datadog 2.24.0 → 2.25.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a1e3df0d4845537939ee39a49f98f9645cf0b5f3cd8f62cd9b7c8dd7f7cf112f
-  data.tar.gz: e84c39b5b0d3b464aa5d9c1d050a215374520575832bee48671549bbf9696973
+  metadata.gz: b31bd418a350c8999b821462c0699a19af1b02242a7a22f4fee10859cd520d4c
+  data.tar.gz: 4a77d7cb714bfb82312d642b583d23f7b9407435c6577b864f1ca98751826ec6
 SHA512:
-  metadata.gz: f00d5556de98278dc5f80d1146374b378e6d21e32c041239e0e6a6237f4169d79061f1e94df1f8221255a2a807ed6a3ff6f80668ff3421030737c6ec7bf35f76
-  data.tar.gz: 94a76fd5432c238ee71c261419cb99e943143e802092ba0ec4aa9391e988f5ed6e9c307295211f0c16951d47e060633b62b40f982c83834aa179b6e66b03af91
+  metadata.gz: f51a7d85ab5e057e5a485f7dffe7d329b4aacde56d784239a15dbb8a48508d082ba69dbecb992336d132965b642ccdf39cd4f4e2378d749174cab64496b1fe2f
+  data.tar.gz: 83504124b5fad578d31002d5ab4d19450c14c8a857b7b553925bbff2cb2fdb53ee2dbeb2e7c774128c92203e69b3c484896591435ec4df01740e2028b70ff7fe

data/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## [Unreleased]
 
+## [2.25.0] - 2026-01-13
+
+### Added
+
+AI Guard: Add SDK for evaluating the safety of user messages and assistant commands for LLM session ([#5144][])
+
+### Changed
+
+Core: Bump minimum version of `datadog-ruby_core_source` dependency ([#5215][])
+
+### Fixed
+
+AppSec: Fix processing of numeric data for WAF and RASP checks ([#5222][])
+
 ## [2.24.0] - 2026-01-08
 
 ### Added
@@ -9,6 +23,11 @@
 * Core: Add support for installing the gem on Ruby 4.0.x stable ([#5157][])
 * Tracing: Add origin detection using extra headers and the `DD_EXTERNAL_ENV` variable. ([#5028][])
 * Dynamic Instrumentation: Add one-click enablement support ([#5150][])
+* SSI: Add support for Bundler deployment mode ([#5053][])
+* SSI: Report UI-oriented injection results ([#5053][])
+* SSI: Guard against Bundler global force_ruby_platform ([#5053][])
+* SSI: Guard against Bundler 4.0 and Bundler 2.7 in 4.0 mode ([#5053][])
+* SSI: Guard against Ruby 3.5+ ([#5053][])
 
 ### Changed
 
@@ -3418,7 +3437,8 @@ Release notes: https://github.com/DataDog/dd-trace-rb/releases/tag/v0.3.1
 Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 
 
-[Unreleased]: https://github.com/DataDog/dd-trace-rb/compare/v2.24.0...master
+[Unreleased]: https://github.com/DataDog/dd-trace-rb/compare/v2.25.0...master
+[2.25.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.24.0...v2.25.0
 [2.24.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.23.0...v2.24.0
 [2.23.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.22.0...v2.23.0
 [2.22.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.21.0...v2.22.0
@@ -5059,12 +5079,14 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#5044]: https://github.com/DataDog/dd-trace-rb/issues/5044
 [#5045]: https://github.com/DataDog/dd-trace-rb/issues/5045
 [#5049]: https://github.com/DataDog/dd-trace-rb/issues/5049
+[#5053]: https://github.com/DataDog/dd-trace-rb/issues/5053
 [#5054]: https://github.com/DataDog/dd-trace-rb/issues/5054
 [#5058]: https://github.com/DataDog/dd-trace-rb/issues/5058
 [#5073]: https://github.com/DataDog/dd-trace-rb/issues/5073
 [#5086]: https://github.com/DataDog/dd-trace-rb/issues/5086
 [#5091]: https://github.com/DataDog/dd-trace-rb/issues/5091
 [#5122]: https://github.com/DataDog/dd-trace-rb/issues/5122
+[#5144]: https://github.com/DataDog/dd-trace-rb/issues/5144
