dd-trace 6.9.0 → 6.11.0

package/packages/dd-trace/src/aiguard/integrations/anthropic.js

@@ -0,0 +1,70 @@
+'use strict'
+
+const { channel } = require('dc-polyfill')
+
+const log = require('../../log')
+const { getMessagesInputMessages, getMessagesOutputMessages } = require('../messages/anthropic')
+const { SOURCE_AUTO } = require('../tags')
+const { pushEvaluation } = require('./evaluate')
+
+const messagesBeforeChannel = channel('dd-trace:anthropic:messages:before')
+const messagesAfterChannel = channel('dd-trace:anthropic:messages:after')
+
+let isEnabled = false
+let aiguard
+let opts
+
+/**
+ * Subscribes AI Guard to Anthropic lifecycle channels.
+ *
+ * @param {object} aiguardInstance
+ * @param {boolean} block
+ */
+function enable (aiguardInstance, block) {
+  if (isEnabled) return
+
+  aiguard = aiguardInstance
+  opts = { block, source: SOURCE_AUTO, integration: 'anthropic' }
+
+  messagesBeforeChannel.subscribe(onMessagesBefore)
+  messagesAfterChannel.subscribe(onMessagesAfter)
+
+  isEnabled = true
+}
+
+function disable () {
+  if (!isEnabled) return
+
+  messagesBeforeChannel.unsubscribe(onMessagesBefore)
+  messagesAfterChannel.unsubscribe(onMessagesAfter)
+
+  aiguard = undefined
+  opts = undefined
+  isEnabled = false
+}
+
+function onMessagesBefore (ctx) {
+  pushEvaluation(ctx, aiguard, getMessagesInputMessages(ctx.args?.[0]), opts)
+}
+
+function onMessagesAfter (ctx) {
+  const inputMessages = getMessagesInputMessages(ctx.args?.[0])
+  if (!inputMessages?.length) return
+
+  let body = ctx.body
+  if (typeof body === 'string') {
+    try {
+      body = JSON.parse(body)
+    } catch {
+      log.error('AIGuard: unable to decode Anthropic response body')
+      return
+    }
+  }
+
+  const outputMessages = getMessagesOutputMessages(body)
+  if (!outputMessages.length) return
+
+  pushEvaluation(ctx, aiguard, [...inputMessages, ...outputMessages], opts)
+}
+
+module.exports = { enable, disable }

package/packages/dd-trace/src/aiguard/integrations/index.js

@@ -1,5 +1,6 @@
 'use strict'
 
+const anthropic = require('./anthropic')
 const openai = require('./openai')
 const vercelAi = require('./vercel-ai')
 
@@ -14,6 +15,7 @@ let isEnabled = false
 function enable (aiguard, block) {
   if (isEnabled) return
 
+  anthropic.enable(aiguard, block)
   openai.enable(aiguard, block)
   vercelAi.enable(aiguard, block)
 
@@ -23,12 +25,14 @@ function enable (aiguard, block) {
 function disable () {
   vercelAi.disable()
   openai.disable()
+  anthropic.disable()
   isEnabled = false
 }
 
 module.exports = {
   enable,
   disable,
+  anthropic,
   openai,
   vercelAi,
 }

