dd-trace 6.17.0 → 6.19.0

package/packages/datadog-plugin-cypress/src/index.js

@@ -26,6 +26,7 @@ class CypressPlugin extends Plugin {
         userAfterRunHandlers,
         userAfterScreenshotHandlers,
         cleanupWrapper,
+        registerBeforeRun,
       } = payload
 
       const registerAfterRunWithCleanup = (afterRunHandler) => {
@@ -79,6 +80,7 @@ class CypressPlugin extends Plugin {
       }
 
       if (cypressPlugin._isInit) {
+        registerBeforeRun()
         // Already initialized by manual plugin call — just chain user handlers.
         // Pass the plugin's afterScreenshot so chaining a user handler doesn't drop the upload
         // (the chained registration replaces the one plugin.js set, so it must include it).
@@ -94,7 +96,7 @@ class CypressPlugin extends Plugin {
         return
       }
 
-      on('before:run', cypressPlugin.beforeRun.bind(cypressPlugin))
+      registerBeforeRun(cypressPlugin.beforeRun.bind(cypressPlugin))
       registerAfterScreenshot(datadogAfterScreenshotHandler)
 
       on('after:spec', (spec, results) => {

package/packages/datadog-plugin-fetch/src/index.js

@@ -17,6 +17,9 @@ class FetchPlugin extends HttpClientPlugin {
 
     const store = super.bindStart(ctx)
 
+    // Native undici diagnostics also fire for requests already traced by this wrapper.
+    store.skipUndici = true
+
     for (const name in options.headers) {
       if (!req.headers.has(name)) {
         req.headers.set(name, options.headers[name])

package/packages/datadog-plugin-jest/src/index.js

@@ -117,19 +117,18 @@ class JestPlugin extends CiPlugin {
       isEarlyFlakeDetectionEnabled,
       isEarlyFlakeDetectionFaulty,
       isTestManagementTestsEnabled,
-      isExpectedEmptySession,
+      testSessionEmptyReason,
       onDone,
     }) => {
       const finishSession = () => {
         this.testSessionSpan.setTag(TEST_STATUS, status)
         this.testModuleSpan.setTag(TEST_STATUS, status)
 
-        if (isExpectedEmptySession) {
+        if (testSessionEmptyReason) {
           setExpectedEmptyTestSessionTags(
             this.testSessionSpan,
             this.testModuleSpan,
-            'No tests were found',
-            'zero_tests'
+            testSessionEmptyReason
           )
         }
 

package/packages/datadog-plugin-mocha/src/index.js

@@ -885,7 +885,7 @@ class MochaPlugin extends CiPlugin {
       isTestManagementEnabled,
       isParallel,
       isFrameworkError,
-      isExpectedEmptySession,
+      testSessionEmptyReason,
       onDone,
     }) => {
       this._exportPendingWorkerTraces()
@@ -898,12 +898,11 @@ class MochaPlugin extends CiPlugin {
         this.testSessionSpan.setTag(TEST_STATUS, status)
         this.testModuleSpan.setTag(TEST_STATUS, status)
 
-        if (isExpectedEmptySession) {
+        if (testSessionEmptyReason) {
           setExpectedEmptyTestSessionTags(
             this.testSessionSpan,
             this.testModuleSpan,
-            'No tests were executed',
-            'zero_tests'
+            testSessionEmptyReason
           )
         }
 

package/packages/datadog-plugin-oracledb/src/connection-parser.js

@@ -3,6 +3,8 @@
 const { URL } = require('url')
 const log = require('../../dd-trace/src/log')
 
+const easyConnectProtocol = /^tcps?:\/\//i
+
 function parseOracleDescriptor (descriptor) {
   const hostnameMatch = descriptor.match(/HOST\s*=\s*([^)]+)/i)
   const hostname = hostnameMatch?.[1] || 'localhost' // Default Oracle hostname
@@ -24,7 +26,7 @@ module.exports = function getDBInformation (connAttrs) {
     return parseOracleDescriptor(connectString)
   }
   try {
-    const url = new URL(`oracle://${connectString}`)
+    const url = new URL(easyConnectProtocol.test(connectString) ? connectString : `oracle://${connectString}`)
     return {
       hostname: url.hostname || 'localhost', // Default Oracle hostname
       port: url.port || '1521', // Default Oracle port

package/packages/datadog-plugin-playwright/src/index.js

@@ -70,8 +70,6 @@ const log = require('../../dd-trace/src/log')
 
