dd-trace 5.103.0 → 5.105.0

package/packages/datadog-instrumentations/src/grpc/client.js

@@ -14,11 +14,14 @@ const finishChannel = channel('apm:grpc:client:request:finish')
 const emitChannel = channel('apm:grpc:client:request:emit')
 
 function createWrapMakeRequest (type, hasPeer = false) {
+  const metadataIndex = type === types.client_stream || type === types.bidi ? 3 : 4
+
   return function wrapMakeRequest (makeRequest) {
     return function (path) {
-      const args = ensureMetadata(this, arguments, 4)
+      if (!startChannel.hasSubscribers) return makeRequest.apply(this, arguments)
 
-      return callMethod(this, makeRequest, args, path, args[4], type, hasPeer)
+      const { metadata, args } = resolveMetadata(this, arguments, metadataIndex)
+      return callMethod(this, makeRequest, args, path, metadata, type, hasPeer)
     }
   }
 }
@@ -82,9 +85,13 @@ function wrapMethod (method, path, type, hasPeer) {
     return method
   }
 
+  const metadataIndex = type === types.client_stream || type === types.bidi ? 0 : 1
+
   const wrapped = shimmer.wrapFunction(method, method => function () {
-    const args = ensureMetadata(this, arguments, 1)
-    return callMethod(this, method, args, path, args[1], type, hasPeer)
+    if (!startChannel.hasSubscribers) return method.apply(this, arguments)
+
+    const { metadata, args } = resolveMetadata(this, arguments, metadataIndex)
+    return callMethod(this, method, args, path, metadata, type, hasPeer)
   })
 
   patched.add(wrapped)
@@ -140,24 +147,25 @@ function createWrapEmit (ctx, hasPeer = false) {
 }
 
 function callMethod (client, method, args, path, metadata, type, hasPeer = false) {
-  if (!startChannel.hasSubscribers) return method.apply(client, args)
-
-  const length = args.length
-  const callback = args[length - 1]
-
   const ctx = { metadata, path, type }
 
   return startChannel.runStores(ctx, () => {
     try {
+      let callArgs = args
+
       if (type === types.unary || type === types.client_stream) {
+        if (!Array.isArray(callArgs)) callArgs = [...callArgs]
+
+        const length = callArgs.length
+        const callback = callArgs[length - 1]
         if (typeof callback === 'function') {
-          args[length - 1] = wrapCallback(ctx, callback)
+          callArgs[length - 1] = wrapCallback(ctx, callback)
         } else {
-          args[length] = wrapCallback(ctx)
+          callArgs[length] = wrapCallback(ctx)
         }
       }
 
-      const call = method.apply(client, args)
+      const call = method.apply(client, callArgs)
 
       if (call && typeof call.emit === 'function') {
         shimmer.wrap(call, 'emit', createWrapEmit(ctx, hasPeer))
@@ -167,36 +175,44 @@ function callMethod (client, method, args, path, metadata, type, hasPeer = false
     } catch (e) {
       ctx.error = e
       errorChannel.publish(ctx)
+      throw e
     }
     // No end channel needed
   })
 }
 
-function ensureMetadata (client, args, index) {
-  const grpc = getGrpc(client)
-
-  if (!client || !grpc) return args
-
-  const meta = args[index]
-  const normalized = []
-
-  for (let i = 0; i < index; i++) {
-    normalized.push(args[i])
+/**
+ * Returns the `Metadata` for a gRPC client invocation, splicing or replacing
+ * one at `index` when the user did not pass their own.
+ *
+ * @param {object} client
+ * @param {ArrayLike<unknown>} args
+ * @param {number} index
+ * @returns {{ metadata: object | undefined, args: ArrayLike<unknown> }}
+ */
+function resolveMetadata (client, args, index) {
+  const grpc = client && getGrpc(client)
+  if (!grpc) return { metadata: undefined, args }
+
+  const slot = args[index]
+
+  if (slot instanceof grpc.Metadata || slot?.constructor?.name === 'Metadata') {
+    return { metadata: slot, args }
   }
 
-  if (!meta || !meta.constructor || meta.constructor.name !== 'Metadata') {
-    normalized.push(new grpc.Metadata())
-  }
-
-  if (meta) {
-    normalized.push(meta)
-  }
+  const metadata = new grpc.Metadata()
 
-  for (let i = index + 1; i < args.length; i++) {
-    normalized.push(args[i])
+  if (slot == null) {
+    const out = [...args]
+    out[index] = metadata
+    return { metadata, args: out }
   }
 
