dd-trace 6.12.0 → 6.13.0

package/packages/dd-trace/src/aiguard/evaluation.js

@@ -8,11 +8,14 @@ const { keepTrace } = require('../priority_sampler')
 const { extractIp } = require('../plugins/util/ip_extractor')
 const { AI_GUARD } = require('../standalone/product')
 const telemetryMetrics = require('../telemetry/metrics')
+const { normalizeRedactionReplacements, redactMessages } = require('./redaction')
 const TAGS = require('./tags')
 
 const ALLOW = 'ALLOW'
 
+/** @typedef {import('../../../../index').aiguard.ContentPart} ContentPart */
 /** @typedef {import('../../../../index').aiguard.Message} Message */
+/** @typedef {import('../../../../index').aiguard.RedactionReplacement} RedactionReplacement */
 /** @typedef {import('../opentracing/span')} Span */
 
 /**
@@ -24,19 +27,22 @@ const ALLOW = 'ALLOW'
  * @property {Record<string, unknown>} tagProbabilities
  * @property {boolean} hasTagProbabilities
  * @property {boolean} blockingEnabled
+ * @property {unknown} redactionReplacements
  */
 
 /**
  * @typedef {object} EvaluationOutcome
  * @property {{ action: string, reason: string|undefined, tags: Array<unknown>,
- *   tagProbabilities: Record<string, unknown>, sds: Array<unknown> }} result
+ *   tagProbabilities: Record<string, unknown>, sds: Array<unknown>, messages: Message[],
+ *   redactionReplacements: RedactionReplacement[] }} result
  * @property {boolean} shouldBlock
  * @property {boolean} hasTagProbabilities
+ * @property {{ enabled: boolean, applied: boolean, failures: number }} redaction
  */
 
 /**
  * @typedef {object} EvaluationMetaStruct
- * @property {Message[]} messages
+ * @property {Message[]} [messages]
  * @property {Array<unknown>} [attack_categories]
  * @property {Array<unknown>} [sds]
  * @property {Record<string, unknown>} [tag_probs]
@@ -45,6 +51,7 @@ const ALLOW = 'ALLOW'
 /**
  * @typedef {object} EvaluationReport
  * @property {Span} span
+ * @property {Message[]} messages
  * @property {EvaluationMetaStruct} metaStruct
  * @property {{ source: string, integration: string }} telemetryTags
  */
@@ -79,6 +86,7 @@ function parseEvaluationResponse (body) {
     tagProbabilities: isRecord(attributes.tag_probs) ? attributes.tag_probs : {},
     hasTagProbabilities: isRecord(attributes.tag_probs),
     blockingEnabled: attributes.is_blocking_enabled === true,
+    redactionReplacements: attributes.redaction_replacements,
   }
 }
 
@@ -96,11 +104,16 @@ function shouldBlockEvaluation (block, evaluation) {
 /**
  * Applies local evaluation policy and creates the result returned to the caller.
  *
+ * @param {Message[]} messages
  * @param {EvaluationResponse} evaluation
- * @param {boolean} block
+ * @param {{ block: boolean, redactionEnabled: boolean }} options
  * @returns {EvaluationOutcome}
  */
-function createEvaluationOutcome (evaluation, block) {
+function createEvaluationOutcome (messages, evaluation, options) {
+  const redaction = options.redactionEnabled
+    ? redactMessages(messages, evaluation.redactionReplacements)
+    : { messages, redacted: false, failures: 0 }
+
   return {
     result: {
       action: evaluation.action,
@@ -108,9 +121,16 @@ function createEvaluationOutcome (evaluation, block) {
       tags: evaluation.tags,
       tagProbabilities: evaluation.tagProbabilities,
       sds: evaluation.sdsFindings,
+      messages: redaction.messages,
+      redactionReplacements: normalizeRedactionReplacements(evaluation.redactionReplacements),
     },
-    shouldBlock: shouldBlockEvaluation(block, evaluation),
+    shouldBlock: shouldBlockEvaluation(options.block, evaluation),
     hasTagProbabilities: evaluation.hasTagProbabilities,
+    redaction: {
+      enabled: options.redactionEnabled,
+      applied: redaction.redacted,
+      failures: redaction.failures,
+    },
   }
 }
 