 const PLAYWRIGHT_FAILURE_SCREENSHOT_RE = /^test-failed-\d+\.png$/
 const PLAYWRIGHT_VIDEO_CONTENT_TYPES = new Set(['video/mp4', 'video/webm'])
-const EMPTY_SHARD_SKIP_REASON = 'No tests were assigned to this shard'
-const EMPTY_SHARD_REASON = 'zero_test_shard'
 const RETRY_TEST_ID = '_dd.playwright.retry_test_id'
 const DEFER_FINAL_STATUS = '_dd.playwright.defer_final_status'
 const noop = () => {}
@@ -186,7 +184,7 @@ class PlaywrightPlugin extends CiPlugin {
       isEarlyFlakeDetectionEnabled,
       isEarlyFlakeDetectionFaulty,
       isTestManagementTestsEnabled,
-      isExpectedEmptyShard,
+      testSessionEmptyReason,
       error,
       onDone,
     }) => {
@@ -212,12 +210,11 @@ class PlaywrightPlugin extends CiPlugin {
         this.testModuleSpan.setTag(TEST_STATUS, status)
         this.testSessionSpan.setTag(TEST_STATUS, status)
 
-        if (isExpectedEmptyShard) {
+        if (testSessionEmptyReason) {
           setExpectedEmptyTestSessionTags(
             this.testSessionSpan,
             this.testModuleSpan,
-            EMPTY_SHARD_SKIP_REASON,
-            EMPTY_SHARD_REASON
+            testSessionEmptyReason
           )
         }
 
@@ -526,6 +523,8 @@ class PlaywrightPlugin extends CiPlugin {
     this.addSub('ci:playwright:test:finish', ({
       span,
       testStatus,
+      isExpectedFailure,
+      hasNonRetriableError,
       steps,
       error,
       extraTags,
@@ -565,6 +564,12 @@ class PlaywrightPlugin extends CiPlugin {
       if (extraTags) {
         span.addTags(extraTags)
       }
+      if (isExpectedFailure) {
+        span.setTag('test.result', 'xfail')
+      }
+      if (hasNonRetriableError === true) {
+        span.setTag('test.playwright.has_non_retriable_error', 'true')
+      }
       if (isNew) {
         span.setTag(TEST_IS_NEW, 'true')
         if (isEfdRetry) {

package/packages/datadog-plugin-undici/src/index.js

@@ -47,6 +47,8 @@ class UndiciPlugin extends HttpClientPlugin {
     if (!request) return
 
     const store = storage('legacy').getStore()
+    if (store?.skipUndici) return
+
     const { origin = '', path = '/' } = request
     const method = request.method?.toUpperCase() ?? 'GET'
 
@@ -207,6 +209,9 @@ class UndiciPlugin extends HttpClientPlugin {
 
     const store = super.bindStart(ctx)
 
+    // Undici 5.0 emits native diagnostics even though its fetch needs the legacy wrapper.
+    store.skipUndici = true
+
     // Inject trace headers back into the request
     for (const name of Object.keys(options.headers)) {
       if (!req.headers.has(name)) {

package/packages/datadog-plugin-vitest/src/index.js

@@ -580,7 +580,7 @@ class VitestPlugin extends CiPlugin {
       requestErrorTags,
       vitestPool,
       isVitestNoWorkerInitActive,
-      isExpectedEmptySession,
+      testSessionEmptyReason,
       onDone,
     }) => {
       for (const [tag, value] of Object.entries(requestErrorTags)) {
@@ -589,12 +589,11 @@ class VitestPlugin extends CiPlugin {
       }
       this.testSessionSpan.setTag(TEST_STATUS, status)
       this.testModuleSpan.setTag(TEST_STATUS, status)
-      if (isExpectedEmptySession) {
+      if (testSessionEmptyReason) {
         setExpectedEmptyTestSessionTags(
           this.testSessionSpan,
           this.testModuleSpan,
-          'No tests were executed',
-          'zero_tests'
+          testSessionEmptyReason
         )
       }
       if (error) {

package/packages/datadog-plugin-ws/src/producer.js

@@ -21,7 +21,7 @@ class WSProducerPlugin extends TracingPlugin {
 
   bindStart (ctx) {
     const { byteLength, socket, binary } = ctx
-    if (!socket.spanContext) return
+    if (!socket?.spanContext) return
 
     const spanTags = socket.spanTags
     const path = getSegment(spanTags['resource.name'], ' ', 1)