-  return normalized
+  const out = new Array(args.length + 1)
+  for (let i = 0; i < index; i++) out[i] = args[i]
+  out[index] = metadata
+  for (let i = index; i < args.length; i++) out[i + 1] = args[i]
+  return { metadata, args: out }
 }
 
 function getType (definition) {

package/packages/datadog-instrumentations/src/helpers/ai-messages.js

@@ -1,5 +1,53 @@
 'use strict'
 
+/**
+ * Returns the value as a string, JSON-stringifying it when it is not already a string.
+ * Returns the value unchanged when it is `null` or `undefined`.
+ *
+ * @param {unknown} value
+ * @returns {string|undefined|null}
+ */
+function stringifyIfNeeded (value) {
+  if (value == null) return value
+  return typeof value === 'string' ? value : JSON.stringify(value)
+}
+
+const FILE_FALLBACK = '[file]'
+const IMAGE_FALLBACK = '[image]'
+
+const OPENAI_RESPONSE_TOOL_CALL_TYPES = new Set([
+  'apply_patch_call',
+  'code_interpreter_call',
+  'computer_call',
+  'custom_tool_call',
+  'file_search_call',
+  'function_call',
+  'image_generation_call',
+  'local_shell_call',
+  'mcp_call',
+  'shell_call',
+  'web_search_call',
+])
+
+const OPENAI_RESPONSE_TOOL_OUTPUT_TYPES = new Set([
+  'apply_patch_call_output',
+  'computer_call_output',
+  'custom_tool_call_output',
+  'function_call_output',
+  'local_shell_call_output',
+  'shell_call_output',
+])
+
+/**
+ * Returns a stringified value, falling back to an empty string for absent values.
+ *
+ * @param {unknown} value
+ * @returns {string}
+ */
+function stringifyOrEmpty (value) {
+  return stringifyIfNeeded(value) ?? ''
+}
+
 /**
  * Converts a LanguageModelV2FilePart with an image mediaType to an AI guard style image_url content part.
  *
@@ -79,12 +127,11 @@ function convertVercelPromptToMessages (prompt) {
           if (part.type === 'text') {
             textParts.push(part.text)
           } else if (part.type === 'tool-call') {
-            const args = part.args ?? part.input
             toolCalls.push({
               id: part.toolCallId,
               function: {
                 name: part.toolName,
-                arguments: typeof args === 'string' ? args : JSON.stringify(args),
+                arguments: stringifyIfNeeded(part.args ?? part.input),
               },
             })
           }
@@ -103,11 +150,10 @@ function convertVercelPromptToMessages (prompt) {
 
         for (const part of msg.content) {
           if (part.type === 'tool-result') {
-            const result = part.result ?? part.output
             messages.push({
               role: 'tool',
               tool_call_id: part.toolCallId,
-              content: typeof result === 'string' ? result : JSON.stringify(result),
+              content: stringifyIfNeeded(part.result ?? part.output),
             })
           }
         }
@@ -118,6 +164,58 @@ function convertVercelPromptToMessages (prompt) {
   return messages
 }
 
+/**
+ * Converts OpenAI chat-completions messages to the message format expected by AI Guard.
+ *
+ * Modern `tool_calls` messages already match the expected shape. Deprecated chat
+ * completions `function_call` and `function` role messages are normalized to the
+ * equivalent tool-call shape so AI Guard can classify them as tool interactions.
+ *
+ * @param {Array<object>} messages
+ * @returns {Array<object>|undefined}
+ */
+function normalizeOpenAIChatMessages (messages) {
+  if (!Array.isArray(messages) || messages.length === 0) return
+
+  const normalizedMessages = []
+  for (const message of messages) {
+    const normalized = normalizeOpenAIChatMessage(message)
+    if (normalized) normalizedMessages.push(normalized)
+  }
+  return normalizedMessages.length ? normalizedMessages : undefined
+}
+
+/**
+ * Converts one OpenAI chat-completions message to AI Guard's expected shape.
+ *
+ * @param {object} message
+ * @returns {object|undefined}
+ */
+function normalizeOpenAIChatMessage (message) {
+  if (!message || typeof message !== 'object') return
+
+  if (message.role === 'function') {
+    return {
+      role: 'tool',
+      tool_call_id: message.tool_call_id ?? message.name,
+      content: stringifyOrEmpty(message.content),
+    }
+  }
+
+  if (!message.function_call) return message
+
+  const { function_call: functionCall, ...normalized } = message
+  const name = functionCall.name
+  normalized.tool_calls ??= [{
+    id: message.tool_call_id ?? name,
+    function: {
+      name,
+      arguments: stringifyOrEmpty(functionCall.arguments),
+    },
+  }]
+  return normalized
+}
+
 /**
  * Converts LLM output tool calls to AI guard style message format.
  *
@@ -130,16 +228,13 @@ function buildToolCallOutputMessages (inputMessages, toolCalls) {
     ...inputMessages,
     {
       role: 'assistant',
-      tool_calls: toolCalls.map(tc => {
-        const args = tc.args ?? tc.input
-        return {
-          id: tc.toolCallId,
-          function: {
-            name: tc.toolName,
-            arguments: typeof args === 'string' ? args : JSON.stringify(args),
-          },
-        }
-      }),
+      tool_calls: toolCalls.map(tc => ({
+        id: tc.toolCallId,
+        function: {
+          name: tc.toolName,
+          arguments: stringifyIfNeeded(tc.args ?? tc.input),
+        },
+      })),
     },
   ]
 }
@@ -173,10 +268,223 @@ function buildOutputMessages (inputMessages, content) {
   return inputMessages
 }
 