@@ -130,6 +150,7 @@ class EvaluationReporter {
   #config
   #maxMessagesLength
   #maxContentSize
+  #redactionEnabled
 
   /**
    * @param {import('../config/config-base')} config
@@ -138,6 +159,7 @@ class EvaluationReporter {
     this.#config = config
     this.#maxMessagesLength = config.experimental.aiguard.maxMessagesLength
     this.#maxContentSize = config.experimental.aiguard.maxContentSize
+    this.#redactionEnabled = config.experimental.aiguard.redactionEnabled
   }
 
   /**
@@ -150,19 +172,18 @@ class EvaluationReporter {
    */
   start (span, messages, options) {
     const telemetryTags = { source: options.source, integration: options.integration }
-    const last = messages.at(-1)
+    const evaluatedMessages = this.#redactionEnabled ? clone(messages) : messages
+    const last = evaluatedMessages.at(-1)
     const target = this.#isToolCall(last) ? 'tool' : 'prompt'
     span.setTag(TAGS.TARGET_TAG_KEY, target)
     if (target === 'tool') {
-      const name = this.#getToolName(last, messages)
+      const name = this.#getToolName(last, evaluatedMessages)
       if (name) {
         span.setTag(TAGS.TOOL_NAME_TAG_KEY, name)
       }
     }
 
-    const metaStruct = {
-      messages: this.#buildMessagesForMetaStruct(messages, telemetryTags),
-    }
+    const metaStruct = {}
     span.meta_struct = {
       [TAGS.META_STRUCT_KEY]: metaStruct,
     }
@@ -178,6 +199,7 @@ class EvaluationReporter {
 
     return {
       span,
+      messages: evaluatedMessages,
       metaStruct,
       telemetryTags,
     }
@@ -191,6 +213,7 @@ class EvaluationReporter {
    * @returns {void}
    */
   fail (report, errorType) {
+    report.metaStruct.messages = this.#buildMessagesForMetaStruct(report.messages, report.telemetryTags)
     aiguardMetrics.count(TAGS.TELEMETRY_REQUESTS, { error: true, ...report.telemetryTags }).inc(1)
     aiguardMetrics.count(TAGS.TELEMETRY_ERROR, { type: errorType, ...report.telemetryTags }).inc(1)
   }
@@ -203,18 +226,38 @@ class EvaluationReporter {
    * @returns {void}
    */
   finish (report, outcome) {
-    const { result, shouldBlock } = outcome
+    const { result, redaction, shouldBlock } = outcome
 
     if (result.tags.length > 0) report.metaStruct.attack_categories = result.tags
     if (result.sds.length > 0) report.metaStruct.sds = result.sds
     if (outcome.hasTagProbabilities) report.metaStruct.tag_probs = result.tagProbabilities
 
-    const requestTelemetryTags = {
-      action: result.action,
-      error: false,
-      block: shouldBlock,
-      ...report.telemetryTags,
+    if (redaction.enabled) {
+      report.span.setTag(TAGS.REDACTED_TAG_KEY, redaction.applied ? 'true' : 'false')
+      if (redaction.failures > 0) {
+        aiguardMetrics.count(TAGS.TELEMETRY_ERROR, {
+          type: TAGS.ERROR_TYPE_REDACTION,
+          ...report.telemetryTags,
+        }).inc(redaction.failures)
+      }
     }
+
+    report.metaStruct.messages = this.#buildMessagesForMetaStruct(result.messages, report.telemetryTags)
+
+    const requestTelemetryTags = redaction.enabled
+      ? {
+          action: result.action,
+          error: false,
+          block: shouldBlock,
+          redacted: redaction.applied,
+          ...report.telemetryTags,
+        }
+      : {
+          action: result.action,
+          error: false,
+          block: shouldBlock,
+          ...report.telemetryTags,
+        }
     aiguardMetrics.count(TAGS.TELEMETRY_REQUESTS, requestTelemetryTags).inc(1)
 
     report.span.setTag(TAGS.ACTION_TAG_KEY, result.action)
@@ -242,10 +285,7 @@ class EvaluationReporter {
     let contentTruncated = false
     for (let i = messages.length - size; i < messages.length; i++) {
       const message = clone(messages[i])
-      if (message.content?.length > this.#maxContentSize) {
-        contentTruncated = true
-        message.content = message.content.slice(0, this.#maxContentSize)
-      }
+      if (this.#truncateMessageContent(message)) contentTruncated = true
       result.push(message)
     }
     if (contentTruncated) {
@@ -254,6 +294,40 @@ class EvaluationReporter {
     return result
   }
 