package/packages/dd-trace/src/aiguard/messages/anthropic.js

@@ -0,0 +1,423 @@
+'use strict'
+
+const { FILE_FALLBACK, IMAGE_FALLBACK, stringifyOrEmpty } = require('./utils')
+/**
+ * Converts an Anthropic image block to an `image_url` content part.
+ *
+ * @param {object} block
+ * @returns {{type: 'image_url', image_url: {url: string}}|undefined}
+ */
+function convertAnthropicImageBlock (block) {
+  const source = block.source
+  if (!source || typeof source !== 'object') return
+  if (source.type === 'url' && typeof source.url === 'string') {
+    return { type: 'image_url', image_url: { url: source.url } }
+  }
+  if (source.type === 'base64' && typeof source.data === 'string' && typeof source.media_type === 'string') {
+    return { type: 'image_url', image_url: { url: `data:${source.media_type};base64,${source.data}` } }
+  }
+}
+
+/**
+ * Extracts the body content from a document block's source.
+ * Inline `text` and `content` sources are normalized to their actual text; URL sources return the
+ * URL; base64 / unknown sources return undefined (no readable body).
+ *
+ * @param {object|undefined} source
+ * @returns {string|Array<object>|undefined}
+ */
+function extractDocumentSource (source) {
+  if (!source) return
+  // PlainTextSource stores inline text in `data`, not `text`.
+  if (source.type === 'text' && typeof source.data === 'string') return source.data
+  if (source.type === 'url' && typeof source.url === 'string') return source.url
+  if (source.type === 'content') {
+    // ContentBlockSource.content is string | Array<ContentBlockSourceContent>.
+    if (typeof source.content === 'string') return source.content
+    if (Array.isArray(source.content)) return convertAnthropicBlocksToContent(source.content)
+  }
+}
+
+/**
+ * Combines model-visible metadata strings with an extracted body. When the body has images the
+ * metadata becomes leading text parts and an array is returned; otherwise the metadata and a string
+ * body are newline-joined. Returns undefined when there is nothing to include.
+ *
+ * @param {Array<string>} metadata
+ * @param {string|Array<object>|undefined} body
+ * @returns {string|Array<object>|undefined}
+ */
+function combineMetadataWithBody (metadata, body) {
+  if (Array.isArray(body)) {
+    const parts = metadata.map(text => ({ type: 'text', text }))
+    for (const part of body) parts.push(part)
+    return parts
+  }
+
+  const lines = [...metadata]
+  if (typeof body === 'string') lines.push(body)
+  return lines.length ? lines.join('\n') : undefined
+}
+
+/**
+ * Extracts text from an Anthropic document block. The model-visible `title` and `context` are
+ * combined with the source body so prompt-injections placed in document metadata — not just its
+ * content — reach AI Guard. base64 / unknown sources fall back to the metadata or [file].
+ *
+ * @param {object} block
+ * @returns {string|Array<object>}
+ */
+function convertAnthropicDocumentBlock (block) {
+  const metadata = []
+  if (typeof block.title === 'string' && block.title) metadata.push(block.title)
+  if (typeof block.context === 'string' && block.context) metadata.push(block.context)
+
+  return combineMetadataWithBody(metadata, extractDocumentSource(block.source)) ?? FILE_FALLBACK
+}
+
+/**
+ * @param {Array<object>} items
+ * @param {string|Array<object>|undefined} content
+ */
+function appendContent (items, content) {
+  if (Array.isArray(content)) {
+    for (const part of content) items.push(part)
+  } else if (content !== undefined) {
+    items.push({ type: 'text', text: content })
+  }
+}
+
+/**
+ * Walks Anthropic content blocks once and emits normalized content and tool events in source order.
+ *
+ * `search_result` blocks have their text inside `content: Array<TextBlockParam>`,
+ * not a top-level `text` field; they are walked explicitly so RAG-injected text
+ * reaches AI Guard for evaluation.
+ * `thinking` / `redacted_thinking` are dropped — internal reasoning must not reach
+ * AI Guard. Unknown block types fall through to a best-effort `text`-field extraction;
+ * purely structural blocks without a `text` field are dropped silently.
+ *
+ * @param {Array<object>} blocks
+ * @returns {Array<object>}
+ */
+function walkContentBlocks (blocks) {
+  const items = []
+  if (!Array.isArray(blocks)) return items
+
+  for (const block of blocks) {
+    if (!block || typeof block !== 'object') continue
+    switch (block.type) {
+      case 'text':
+        if (typeof block.text === 'string') items.push({ type: 'text', text: block.text })
+        break
+      case 'image': {
+        const image = convertAnthropicImageBlock(block)
+        if (image) {
+          items.push(image)
+        } else {
+          items.push({ type: 'text', text: IMAGE_FALLBACK })
+        }
+        break
+      }
+      case 'document': {
+        appendContent(items, convertAnthropicDocumentBlock(block))
+        break
+      }
+      case 'tool_use':
+      case 'server_tool_use':
+      case 'mcp_tool_use':
