tPjbUddlZddlZddlZddlZddlmZddlmZmZmZm Z m Z m Z m Z ddl mZddlmZddlmZddlmZmZmZddlmZdd lmZmZmZmZdd lmZdd l m!Z!dd l"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z( dd l)m*Z*erddl,m-Z.eZ/e e0d<ddl1m2Z2m3Z3ddl4m5Z5m6Z6m7Z7m8Z8ejrdZ:e e0d<e;hdZ_GUARDRAIL_BLOCK_STATUS_CODESzThe user's latest message was flagged for {reason} by a content safety guardrail. This may be a false positive. Use your judgment: respond helpfully if the request is legitimate, or decline if it is not.DEFAULT_ADVISORY_MESSAGElitellm_guardrail_self_recordedF)default_guardrail_self_recordedereturnct|tryt|tttfryt #t|t r|j tvryy)a Returns True if the exception represents an intentional guardrail block (this was logged previously as an API failure - guardrail_failed_to_respond). Guardrails signal intentional blocks by raising: - GuardrailRaisedException (generic guardrail API, tool permission) - BlockedPiiEntityError (Presidio PII detection) - SensitiveDataRouteException (sensitive-data reroute to on-premise model) - HTTPException with a block-signalling status (400, 403, 422) - ModifyResponseException (passthrough mode violation) Only the statuses guardrails use in-tree to signal a deliberate rejection count as an intervention: 400 (content policy), 403 (e.g. akto) and 422 (e.g. llm_as_a_judge). Other 4xx codes are commonly propagated from an upstream guardrail provider response (401 bad key, 408 timeout, 429 rate limit, or a raw upstream status), which are technical failures, not blocks, so they stay guardrail_failed_to_respond. TF) isinstancer%r$r#r&r status_coder,r1s j/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/integrations/custom_guardrail.pyis_guardrail_interventionr8JsQ&!,- $ ! '  Z=%AammWtFt chtjjd}|yt|}|dS|S)a4Whether guardrail-mode validation raises (default) or logs a warning. Set `LITELLM_STRICT_GUARDRAIL_MODES=false` to keep the pre-LIT-4226 behavior for guardrails whose supported_event_hooks list newly includes their configured mode: log the mismatch and continue instead of raising at boot. LITELLM_STRICT_GUARDRAIL_MODEST)osenvirongetr)rawparseds r7_strict_guardrail_modes_enabledrAms8 @AC {$F>4-v-r9 request_datac |jd}|r t|S|jdxsi}|jd}|r t|S|jdxsi}|jd}|r t|Sy)zFExtract session_id from request data (litellm_session_id or metadata).litellm_session_idmetadata session_idlitellm_metadataN)r>str)rBrFrErGs r7 get_session_id_from_request_datarI{s!!"67J:"&&z28bHl+J:*../ABHb!%%l3J: r9c!eZdZUdZeeed<dZeeed<dZeeed< djde dzde e dzde e e ze zdzd ed ed ed e dzd e dzde dzde dzde dzde dzdedededef fd Zdkde dee efdzde fdZ dlde dee efdee efdzdeddf dZd ee efd!e defd"Z dkd#e dee efdee efdzddfd$Zdee efde dzfd%Zed&e de fd'Zd(e de fd)Zd*e e dzdee efd+ede e dzfd,Zd*e e dzdee efd+eddfd-Zdefd.Z dkdee efdee efdzddfd/Zeded0dzfd1Z e!de e dzfd2Z"de e e ze zdzde e ddfd3Z#ed edefd4Z$d ededzfd5Z%d ede e fd6Z&d7edefd8Z'd ede e e ee e(fzfd9Z)d:e e e ee e(fzdefd;Z*de dzfd<Z+d ee efddfd=Z,d ee efdefd>Z-defd?Z.dmd@Z/dAee efdBe0dzdedzfdCZ1dedDe2dBe0dzde2dzfdEZ3defdFZ4defdGZ5dHe defdIZ6dHe defdJZ7dedefdKZ8defdLZ9 dndMe:e zeze ezdedNe;dOe dkdVe?dedWe@dXdYeAdZde?f d[ZB dodDedzdedOe!+@"6P'5N&(46P'->9V*,B#%4&6,B#  ))*6KL "6" 24&&K%  s5B C  !CC r/contextr2c|js|Sd|i}|r|j| |jjdi|S#t$r-}t j d|j ||cYd}~Sd}~wwxYw)zr%rO)rfrrrBrsrtrvs r7raise_passthrough_exceptionz+CustomGuardrail.raise_passthrough_exceptions<N$'';%%%..)