+  /**
+   * Truncates text in a cloned message to one shared content-size limit.
+   *
+   * @param {{ content?: string|ContentPart[] }} message
+   * @returns {boolean}
+   */
+  #truncateMessageContent (message) {
+    const { content } = message
+    if (typeof content === 'string') {
+      if (content.length <= this.#maxContentSize) return false
+
+      message.content = content.slice(0, this.#maxContentSize)
+      return true
+    }
+
+    if (!Array.isArray(content)) return false
+
+    let remainingContentSize = this.#maxContentSize
+    let truncated = false
+    for (const part of content) {
+      const text = part?.text
+      if (typeof text !== 'string') continue
+
+      if (text.length > remainingContentSize) {
+        part.text = text.slice(0, remainingContentSize)
+        truncated = true
+        remainingContentSize = 0
+      } else {
+        remainingContentSize -= text.length
+      }
+    }
+    return truncated
+  }
+
   /**
    * Returns whether a message represents a tool call or tool output.
    *

package/packages/dd-trace/src/aiguard/integrations/vercel-ai.js

@@ -74,18 +74,17 @@ function onStreamAfter (ctx) {
  */
 function getStreamContent (chunks) {
   const toolCalls = []
-  const textParts = []
+  let text = ''
 
   for (const chunk of chunks) {
     if (chunk?.type === 'tool-call') {
       toolCalls.push(chunk)
     } else if (chunk?.type === 'text-delta') {
-      textParts.push(chunk.textDelta)
+      text += chunk.delta ?? chunk.textDelta ?? ''
     }
   }
 
   if (toolCalls.length) return toolCalls
-  const text = textParts.join('')
   return text ? [{ type: 'text', text }] : []
 }
 

package/packages/dd-trace/src/aiguard/messages/anthropic.js

@@ -269,27 +269,39 @@ function convertServerToolResultContent (content) {
     return content.error_message ? `${content.error_code}: ${content.error_message}` : content.error_code
   }
 
-  const lines = []
+  let lines
   if (Array.isArray(content)) {
     for (const item of content) {
       if (!item || typeof item !== 'object') continue
       // text blocks (MCP / generic), then web-search title + url.
-      if (typeof item.text === 'string') lines.push(item.text)
-      if (typeof item.title === 'string') lines.push(item.title)
-      if (typeof item.url === 'string') lines.push(item.url)
+      if (typeof item.text === 'string') {
+        lines = lines === undefined ? item.text : `${lines}\n${item.text}`
+      }
+      if (typeof item.title === 'string') {
+        lines = lines === undefined ? item.title : `${lines}\n${item.title}`
+      }
+      if (typeof item.url === 'string') {
+        lines = lines === undefined ? item.url : `${lines}\n${item.url}`
+      }
     }
   } else {
-    if (typeof content.stdout === 'string' && content.stdout) lines.push(content.stdout)
-    if (typeof content.stderr === 'string' && content.stderr) lines.push(content.stderr)
-    if (typeof content.content === 'string' && content.content) lines.push(content.content)
+    if (typeof content.stdout === 'string' && content.stdout) lines = content.stdout
+    if (typeof content.stderr === 'string' && content.stderr) {
+      lines = lines === undefined ? content.stderr : `${lines}\n${content.stderr}`
+    }
+    if (typeof content.content === 'string' && content.content) {
+      lines = lines === undefined ? content.content : `${lines}\n${content.content}`
+    }
     if (Array.isArray(content.lines)) {
       for (const line of content.lines) {
-        if (typeof line === 'string') lines.push(line)
+        if (typeof line === 'string') {
+          lines = lines === undefined ? line : `${lines}\n${line}`
+        }
       }
     }
   }
 
-  return lines.join('\n') || '[tool result]'
+  return lines || '[tool result]'
 }
 