 [#5145]: https://github.com/DataDog/dd-trace-rb/issues/5145
 [#5146]: https://github.com/DataDog/dd-trace-rb/issues/5146
 [#5148]: https://github.com/DataDog/dd-trace-rb/issues/5148
@@ -5078,6 +5100,8 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#5176]: https://github.com/DataDog/dd-trace-rb/issues/5176
 [#5194]: https://github.com/DataDog/dd-trace-rb/issues/5194
 [#5197]: https://github.com/DataDog/dd-trace-rb/issues/5197
+[#5215]: https://github.com/DataDog/dd-trace-rb/issues/5215
+[#5222]: https://github.com/DataDog/dd-trace-rb/issues/5222
 [@AdrianLC]: https://github.com/AdrianLC
 [@Azure7111]: https://github.com/Azure7111
 [@BabyGroot]: https://github.com/BabyGroot
@@ -5232,4 +5256,4 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [@y-yagi]: https://github.com/y-yagi
 [@yujideveloper]: https://github.com/yujideveloper
 [@yukimurasawa]: https://github.com/yukimurasawa
-[@zachmccormick]: https://github.com/zachmccormick
+[@zachmccormick]: https://github.com/zachmccormick

data/lib/datadog/ai_guard/api_client.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+require "uri"
+require "net/http"
+require "json"
+
+module Datadog
+  module AIGuard
+    # API Client for AI Guard API.
+    # Uses net/http to perform request. Raises on client and server errors.
+    class APIClient
+      DEFAULT_SITE = "app.datadoghq.com"
+      DEFAULT_PATH = "/api/v2/ai-guard"
+
+      def initialize(endpoint:, api_key:, application_key:, timeout:)
+        @timeout = timeout
+
+        @endpoint_uri = if endpoint
+          URI(endpoint) #: URI::HTTP
+        else
+          URI::HTTPS.build(
+            host: Datadog.configuration.site || DEFAULT_SITE,
+            path: DEFAULT_PATH
+          )
+        end
+
+        @headers = {
+          "DD-API-KEY": api_key.to_s,
+          "DD-APPLICATION-KEY": application_key.to_s,
+          "DD-AI-GUARD-VERSION": Datadog::VERSION::STRING,
+          "DD-AI-GUARD-SOURCE": "SDK",
+          "DD-AI-GUARD-LANGUAGE": "ruby",
+          "content-type": "application/json"
+        }.freeze
+      end
+
+      def post(path, body:)
+        Net::HTTP.start(@endpoint_uri.host.to_s, @endpoint_uri.port, use_ssl: use_ssl?, read_timeout: @timeout) do |http|
+          request = Net::HTTP::Post.new(@endpoint_uri.request_uri + path, @headers)
+          request.body = body.to_json
+
+          response = http.request(request)
+          raise_on_http_error!(response)
+
+          parse_response_body(response.body)
+        end
+      rescue Net::ReadTimeout
+        raise AIGuardClientError, "Request to AI Guard timed out"
+      end
+
+      private
+
+      def raise_on_http_error!(response)
+        case response
+        when Net::HTTPSuccess
+          # do nothing
+        when Net::HTTPRedirection
+          raise AIGuardClientError, "Redirects for AI Guard API are not supported"
+        else
+          error_message = begin
+            parsed_body = JSON.parse(response.body)
+            Array(parsed_body.fetch('errors')).join(', ')
+          rescue JSON::ParserError, KeyError
+            response.body
+          end
+
+          raise AIGuardClientError, error_message
+        end
+      end
+
+      def parse_response_body(body)
+        JSON.parse(body)
+      rescue JSON::ParserError
+        raise AIGuardClientError, "Could not parse response body"
+      end
+
+      def use_ssl?