package/packages/datadog-shimmer/src/shimmer.js

@@ -53,8 +53,15 @@ function copyProperties (original, wrapped) {
       const descriptor = /** @type {Descriptor} */ (Object.getOwnPropertyDescriptor(original, key))
       if (descriptor.writable && descriptor.enumerable && descriptor.configurable) {
         wrapped[key] = original[key]
-      } else if (descriptor.writable || descriptor.configurable || !Object.hasOwn(wrapped, key)) {
-        Object.defineProperty(wrapped, key, descriptor)
+      } else {
+        try {
+          Object.defineProperty(wrapped, key, descriptor)
+        } catch (error) {
+          const wrappedDescriptor = Object.getOwnPropertyDescriptor(wrapped, key)
+          if (wrappedDescriptor?.configurable !== false || wrappedDescriptor.writable) {
+            throw error
+          }
+        }
       }
     }
   }
@@ -320,19 +327,16 @@ function assertMethod (target, name, method) {
 }
 
 /**
- * Asserts that a target is not a class constructor.
+ * Asserts that a target is not an identifiable class constructor.
  *
  * @param {Function} target - The target function.
- * @throws {Error} If the target is a class constructor.
+ * @throws {TypeError} If the target is an identifiable class constructor.
  */
 function assertNotClass (target) {
-  // Class constructors have a non-writable `prototype` property; functions have a
-  // writable one and arrows / async / method-shorthand have none at all. The
-  // `'prototype' in target` gate skips the descriptor lookup for the no-prototype
-  // shapes; the `in` operator is cheaper than reading `target.prototype` since
-  // it returns a boolean instead of materialising the prototype reference.
+  // Frozen functions also have a non-writable `prototype`; inspect their source only then.
   if ('prototype' in target &&
-      Object.getOwnPropertyDescriptor(target, 'prototype').writable === false) {
+      Object.getOwnPropertyDescriptor(target, 'prototype').writable === false &&
+      (!Object.isFrozen(target) || Function.prototype.toString.call(target).startsWith('class'))) {
     throw new TypeError('Target is a native class constructor and cannot be wrapped.')
   }
 }

package/packages/datadog-turbopack/index.js

@@ -6,6 +6,7 @@ const path = require('node:path')
 
 const satisfies = require('../../vendor/dist/semifies')
 const hooks = require('../datadog-instrumentations/src/helpers/hooks')
+const { getRewriteTargetNames } = require('../datadog-instrumentations/src/helpers/rewriter/targets')
 const { SYNTHETIC_EXTENSION } = require('./src/constants')
 
 const BUILTIN_MODULES = new Set(Module.builtinModules)
@@ -158,7 +159,9 @@ function hasDatadogLoader (value) {
  */
 function createPackagePathPattern () {
   const names = []
-  for (const name of Object.keys(hooks)) {
+  const targetPackages = new Set(Object.keys(hooks))
+  for (const name of getRewriteTargetNames()) targetPackages.add(name)
+  for (const name of targetPackages) {
     if (!name.startsWith('.') && !BUILTIN_MODULES.has(name)) names.push(escapeRegExp(name))
   }
   names.sort()

package/packages/datadog-turbopack/src/loader.js

@@ -11,7 +11,10 @@ const hooks = require('../../datadog-instrumentations/src/helpers/hooks')
 const instrumentations = require('../../datadog-instrumentations/src/helpers/instrumentations')
 const { filename, matchesInstrumentation } = require('../../datadog-instrumentations/src/helpers/instrumentation-utils')
 const { createBundlerRewriter } = require('../../datadog-instrumentations/src/helpers/rewriter')
-const { getRewriteTarget } = require('../../datadog-instrumentations/src/helpers/rewriter/targets')
+const {
+  getRewriteTarget,
+  getRewriteTargetNames,
+} = require('../../datadog-instrumentations/src/helpers/rewriter/targets')
 const { isESMFile } = require('../../datadog-esbuild/src/utils')
 const { SYNTHETIC_EXTENSION } = require('./constants')
 