 /**

package/packages/dd-trace/src/aiguard/noop.js

@@ -2,7 +2,15 @@
 
 class NoopAIGuard {
   evaluate (messages, opts) {
-    return Promise.resolve({ action: 'ALLOW', reason: 'AI Guard is not enabled', tags: [], sds: [] })
+    return Promise.resolve({
+      action: 'ALLOW',
+      reason: 'AI Guard is not enabled',
+      tags: [],
+      tagProbabilities: {},
+      sds: [],
+      messages,
+      redactionReplacements: [],
+    })
   }
 }
 

package/packages/dd-trace/src/aiguard/redaction.js

@@ -0,0 +1,183 @@
+'use strict'
+
+/** @typedef {import('../../../../index').aiguard.RedactionReplacement} RedactionReplacement */
+
+const SEGMENT_PATTERN = /^([A-Za-z0-9_]+)(?:\[([0-9]+)\])?$/
+
+/**
+ * Converts the raw backend replacements into the public, typed contract.
+ *
+ * @param {unknown} replacements
+ * @returns {RedactionReplacement[]}
+ */
+function normalizeRedactionReplacements (replacements) {
+  if (!Array.isArray(replacements)) return []
+
+  const result = []
+  for (const entry of replacements) {
+    if (entry === null || typeof entry !== 'object' || Array.isArray(entry)) continue
+
+    const { path, replacement } = entry
+    if (typeof path !== 'string' || path.length === 0 || typeof replacement !== 'string') continue
+
+    result.push({ path, replacement })
+  }
+  return result
+}
+
+/**
+ * Parses an AI Guard location path into named segments and optional indexes.
+ *
+ * @param {string} path
+ * @returns {Array<{ name: string, index: number|undefined }>|undefined}
+ */
+function parsePath (path) {
+  const segments = []
+  for (const rawSegment of path.split('.')) {
+    const match = SEGMENT_PATTERN.exec(rawSegment)
+    if (!match) return
+
+    segments.push({
+      name: match[1],
+      index: match[2] === undefined ? undefined : Number(match[2]),
+    })
+  }
+  return segments
+}
+
+/**
+ * Reports whether a parsed path targets an allowed message string.
+ *
+ * @param {Array<{ name: string, index: number|undefined }>} segments
+ * @returns {boolean}
+ */
+function isRedactablePath (segments) {
+  const first = segments[0]
+  if (first?.name !== 'messages' || first.index === undefined) return false
+
+  if (segments.length === 2) {
+    const content = segments[1]
+    return content.name === 'content' && content.index === undefined
+  }
+
+  if (segments.length === 3) {
+    const content = segments[1]
+    const text = segments[2]
+    return content.name === 'content' && content.index !== undefined &&
+      text.name === 'text' && text.index === undefined
+  }
+
+  if (segments.length === 4) {
+    const toolCalls = segments[1]
+    const functionSegment = segments[2]
+    const argumentsSegment = segments[3]
+    return toolCalls.name === 'tool_calls' && toolCalls.index !== undefined &&
+      functionSegment.name === 'function' && functionSegment.index === undefined &&
+      argumentsSegment.name === 'arguments' && argumentsSegment.index === undefined
+  }
+
+  return false
+}
+
+/**
+ * Resolves a location path to a writable string container and key.
+ *
+ * @param {{ messages: Array<object> }} root
+ * @param {string} path
+ * @returns {{ container: object|Array<unknown>, key: string|number }|undefined}
+ */
+function resolveWritableString (root, path) {
+  const segments = parsePath(path)
+  if (!segments || !isRedactablePath(segments)) return
+
+  const terminal = segments.at(-1)
+  let node = root
+  for (let i = 0; i < segments.length - 1; i++) {
+    const { name, index } = segments[i]
+    if (!node || typeof node !== 'object' || !Object.hasOwn(node, name)) return
+
+    node = node[name]
+    if (index !== undefined) {
+      if (!Array.isArray(node) || index >= node.length) return
+      node = node[index]
+    }
+  }
+
+  if (!node || typeof node !== 'object') return
+  if (!Object.hasOwn(node, terminal.name) || typeof node[terminal.name] !== 'string') return
+  return { container: node, key: terminal.name }
+}
+
+/**
+ * Applies redaction replacements to an AI Guard message list.
+ * The caller transfers ownership of a private snapshot. Successful replacements mutate that snapshot in place.
+ *
+ * @param {Array<object>} messages
+ * @param {unknown} replacements
+ * @returns {{ messages: Array<object>, redacted: boolean, failures: number }}
+ */
+function redactMessages (messages, replacements) {
+  if (!Array.isArray(messages) || replacements === undefined || replacements === null) {
+    return { messages, redacted: false, failures: 0 }
+  }
+
+  try {
+    if (!Array.isArray(replacements)) {
+      return { messages, redacted: false, failures: 1 }
+    }
+    if (replacements.length === 0) return { messages, redacted: false, failures: 0 }
+
+    const replacementsByPath = new Map()
+    const conflictingPaths = new Set()
+    let failures = 0
+    for (const entry of replacements) {
+      if (!entry || typeof entry !== 'object') {
+        failures++
+        continue
+      }
+
+      const { path, replacement } = entry
+      if (typeof path !== 'string' || path.length === 0 || typeof replacement !== 'string') {
+        failures++
+        continue
+      }
+
+      if (conflictingPaths.has(path)) continue
+      if (replacementsByPath.has(path) && replacementsByPath.get(path) !== replacement) {
+        replacementsByPath.delete(path)
+        conflictingPaths.add(path)
+        failures++
+        continue
+      }
+      replacementsByPath.set(path, replacement)
+    }
+
+    if (replacementsByPath.size === 0) return { messages, redacted: false, failures }
+
+    const root = { messages }
+    const targets = []
+
+    for (const [path, replacement] of replacementsByPath) {
+      const resolved = resolveWritableString(root, path)
+      if (!resolved) {
+        failures++
+        continue
+      }
+
+      targets.push({ ...resolved, replacement })
+    }
+
+    for (const { container, key, replacement } of targets) {
+      container[key] = replacement
+    }
+
+    return { messages, redacted: targets.length > 0, failures }
+  } catch {
+    return { messages, redacted: false, failures: 1 }
+  }
+}
+
+module.exports = {
+  normalizeRedactionReplacements,
+  redactMessages,
+}