+        @endpoint_uri.scheme == 'https'
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/component.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+require_relative 'api_client'
+require_relative 'evaluation'
+require_relative 'evaluation/request'
+require_relative 'evaluation/result'
+require_relative 'evaluation/no_op_result'
+require_relative 'evaluation/message'
+require_relative 'evaluation/tool_call'
+require_relative 'ext'
+
+module Datadog
+  module AIGuard
+    # Component for API Guard product
+    class Component
+      attr_reader :api_client, :logger
+
+      def self.build(settings, logger:, telemetry:)
+        return unless settings.respond_to?(:ai_guard) && settings.ai_guard.enabled
+
+        api_client = APIClient.new(
+          endpoint: settings.ai_guard.endpoint,
+          api_key: settings.api_key,
+          application_key: settings.ai_guard.app_key,
+          timeout: settings.ai_guard.timeout_ms / 1_000
+        )
+
+        new(api_client, logger: logger, telemetry: telemetry)
+      end
+
+      def initialize(api_client, logger:, telemetry:)
+        @api_client = api_client
+        @logger = logger
+        @telemetry = telemetry
+      end
+
+      def shutdown!
+        # no-op
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/configuration/ext.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AIGuard
+    module Configuration
+      # This module contains constants for AI Guard component
+      module Ext
+        ENV_AI_GUARD_ENABLED = "DD_AI_GUARD_ENABLED"
+        ENV_AI_GUARD_ENDPOINT = "DD_AI_GUARD_ENDPOINT"
+        ENV_AI_GUARD_TIMEOUT = "DD_AI_GUARD_TIMEOUT"
+        ENV_AI_GUARD_MAX_CONTENT_SIZE = "DD_AI_GUARD_MAX_CONTENT_SIZE"
+        ENV_AI_GUARD_MAX_MESSAGES_LENGTH = "DD_AI_GUARD_MAX_MESSAGES_LENGTH"
+        ENV_APP_KEY = "DD_APP_KEY"
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/configuration/settings.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+require 'uri'
+require_relative "ext"
+
+module Datadog
+  module AIGuard
+    module Configuration
+      # AI Guard specific settings
+      module Settings
+        def self.extended(base)
+          base = base.singleton_class unless base.is_a?(Class)
+          add_settings!(base)
+        end
+
+        def self.add_settings!(base)
+          base.class_eval do
+            # AI Guard specific configurations.
+            # @public_api
+            settings :ai_guard do
+              # Enable AI Guard.
+              #
+              # You can use this option to skip calls to AI Guard API without having to remove library as a whole.
+              #
+              # @default `DD_AI_GUARD_ENABLED`, otherwise `false`
+              # @return [Boolean]
+              option :enabled do |o|
+                o.type :bool
+                o.env Ext::ENV_AI_GUARD_ENABLED
+                o.default false
+              end
+
+              # AI Guard API endpoint path.
+              #
+              # @default `DD_AI_GUARD_ENDPOINT`, otherwise `nil`
+              # @return [String, nil]
+              option :endpoint do |o|
+                o.type :string, nilable: true
+                o.env Ext::ENV_AI_GUARD_ENDPOINT
+
+                o.setter do |value|
+                  next unless value
+
+                  uri = URI(value.to_s)
+                  raise ArgumentError, "Please provide an absolute URI that includes a protocol" unless uri.absolute?
+
+                  uri.to_s.delete_suffix("/")
+                end
+              end
+
+              # Datadog Application key.
+              #
+              # @default `DD_APP_KEY` environment variable, otherwise `nil`
+              # @return [String, nil]
+              option :app_key do |o|
+                o.type :string, nilable: true
+                o.env Ext::ENV_APP_KEY
+              end
+
+              # Request timeout in milliseconds.
+              #
+              # @default `DD_AI_GUARD_TIMEOUT`, otherwise 10 000 ms
+              # @return [Integer]
+              option :timeout_ms do |o|
+                o.type :int
+                o.env Ext::ENV_AI_GUARD_TIMEOUT
+                o.default 10_000
+              end
+
+              # Maximum content size in bytes.
+              # Content that exceeds the maximum allowed size is truncated before
+              # being stored in the current span context.