+/**
+ * Converts OpenAI Responses API input/output items to OpenAI chat-style messages.
+ *
+ * @param {string|Array<object>|undefined} items
+ * @param {string} defaultRole
+ * @returns {Array<object>}
+ */
+function convertOpenAIResponseItemsToMessages (items, defaultRole) {
+  if (typeof items === 'string') return [{ role: defaultRole, content: items }]
+  if (!Array.isArray(items)) return []
+
+  const messages = []
+  for (const item of items) {
+    const converted = openAIResponseItemToMessage(item, defaultRole)
+    if (Array.isArray(converted)) {
+      for (const message of converted) messages.push(message)
+    } else if (converted) {
+      messages.push(converted)
+    }
+  }
+  return messages
+}
+
+/**
+ * Converts OpenAI reusable prompt variables to user messages for AI Guard.
+ *
+ * The reusable prompt template body is not available on the request, but its
+ * variables are user/application-provided content that OpenAI substitutes into
+ * the prompt. Screening them closes prompt-only `responses.create({ prompt })`
+ * calls and prompt variables used alongside `input`.
+ *
+ * @param {{variables?: Record<string, string|object>|null}|undefined|null} prompt
+ * @returns {Array<object>}
+ */
+function convertOpenAIResponsePromptToMessages (prompt) {
+  const variables = prompt?.variables
+  if (!variables || typeof variables !== 'object') return []
+
+  const messages = []
+  for (const value of Object.values(variables)) {
+    const content = openAIResponsePromptVariableToMessageContent(value)
+    if (content != null) messages.push({ role: 'user', content })
+  }
+  return messages
+}
+
+/**
+ * Converts one OpenAI reusable prompt variable value to message content.
+ *
+ * Routes every variable through `openAIResponseContentToMessageContent` so the
+ * result follows the same string-when-text-only / array-when-multimodal shape
+ * convention used elsewhere in this file. Media variables that produce no
+ * usable content (e.g. an `input_image` with no URL or `file_id`) fall back to
+ * a stable text marker so AI Guard still observes that a media variable was
+ * attached.
+ *
+ * @param {string|object} value
+ * @returns {string|Array<{type: string, text?: string, image_url?: {url: string}}>|undefined}
+ */
+function openAIResponsePromptVariableToMessageContent (value) {
+  let part
+  if (typeof value === 'string') {
+    part = { type: 'input_text', text: value }
+  } else if (value && typeof value === 'object') {
+    part = value
+  } else {
+    return
+  }
+
+  const content = openAIResponseContentToMessageContent([part])
+  if (content != null) return content
+  if (part.type === 'input_image') return IMAGE_FALLBACK
+}
+
+/**
+ * Converts one OpenAI Responses API item to an OpenAI chat-style message.
+ *
+ * @param {object} item
+ * @param {string} defaultRole
+ * @returns {object|Array<object>|undefined}
+ */
+function openAIResponseItemToMessage (item, defaultRole) {
+  if (!item || typeof item !== 'object') return
+  const type = item.type ?? 'message'
+
+  if (type === 'message') {
+    const content = openAIResponseContentToMessageContent(item.content)
+    if (content != null) return { role: item.role || defaultRole, content }
+  } else if (OPENAI_RESPONSE_TOOL_CALL_TYPES.has(type)) {
+    return openAIResponseToolCallToMessages(item)
+  } else if (OPENAI_RESPONSE_TOOL_OUTPUT_TYPES.has(type)) {
+    return openAIResponseToolOutputToMessage(item)
+  }
+}
+
+/**
+ * Converts a Responses API tool-call item to one or more chat-style messages.
+ *
+ * Most tool-call items represent only the assistant's tool request. MCP and
+ * image-generation items can also carry tool output on the same item, so include
+ * a linked tool message when output-like fields are present.
+ *
+ * @param {object} item
+ * @returns {object|Array<object>}
+ */
+function openAIResponseToolCallToMessages (item) {
+  const toolCallId = item.call_id ?? item.id ?? item.name ?? item.type
