tPjUddlZddlZddlZddlmZmZmZddlmZmZddl m Z m Z ddl m Z mZmZmZmZmZddlmZddlZddlmZddlmZdd lmZdd lmZdd lmZdd lm Z m!Z!dd l"m#Z#ddl$m%Z%ddl$m&Z'ddl(m)Z)ddl*m+Z+ddl,m-Z-ddl.m/Z/ddl0m1Z1ddl2m3Z3ddl4m5Z5ddl6m7Z7ddl8m9Z9ddl:m;Z;mZ>m?Z?ddl@m&ZAddlBmCZCmDZDmEZEmFZFmGZGmHZHe rddlImJZKGddeZLde3d d!fd"ZMe?jjeCe?jjeEe?jjeFe?jjeGe?jjeDe?jjeHe?jje'e?jjeAiZWeeXd#<ejd$ZZeeXd%<e?jje#e?jje%e?jje)e?jje+e?jje-e?jje/iZ[ee\e]e^efeXd&<d'Z_d(Z`e[je`e_ZbeeXd)<eWjebGd*d+Zcd,ed-e>d dfd.ZdGd/d0ZeeeZfeeXd1<ejZheeXd2<y)3N)CallableIteratorMapping)datetimetimezone)chaincount) TYPE_CHECKINGFinalLiteralOptionalProtocolcast)ValidationError)Router)verbose_proxy_logger)uuid)CustomGuardrail) safe_dumps).effective_scan_only_tool_results_for_guardrail)effective_skip_tool_message_for_guardrail)BedrockGuardrail)GraySwanGuardrail)initialize_guardrail)lakeraAI_Moderation)LakeraAIGuardrail)_OPTIONAL_PresidioPIIMasking)ToolPermissionGuardrail)get_instance_fn) PrismaClient) TableActions)GuardrailsRepository) get_secret) GuardrailGuardrailEventHooksLakeraCategoryThresholds LitellmParamsSupportedGuardrailIntegrations)initialize_bedrockinitialize_hide_secretsinitialize_lakerainitialize_lakera_v2initialize_presidioinitialize_tool_permission)modelsc>eZdZedefdZdeeeeffdZ y)_GuardrailRowLikereturncyNselfs p/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/guardrails/guardrail_registry.py guardrail_idz_GuardrailRowLike.guardrail_idFs#&cyr5r6r7s r9__iter__z_GuardrailRowLike.__iter__Hsr;N) __name__ __module__ __qualname__propertystrr:rtupleobjectr=r6r;r9r2r2Es+ &c&&;(5f#56;r;r2 prisma_clientr3z3TableActions[prisma_models.LiteLLM_GuardrailsTable]c,t|jS)zLTyped view of the guardrails table actions exposed by the Prisma repository.)r"table)rEs r9_guardrail_tablerHKs  . 4 44r;guardrail_initializer_registryz$625f63f4-935a-50e5-98b5-fbe77babc74aCONFIG_GUARDRAIL_ID_NAMESPACEguardrail_class_registryc ji} tjjt}tjj |d}tjj |st jd|Stj|D]b}tjj ||}tjj|r|jdrUtjj |d}tjj |sd|} t jd|tj|}t|dr]t|dd}t|t rt|j#|t jd |t%|j'n4t|d r(t|d d} | ||<t jd |et jdt/|t%|j'|S#t($r"} t j*d || Yd} ~ d} ~ wt,$r"} t j*d || Yd} ~ d} ~ wwxYw#t,$r!} t j*d| Yd} ~ |Sd} ~ wwxYw)a Get guardrail initializers by discovering them from the guardrail_hooks directory structure. Scans the guardrail_hooks directory for subdirectories containing __init__.py files with either guardrail_initializer_registry or initialize_guardrail functions. Returns: Dict[str, Callable]: A dictionary mapping guardrail types to their initializer functions guardrail_hooks#guardrail_hooks directory not found__ __init__.py)litellm.proxy.guardrails.guardrail_hooks.Discovering guardrails in: %srINz.Found guardrail_initializer_registry in %s: %srz)Found initialize_guardrail function in %sCould not import %s: %sError processing %s: %sz(Discovered %s guardrail initializers: %s,Error discovering guardrail initializers: %s)ospathdirname__file__joinexistsrdebuglistdirisdir startswith importlib