {
-  #ifdef __linux__
+  #ifdef OTEL_THREAD_CONTEXT_SUPPORTED
     return Qtrue;
   #else
     return Qfalse;
@@ -176,17 +197,17 @@ static VALUE native_set(
     DDTRACE_UNUSED VALUE span_id,
     DDTRACE_UNUSED VALUE local_root_span_id
   ) {
-  #ifdef __linux__
+  #ifdef OTEL_THREAD_CONTEXT_SUPPORTED
     if (!otel_context_enabled) return Qfalse;
 
     uint8_t trace_id_bytes[16];
     uint8_t span_id_bytes[8];
     uint8_t local_root_span_id_bytes[8];
 
-    const int BIG_ENDIAN_PACK_FLAGS = INTEGER_PACK_MSWORD_FIRST | INTEGER_PACK_BIG_ENDIAN;
-    rb_integer_pack(trace_id, trace_id_bytes, sizeof(trace_id_bytes), 1, 0, BIG_ENDIAN_PACK_FLAGS);
-    rb_integer_pack(span_id, span_id_bytes, sizeof(span_id_bytes), 1, 0, BIG_ENDIAN_PACK_FLAGS);
-    rb_integer_pack(local_root_span_id, local_root_span_id_bytes, sizeof(local_root_span_id_bytes), 1, 0, BIG_ENDIAN_PACK_FLAGS);
+    // Note: We use 2 words of size 8, as `rb_integer_pack` has a fast path for it (vs 16 bytes of size 1)
+    rb_integer_pack(trace_id, trace_id_bytes, 2, sizeof(uint64_t), 0, INTEGER_PACK_BIG_ENDIAN);
+    pack_span_id(span_id, span_id_bytes);
+    pack_span_id(local_root_span_id, local_root_span_id_bytes);
 
     ddog_ThreadContextHandle *handle = get_current_fiber_handle();
 
@@ -207,7 +228,7 @@ static VALUE native_set(
 }
 
 static VALUE native_clear(DDTRACE_UNUSED VALUE _self) {
-  #ifdef __linux__
+  #ifdef OTEL_THREAD_CONTEXT_SUPPORTED
     if (!otel_context_enabled) return Qfalse;
 
     ddog_ThreadContextHandle *detached = ddog_otel_thread_ctx_detach();
@@ -220,7 +241,7 @@ static VALUE native_clear(DDTRACE_UNUSED VALUE _self) {
 }
 
 static VALUE native_read(DDTRACE_UNUSED VALUE _self) {
-  #ifdef __linux__
+  #ifdef OTEL_THREAD_CONTEXT_SUPPORTED
     const uint8_t *raw = otel_thread_ctx_v1;
     if (!raw) return Qnil;
 

data/ext/libdatadog_api/trace_exporter.c

@@ -34,6 +34,7 @@ static VALUE _native_from_span(VALUE klass, VALUE span);
 
 /* TraceExporter methods */
 static VALUE _native_exporter_new(int argc, VALUE *argv, VALUE klass);
+static VALUE _native_close(VALUE self);
 static VALUE _native_send_traces(VALUE self, VALUE traces, VALUE native_events_supported);
 static VALUE _native_before_fork(VALUE self);
 static VALUE _native_after_fork_in_parent(VALUE self);
@@ -1410,9 +1411,10 @@ static VALUE create_ok_response(long trace_count, VALUE payload) {
  *   TraceExporter._native_new(
  *     url:, tracer_version: nil, language: nil, language_version: nil,
  *     language_interpreter: nil, hostname: nil, env: nil,
- *     service: nil, version: nil) -> TraceExporter
+ *     service: nil, version: nil, client_computed_stats: false,
+ *     timeout_milliseconds: nil) -> TraceExporter
  *
- * +url+ is required (String).  All other arguments may be nil.
+ * +url+ is required (String). Metadata arguments may be nil.
  * ======================================================================== */
 
 static VALUE _native_exporter_new(
@@ -1431,6 +1433,8 @@ static VALUE _native_exporter_new(
   VALUE rb_env                  = rb_hash_fetch(options, ID2SYM(rb_intern("env")));
   VALUE rb_service              = rb_hash_fetch(options, ID2SYM(rb_intern("service")));
   VALUE rb_version              = rb_hash_fetch(options, ID2SYM(rb_intern("version")));
+  VALUE rb_client_computed_stats = rb_hash_lookup2(options, ID2SYM(rb_intern("client_computed_stats")), Qfalse);
+  VALUE rb_timeout_milliseconds = rb_hash_lookup2(options, ID2SYM(rb_intern("timeout_milliseconds")), Qnil);
 