@@ -21,6 +24,7 @@ const MODULE_BINDING = 2
 const REQUIRE_BINDING = 4
 const COMMONJS_BINDINGS = MODULE_BINDING | REQUIRE_BINDING
 const targetPackages = new Set(Object.keys(hooks))
+for (const name of getRewriteTargetNames()) targetPackages.add(name)
 const entrypoints = new Map()
 const loadedHooks = new Set()
 const packageCache = new Map()
@@ -98,7 +102,7 @@ module.exports = function loader (source, inputSourceMap) {
     }
 
     if (publications.length > 0) code = appendCommonJsPublications(code, publications, dcModule)
-    if (rewritten && publications.length === 0) {
+    if (rewritten && publications.length === 0 && (rewriteTarget.activate || hooks[rewriteTarget.moduleName])) {
       if (!esm && hasUnsafeCommonJsBindings(code)) {
         this.emitWarning?.(new Error(`Skipped CommonJS activation for unsafe wrapper bindings in ${resourcePath}`))
         this.callback(undefined, source, inputSourceMap)

package/packages/dd-trace/src/agent/info.js

@@ -17,21 +17,22 @@ module.exports = {
  * Fetches agent information from the /info endpoint
  * @param {URL} url - The agent URL
  * @param {Function} callback - Callback function with signature (err, agentInfo)
- * @param {{ deadline?: number, signal?: AbortSignal }} [options] - Request finalization options
+ * @param {{ deadline?: number, signal?: AbortSignal, path?: string, retry?: boolean }} [options]
+ * Request finalization and routing options
  * @param {Function} [makeRequest] - Request implementation
  */
 function fetchAgentInfo (url, callback, options = {}, makeRequest = request) {
-  const urlKey = url.href
+  const urlKey = JSON.stringify([url.href, options.path ?? '/info'])
 
   if (cachedUrl !== null && cachedUrl !== urlKey) {
-    // Clear cache if URL changes
+    // Different consumers may query different paths on the same Agent URL.
     clearCache()
   } else if (cachedData !== null && (Date.now() - cachedTimestamp) < CACHE_TTL_MS) {
     // Return cached result if still valid
     return process.nextTick(callback, null, cachedData)
   }
 
-  options.path = '/info'
+  options.path ??= '/info'
   options.url = url
   makeRequest('', options, (err, res) => {
     if (err) {

package/packages/dd-trace/src/aiguard/client.js

@@ -1,10 +1,15 @@
 'use strict'
 
 const tracerVersion = require('../../../../package.json').version
+const { createAgents } = require('../exporters/common/agents')
+const request = require('../exporters/common/request')
 const { AIGuardClientError } = require('./errors')
 const { parseEvaluationResponse } = require('./evaluation')
 const TAGS = require('./tags')
 
+// Evaluations can run concurrently on the application's request path.
+const { httpAgent, httpsAgent } = createAgents(16)
+
 /**
  * Resolves the AI Guard host for a Datadog site.
  *
@@ -18,29 +23,43 @@ function aiGuardHost (site) {
  * Sends a request to the AI Guard service.
  *
  * @param {object} body
- * @param {{ url: string, headers: Record<string, string>, timeout: number }} opts
+ * @param {{ url: string, headers: Record<string, string|undefined>, timeout: number }} opts
  * @returns {Promise<{ status: number, body: unknown }>}
  */
-async function executeRequest (body, opts) {
-  const postData = JSON.stringify(body)
-  const headers = {
-    'Content-Type': 'application/json',
-    'Content-Length': Buffer.byteLength(postData),
-    ...opts.headers,
-  }
+function executeRequest (body, opts) {
+  return new Promise((resolve, reject) => {
+    const postData = JSON.stringify(body)
+    const url = new URL(opts.url)
+    request(postData, {
+      url,
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        ...opts.headers,
+      },
+      agent: url.protocol === 'https:' ? httpsAgent : httpAgent,
+      timeout: opts.timeout,
+      signal: AbortSignal.timeout(opts.timeout),
+      retry: false,
+      includeErrorResponseBody: true,
+    }, (error, result, status) => {
+      if (status === undefined) {
+        reject(error || new Error('AI Guard request completed without a status'))
+        return
+      }
 
-  const response = await fetch(opts.url, {
-    method: 'POST',
-    headers,
-    body: postData,
-    signal: AbortSignal.timeout(opts.timeout),
+      let responseBody
+      try {
+        const responseText = error ? /** @type {Error & { responseBody?: string }} */ (error).responseBody : result
+        if (typeof responseText !== 'string') throw new TypeError('AI Guard response body is missing')
+        responseBody = JSON.parse(responseText)
+      } catch (cause) {
+        reject(cause)
+        return
+      }
+      resolve({ status, body: responseBody })
+    })
   })
-
-  const responseBody = await response.json()
-  return {
-    status: response.status,
-    body: responseBody,
-  }
 }
 
 class AIGuardClient {

package/packages/dd-trace/src/aiguard/integrations/anthropic.js

@@ -2,10 +2,15 @@
 
 const { channel } = require('dc-polyfill')
 