package/packages/dd-trace/src/aiguard/sdk.js

@@ -12,6 +12,7 @@ class AIGuard extends NoopAIGuard {
   #tracer
   #client
   #reporter
+  #redactionEnabled
   #meta
 
   /**
@@ -29,6 +30,7 @@ class AIGuard extends NoopAIGuard {
     this.#tracer = tracer
     this.#client = new AIGuardClient(config)
     this.#reporter = new EvaluationReporter(config)
+    this.#redactionEnabled = config.experimental.aiguard.redactionEnabled
     this.#meta = { service: config.service, env: config.env }
     this.#initialized = true
   }
@@ -45,13 +47,16 @@ class AIGuard extends NoopAIGuard {
       const report = this.#reporter.start(span, messages, { source, integration })
       let evaluation
       try {
-        evaluation = await this.#client.evaluate(messages, this.#meta)
+        evaluation = await this.#client.evaluate(report.messages, this.#meta)
       } catch (error) {
         this.#reporter.fail(report, error.telemetryType ?? TAGS.ERROR_TYPE_CLIENT)
         throw error
       }
 
-      const outcome = createEvaluationOutcome(evaluation, block)
+      const outcome = createEvaluationOutcome(report.messages, evaluation, {
+        block,
+        redactionEnabled: this.#redactionEnabled,
+      })
       this.#reporter.finish(report, outcome)
 
       if (outcome.shouldBlock) {

package/packages/dd-trace/src/aiguard/tags.js

@@ -7,6 +7,7 @@ module.exports = {
   ACTION_TAG_KEY: 'ai_guard.action',
   REASON_TAG_KEY: 'ai_guard.reason',
   BLOCKED_TAG_KEY: 'ai_guard.blocked',
+  REDACTED_TAG_KEY: 'ai_guard.redacted',
   EVENT_TAG_KEY: 'ai_guard.event',
   META_STRUCT_KEY: 'ai_guard',
 
@@ -27,4 +28,5 @@ module.exports = {
   ERROR_TYPE_CLIENT: 'client_error',
   ERROR_TYPE_STATUS: 'bad_status',
   ERROR_TYPE_RESPONSE: 'bad_response',
+  ERROR_TYPE_REDACTION: 'redaction_error',
 }