   /* Phase 1: validate types (may raise, no Rust resources yet) */
   ENFORCE_TYPE(rb_url, T_STRING);
@@ -1442,6 +1446,20 @@ static VALUE _native_exporter_new(
   if (rb_env                  != Qnil) ENFORCE_TYPE(rb_env,                  T_STRING);
   if (rb_service              != Qnil) ENFORCE_TYPE(rb_service,              T_STRING);
   if (rb_version              != Qnil) ENFORCE_TYPE(rb_version,              T_STRING);
+  if (rb_client_computed_stats != Qtrue && rb_client_computed_stats != Qfalse) {
+    rb_raise(rb_eTypeError, "client_computed_stats must be true or false");
+  }
+
+  long long timeout_milliseconds = 0;
+  if (rb_timeout_milliseconds != Qnil) {
+    if (!RB_TYPE_P(rb_timeout_milliseconds, T_FIXNUM) && !RB_TYPE_P(rb_timeout_milliseconds, T_BIGNUM)) {
+      rb_raise(rb_eTypeError, "timeout_milliseconds must be an Integer or nil");
+    }
+    timeout_milliseconds = NUM2LL(rb_timeout_milliseconds);
+    if (timeout_milliseconds < 0) {
+      rb_raise(rb_eRangeError, "timeout_milliseconds must be non-negative");
+    }
+  }
 
   /* Phase 2: configure before creating the separately-owned runtime. */
   ddog_TraceExporterConfig *config = NULL;
@@ -1457,6 +1475,22 @@ static VALUE _native_exporter_new(
   set_config_field(config, ddog_trace_exporter_config_set_service,           rb_service,               "service");
   set_config_field(config, ddog_trace_exporter_config_set_version,           rb_version,               "version");
 
+  if (rb_timeout_milliseconds != Qnil) {
+    ddog_TraceExporterError *timeout_err = ddog_trace_exporter_config_set_connection_timeout(
+        config, (uint64_t)timeout_milliseconds);
+    if (timeout_err != NULL) {
+      ddog_trace_exporter_config_free(config);
+      check_exporter_error("Failed to configure native transport timeout", timeout_err);
+    }
+  }
+
+  ddog_TraceExporterError *stats_err = ddog_trace_exporter_config_set_client_computed_stats(
+      config, rb_client_computed_stats == Qtrue);
+  if (stats_err != NULL) {
+    ddog_trace_exporter_config_free(config);
+    check_exporter_error("Failed to configure client-computed stats", stats_err);
+  }
+
   /*
    * Create a SharedRuntime and attach it to the config before building the
    * exporter.  The exporter holds a clone of the runtime's Arc; we keep our
@@ -1511,12 +1545,47 @@ static VALUE _native_exporter_new(
  * (Puma, Unicorn, Passenger).
  * ======================================================================== */
 