-const { getMessagesInputMessages, getMessagesOutputMessages } = require('../messages/anthropic')
+const {
+  getMessagesInputMessages,
+  getMessagesOutputMessages,
+  getStreamedMessagesOutputMessages,
+} = require('../messages/anthropic')
 const { decode } = require('../messages/utils')
 const { SOURCE_AUTO } = require('../tags')
 const { evaluate } = require('./evaluate')
+const { interceptStream } = require('./stream')
 
 const messagesPrepareChannel = channel('dd-trace:anthropic:messages:prepare')
 const messagesInterceptChannel = channel('dd-trace:anthropic:messages:intercept')
@@ -13,18 +18,21 @@ const messagesInterceptChannel = channel('dd-trace:anthropic:messages:intercept'
 let isEnabled = false
 let aiguard
 let opts
+let analyzeStreamResponses
 
 /**
  * Subscribes AI Guard to the Anthropic interception channels.
  *
  * @param {object} aiguardInstance
  * @param {boolean} block
+ * @param {boolean} analyzeStreams
  */
-function enable (aiguardInstance, block) {
+function enable (aiguardInstance, block, analyzeStreams) {
   if (isEnabled) return
 
   aiguard = aiguardInstance
   opts = { block, source: SOURCE_AUTO, integration: 'anthropic' }
+  analyzeStreamResponses = analyzeStreams
 
   messagesPrepareChannel.subscribe(onMessagesPrepare)
   messagesInterceptChannel.subscribe(onMessagesIntercept)
@@ -40,6 +48,7 @@ function disable () {
 
   aiguard = undefined
   opts = undefined
+  analyzeStreamResponses = undefined
   isEnabled = false
 }
 
@@ -76,19 +85,35 @@ function onMessagesIntercept (ctx) {
     return inputEvaluation
   }
 
+  const isStream = ctx.arguments[0].stream
+  if (isStream && !analyzeStreamResponses) return
+
   // One model call has one output however many readers observe it: `parse`, `json()`, `text()`
   // and every `clone()` of the raw response share this callback.
   let outputEvaluation
   ctx.onResult = body => {
     if (!isEnabled) return body
 
+    if (isStream) {
+      outputEvaluation ??= interceptStream(body, chunks => {
+        if (!isEnabled) return
+        const outputMessages = decode(
+          () => getStreamedMessagesOutputMessages(chunks),
+          null,
+          'AIGuard: unable to decode the streamed Anthropic response: %s'
+        )
+        if (!outputMessages?.length) return
+        return evaluate(ctx, aiguard, [[...inputMessages, ...outputMessages]], opts)
+      })
+      return outputEvaluation
+    }
+
     const outputMessages = decode(
       () => getMessagesOutputMessages(body),
       null,
       'AIGuard: unable to decode Anthropic response body: %s'
     )
-    if (outputMessages === null) return body
-    if (!outputMessages.length) return body
+    if (!outputMessages?.length) return body
 
     outputEvaluation ??= evaluate(ctx, aiguard, [[...inputMessages, ...outputMessages]], opts)
     return outputEvaluation.then(() => body)

package/packages/dd-trace/src/aiguard/integrations/index.js

@@ -16,7 +16,7 @@ let isEnabled = false
 function enable (aiguard, block, analyzeStreamResponses) {
   if (isEnabled) return
 
-  anthropic.enable(aiguard, block)
+  anthropic.enable(aiguard, block, analyzeStreamResponses)
   openai.enable(aiguard, block, analyzeStreamResponses)
   vercelAi.enable(aiguard, block, analyzeStreamResponses)
 

package/packages/dd-trace/src/aiguard/integrations/openai.js

@@ -13,6 +13,7 @@ const {
 const { decode } = require('../messages/utils')
 const { SOURCE_AUTO } = require('../tags')
 const { evaluate } = require('./evaluate')
+const { interceptStream } = require('./stream')
 
 const chatCompletionsInterceptChannel = channel('dd-trace:openai:chat.completions:intercept')
 const responsesInterceptChannel = channel('dd-trace:openai:responses:intercept')
@@ -74,9 +75,16 @@ function onChatCompletions (ctx) {
 
     if (isStream) {
       outputEvaluation ??= interceptStream(body, chunks => {
-        return getStreamedChatCompletionsOutputMessages(chunks)
-          .map(message => [...inputMessages, message])
-      }, ctx)
+        if (!isEnabled) return
+        const conversations = decode(
+          () => getStreamedChatCompletionsOutputMessages(chunks)
+            .map(message => [...inputMessages, message]),
+          null,
+          'AIGuard: unable to decode the streamed OpenAI response: %s'
+        )
+        if (!conversations?.length) return
+        return evaluate(ctx, aiguard, conversations, opts)
+      })
       return outputEvaluation
     }
 