+  const message = {
+    role: 'assistant',
+    tool_calls: [{
+      id: toolCallId,
+      function: {
+        name: item.name ?? item.server_label ?? item.type,
+        arguments: stringifyOrEmpty(item.arguments ?? item.input ?? item.action),
+      },
+    }],
+  }
+
+  if (item.output == null && item.result == null && item.error == null) return message
+  return [message, openAIResponseToolOutputToMessage(item)]
+}
+
+/**
+ * Converts a Responses API tool-output item to a chat-style tool message.
+ *
+ * @param {object} item
+ * @returns {object}
+ */
+function openAIResponseToolOutputToMessage (item) {
+  return {
+    role: 'tool',
+    tool_call_id: item.call_id ?? item.id,
+    content: openAIResponseOutputValueToMessageContent(item.output ?? item.result ?? item.error),
+  }
+}
+
+/**
+ * Converts Responses API tool output to message content.
+ *
+ * @param {unknown} output
+ * @returns {string|Array<{type: string, text?: string, image_url?: {url: string}}>}
+ */
+function openAIResponseOutputValueToMessageContent (output) {
+  const content = openAIResponseContentToMessageContent(output)
+  return content ?? stringifyOrEmpty(output)
+}
+
+/**
+ * Converts OpenAI Responses API content to OpenAI chat-style message content.
+ *
+ * @param {string|Array<string|{type?: string, text?: string, refusal?: string,
+ *   image_url?: string|{url?: string}, file_id?: string, file_url?: string,
+ *   filename?: string}>|undefined} content
+ * @returns {string|Array<{type: string, text?: string, image_url?: {url: string}}>|undefined}
+ */
+function openAIResponseContentToMessageContent (content) {
+  if (typeof content === 'string') return content
+  if (!Array.isArray(content)) return
+
+  const parts = []
+  let hasImages = false
+
+  for (const part of content) {
+    if (!part) continue
+    if (typeof part === 'string') {
+      parts.push({ type: 'text', text: part })
+    } else if ((part.type === 'input_text' || part.type === 'output_text' || part.type === 'text') &&
+      typeof part.text === 'string') {
+      parts.push({ type: 'text', text: part.text })
+    } else if (part.type === 'refusal' && typeof part.refusal === 'string') {
+      parts.push({ type: 'text', text: part.refusal })
+    } else if (part.type === 'input_image' || part.type === 'image_url') {
+      const image = openAIResponseImageContentPart(part)
+      if (image) {
+        hasImages = true
+        parts.push(image)
+      }
+    } else if (part.type === 'input_file') {
+      parts.push({ type: 'text', text: openAIResponseFileContentPart(part) })
+    }
+  }
+
+  if (!parts.length) return
+  if (hasImages) return parts
+  return parts.map(part => part.text).join('\n')
+}
+
+/**
+ * Converts an OpenAI image content part to AI Guard image_url content.
+ *
+ * @param {{image_url?: string|{url?: string}, file_id?: string, url?: string}} part
+ * @returns {{type: 'image_url', image_url: {url: string}}|undefined}
+ */
+function openAIResponseImageContentPart (part) {
+  const url = typeof part.image_url === 'string' ? part.image_url : part.image_url?.url ?? part.url
+  if (url) return { type: 'image_url', image_url: { url } }
+  if (part.file_id) return { type: 'image_url', image_url: { url: part.file_id } }
+}
+
+/**
+ * Extracts a stable text marker from an OpenAI file content part.
+ *
+ * @param {{file_id?: string|null, file_url?: string, filename?: string, file_data?: string}} part
+ * @returns {string}
+ */
+function openAIResponseFileContentPart (part) {
+  return part.file_id ?? part.file_url ?? part.filename ?? FILE_FALLBACK
+}
+
 module.exports = {
   convertVercelPromptToMessages,
   convertFilePartToImageUrl,
+  normalizeOpenAIChatMessages,
   buildToolCallOutputMessages,
   buildTextOutputMessages,
   buildOutputMessages,
+  convertOpenAIResponseItemsToMessages,
+  convertOpenAIResponsePromptToMessages,
+  openAIResponseContentToMessageContent,
 }