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/utils.js

@@ -108,7 +108,7 @@ function stringifyWithRanges (obj, objRanges, loadSensitiveRanges = false) {
     value = JSON.stringify(cloneObj, null, 2)
 
     if (counter > 0) {
-      const segments = []
+      let formattedValue = ''
       let outputLength = 0
       let pos = 0
       let rangeKeyIndex = value.indexOf(STRINGIFY_RANGE_KEY)
@@ -133,13 +133,14 @@ function stringifyWithRanges (obj, objRanges, loadSensitiveRanges = false) {
               start,
               end: start + originalValue.length,
             })
-            segments.push(value.slice(pos, rangeKeyIndex), originalValue)
+            formattedValue += value.slice(pos, rangeKeyIndex)
+            formattedValue += originalValue
             outputLength += cleanLength + originalValue.length
             pos = rangeKeyIndex + matchValue.length
           } else {
             // can't happen, the only way to this to happen is
             // if the JSON has a value starting with the value of STRINGIFY_SENSITIVE_NOT_STRING_KEY
-            segments.push(value.slice(pos, rangeKeyIndex + STRINGIFY_SENSITIVE_NOT_STRING_KEY.length + 1))
+            formattedValue += value.slice(pos, rangeKeyIndex + STRINGIFY_SENSITIVE_NOT_STRING_KEY.length + 1)
             outputLength += cleanLength + STRINGIFY_SENSITIVE_NOT_STRING_KEY.length + 1
             pos = rangeKeyIndex + STRINGIFY_SENSITIVE_NOT_STRING_KEY.length + 1
           }
@@ -152,13 +153,13 @@ function stringifyWithRanges (obj, objRanges, loadSensitiveRanges = false) {
               start,
               end: start + Number.parseInt(regexRes[1], 10),
             })
-            segments.push(value.slice(pos, rangeKeyIndex))
+            formattedValue += value.slice(pos, rangeKeyIndex)
             outputLength += cleanLength
             pos = rangeKeyIndex + regexRes[0].length
           } else {
             // can't happen, the only way to this to happen is
             // if the JSON has a value starting with the value of STRINGIFY_SENSITIVE_KEY
-            segments.push(value.slice(pos, rangeKeyIndex + STRINGIFY_SENSITIVE_KEY.length))
+            formattedValue += value.slice(pos, rangeKeyIndex + STRINGIFY_SENSITIVE_KEY.length)
             outputLength += cleanLength + STRINGIFY_SENSITIVE_KEY.length
             pos = rangeKeyIndex + STRINGIFY_SENSITIVE_KEY.length
           }
@@ -175,13 +176,13 @@ function stringifyWithRanges (obj, objRanges, loadSensitiveRanges = false) {
             }))
             ranges.push(...updatedRanges)
 
-            segments.push(value.slice(pos, rangeKeyIndex))
+            formattedValue += value.slice(pos, rangeKeyIndex)
             outputLength += cleanLength
             pos = rangeKeyIndex + regexRes[0].length
           } else {
             // can't happen, the only way to this to happen is
             // if the JSON has a value starting with the value of STRINGIFY_RANGE_KEY
-            segments.push(value.slice(pos, rangeKeyIndex + STRINGIFY_RANGE_KEY.length))
+            formattedValue += value.slice(pos, rangeKeyIndex + STRINGIFY_RANGE_KEY.length)
             outputLength += cleanLength + STRINGIFY_RANGE_KEY.length
             pos = rangeKeyIndex + STRINGIFY_RANGE_KEY.length
           }
@@ -190,8 +191,8 @@ function stringifyWithRanges (obj, objRanges, loadSensitiveRanges = false) {
         rangeKeyIndex = value.indexOf(STRINGIFY_RANGE_KEY, pos)
       }
 
-      segments.push(value.slice(pos))
-      value = segments.join('')
+      formattedValue += value.slice(pos)
+      value = formattedValue
     }
   } else {
     value = JSON.stringify(obj, null, 2)

package/packages/dd-trace/src/appsec/rule_manager.js

@@ -82,6 +82,8 @@ function updateWafFromRC (transaction) {
         const asmFile = /** @type {AsmConfigFile} */ (item.file)
         if (asmFile?.actions?.length) {
           newActions.set(item.id, asmFile.actions)
+        } else {
+          newActions.delete(item.id)
         }
       }
     } catch (e) {