import_modulehasattrgetattr isinstancedictupdatelistkeys ImportErrorerror Exceptionlen) discovered_initializers current_dir hooks_diritem item_path init_file module_pathmoduleregistry initialize_fnes r9$get_guardrail_initializer_from_hooksrxgsO&(=VWW__X6 77<< 5FG ww~~i( & &'L M* *JJy)* D Y5I77==+tt/D Y >I77>>),EdVLK $**+JKX"00=6#CDT[ @$UH"(D1/66x@,22Lk[_`h`m`m`o[p V%;I77>>),EdVLK $**+JKX"00=6#=>KR :DLH"(D1*11(;7" N  $**+DkSTU $../H+WXY  V""#QSTUU Vs\A8G/>B.G/-A%FG/ G,!F>8G/> G, G'!G/'G,,G// H8HH_discovered_initializersceZdZdZdZdededzfdZdede fd Z d ede fd Z d edede fd Z e de deefd Zd ede dedzfdZdede dedzfdZy)GuardrailRegistryzi Registry for guardrails Handles adding, removing, and getting guardrails in DB + in memory cyr5r6r7s r9__init__zGuardrailRegistry.__init__s r;guardrail_namer3Nctjjt}|D]&}t |ts|j |k(s$|cSy)zW Returns the initialized guardrail callback for a given guardrail name ) callback_typeN)litellmlogging_callback_managerget_custom_loggers_for_typerrdr)r8ractive_guardrailsactive_guardrails r9"get_initialized_guardrail_callbackz4GuardrailRegistry.get_initialized_guardrail_callbacksS$<<XXgvXw 1 , *O<#22nD++ ,r; guardrailrEc FK |jd}|jdi}t|dr|j}n|r t|ni}t |}t |jdi}t |j |||tjtjtjtjdd{}t|} |j| d<| S7 #t$r} td | d} ~ wwxYww) z1 Add a guardrail to the database rlitellm_params model_dumpguardrail_info)rrr created_at updated_at)dataNr:zError adding guardrail to DB: ) getrbrrerrHcreaternowrutcr:rk) r8rrErlitellm_params_objlitellm_params_dictrrcreated_guardrailguardrail_dictrws r9add_guardrail_to_dbz%GuardrailRegistry.add_guardrail_to_dbs B$-MM2B$CN(1 6F(K )<8&8&C&C&E#BTd+=&>Z\#)34G)HN)3IMMBRTV4W)XNAQQ^@_@f@f&4&4&4"*,,x||"<"*,,x||"< AgA; %)ON->-K-KN> *! !; Bso F"=188P\?]8^ ^ ^L>9NOP P _ F@DE E Fs0A 31 3A3 AA  AAc K |jd}|jdi}t|dr|j}n|r t|ni}t |}t |jdi}t |j d|i|||tjtjdd{} | td |t| S7#t$r} td | d} ~ wwxYww) z4 Update a guardrail in the database rrrrr:)rrrr)rrNz)Guardrail not found, passed guardrail_id=z Error updating guardrail in DB: ) rrbrrerrHrfrrrr ValueErrorrk) r8r:rrErrrrrupdated_guardrailrws r9update_guardrail_in_dbz(GuardrailRegistry.update_guardrail_in_dbJs D$-MM2B$CN(1 6F(K )<8&8&C&C&E#BTd+=&>Z\#)34G)HN)3IMMBRTV4W)XNHXXeGfGmGm%|4&4&4&4"*,,x||"< HnHB !( #L\N![\\)* *B D>qcBC C Ds;DB+C99C>>Dc K t|jddiddid{}g}|D]%}|jtdit |'|S72#t $r}t d|d}~wwxYww) z Get all active guardrails from the database. Only rows with status == "active" are returned (pending_review and rejected are excluded). statusactiverdesc)rorderNz"Error getting guardrails from DB: r6)rH find_manyappendr$rerk)rEguardrails_from_db guardrailsrrws r9get_all_guardrails_from_dbz,GuardrailRegistry.get_all_guardrails_from_dbks F.>}.M.W.W*#V,/X/)  24J/ B !!)"