package/packages/datadog-instrumentations/src/helpers/callback-instrumentor.js

@@ -45,7 +45,7 @@ function createCallbackInstrumentor (prefix, { captureResult = false } = {}) {
         }
 
         return startCh.runStores(ctx, () => {
-          args[lastIndex] = shimmer.wrapFunction(cb, cb => function (error, ...rest) {
+          args[lastIndex] = shimmer.wrapCallback(cb, cb => function (error, ...rest) {
             if (error) {
               ctx.error = error
               errorCh.publish(ctx)

package/packages/datadog-instrumentations/src/helpers/hooks.js

@@ -5,6 +5,7 @@ module.exports = {
   child_process: () => require('../child_process'),
   crypto: () => require('../crypto'),
   dns: () => require('../dns'),
+  'dns/promises': () => require('../dns'),
   fs: { serverless: false, fn: () => require('../fs') },
   http: () => require('../http'),
   http2: () => require('../http2'),
@@ -21,6 +22,7 @@ module.exports = {
   '@modelcontextprotocol/sdk': () => require('../modelcontextprotocol-sdk'),
   'apollo-server-core': () => require('../apollo-server-core'),
   '@aws-sdk/smithy-client': () => require('../aws-sdk'),
+  '@azure/cosmos': { esmFirst: true, fn: () => require('../azure-cosmos') },
   '@azure/event-hubs': () => require('../azure-event-hubs'),
   '@azure/functions': () => require('../azure-functions'),
   'durable-functions': () => require('../azure-durable-functions'),
@@ -48,6 +50,7 @@ module.exports = {
   '@prisma/client': { esmFirst: true, fn: () => require('../prisma') },
   './runtime/library.js': () => require('../prisma'),
   '@redis/client': () => require('../redis'),
+  '@smithy/core': () => require('../aws-sdk'),
   '@smithy/smithy-client': () => require('../aws-sdk'),
   '@vitest/runner': { esmFirst: true, fn: () => require('../vitest') },
   aerospike: () => require('../aerospike'),
@@ -111,6 +114,7 @@ module.exports = {
   multer: () => require('../multer'),
   mysql: () => require('../mysql'),
   mysql2: () => require('../mysql2'),
+  '@nats-io/nats-core': () => require('../nats'),
   next: () => require('../next'),
   'node-serialize': () => require('../node-serialize'),
   nyc: () => require('../nyc'),

package/packages/datadog-instrumentations/src/helpers/instrument.js

@@ -58,7 +58,8 @@ exports.getHooks = function getHooks (names) {
  * @param {string} [args.file] path to file within package to instrument. Defaults to 'index.js'.
  * @param {string} [args.filePattern] pattern to match files within package to instrument
  * @param {boolean} [args.patchDefault] whether to patch the default export. Defaults to true.
- * @param {(moduleExports: unknown, version: string, isIitm?: boolean) => unknown} [hook] Patches module exports
+ * @param {(moduleExports: unknown, version: string, isIitm?: boolean, hookMeta?: object) => unknown} [hook]
+ * Patches module exports
  */
 exports.addHook = function addHook ({ name, versions, file, filePattern, patchDefault }, hook) {
   if (!instrumentations[name]) {

package/packages/datadog-instrumentations/src/helpers/kafka.js

@@ -1,5 +1,10 @@
 'use strict'
 
+// Produce API key 0; v0–v2 use the legacy MessageSet format with no header
+// field, so trace headers can only be carried on v3+ (Kafka >=0.11).
+const PRODUCE_API_KEY = 0
+const PRODUCE_VERSION_WITH_HEADERS = 3
+
 // Side-table mapping a kafkajs producer/consumer to the cluster captured at
 // creation time. The boundary uses it to read `cluster.brokerPool` lazily on
 // first send/consume instead of opening a parallel admin connection. A
@@ -35,7 +40,19 @@ function cloneMessages (messages, ensureHeaders) {
   return result
 }
 
+/**
+ * @param {{ versions?: Record<number, { minVersion: number, maxVersion: number }> } | undefined} brokerPool
+ *   kafkajs's `cluster.brokerPool`. `versions` is populated once the seed
+ *   broker handshakes; before that, the answer is unknown and we return
+ *   `true` so the caller defaults to injection.
+ */
+function brokerSupportsMessageHeaders (brokerPool) {
+  const produce = brokerPool?.versions?.[PRODUCE_API_KEY]
+  return !produce || produce.maxVersion >= PRODUCE_VERSION_WITH_HEADERS
+}
+
 module.exports = {
+  brokerSupportsMessageHeaders,
   clientToCluster,
   cloneMessages,
 }