/   r9datarxcd|d}|jd}|jd}|jd}t|tr&t|tr g||}||d<|d||d<yt|tr&t|tr g||}||d<|d||d<y|yt|tr g||} | |d<y|g} | |d<y) a Append an advisory system message to the request in place, so the LLM itself can weigh a possible false-positive guardrail flag rather than the request being hard-blocked or silently allowed. Unlike raise_passthrough_exception, this does NOT short-circuit the LLM call; the request proceeds normally with the extra message appended. Guardrails should call this from on_flagged handling analogous to how passthrough-supporting guardrails call raise_passthrough_exception. Args: data: The request data dictionary, mutated in place to append the advisory message to its "messages" list and/or "input"/ "instructions" text. message: The formatted advisory message to append as a system message. Returns: True if the advisory was actually written somewhere the model will see it. False if ``data["input"]`` is a structured Responses-API list (not a plain string) -- the Responses API reads only ``input``, so appending to ``messages`` would be inert regardless of whether a ``messages`` list also happens to be present, and there is no field this helper can safely append into. The caller must treat this like any other case where the mitigation can't land and degrade to blocking instead of silently letting the flagged request through unmodified. system)rolecontentmessagesinput instructionsz TF)r>r4rHlist) rfrzrxadvisory_messageexisting_messagesexisting_inputexisting_instructionsmessages_with_instructions_notemessages_with_input_notemessages_without_input_note sole_messages r7inject_advisory_messagez'CustomGuardrail.inject_advisory_message+s)@,4"H#'88J#7 $ 1'+xx'? +S 1 +T2:&:$:/$CZ &;%#>   r9ct|S)z%Extract session_id from request data.)rI)rfrBs r7rz1CustomGuardrail._get_session_id_from_request_datas / ==r9textcftj|jdjS)aStable content hash for a single scannable text segment. Hashing the exact text the provider would receive means an edited earlier segment produces a different hash and gets re-scanned, while an unchanged segment repeated on a later turn is skipped. zutf-8)hashlibsha256encode hexdigest)rs r7_scanned_text_hashz"CustomGuardrail._scanned_text_hashs%~~dkk'23==??r9rFc&d|jd|S)Nzguardrail_scanned_texts::)rO)rfrFs r7_scanned_texts_cache_keyz(CustomGuardrail._scanned_texts_cache_keys)$*=*=)>a |LLr9textscachec~K|jr|sy|js |jr!tjd|j yt |}|s!tjd|j y |j|j|d{}t|tr|Dchc] }t|c}n t}|D cgc]} |j| |vs| c} S7[#t$r+}tjd|j |Yd}~yd}~wwxYwcc}wcc} ww)aReturn only the text segments not already scanned earlier in this session. Returns ``None`` when incremental scanning is inactive (feature off, no session id, masking enabled, or the cache read failed). ``None`` signals the caller to fall back to a full scan; a returned list (possibly empty) signals the caller to scan only that subset and skip masking write-back. NzZGuardrail %s: only_scan_new_messages is not supported with masking; scanning full context.zbGuardrail %s: only_scan_new_messages enabled but request has no session id; scanning full context.keyzOGuardrail %s: failed to read scanned-message cache (%s); scanning full context.)r^rSrTr rcrOrIdebugasync_get_cacherror4rrHsetr) rfrrBrrFcachedr1hseenrs r7filter_new_texts_for_sessionz,CustomGuardrail.filter_new_texts_for_sessions!**%  $ $(B(B  " "l## <\J   t##  */*?*?DDaDablDm*?