+static void *close_exporter_without_gvl(void *ptr) {
+  trace_exporter_t *resources = ptr;
+  if (resources->exporter != NULL) {
+    ddog_trace_exporter_free(resources->exporter);
+    resources->exporter = NULL;
+  }
+  if (resources->runtime != NULL) {
+    ddog_shared_runtime_free(resources->runtime);
+    resources->runtime = NULL;
+  }
+  return NULL;
+}
+
+static VALUE close_exporter_body(VALUE ptr) {
+  rb_thread_call_without_gvl(close_exporter_without_gvl, (void *)ptr, NULL, NULL);
+  return Qnil;
+}
+
+static VALUE close_exporter_ensure(VALUE ptr) {
+  /* An interrupt may arrive before the no-GVL call starts. */
+  close_exporter_without_gvl((void *)ptr);
+  return Qnil;
+}
+
+static VALUE _native_close(VALUE self) {
+  trace_exporter_t *wrapper;
+  TypedData_Get_Struct(self, trace_exporter_t, &trace_exporter_typed_data, wrapper);
+  if (wrapper == NULL) return Qnil;
+
+  trace_exporter_t resources = *wrapper;
+  wrapper->exporter = NULL;
+  wrapper->runtime = NULL;
+  rb_ensure(close_exporter_body, (VALUE)&resources, close_exporter_ensure, (VALUE)&resources);
+  RB_GC_GUARD(self);
+  return Qnil;
+}
+
 static VALUE _native_before_fork(VALUE self) {
   trace_exporter_t *wrapper;
   TypedData_Get_Struct(self, trace_exporter_t, &trace_exporter_typed_data, wrapper);
-  if (wrapper == NULL || wrapper->runtime == NULL) {
-    raise_error(rb_eRuntimeError, "TraceExporter has not been initialized or was already freed");
-  }
+  if (wrapper == NULL || wrapper->runtime == NULL) return Qnil;
   ddog_SharedRuntimeFFIError *err = ddog_shared_runtime_before_fork(wrapper->runtime);
   check_shared_runtime_error("Failed to prepare for fork", err);
   return Qnil;
@@ -1525,9 +1594,7 @@ static VALUE _native_before_fork(VALUE self) {
 static VALUE _native_after_fork_in_parent(VALUE self) {
   trace_exporter_t *wrapper;
   TypedData_Get_Struct(self, trace_exporter_t, &trace_exporter_typed_data, wrapper);
-  if (wrapper == NULL || wrapper->runtime == NULL) {
-    raise_error(rb_eRuntimeError, "TraceExporter has not been initialized or was already freed");
-  }
+  if (wrapper == NULL || wrapper->runtime == NULL) return Qnil;
   ddog_SharedRuntimeFFIError *err = ddog_shared_runtime_after_fork_parent(wrapper->runtime);
   check_shared_runtime_error("Failed to restore after fork in parent", err);
   return Qnil;
@@ -1536,9 +1603,7 @@ static VALUE _native_after_fork_in_parent(VALUE self) {
 static VALUE _native_after_fork_in_child(VALUE self) {
   trace_exporter_t *wrapper;
   TypedData_Get_Struct(self, trace_exporter_t, &trace_exporter_typed_data, wrapper);
-  if (wrapper == NULL || wrapper->runtime == NULL) {
-    raise_error(rb_eRuntimeError, "TraceExporter has not been initialized or was already freed");
-  }
+  if (wrapper == NULL || wrapper->runtime == NULL) return Qnil;
   ddog_SharedRuntimeFFIError *err = ddog_shared_runtime_after_fork_child(wrapper->runtime);
   check_shared_runtime_error("Failed to restore after fork in child", err);
   return Qnil;
@@ -1848,6 +1913,7 @@ void trace_exporter_init(VALUE tracing_module) {
   /* Instance: _native_send_traces(traces, native_events_supported) -> Array[Response] */
   rb_define_method(trace_exporter_class, "_native_send_traces",
                    _native_send_traces, 2);
+  rb_define_method(trace_exporter_class, "_native_close", _native_close, 0);
 
   /* Instance: fork safety hooks */
   rb_define_method(trace_exporter_class, "_native_before_fork",

data/ext/libdatadog_extconf_helpers.rb

@@ -2,6 +2,7 @@
 
 require "rubygems"
 require "pathname"
+require "shellwords"
 
 module Datadog
   # Contains a bunch of shared helpers that get used during building of extensions that link to libdatadog
@@ -10,7 +11,7 @@ module Datadog
   module LibdatadogExtconfHelpers
     # Used to make sure the correct gem version gets loaded, as extconf.rb does not get run with "bundle exec" and thus
     # may see multiple libdatadog versions. See https://github.com/DataDog/dd-trace-rb/pull/2531 for the horror story.
-    LIBDATADOG_VERSION = "~> 40.0.0.2.0"
+    LIBDATADOG_VERSION = "~> 45.0.0.1.0"
 
     # Used as an workaround for a limitation with how dynamic linking works in environments where the datadog gem and
     # libdatadog are moved after the extension gets compiled.
@@ -116,7 +117,10 @@ module Datadog
       extconf_folder:,
       libdatadog_pkgconfig_folder: Libdatadog.pkgconfig_folder,
       gem_dir: Gem.dir,
-      logger: Logging
+      logger: Logging,
+      target_incflags: $INCFLAGS,
+      target_ldflags: $LDFLAGS,
+      target_libs: $libs
     )
       return unless libdatadog_pkgconfig_folder
 
@@ -124,10 +128,9 @@ module Datadog
       libdir = "#{libdatadog_pkgconfig_folder}/../../lib"
       includedir = "#{libdatadog_pkgconfig_folder}/../../include"
 
-      # Set mkmf global variables
-      $INCFLAGS << " -I#{includedir}"
-      $LDFLAGS << " -L#{libdir} -Wl,-rpath,#{libdir}"
-      $libs << " -ldatadog_profiling"
+      target_incflags << " -I#{Shellwords.escape(includedir)}"
+      target_ldflags << " -L#{Shellwords.escape(libdir)} -Wl,-rpath,#{Shellwords.escape(libdir)}"
+      target_libs << " -ldatadog_profiling"
 