+        // server_tool_use / mcp_tool_use are the built-in- and MCP-tool counterparts of tool_use.
+        items.push({
+          kind: 'tool_call',
+          value: {
+            id: block.id ?? block.name,
+            function: {
+              name: block.name,
+              arguments: stringifyOrEmpty(block.input),
+            },
+          },
+        })
+        break
+      case 'tool_result':
+        items.push({
+          kind: 'tool_result',
+          value: {
+            role: 'tool',
+            tool_call_id: block.tool_use_id,
+            content: convertAnthropicToolResultContent(block.content),
+          },
+        })
+        break
+      case 'search_result': {
+        // title and source are required, model-visible strings; include them so a prompt injection
+        // placed in the metadata (not only the content) reaches AI Guard for evaluation.
+        const metadata = []
+        if (typeof block.title === 'string' && block.title) metadata.push(block.title)
+        if (typeof block.source === 'string' && block.source) metadata.push(block.source)
+        appendContent(items, combineMetadataWithBody(metadata, convertAnthropicBlocksToContent(block.content)))
+        break
+      }
+      case 'web_fetch_tool_result': {
+        // Emit as a tool result (like other *_tool_result blocks) so the call -> result -> final-text
+        // timeline is preserved and the fetched document isn't merged into the assistant answer.
+        const content = block.content
+        const resultContent = content?.type === 'web_fetch_result' && content.content
+          ? convertAnthropicDocumentBlock(content.content)
+          : convertServerToolResultContent(content)
+        items.push({
+          kind: 'tool_result',
+          value: {
+            role: 'tool',
+            tool_call_id: block.tool_use_id,
+            content: resultContent,
+          },
+        })
+        break
+      }
+      case 'thinking':
+      case 'redacted_thinking':
+        break
+      default:
+        if (typeof block.type === 'string' && block.type.endsWith('_tool_result')) {
+          items.push({
+            kind: 'tool_result',
+            value: {
+              role: 'tool',
+              tool_call_id: block.tool_use_id,
+              content: convertServerToolResultContent(block.content),
+            },
+          })
+        } else if (typeof block.text === 'string') {
+          items.push({ type: 'text', text: block.text })
+        }
+        break
+    }
+  }
+  return items
+}
+
+/**
+ * Reduces walker `parts` to normalized message content: a plain string when
+ * only text is present, an array of content parts when images are present,
+ * or `undefined` when there is nothing to render.
+ *
+ * @param {Array<object>} parts
+ * @param {boolean} hasImages
+ * @returns {string|Array<object>|undefined}
+ */
+function partsToContent (parts, hasImages) {
+  if (!parts.length) return
+  if (hasImages) return parts
+  return parts.map(p => p.text).join('\n')
+}
+
+/**
+ * @param {Array<object>} parts
+ * @returns {boolean}
+ */
+function hasImageParts (parts) {
+  return parts.some(part => part.type === 'image_url')
+}
+
+/**
+ * Converts Anthropic top-level `system` to a normalized system message.
+ *
+ * @param {string|Array<object>|undefined} system
+ * @returns {{role: 'system', content: string|Array<object>}|undefined}
+ */
+function convertAnthropicSystem (system) {
+  if (typeof system === 'string') {
+    return system.length ? { role: 'system', content: system } : undefined
+  }
+  const content = convertAnthropicBlocksToContent(system)
+  if (content != null) return { role: 'system', content }
+}
+
+/**
+ * Converts a plain string or array of Anthropic content blocks into normalized message content.
+ *
+ * @param {string|Array<object>|undefined} blocks
+ * @returns {string|Array<object>|undefined}
+ */
+function convertAnthropicBlocksToContent (blocks) {
+  if (typeof blocks === 'string') return blocks
+  const parts = []
+  for (const item of walkContentBlocks(blocks)) {
+    if (!item.kind) parts.push(item)
+  }
+  return partsToContent(parts, hasImageParts(parts))
+}
+
+/**
+ * Converts an Anthropic tool_result block's content into a message content value.
+ *
+ * @param {string|Array<object>|undefined} content
+ * @returns {string|Array<object>}
+ */
+function convertAnthropicToolResultContent (content) {
+  return convertAnthropicBlocksToContent(content) ?? stringifyOrEmpty(content)
+}
+
+/**
+ * @param {unknown} content
+ * @returns {string}
+ */
+function convertServerToolResultContent (content) {
+  if (typeof content === 'string') return content || '[tool result]'
+  if (!content || typeof content !== 'object') return '[tool result]'
+  if (typeof content.error_code === 'string') {
+    return content.error_message ? `${content.error_code}: ${content.error_message}` : content.error_code
+  }
+
+  const lines = []
+  if (Array.isArray(content)) {
+    for (const item of content) {
+      if (!item || typeof item !== 'object') continue