*n$nF=Gvt Q Q ,1,A,Ai,A,P&PHNXYacgNh0JAQ0JnpO'+DMM/N:Z,['\F''@(   !R&P0J     " "e##   smA D5C0&D5)C>>C5?C>C7)AC>*C<+C>/D55C>7C>> D2!D-(D5-D22D5c@|jdk(xr|jduS)z Returns True if this guardrail is configured to route requests to a different model when sensitive data is detected. routeN)rYrZrfs r7should_route_on_sensitive_dataz.CustomGuardrail.should_route_on_sensitive_datas& %%0cT5W5W_c5ccr9c|jr |j|j||yt d|j |j d#t$r't d|j d|j dwxYw)a Handle sensitive data detection based on guardrail configuration. If on_sensitive_data='route', raises SensitiveDataRouteException to reroute. Otherwise, raises GuardrailRaisedException to block. When routing is configured but the request carries no session_id, routing is not possible so the request falls back to a graceful block. Args: request_data: The request data dictionary detection_info: Optional non-sensitive detection metadata. When routing, this is surfaced in request metadata and logs, so it must not contain the raw detected sensitive values. Raises: SensitiveDataRouteException: When configured to route and a session_id is present GuardrailRaisedException: When configured to block, or when routing is configured but no session_id is available )rrBrszSensitive data detected by z- (routing skipped: request has no session_id)T)rxrOblocked_contentN)rrrZrbr$rO)rfrBrss r7handle_sensitive_data_detectionz/CustomGuardrail.handle_sensitive_data_detection s0  . . 0 99#'#E#E!-#1:+5d6I6I5JK#22 $  .5d6I6I5JJwx#'#6#6$(  s A0Brcy)zx Returns the config model for the guardrail This is used to render the config model in the UI. Nr`r`r9r7get_config_modelz CustomGuardrail.get_config_model7sr9cy)a^ Returns the event hooks this guardrail supports, for the UI to render. Subclasses should override to return their supported hooks list. When a subclass returns None, the endpoint omits it from the per-provider map and the UI is expected to fall back to the global `supported_modes` list client-side. Nr`)clss r7get_supported_event_hooksz)CustomGuardrail.get_supported_event_hooks@sr9cdttttzdttddfd}|yt|tr t|}t|tr |||yt|trg}|j j D]5}t|tr|j|%|j|7||||jr=t|jtr |jn |jg}|||yyt|tr||vrtd|d|yy)NrQrPr2cr|D]2}t|tr t|}||vs#td|d|y)N Event hook % is not in the supported event hooks )r4rHrrb)rQrPhooks r75_validate_event_hook_list_is_in_supported_event_hookszcCustomGuardrail._validate_event_hook.._validate_event_hook_list_is_in_supported_event_hooksQsM# wdC(.t4D44${4&8]^s]t%uvv  wr9rr) rrrHr4rtagsvaluesextendappendr/rb)rfrQrPrtag_values_flatv default_lists r7raz$CustomGuardrail._validate_event_hookLsH  w01DI= w#'(;#< w w    j# &,Z8J j$ ' A*Nc d  D )+-O__++- .a&#**1-#**1-  . B/Sh i!!5? @R@RTX5Yz11`j`r`r_s ElTij" $7 8!66 ;zl:_`u_v!wxx79r9ci}i}dD]N}|j|}t|ts%|jdxs|}|jdxs|}Pi||S)aReturn merged admin-configured key and team metadata from the request data. The proxy may inject admin metadata (user_api_key_metadata, user_api_key_team_metadata) into either ``metadata`` or ``litellm_metadata`` depending on endpoint. Check both so a caller cannot shadow admin config by pre-populating the other key. Key-level settings override team-level. rErGuser_api_key_team_metadatauser_api_key_metadatar>r4r)rz team_metakey_metarmetas r7_get_admin_metadataz#CustomGuardrail._get_admin_metadatapsu 3 EC88C=DdD)!