+              #
+              # @default `DD_AI_GUARD_MAX_CONTENT_SIZE`, otherwise 524 228 bytes
+              # @return [Integer]
+              option :max_content_size_bytes do |o|
+                o.type :int
+                o.env Ext::ENV_AI_GUARD_MAX_CONTENT_SIZE
+                o.default 512 * 1024
+              end
+
+              # Maximum number of messages.
+              # Older messages are omitted once the message limit is reached.
+              #
+              # @default `DD_AI_GUARD_MAX_MESSAGES_LENGTH`, otherwise 16 messages
+              # @return [Integer]
+              option :max_messages_length do |o|
+                o.type :int
+                o.env Ext::ENV_AI_GUARD_MAX_MESSAGES_LENGTH
+                o.default 16
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/configuration.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AIGuard
+    # Configuration module for AI Guard
+    module Configuration
+    end
+  end
+end
+
+require_relative "configuration/settings"

data/lib/datadog/ai_guard/evaluation/message.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AIGuard
+    module Evaluation
+      # Message class for AI Guard
+      class Message
+        attr_reader :role, :content, :tool_call, :tool_call_id
+
+        def initialize(role:, content: nil, tool_call: nil, tool_call_id: nil)
+          raise ArgumentError, "Role must be set to a non-empty value" if role.to_s.empty?
+
+          @role = role.to_sym
+          @content = content
+          @tool_call = tool_call
+          @tool_call_id = tool_call_id
+
+          if @tool_call && !@tool_call.is_a?(ToolCall)
+            raise ArgumentError, "Expected an instance of #{ToolCall.name} for :tool_call argument"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/evaluation/no_op_result.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AIGuard
+    module Evaluation
+      # Class for emulating AI Guard evaluation result when AI Guard is disabled.
+      class NoOpResult
+        attr_reader :action, :reason, :tags
+
+        def initialize
+          @action = Result::ALLOW_ACTION
+          @reason = "AI Guard is disabled"
+          @tags = []
+        end
+
+        def allow?
+          true
+        end
+
+        def deny?
+          false
+        end
+
+        def abort?
+          false
+        end
+
+        def blocking_enabled?
+          false
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/evaluation/request.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AIGuard
+    module Evaluation
+      # Request builds the request body from an array of messages and processes the response
+      class Request
+        REQUEST_PATH = "/evaluate"
+
+        attr_reader :serialized_messages
+
+        def initialize(messages)
+          @serialized_messages = serialize_messages(messages)
+        end
+
+        def perform
+          api_client = AIGuard.api_client
+
+          # This should never happen, as we are only calling this method when AI Guard is enabled,
+          # and this means the API Client was not initialized properly.
+          #
+          # Please report this at https://github.com/datadog/dd-trace-rb/blob/master/CONTRIBUTING.md#found-a-bug
+          raise "AI Guard API Client not initialized" unless api_client
+
+          raw_response = api_client.post(REQUEST_PATH, body: build_request_body)
+
+          Result.new(raw_response)
+        end
+
+        private
+
+        def build_request_body
+          {
+            data: {
+              attributes: {
+                messages: @serialized_messages,
+                meta: {
+                  service: Datadog.configuration.service,
+                  env: Datadog.configuration.env
+                }
+              }
+            }
+          }
+        end
+
+        def serialize_messages(messages)
+          serialized_messages = []
+
+          messages.each do |message|
+            serialized_messages << serialize_message(message)
+
+            break if serialized_messages.count == Datadog.configuration.ai_guard.max_messages_length
+          end
+
+          serialized_messages
+        end
+
+        def serialize_message(message)
+          if message.tool_call
+            {
+              role: message.role,
+              tool_calls: [
+                {
+                  id: message.tool_call.id,
+                  function: {
+                    name: message.tool_call.tool_name,
+                    arguments: message.tool_call.arguments
+                  }
+                }
+              ]
+            }
+          elsif message.tool_call_id
+            {role: message.role, tool_call_id: message.tool_call_id, content: message.content}
+          else
+            {role: message.role, content: message.content}
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/evaluation/result.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AIGuard
+    module Evaluation
+      # Wrapper class for evaluation API response
+      class Result
+        ALLOW_ACTION = "ALLOW"
+        DENY_ACTION = "DENY"
+        ABORT_ACTION = "ABORT"
+
+        attr_reader :action, :reason, :tags
+
+        def initialize(raw_response)
+          attributes = raw_response.fetch("data").fetch("attributes")
+
+          @action = attributes.fetch("action")
+          @reason = attributes.fetch("reason")
+          @tags = attributes.fetch("tags")
+          @is_blocking_enabled = attributes.fetch("is_blocking_enabled")
+        rescue KeyError => e
+          raise AIGuardClientError, "Missing key: \"#{e.key}\""
+        end
+
+        def allow?