@tI"@A B ) F@DE E Fs8A;#AA1AA;A A8%A33A88A;cK t|jd|id{}|sytdit|S7#t$r}t d|d}~wwxYww)z= Get a guardrail by its ID from the database r:rN!Error getting guardrail from DB: r6rH find_uniquer$rerk)r8r:rErrws r9get_guardrail_by_id_from_dbz-GuardrailRegistry.get_guardrail_by_id_from_dbsr E%5m%D%P%PXfhtWu%P%vvI1Y1 1 w  E?sCD D EAA! AAAA!AA!A A AAA!cK t|jd|id{}|sytdit|S7#t$r}t d|d}~wwxYww)z? Get a guardrail by its name from the database rrNrr6r)r8rrErrws r9get_guardrail_by_name_from_dbz/GuardrailRegistry.get_guardrail_by_name_from_dbsy E%5m%D%P%P'8&Q& I1Y1 1  E?sCD D Er)r>r?r@__doc__rrBrrr$r rrr staticmethodrgrrrr6r;r9rrs   [_I_  B9 B\ BD F3 F| FDDDcoDBF#F iFF* Ec ER^ Ecloscs EE#EVbEgpswgwEr;rinstancerc|jt|j|_|jt|j|_yy)a.Override the parallel/raw-scan flags only when ``litellm_params`` explicitly sets them, preserving whatever default the guardrail's own constructor chose otherwise (its constructor default may be True, so blindly copying an absent/None config value would silently clobber it back to False).N)run_in_parallelboolscan_raw_request)rrs r9 _apply_configured_bool_overridesrsG %%1#'(F(F#G &&2$()H)H$I!3r;c eZdZdZdZdedefdZ d!dededzd ed d e d dedzf d Z d"dedede dedzde dzf dZ d#deded e d ddfdZdeddfdZdeefdZdededzfdZdede d dzfdZdeefdZdededzfdZdeedeefdZede eeefzdzdeeefdzfdZdededefdZ d$dededzd e d dedzfdZd"dededzdedzfd Zy)%InMemoryGuardrailHandlerz[ Class that handles initializing guardrails and adding them to the CallbackManager c2i|_ i|_ i|_yr5)IN_MEMORY_GUARDRAILS guardrail_id_to_custom_guardrail_sourcesr7s r9rz!InMemoryGuardrailHandler.__init__s.:<! TV- =?  r;rr3c~tffdtdD}d|D}tfd|DS)Nc3,K|] }d| yw):Nr6).0 occurrencers r9 z@InMemoryGuardrailHandler._stable_guardrail_id..s0mV`N3C1ZL1Q0msr)c 3K|]6}ttjt|j d8yw)zutf-8N)rBruuid5rJencode)rseeds r9rz@InMemoryGuardrailHandler._stable_guardrail_id..s,wimDJJ/LdkkZaNb$c dws<>c3@K|]}|jvs|ywr5)r)r candidate_idr8s r9rz@InMemoryGuardrailHandler._stable_guardrail_id..st\lZ^ZsZsFsLts)rr next)r8rseeds candidate_idss`` r9_stable_guardrail_idz-InMemoryGuardrailHandler._stable_guardrail_ids;n.0mdijkdl0mnwqvw t]tttr;Nrconfig_file_path llm_routerrsource)dbconfigc |jdxs|j|d}||d<||jvr3tjd||j |<|j|Sd}|d}tjd|t |tr tdi|}n|}d|vr|drtdi|d} | |_ |jr>|jjdr#tt|j|_ |jr>|jjdr#tt|j|_|j } | t#d t$j| } | r8d dl} | j)| } d | j*vr | |||}nB| ||}n8t | trd | vr|j-|| || }nt#d| |ydD]}t/||t1||dt3|}|r"|j5st#d|dd|rt7|rt#d|ddt9||t;|jd|d||jd}||j|<||j<|<||j |<|S)z Initialize a guardrail from a dictionary and add it to the litellm callback manager Returns a Guardrail object if the guardrail is initialized successfully r:rz3guardrail_id already exists in IN_MEMORY_GUARDRAILSNrzlitellm_params= %scategory_thresholdsz os.environ/zguardrail_type is requiredrr.)rguardrail_typerrzUnsupported guardrail: ) skip_system_message_in_guardrailskip_tool_message_in_guardrailscan_only_tool_resultsrz: scan_only_tool_results is enabled, but this guardrail's role filtering never scans tool results, so no request content would ever be scanned. Remove scan_only_tool_results or the guardrail's role-filtering option.z: scan_only_tool_results and skip_tool_message_in_guardrail are enabled together, which excludes every message from scanning, so