=>K)Ixx 78DHH E))(x((r9cD|j|jddS)z Returns True if the global guardrail should be disabled. Reads from admin-configured key/team metadata only, not from the request body, to prevent callers from disabling guardrails. disable_global_guardrailsF)rr>)rfrzs r7get_disable_global_guardrailz,CustomGuardrail.get_disable_global_guardrails#''-112MuUUr9cj|j|jd}t|tr|SgS)z Returns the list of global guardrail names the team/key has opted out of. Reads from admin-configured key/team metadata only. opted_out_global_guardrails)rr>r4r)rfrzrs r7-get_opted_out_global_guardrails_from_metadataz=CustomGuardrail.get_opted_out_global_guardrails_from_metadatas4 //599:WX"5$/u7R7r9resultc|y tt}t||S#t$r}dt |vrYd}~yd}~wwxYw)a Check if result is a valid LLMResponseTypes instance. Safely handles TypedDict types which don't support isinstance checks. For non-LiteLLM responses (like passthrough httpx.Response), returns True to allow them through. NF TypedDictT)r rr4 TypeErrorrH)rfrresponse_typesr1s r7_is_valid_response_typez'CustomGuardrail._is_valid_response_typesM > $,-=$>Nfn5 5 c!f$   s A <<Acd|vr|dSdD]C}|j|xsi}t|ts)d|vs.|jdxsgcSgS)zN Returns the guardrail(s) to be run from the metadata or root guardrailsrr)rfrzmeta_keyrs r7get_guardrail_from_metadataz+CustomGuardrail.get_guardrail_from_metadatasg 4  % %9 4H88H%+D$%,$*>xx -33 4 r9requested_guardrailsc|D]E}t|tr|j|vs"yt|ts5|j|k(sEyy)NTF)r4rrOrH)rfr _guardrails r7%_guardrail_is_in_requested_guardrailsz5CustomGuardrail._guardrail_is_in_requested_guardrailssN/ J*d+&&*4J,&&*4  r9c6|j}|sytd|S)Nr)rOr()rfnames r7_pre_call_markerz CustomGuardrail._pre_call_markers%))*+1TF33r9c"|j}|ydD]k}|j|}t|ts%|jt}t|t r||vr|j |y|g|t<yt|gi|d<y)a Record that this guardrail's ``async_pre_call_hook`` already ran for this request, so the deployment-level hook does not run it a second time. The proxy runs pre-call guardrails in ``ProxyLogging.pre_call_hook``. The router later spreads a deployment's model-level ``guardrails`` into the top-level request kwargs, which would otherwise re-trigger the same hook from ``async_pre_call_deployment_hook``. NrrE)rr>r4rr"rrrfrzmarkerrrexecuteds r7mark_pre_call_hook_ranz&CustomGuardrail.mark_pre_call_hook_rans--/ > 8 H88H%D$%88$DEh-X- /?EXD9: =vhGZr9c|j}|ydD]P}|j|}t|ts%|jt}t|t sK||vsPyy)NFrT)rr>r4rr"rrs r7_pre_call_hook_already_ranz*CustomGuardrail._pre_call_hook_already_ransg--/ >8 H88H%D$%88$DEh-&H2D  r9cLt|jtjuSN)typeapply_guardrailrKrs r7uses_apply_guardrail_interfacez.CustomGuardrail.uses_apply_guardrail_interfacesDz))1P1PPPr9c|jr |jr|S ddlm}|S#t$r6}t d|j xst |jd|d}~wwxYw)Nr)unified_guardrailz Guardrail z implements apply_guardrail, which needs the litellm proxy dependencies to run at the deployment level. Install them with: pip install 'litellm[proxy]')rrMlitellm.proxy.utilsr ImportErrorrOr__name__)rfrr1s r7_deployment_pre_call_targetz+CustomGuardrail._deployment_pre_call_targetsy2248W8WK  =!  T00GDJ4G4GHIBB   s( A'1A""A'rg call_typec Kddlm}|jd}|t|ts|S|j |r|S|j |tjdur|S|tjk(s|tjk(r|j}||ur||d<|j||jd|jd|jd |jd |jd  t||tjk(rd ndd{}|(t|tr|jd}|||d<|S70w)NrUserAPIKeyAuthrrz event_typeTguardrail_to_applyuser_api_key_user_iduser_api_key_team_iduser_api_key_end_user_iduser_api_key_hashuser_api_key_request_routeuser_idteam_id end_user_idapi_key request_route completion acompletion)user_api_key_dictrrzrr)litellm.proxy._typesrr>r4rrshould_run_guardrailrpre_callrrrrasync_pre_call_hookr r)rfrgrrlitellm_guardrailstargetrresult_messagess r7async_pre_call_deployment_hookz.CustomGuardrail.async_pre_call_deployment_hook s\7%+JJ|$<  %Z8JD-QM  * *6 2M  $ $&=P=Y=Y $ Zbf fM  ,, , Y=R=R0R <<>FT!