@@ -112,9 +120,15 @@ function onResponses (ctx) {
 
     if (isStream) {
       outputEvaluation ??= interceptStream(body, chunks => {
-        const outputMessages = getStreamedResponsesOutputMessages(chunks)
-        return outputMessages.length ? [[...inputMessages, ...outputMessages]] : []
-      }, ctx)
+        if (!isEnabled) return
+        const outputMessages = decode(
+          () => getStreamedResponsesOutputMessages(chunks),
+          null,
+          'AIGuard: unable to decode the streamed OpenAI response: %s'
+        )
+        if (!outputMessages?.length) return
+        return evaluate(ctx, aiguard, [[...inputMessages, ...outputMessages]], opts)
+      })
       return outputEvaluation
     }
 
@@ -130,54 +144,4 @@ function onResponses (ctx) {
   }
 }
 
-/**
- * Uses the OpenAI SDK's stream splitting support to evaluate one branch and return the other.
- *
- * @param {object} stream
- * @param {(chunks: Array<object>) => Array<Array<object>>} getConversations
- * @param {object} ctx
- * @returns {object|Promise<object>}
- */
-function interceptStream (stream, getConversations, ctx) {
-  if (typeof stream?.tee !== 'function') return stream
-
-  let branches
-  try {
-    branches = stream.tee()
-  } catch {
-    return stream
-  }
-
-  const [evaluationStream, resultStream] = branches
-  return drainStream(evaluationStream).then(chunks => {
-    if (!isEnabled) return resultStream
-    const conversations = decode(
-      () => getConversations(chunks),
-      null,
-      'AIGuard: unable to decode the streamed OpenAI response: %s'
-    )
-    if (!conversations?.length) return resultStream
-    return evaluate(ctx, aiguard, conversations, opts).then(() => resultStream)
-  }, () => resultStream)
-}
-
-/**
- * @param {object} stream
- * @returns {Promise<Array<object>>}
- */
-function drainStream (stream) {
-  const chunks = []
-  const iterator = stream[Symbol.asyncIterator]()
-
-  function readAll () {
-    return iterator.next().then(({ done, value }) => {
-      if (done) return chunks
-      chunks.push(value)
-      return readAll()
-    })
-  }
-
-  return readAll()
-}
-
 module.exports = { enable, disable }

package/packages/dd-trace/src/aiguard/integrations/stream.js

@@ -0,0 +1,60 @@
+'use strict'
+
+const log = require('../../log')
+
+/**
+ * Splits an SDK stream, consumes one branch, and returns the other after inspection.
+ *
+ * @param {object} stream
+ * @param {(chunks: Array<object>) => void|Promise<void>} inspect
+ * @returns {object|Promise<object>}
+ */
+function interceptStream (stream, inspect) {
+  if (typeof stream?.tee !== 'function') return stream
+
+  try {
+    const [inspectionStream, resultStream] = stream.tee()
+    return drainStream(inspectionStream).then(chunks => {
+      return Promise.resolve(inspect(chunks)).then(() => resultStream)
+    })
+  } catch {
+    return stream
+  }
+}
+
+/**
+ * Buffers the whole stream. A stream that ends early still yields what it delivered: truncated
+ * output can carry the very violation the evaluation is looking for, so it is judged rather than
+ * skipped, and the read failure is logged because nothing downstream reports it.
+ *
+ * @param {object} stream
+ * @returns {Promise<Array<object>>}
+ */
+function drainStream (stream) {
+  const chunks = []
+  const iterator = stream[Symbol.asyncIterator]()
+
+  function onReadError (error) {
+    log.error('AIGuard: the streamed response ended after %s chunks: %s', chunks.length, error)
+    return chunks
+  }
+
+  function readAll () {
+    let next
+    try {
+      next = iterator.next()
+    } catch (error) {
+      return Promise.resolve(onReadError(error))
+    }
+
+    return next.then(({ done, value }) => {
+      if (done) return chunks
+      chunks.push(value)
+      return readAll()
+    }, onReadError)
+  }
+
+  return readAll()
+}
+
+module.exports = { interceptStream }