no request content would ever be scanned. Remove one of the two.r)r:rrrr6)rrrrr\rrdrer'r&rapi_keyr_rBr#api_baserrrIinspect signature parametersinitialize_custom_guardrailsetattrrcrsupports_scan_only_tool_resultsrrr$r)r8rrrrr:custom_guardrail_callbacklitellm_params_datarlakera_category_thresholdsr initializerrsig scoping_paramscan_only_tool_results_enabledparsed_guardrails r9rz-InMemoryGuardrailHandler.initialize_guardrails+(mmN;ut?X?XYbcsYt?u $0 .! 444 4 & &'\ ]+1DMM, ',,\: :<@!%./?%@""#79LM )4 0*A-@AN0N $7 7'>'I'I-'X&)*^5L5L*M&NN # . 8 8  !9: :;??O   **;7Cs~~-,7"-) -8 ,R)  ,1F(,(H(H#--!1 )I) %6~6FGH H $ 0" p 1='.ZgimBno  p 5c)5 *.6O6o6o6q  +;!< =>jj .2[\u2v  +;!< =>dd --F W"+"~6$%56)$==)9: # 3C!!,/>W--l;&, l#r;rrc|s tdtjd|t||}|j}|$t d|ddj t|j}t|dr|jd }n|r t|ni}d D]} |j| d|d|d ||d |} tjj| | S)z Initialize a Custom Guardrail from a python file or module path This initializes it by adding it to the litellm callback manager zTGuardrailsAIException - Please pass the config_file_path to initialize_guardrails_v2z!Initializing custom guardrail: %s)rNzmode is required for guardrail z* please set mode to one of the following: z, rT) exclude_none)rmode default_onr)r event_hookrr6)rkrr\rrrrZr%rrbrrepoprradd_litellm_callback) r8rrrr_guardrail_classrr extra_paramskey_guardrail_callbacks r9rz4InMemoryGuardrailHandler.initialize_custom_guardrail4s. rs s"" /  CR -=C %)) <1.1AAklpluluwJmKlLM +55 >< 0)44$4GL3A4/rL7 (C   S$ ' (&6& $%56!&  &  ((==>QR""r;r:c||j|<||j|<|jj|}|r3t t |jdi}|j |yy)z Update a guardrail in memory - updates the guardrail in memory - updates the guardrail params in litellm.callback_manager r)rN)rrrrrr'update_in_memory_litellm_params)r8r:rrrupdated_litellm_paramss r9update_in_memory_guardrailz3InMemoryGuardrailHandler.update_in_memory_guardrailjsn3<!!,/&, l#+/+P+P+T+TUa+b! $,0 N^`b@c,d " % E EUk E l %r;c|jj|d|jj|d|jj|d}|ytj j |y)a Delete a guardrail in memory and remove from litellm callbacks. The callback is purged from every callback list, not just litellm.callbacks: request handling promotes guardrail callbacks into the success/failure/async lists, so removing it from only litellm.callbacks leaves the old instance stranded in those lists on every re-initialization. N)rrrrrrremove_callback_from_all_lists)r8r:rs r9delete_in_memory_guardrailz3InMemoryGuardrailHandler.delete_in_memory_guardrail~sg !!%%lD9 ,-+/+P+P+T+TUacg+h! $ , ((GGHabr;cHt|jjS)z/ List all guardrails in memory )rgrvaluesr7s r9list_in_memory_guardrailsz2InMemoryGuardrailHandler.list_in_memory_guardrailssD--44677r;c8|jj|S)z7 Get a guardrail by its ID from memory )rrr8r:s r9get_guardrail_by_idz,InMemoryGuardrailHandler.get_guardrail_by_ids((,,\::r;c8|jj|S)zB Return the provenance of an in-memory guardrail. )rrr s r9 get_sourcez#InMemoryGuardrailHandler.get_sources}}  ..r;c|jjDcgc]&\}}|jj|dk(s%|(c}}Scc}}w)a4 List in-memory guardrails owned by config.yaml. DB-sourced entries are excluded: a read surface that also queries the DB would double-count live ones, and a DB-sourced entry that's missing from the DB is stale (deleted on another pod, awaiting reconciliation here). r)ritemsrr)r8gidgs r9list_config_guardrailsz/InMemoryGuardrailHandler.list_config_guardrailssC!