/3+,"("<"<"0"JJ'=>"JJ'=> & +E F"JJ':;"(**-I"J #*3y7K7K*K,Q^#= # F!j&>)/J)?".)8F:& % sD*E,E-1Eresponsec Kddlm}|jd}|t|ts|S|j |t jdur|S|j||jd|jd|jd |jd |jd  || d{}|j|s|S|S7w)zh Allow modifying / reviewing the response just after it's received from the deployment. rrrNrTrrrrr r )rrzr) rrr>r4rrr post_callasync_post_call_success_hookr)rfrBrrrrrs r7'async_post_call_success_deployment_hookz7CustomGuardrail.async_post_call_success_deployment_hook1s 8%1$4$4\$B  %Z8JD-QO  $ $,CVC`C` $ aim mO#??,$(()?@$(()?@(,,-GH$(()<=*../KL @   ++F3O   sB>CCCcy)aRWhether this guardrail can scan tool-result content. Guardrails whose own role filtering only ever scans human-authored messages override this to return False, so configuring them with ``scan_only_tool_results`` is rejected at initialization instead of silently scanning nothing on every request. Tr`rs r7supports_scan_only_tool_resultsz/CustomGuardrail.supports_scan_only_tool_resultsVsr9cy)a>Whether returned ``structured_messages`` span the whole request. Translation handlers hand guardrails only the in-scope subset of the conversation and merge a returned ``structured_messages`` list back into the full request. A guardrail that already rebuilds the complete conversation itself (like CrowdStrike AIDR with its skip filters active) overrides this to return True so the handler installs the returned list as-is instead of merging it a second time, which would duplicate the out-of-scope messages. Fr`rs r7&structured_messages_cover_full_requestz6CustomGuardrail.structured_messages_cover_full_request`sr9rcj|j|}|j|}|j|}tjd|j ||j ||j|jdur|j |vry|jdur|dury|jdurY|durU|j|rCt|j tr( ddl m }|j||j |}||Syy|j r!|j|s|j dk7ry|j|syt|j tr( ddl m }|j||j |}||Sy#t$r tdwxYw#t$r tdwxYw)zO Returns True if the guardrail should be run on the event_type zinside should_run_guardrail for guardrail=%s event_type= %s guardrail_supported_event_hooks= %s requested_guardrails= %s self.default_on= %sTFr)EnterpriseCustomGuardrailHelperzuSetting tag-based guardrails is only available in litellm-enterprise. You must be a premium user to use this feature. logging_only)rrrr rrOrQrR_event_hook_is_event_typer4r0litellm_enterprise.integrations.custom_guardrailr%r_should_run_if_mode_by_tagrr)rfrzrrdisable_global_guardrailrr%rs r7rz$CustomGuardrail.should_run_guardrailms'+&F&Ft&L*.*K*KD*Q -1-_-_`d-e# [     OO OO   ??d "t':':>Y'Y ??d "'?4'G ??d "'?t'K--j9doot4=WWdoozF)%  OO>>?ST  N2--j9 doot , 5OOPTVZVeVegqrF! E')T6 !L sFFFF2c|jyt|jtr|j|jvSt|jtr|jj j D]4}t|tr|j|vs"y|j|k(s4y|jjr_t|jjtr|jjn|jjg}|j|vSy|j|jk(S)a Returns True if the event_hook is the same as the event_type eg. if `self.event_hook == "pre_call" and event_type == "pre_call"` -> then True eg. if `self.event_hook == "pre_call" and event_type == "post_call"` -> then False TF)rQr4rrrrrr/)rfr tag_valuers r7r'z)CustomGuardrail._event_hook_is_event_types ?? " doot ,##t6 6 doot ,!__1188: i.!''94#%%2  &&/9$//:Q:QSW/XDOO++_c_n_n_v_v^w"''<77*"2"222r9c |j|}|D]}t|ts|j|vs#t di||j}|j di}|j durNt|tr:|r8tjd|jt|jicS|cSiS)a Returns `extra_body` to be added to the request body for the Guardrail API call Use this to pass dynamic params to the guardrail API call - eg. success_threshold, failure_threshold, etc. ``` [{"lakera_guard": {"extra_body": {"foo": "bar"}}}] ``` Will return: for guardrail=`lakera-guard`: { "foo": "bar" } Args: request_data: The original `request_data` passed to LiteLLM Proxy extra_bodyTzOGuardrail %s: ignoring dynamic extra_body keys %s because premium_user is Falser`) rr4rrOrr>_validate_premium_userr rcrkeys)rfrBr guardrailguardrail_configr.s r7)get_guardrail_dynamic_request_body_paramsz9CustomGuardrail.get_guardrail_dynamic_request_body_paramss$'+&F&F|&T. "I)T*t/B/Bi/O;Q;sT]^b^q^qTr;s -11,C ..0<!