+      // text blocks (MCP / generic), then web-search title + url.
+      if (typeof item.text === 'string') lines.push(item.text)
+      if (typeof item.title === 'string') lines.push(item.title)
+      if (typeof item.url === 'string') lines.push(item.url)
+    }
+  } else {
+    if (typeof content.stdout === 'string' && content.stdout) lines.push(content.stdout)
+    if (typeof content.stderr === 'string' && content.stderr) lines.push(content.stderr)
+    if (typeof content.content === 'string' && content.content) lines.push(content.content)
+    if (Array.isArray(content.lines)) {
+      for (const line of content.lines) {
+        if (typeof line === 'string') lines.push(line)
+      }
+    }
+  }
+
+  return lines.join('\n') || '[tool result]'
+}
+
+/**
+ * @param {Array<object>} messages
+ * @param {string} role
+ * @param {Array<object>} parts
+ * @param {Array<object>} toolCalls
+ */
+function appendPendingMessage (messages, role, parts, toolCalls) {
+  const content = partsToContent(parts, hasImageParts(parts))
+  if (content == null && !toolCalls.length) return
+
+  const message = { role }
+  if (content != null) message.content = content
+  if (toolCalls.length) message.tool_calls = toolCalls
+  messages.push(message)
+}
+
+/**
+ * Converts one turn's worth of content blocks (with no mid_conv_system among them) to normalized
+ * messages under a single role.
+ *
+ * Contiguous tool calls are grouped into one assistant message for parallel calls. Each tool result
+ * with pending calls flushes those calls first, preserving sequential server-tool cycles. Standalone
+ * user-supplied tool results remain ahead of accompanying user text.
+ *
+ * @param {string} role
+ * @param {Array<object>} blocks
+ * @returns {Array<object>}
+ */
+function convertContentSegment (role, blocks) {
+  const messages = []
+  let parts = []
+  let toolCalls = []
+
+  for (const item of walkContentBlocks(blocks)) {
+    if (item.kind === 'tool_call') {
+      toolCalls.push(item.value)
+    } else if (item.kind === 'tool_result') {
+      if (toolCalls.length) {
+        appendPendingMessage(messages, role, parts, toolCalls)
+        parts = []
+        toolCalls = []
+      }
+      messages.push(item.value)
+    } else {
+      parts.push(item)
+    }
+  }
+
+  appendPendingMessage(messages, role, parts, toolCalls)
+  return messages
+}
+
+/**
+ * Converts a single Anthropic message to zero or more normalized messages.
+ *
+ * `mid_conv_system` blocks carry system-level instructions inserted at a point in the turn; each
+ * becomes its own `{ role: 'system' }` message in place, so the content around it keeps its role
+ * and chronology instead of the instruction being folded into (and mis-scored as) user/assistant
+ * text. See {@link convertContentSegment} for how each surrounding segment is converted.
+ *
+ * @param {{role: string, content: string|Array<object>}} message
+ * @returns {Array<object>}
+ */
+function convertAnthropicMessage (message) {
+  if (!message || typeof message !== 'object') return []
+  const { role, content } = message
+
+  if (typeof content === 'string') {
+    return content.length ? [{ role, content }] : []
+  }
+  if (!Array.isArray(content)) return []
+
+  const messages = []
+  let segment = []
+  for (const block of content) {
+    if (block?.type === 'mid_conv_system') {
+      for (const converted of convertContentSegment(role, segment)) messages.push(converted)
+      segment = []
+      const systemContent = convertAnthropicBlocksToContent(block.content)
+      if (systemContent != null) messages.push({ role: 'system', content: systemContent })
+    } else {
+      segment.push(block)
+    }
+  }
+  for (const converted of convertContentSegment(role, segment)) messages.push(converted)
+  return messages
+}
+
+/**
+ * Extracts input messages from an Anthropic `messages.create` call.
+ *
+ * @param {{system?: string|Array<object>, messages?: Array<object>}|undefined} callArgs
+ * @returns {Array<object>|undefined}
+ */
+function getMessagesInputMessages (callArgs) {
+  const raw = callArgs?.messages
+  if (!Array.isArray(raw)) return
+
+  const result = []
+  const system = convertAnthropicSystem(callArgs.system)
+  if (system) result.push(system)
+
+  for (const message of raw) {
+    const converted = convertAnthropicMessage(message)
+    for (const m of converted) result.push(m)
+  }
+
+  return result.length ? result : undefined
+}
+
+/**
+ * Extracts output messages from an Anthropic `messages.create` parsed response body.
+ *
+ * @param {{role?: string, content?: Array<object>}|undefined} body
+ * @returns {Array<object>}
+ */
+function getMessagesOutputMessages (body) {
+  if (!body || typeof body !== 'object') return []
+  const role = body.role || 'assistant'
+  return convertAnthropicMessage({ role, content: body.content })
+}
+
+module.exports = {
+  convertAnthropicSystem,
+  convertAnthropicBlocksToContent,
+  convertAnthropicMessage,
+  getMessagesInputMessages,
+  getMessagesOutputMessages,
+}