+          action == ALLOW_ACTION
+        end
+
+        def deny?
+          action == DENY_ACTION
+        end
+
+        def abort?
+          action == ABORT_ACTION
+        end
+
+        def blocking_enabled?
+          !!@is_blocking_enabled
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/evaluation/tool_call.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AIGuard
+    module Evaluation
+      # Tool call class for AI Guard
+      class ToolCall
+        attr_reader :tool_name, :id, :arguments
+
+        def initialize(tool_name, id:, arguments:)
+          @tool_name = tool_name
+          @id = id
+          @arguments = arguments
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/evaluation.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AIGuard
+    # module that contains a function for performing AI Guard Evaluation request
+    # and creating `ai_guard` span with required tags
+    module Evaluation
+      class << self
+        def perform(messages, allow_raise: false)
+          raise ArgumentError, "Messages must not be empty" if messages&.empty?
+
+          Tracing.trace(Ext::SPAN_NAME) do |span, trace|
+            if (last_message = messages.last)
+              if last_message.tool_call
+                span.set_tag(Ext::TARGET_TAG, "tool")
+                span.set_tag(Ext::TOOL_NAME_TAG, last_message.tool_call.tool_name)
+              elsif last_message.tool_call_id
+                span.set_tag(Ext::TARGET_TAG, "tool")
+
+                if (tool_call_message = messages.find { |m| m.tool_call&.id == last_message.tool_call_id })
+                  span.set_tag(Ext::TOOL_NAME_TAG, tool_call_message.tool_call.tool_name) # steep:ignore
+                end
+              else
+                span.set_tag(Ext::TARGET_TAG, "prompt")
+              end
+            end
+
+            request = Request.new(messages)
+            result = request.perform
+
+            span.set_tag(Ext::ACTION_TAG, result.action)
+            span.set_tag(Ext::REASON_TAG, result.reason)
+
+            span.set_metastruct_tag(
+              Ext::METASTRUCT_TAG,
+              {
+                messages: truncate_content(request.serialized_messages),
+                attack_categories: result.tags
+              }
+            )
+
+            if allow_raise && (result.deny? || result.abort?) && result.blocking_enabled?
+              span.set_tag(Ext::BLOCKED_TAG, true)
+              raise AIGuardAbortError.new(action: result.action, reason: result.reason, tags: result.tags)
+            end
+
+            result
+          end
+        end
+
+        def perform_no_op
+          AIGuard.logger&.warn("AI Guard is disabled, messages were not evaluated")
+
+          NoOpResult.new
+        end
+
+        private
+
+        def truncate_content(serialized_messages)
+          serialized_messages.map do |message| # steep:ignore
+            next message unless message[:content]
+
+            {
+              **message,
+              content: message[:content].byteslice(0, Datadog.configuration.ai_guard.max_content_size_bytes)
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/ai_guard/ext.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AIGuard
+    # AI Guard specific constants
+    module Ext
+      SPAN_NAME = "ai_guard"
+      TARGET_TAG = "ai_guard.target"
+      TOOL_NAME_TAG = "ai_guard.tool_name"
+      ACTION_TAG = "ai_guard.action"
+      REASON_TAG = "ai_guard.reason"
+      BLOCKED_TAG = "ai_guard.blocked"
+      METASTRUCT_TAG = "ai_guard"
+    end
+  end
+end