*d3 &..m // !23 I"! "" r9crddlm}m}|dur+tjd|j j yy)z< Returns True if the user is a premium user r)CommonProxyErrors premium_userTz7Trying to use premium guardrail without premium user %sF)litellm.proxy.proxy_serverr5r6r rcnot_premium_userr)rfr5r6s r7r/z&CustomGuardrail._validate_premium_users8 O t #  " "IK\KmKmKsKs r9guardrail_json_responseguardrail_status start_timeend_timedurationmasked_entity_countguardrail_providertracing_detailc t|tr t|}ddlm} | | } nPt|j t r*| d it|j j} n |j } ddl m } | |}t|tr|jddn:t|tr*|D]%}t|ts|jdd't|}ddlm}||}t!d |j"|| ||||||d | xsidtd dffd }t%|\}}||t&j)d  dd lm}|y#t$rYywxYw)a Builds `StandardLoggingGuardrailInformation` and adds it to the request metadata so it can be used for logging to DataDog, Langfuse, etc. Args: tracing_detail: Optional typed dict with provider-specific tracing fields (guardrail_id, policy_template, detection_method, confidence_score, classification, match_details, patterns_checked, alert_recipients). r) GuardrailModeN)filter_exceptions_from_params secret_fields)mask_credentials_in_payload) rOr?guardrail_modeguardrail_responser:r;r<r=r> containerr2cd}|j|}|g||<yt|tr|jy|g||<y)N&standard_logging_guardrail_information)r>r4rr)rHrrslgs r7_append_guardrail_infozjCustomGuardrail.add_standard_logging_guardrail_information_to_request_data.._append_guardrail_infoMsLAC'mmC0H"% #Hd+$#+C #r9T)emit_guardrail_spanr`)r4rorHlitellm.types.utilsrBrQrr model_dump'litellm.litellm_core_utils.core_helpersrCpoprr0litellm.litellm_core_utils.sensitive_data_maskerrErrOrr0r litellm.integrations.otel.loggerrM)rfr9rBr:r;r<r=r>r?rr@rBrFrCclean_guardrail_responseitemrErL_metadata_bucketrMrKs @r7:add_standard_logging_guardrail_information_to_request_datazJCustomGuardrail.add_standard_logging_guardrail_information_to_request_datas* -y 9&)*A&B #5  !'N  .*PT$//2L2L2N-OPN!__N $AAX#Y . 5 $ ( ($ ? 0$ 70 4dD)HH_d3 4$FF^#_  $??W#X 8  ..1)7-! 3  #   1d 1t 1;<H?/ $$T*   L  $   sE(( E43E4inputs input_type)requestr logging_objLiteLLMLoggingObjcK|Sw)a Apply your guardrail logic to the given inputs Args: inputs: Dictionary containing: - texts: List of texts to apply the guardrail to - images: Optional list of images to apply the guardrail to - tool_calls: Optional list of tool calls to apply the guardrail to request_data: The request data dictionary - containing user api key metadata (e.g. user_id, team_id, etc.) input_type: The type of input to apply the guardrail to - "request" or "response" logging_obj: Optional logging object for tracking the guardrail execution Any of the custom guardrails can override this method to provide custom guardrail logic Returns the texts with the guardrail applied and the images with the guardrail applied (if any) Raises: Exception: - If the guardrail raises an exception r`)rfrYrBrZr\s r7rzCustomGuardrail.apply_guardrailgs 8 soriginal_inputsc |in|}|'t|tr|j||rd}nd}tjd||j ||d|||||S) Add StandardLoggingGuardrailInformation to the request data This gets logged on downsteam Langfuse, DataDog, etc. maskallowzGuardrail response: %ssuccessr9rBr:r=r;r<r)r4r_inputs_were_modifiedr rrX) rfrrBr;r<r=rr_rGs r7_process_responsez!CustomGuardrail._process_responses :B9I2x  &:h+E))/8D%+"%,"5x@ GG$6%&!! H r9r1ct|S)zMRetained spelling for existing callers; prefer ``is_guardrail_intervention``.)r8r6s r7_is_guardrail_interventionz*CustomGuardrail._is_guardrail_interventions)++r9c |j|rdnd}|}d|jjvrd}|j||||||||)raguardrail_intervenedguardrail_failed_to_respondCustomCodeGuardraildenyre)ririrrX) rfr1rBr;r<r=rr:rGs r7_process_errorzCustomGuardrail._process_errorsm'+&E&Ea&H "Nk  /0 DNN$;$; ;!'  