% 9 9 ? ? Ahfc1T]]EVEVWZE[_gEghhhs &A A cv|jj|dk7ry|jj|S)z Get a config-owned in-memory guardrail by its ID, or None. Mirrors the fallback in get_guardrail_info: a DB-sourced in-memory entry that missed the DB lookup is stale and must not be surfaced. rN)rrrr s r9get_config_guardrail_by_idz3InMemoryGuardrailHandler.get_config_guardrail_by_ids5 ==  \ *h 6((,,\::r;db_guardrail_idsc|jjDcgc]\}}|dk(r||vr|}}}|D])}tjd||j |+|Scc}}w)aC Drop in-memory entries that originated from the DB but are no longer present in db_guardrail_ids. Config-loaded guardrails are never touched. Called by the periodic DB polling tick so that a guardrail deleted on another pod is eventually purged from this pod's memory + callbacks. rz]Reconcile: removing stale DB-backed guardrail '%s' from memory (deleted in DB by another pod))rrrinfor)r8rr:r stale_idss r9reconcile_db_guardrailsz0InMemoryGuardrailHandler.reconcile_db_guardrailss)- (;(;(= $ f~,6F"F   & :L % %o   + +L 9  :  sA&paramsc|yt|tr|jSt|tr tdi|jS|S#t$r"}t j d||cYd}~Sd}~wwxYw)aK Render litellm_params to a canonical dict so an in-memory LitellmParams and the raw dict loaded from the DB compare equal when they describe the same config. The in-memory side is a LitellmParams whose model_dump() carries every field default and coerces enums, while the DB side is the raw stored dict holding only the keys originally provided. Comparing those two shapes directly never matches, so each DB poll would re-initialize the guardrail forever; normalizing both through LitellmParams keeps the diff meaningful. NziCould not normalize guardrail litellm_params for comparison; treating the guardrail as changed. Error: %sr6)rdr'rrerrwarning)rrws r9(_normalize_litellm_params_for_comparisonzAInMemoryGuardrailHandler._normalize_litellm_params_for_comparisons > fm ,$$& & fd # $.v.99;; # $,,  sA A;A60A;6A; new_guardrailcL|jj|}|y|jd|jdk7ry|j|jd}|j|jd}i}|m|kt|j t|j z}|D]2}|j|} |j|} | | k7s+| | d||<4n ||k7rd||di}|rt j d|t|dkDS)z Check if guardrail params or name have changed compared to in-memory version. Returns True if params/name changed or guardrail doesn't exist in memory. Trr)oldnewz)Guardrail params changed. Differences: %sr)rrrsetrhrr\rl) r8r:rexisting existing_dictnew_dictchanged_fieldsall_keysrold_valnew_vals r9_has_guardrail_params_changedz6InMemoryGuardrailHandler._has_guardrail_params_changeds; 3377 E   <<( )]->->?O-P P $LLX\\ZjMkl GG HYHYZjHkl  $)=!