package/packages/dd-trace/src/aiguard/messages/openai.js

@@ -1,7 +1,6 @@
 'use strict'
 
-const FILE_FALLBACK = '[file]'
-const IMAGE_FALLBACK = '[image]'
+const { FILE_FALLBACK, IMAGE_FALLBACK, stringifyOrEmpty } = require('./utils')
 
 const OPENAI_RESPONSE_TOOL_CALL_TYPES = new Set([
   'apply_patch_call',
@@ -26,28 +25,6 @@ const OPENAI_RESPONSE_TOOL_OUTPUT_TYPES = new Set([
   'shell_call_output',
 ])
 
-/**
- * Returns the value as a string, JSON-stringifying it when it is not already a string.
- * Returns the value unchanged when it is `null` or `undefined`.
- *
- * @param {unknown} value
- * @returns {string|undefined|null}
- */
-function stringifyIfNeeded (value) {
-  if (value == null) return value
-  return typeof value === 'string' ? value : JSON.stringify(value)
-}
-
-/**
- * Returns a stringified value, falling back to an empty string for absent values.
- *
- * @param {unknown} value
- * @returns {string}
- */
-function stringifyOrEmpty (value) {
-  return stringifyIfNeeded(value) ?? ''
-}
-
 /**
  * Converts OpenAI chat-completions messages to the message format expected by AI Guard.
  *

package/packages/dd-trace/src/aiguard/messages/utils.js

@@ -0,0 +1,28 @@
+'use strict'
+
+const FILE_FALLBACK = '[file]'
+const IMAGE_FALLBACK = '[image]'
+
+/**
+ * @param {unknown} value
+ * @returns {string|undefined|null}
+ */
+function stringifyIfNeeded (value) {
+  if (value == null) return value
+  return typeof value === 'string' ? value : JSON.stringify(value)
+}
+
+/**
+ * @param {unknown} value
+ * @returns {string}
+ */
+function stringifyOrEmpty (value) {
+  return stringifyIfNeeded(value) ?? ''
+}
+
+module.exports = {
+  FILE_FALLBACK,
+  IMAGE_FALLBACK,
+  stringifyIfNeeded,
+  stringifyOrEmpty,
+}

package/packages/dd-trace/src/aiguard/messages/vercel-ai.js

@@ -1,16 +1,6 @@
 'use strict'
 
-/**
- * Returns the value as a string, JSON-stringifying it when it is not already a string.
- * Returns the value unchanged when it is `null` or `undefined`.
- *
- * @param {unknown} value
- * @returns {string|undefined|null}
- */
-function stringifyIfNeeded (value) {
-  if (value == null) return value
-  return typeof value === 'string' ? value : JSON.stringify(value)
-}
+const { stringifyIfNeeded } = require('./utils')
 
 /**
  * Converts a LanguageModelV2FilePart with an image mediaType to an AI Guard style image_url content part.