GG$6%-!! H r9ct|jt|jz}|D]+}|j|}|j|}||k7s+yy)z Compare original inputs with response to determine if content was modified. Returns True if the inputs were modified (mask scenario), False otherwise (allow scenario). TF)rr0r>)rfr_rall_keysroriginal_valueresponse_values r7rfz%CustomGuardrail._inputs_were_modifiedsfo2245HMMO8LL C,005N%\\#.N/  r9content_string mask_string start_index end_indexc\d|cxkr|cxkrt|ks|S|S|d||z||dzS)zS Mask the content in the string between the start and end indices. rN)len)rfrtrurvrws r7mask_content_in_stringz&CustomGuardrail.mask_content_in_stringsM[C9CN0CC! !D! !l{+k9N9: responses aresponsestypingrBlitellm.responses.litellm_completion_transformation.transformationr)transform_responses_api_input_to_messagesrr)rfrrzrr input_datars r7%get_guardrails_messages_for_call_typez5CustomGuardrail.get_guardrails_messages_for_call_types    --33 3I11777I88>>>I3399988J' '  ++11 1Y)BVBVB\B\5\ # !% 1J!>hh &*iH-.9 9r9)NNNFFFNNNNNNTFFFr)NN)r2r )NNNNNNN)NNNNN)NNNN)Mr __module__ __qualname__rLrbool__annotations__rMrNrHrrrintrerrrqobjectryrrr staticmethodrrr rrrrrr classmethodrrarrrrrrrrrrrrrrrrr!r#rr'r3r/rorfloatrrXrrr rrgrirorfrzrrrr __classcell__)ris@r7rKrKs27$72768=%x~=&*BFTX %*&+1504#'15(,48'+ %!&',#M#d M# $$784?M#($/B*CCdJTQ M#  M# # M# $M#%($JM#$':M#DjM#%($JM#:M#(+TzM#!%M#M# !M#"!%#M#^d38nt>S_b.15$( 0 0 38n0 S#X- 0 " 0  0 dJ38nJJ  J`15 ' ' 38n' S#X- '  ' R>d38n>QTW[Q[>@@@@M3M3M*UCy4*U3;'*U *U cT  *UX#Cy4#3;'# #  #Jdd15,38n,S#X-,  ,\d#9:TA $/B*Cd*J  "y'$/B*CCdJTQ"y $$78"y  "yH)$)4))*VV$+V8$84PS98cd,cT$sTjOjJkEl9l& "3i$tC9O4O/P*QQ   4#*4 H4S>HdH2 tCH~ $ QQ !%4S>%V_bfVf%korvkv%N####t# # D #J  B(B  BH34G3D36&d&t&P  $$(!%!%59)-158<d!*S4!7$t*!Ddd* d DL d $, d$,d"#s(^d2d $Jd($.d/5d dV6: )12  12  # D$(!%!%15'+&+&&DL & $, & $, &($.&&P,i,D,,$(!%!%15    DL  $,  $, ($. DTTd&WWW W  W W$&m&PT&9=*"**.+*  $ &*r9rKlpentriesct|tsy|jdi|d<|djdg}|D]}||vs|j |y)z:Merge guardrail entries into a single litellm_params dict.NrErJ)r4rr> setdefaultr)rrrentrys r7_append_slg_to_litellm_paramsr-sb b$  vvj!:n//0XZ\]H#  OOE "#r9r\c|y|jt|xsi}|jd}|syt|tr|n|g}t |ddxsi}t t |dd|t |jd|y)aGCopy standard_logging_guardrail_information from request_data into logging_obj. The @log_guardrail_information decorator writes guardrail info to request_data["metadata"] or request_data["litellm_metadata"]. For passthrough routes (/v1/messages, /v1/responses) the spend-log payload is built from logging_obj.litellm_params["metadata"], which is a separate dict that does not share identity with the one in request_data. This helper bridges that gap so guardrail_information is non-null in spend logs for all routes, not just /v1/chat/completions. NrJmodel_call_detailsr{)r>rr4rgetattrr)rBr\meta_srcslg_informcds r7#_sync_guardrail_info_to_logging_objr9s"&&'Ml'[\b`bHll#KLH '1(D'A8zG&:DAGRC!'+7G"NPWX!