-"4"4"67#hmmo:NNH K'++C0",,s+g%29'*JN3'  K h &. h0WXN  & &'RTb c>"Q&&r;c|jd}|stjdy|jj|}|jj||}||jvr|j | |j |||S#t$rU|Qtjd| |j |||#t$rtjd|YwxYwwxYw)a_ Force re-initialization of a guardrail even if it exists in memory. Removes old callback from litellm.callbacks and creates fresh instance. If the new config fails to initialize (e.g. an invalid on_flagged combination), the previous instance is restored rather than left deleted: initialize_guardrail's own ValueError/TypeError propagate uncaught, so a caller reaching this point after already deleting the old instance would otherwise leave the guardrail providing no protection at all, not merely "still enforcing the old config." r:z2Cannot reinitialize guardrail without guardrail_idNrrrz\Reinitializing guardrail %s with updated params failed; restoring the previous configurationz+Restoring previous guardrail %s also failed) rrrjrrrrrkrz)r8rrrr:previous_guardrailprevious_sources r9reinitialize_guardrailz/InMemoryGuardrailHandler.reinitialize_guardrail s "(mmN;  & &'[ \$($=$=$A$A,$O!%!2!2<!H 444 4  + +L 9  ,,ySclr,s s !-$..r p--"4GW`o. !p(223`bno p  s0B!C37C  C3 C.+C3-C..C3cF|jd}|stjdy|j||r=|jdd}tjd|||j ||dSd|j |<|jj|S) z Sync a guardrail from DB - initializes if new, re-initializes if changed. This is the method to call during DB polling. r:z*Cannot sync guardrail without guardrail_idNrUnknownz:Guardrail '%s' (ID: %s) params changed, re-initializing...rr+)rrrjr)rr.rr)r8rrr:rs r9sync_guardrail_from_dbz/InMemoryGuardrailHandler.sync_guardrail_from_db=s (mmN;  & &'S T  - -lI F$-MM2BI$NN % %Ln^j ..#!1/ '+ l#((,,\::r;)NNrr5)r)Nr) r>r?r@rrrBrr$r r rr'rrrrrgrr r rrr!rrrrDrrr)r.r1r6r;r9rrsc $u3u3u(,)-*2 k k *k X& k ' k T  k d(, 4#4#4#& 4# * 4# 4  4#t+/ mmm' m  m(csctc&84 ?8 ;; D8H; /s/w~/F/M/ iYi ;s ;y4?O ;CT#Y*V 44t; f  $6"'#"'i"'\`"'N(,*2 ..*.' . T  .`; ;SSWZ;closcs;r;rIN_MEMORY_GUARDRAIL_HANDLERGUARDRAIL_RECONCILE_LOCK)iasyncior`rVcollections.abcrrrrr itertoolsrr typingr r r r rrpydanticrrrlitellm._loggingr litellm._uuidr%litellm.integrations.custom_guardrailr*litellm.litellm_core_utils.safe_json_dumpsr1litellm.llms.base_llm.guardrail_translation.utilsrr;litellm.proxy.guardrails.guardrail_hooks.bedrock_guardrailsr1litellm.proxy.guardrails.guardrail_hooks.grayswanrrinitialize_grayswan2litellm.proxy.guardrails.guardrail_hooks.lakera_air5litellm.proxy.guardrails.guardrail_hooks.lakera_ai_v2r1litellm.proxy.guardrails.guardrail_hooks.presidior8litellm.proxy.guardrails.guardrail_hooks.tool_permissionrlitellm.proxy.types_utils.utilsrlitellm.proxy.utilsr %litellm.repositories.prisma_protocolsr!'litellm.repositories.table_repositoriesr"litellm.secret_managers.mainr#litellm.types.guardrailsr$r%r&r'r(guardrail_hooks.llm_as_a_judgeinitialize_llm_as_a_judgeguardrail_initializersr*r+r,r-r.r/prismar0 prisma_modelsr2rHBEDROCKvalueLAKERA LAKERA_V2PRESIDIO HIDE_SECRETSTOOL_PERMISSIONGRAYSWANLLM_AS_A_JUDGErI__annotations__UUIDrJrKrerBtyperxr|rfr}rrrr2Lockr3r6r;r9r]s 77'"JJ$1AASS<,>H3.<< 5L55j5 #**002D"))//1B",,224H"++113F"//557N"2288:T"++113F"11779R ) (1tyy1W'XuX#**002B"++113D"))//1D",,224E"++113O"2288:Q E%S$*?%? @AK#\@F > @A#G"H%H%%&>?\E\E~JJP]JbfJk;k;b &>%?U?".',,.%0r;