       # Add extra relative rpaths using $ORIGIN to handle environments where gems are moved after installation.
       # The excessive escaping is needed to get these special characters through Make and the shell untouched.
@@ -141,10 +144,12 @@ module Datadog
           libdatadog_pkgconfig_folder: libdatadog_pkgconfig_folder,
         ),
       ]
-      extra_relative_rpaths.each { |folder| $LDFLAGS << " -Wl,-rpath,$$$\\\\{ORIGIN\\}/#{folder}" }
+      extra_relative_rpaths.each { |folder| target_ldflags << " -Wl,-rpath,$$$\\\\{ORIGIN\\}/#{Shellwords.escape(folder)}" }
 
-      logger.message("linking with libdatadog (include=#{includedir}, lib=#{libdir})\n")
-      logger.message("[datadog] $LDFLAGS were set to: #{$LDFLAGS.inspect}\n")
+      # includedir/libdir/ldflags might have a `%` in there and `logger.message` bottoms out on `printf` so we need to
+      # use the `message("%s", ...)` format otherwise the logger will complain
+      logger.message("%s", "linking with libdatadog (include=#{includedir}, lib=#{libdir})\n")
+      logger.message("%s", "[datadog] $LDFLAGS were set to: #{target_ldflags.inspect}\n")
 
       true
     end

data/lib/datadog/ai_guard/component.rb

@@ -1,37 +1,46 @@
 # frozen_string_literal: true
 
-require_relative "api_client"
+require "json"
+
+require_relative "ext"
+require_relative "http_client"
 require_relative "evaluation"
 require_relative "evaluation/request"
+require_relative "evaluation/response"
+require_relative "evaluation/client"
 require_relative "evaluation/result"
+require_relative "evaluation/outcome"
 require_relative "evaluation/no_op_result"
 require_relative "evaluation/message"
 require_relative "evaluation/tool_call"
 require_relative "evaluation/content_part"
-require_relative "evaluation/content_builder"
-require_relative "ext"
+require_relative "evaluation/message_builder"
+require_relative "redaction"
+require_relative "redaction/result"
+require_relative "redaction/replacements"
+require_relative "metrics/telemetry"
 
 module Datadog
   module AIGuard
     # Component for API Guard product
     class Component
-      attr_reader :api_client, :logger, :telemetry
+      attr_reader :http_client, :logger, :telemetry
 
       def self.build(settings, logger:, telemetry:)
         return unless settings.respond_to?(:ai_guard) && settings.ai_guard.enabled
 
-        api_client = APIClient.new(
+        http_client = HTTPClient.new(
           endpoint: settings.ai_guard.endpoint,
           api_key: settings.api_key,
           application_key: settings.ai_guard.app_key,
           timeout: settings.ai_guard.timeout_ms / 1_000
         )
 
-        new(api_client, logger: logger, telemetry: telemetry)
+        new(http_client, logger: logger, telemetry: telemetry)
       end
 
-      def initialize(api_client, logger:, telemetry:)
-        @api_client = api_client
+      def initialize(http_client, logger:, telemetry:)
+        @http_client = http_client
         @logger = logger
         @telemetry = telemetry
       end

data/lib/datadog/ai_guard/configuration/ext.rb

@@ -6,6 +6,8 @@ module Datadog
       # This module contains constants for AI Guard component
       module Ext
         ENV_AI_GUARD_ENABLED = "DD_AI_GUARD_ENABLED"
+        ENV_AI_GUARD_REDACTION_ENABLED = "DD_AI_GUARD_REDACTION_ENABLED"
+
         ENV_AI_GUARD_ENDPOINT = "DD_AI_GUARD_ENDPOINT"
         ENV_AI_GUARD_TIMEOUT = "DD_AI_GUARD_TIMEOUT"
         ENV_AI_GUARD_MAX_CONTENT_SIZE = "DD_AI_GUARD_MAX_CONTENT_SIZE"

data/lib/datadog/ai_guard/configuration.rb

@@ -34,6 +34,19 @@ module Datadog
                 o.default false
               end
 
+              # Redact sensitive data from evaluated messages.
+              #
+              # When enabled, values flagged by AI Guard are replaced before the messages are
+              # stored in the span or returned to the caller. Disable to skip redaction entirely.
+              #
+              # @default `DD_AI_GUARD_REDACTION_ENABLED`, otherwise `true`
+              # @return [Boolean]
+              option :redaction_enabled do |o|
+                o.type :bool
+                o.env Ext::ENV_AI_GUARD_REDACTION_ENABLED
+                o.default true
+              end
+
               define_method(:instrument) do |integration_name|
                 return unless enabled # steep:ignore