#''*:";WEr9cddl}ddldtdtdzfd|j fd|j fd|j fd}|S) at Decorator to add standard logging guardrail information to any function Add this decorator to ensure your guardrail response is logged to DataDog, OTEL, s3, GCS etc. Logs for: - pre_call - during_call - post_call Some guardrails (e.g. ``block_code_execution``) call ``add_standard_logging_guardrail_information_to_request_data`` directly from inside the wrapped function so they can record a richer payload (structured detections, tracing detail) than this decorator's "allow"/"mask"/raw-response default. To avoid double-recording in that case (which would emit two spans, two Datadog records, two spend-log entries, etc.), a context-local flag records whether the wrapped function appended its own entry; if so, the auto-record is skipped. The flag is a ``ContextVar`` rather than a count of entries in the shared ``request_data`` so it stays correct when guardrails run concurrently (asyncio copies the context into each gathered task): counting shared entries would let one guardrail's append hide another guardrail's missing record. A guardrail that only records an entry when it actually runs (e.g. ``HeadroomGuardrail``, which returns the inputs untouched on an endpoint whose payload it cannot act on) sets ``records_own_guardrail_information = True`` so the auto-record is skipped even on the return paths where it recorded nothing; otherwise a no-op early return would be logged as an "allow"/"success" run even though the guardrail did nothing. The exception branch below still records so a genuine failure is not lost. rN func_namer2c|dk(rtjS|dk(rtjS|dvrtjSy)z2Infer the actual event type from the function namerasync_moderation_hook)rasync_post_call_streaming_hookN)rr during_callr)rs r7$_infer_event_type_from_function_namezGlog_guardrail_information.._infer_event_type_from_function_namessL - -&// / 1 1&22 2   '00 0r9c Ktj}|d}|jdxs|jdxsi} j}d} jdk(rd|vr|jd}|jd}tj d}  |i|d{} |j stjr#| tj|t||S|j| ||jtjjtj|z j||tj|t||S7#t$r} tjr|j| ||jtjjtj|z j| cYd} ~ tj|t||Sd} ~ wwxYw#tj|t||wxYww) NrrzrBrrYr\F)rrBr;r<r=rr_)r1rBr;r<r=r)rnowr>rr0rrNresetrrg timestamp total_secondsroro argsrgr;rfrBrr_r\self_recorded_tokenrr1rfuncs r7 async_wrapperz0log_guardrail_information..async_wrappers$LLN '+Aw$*JJv$6$Z&**^:T$ZXZ @O  ==- -(f2D$jj2O#ZZ 6 %=%A%A%%H K$($$9&$99H559Q9U9U9W, % * *+> ? / k J-))!)%//1!113",,.:5DDF% /** % * *+> ? / k J3: '++-&&)%//1!113",,.:5DDF% '  % * *+> ? / k J  % * *+> ? / k JshB I$ F/F0%F"I7A(F"IF H4 Arr0rrNrrrgrrorors r7 sync_wrapperz/log_guardrail_information..sync_wrappers$LLN '+Aw$*JJv$6$Z&**^:T$ZXZ @O  ==- -(f2D$jj2O#ZZ 6 %=%A%A%%H K"D3F3H559Q9U9U9W$ % * *+> ? / k J%))!)",,.:5DDF% / *" % * *+> ? / k J '++-&&)",,.:5DDF% '  % * *+> ? / k J  % * *+> ? / k Js7")E-8E GA GGG GG #G.cFjr|i|S|i|Sr)iscoroutinefunction)rrgrrinspectrs r7wrapperz*log_guardrail_information..wrappers1  & &t , $1&1 1T,V,,r9) functoolsrrHrwraps)rrrrrrrs` @@@@r7log_guardrail_informationrPs@   t # __T'K'KR__T#K#KJ__T-- Nr9)M contextvarsrr<secretsrrrrrrrr r litellm._loggingr litellm.cachingr "litellm.integrations.custom_loggerr rPrrrlitellm.secret_managers.mainrlitellm.types.guardrailsrrrrlitellm.types.llms.openair3litellm.types.proxy.guardrails.guardrail_hooks.baserrNrrrrrrfastapi.exceptionsrr*litellm.litellm_core_utils.litellm_loggingrr]r rlitellm.constantsr!r"litellm.exceptionsr#r$r%r& token_hexr( frozensetr,r- ContextVarr0rror8rArrHrIrKrrrrrr`r9r7rs SSS+%; 5 7T0W KE#4'"3"3B"7%7'0'AuAG% AW @V@V%uA% 6 6t <=  t F . .4S>cDj&\l\~$ #f #t # #FdFFTXF.HY)Ms5D::EE