mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-11 22:51:28 +00:00
7a81ae98e6
* fix(model_armor): handle Anthropic Messages and Responses streams in post_call The post_call streaming hook buffered every chunk and fed it to stream_chunk_builder, which only understands chat-completion deltas. /v1/messages streams raw Anthropic SSE bytes and /v1/responses streams typed Responses events, so both raised litellm.APIError and surfaced to the client as a 500 on every streamed request. Assemble each surface with its own reader, frame guardrail failures as terminal items in that surface's wire format, and pass the stream through unscanned when it cannot be assembled instead of raising. * fix(model_armor): classify the stream surface and fail closed when it cannot be assembled Decide the wire format explicitly instead of inferring it from a boolean pair, so an opaque raw SSE stream (the Google :streamGenerateContent route) is never refused in Anthropic framing, and a stream that cannot be assembled is blocked rather than released unscanned unless fail_on_error is disabled. Also scan Responses tool-call arguments, read the body only off a terminal Responses event, and record the applied guardrail on the fail-closed path. * test(model_armor): pin the error-only stream predicate against content-carrying streams is_sse_error_stream decides whether a buffered stream is forwarded to the client untouched, so a stream that still carries content must not qualify: the frames-only join drops typed chunks, an empty stream is not a refusal, and a content event may carry an empty error field. * fix(model_armor): let a streamed de-identify match mask instead of blocking A de-identify template reports MATCH_FOUND for every redaction it makes. The streaming block check omitted allow_sanitization, so with mask_response_content enabled that match read as a refusal and the client got a 400 where the non-streaming sibling returned the redacted text. Pass the flag through, as the non-streaming hook already does, and stamp the logged status from the same decision so the spend row agrees with what the client received. Also drop Any from the chat-completion assembler's parameter; stream_chunk_builder takes a bare list, so list[object] carries the mutability requirement without erasing the element type. * fix(model_armor): fail closed when a streamed de-identify match cannot be applied Allowing sanitization past the streaming block check is a promise to apply the redaction Model Armor asked for. Two paths broke that promise and released the buffered original instead: a match that comes back with no sanitized text, and a surface with no assembled body to rewrite. The outcome is now resolved once, before it is recorded, so the status stamped on request metadata agrees with what the client receives rather than reporting the success the block check alone would have implied. * fix: scan the deltas when a Responses stream ends without a body response.failed and response.incomplete are terminal events like response.completed, but a turn that broke mid-generation reports an empty output while the deltas ahead of it already spelled the answer out to the client. Reading only the terminal body found nothing to scan there, and the empty-content shortcut then forwarded every buffered delta past the guardrail. Fall back to the text the delta events carry whenever a Responses stream assembles to nothing. * fix: read the Responses delta event types off the event enum The hand-listed set left out response.mcp_call_arguments.delta, so a turn that streamed only MCP tool arguments and then reported an empty body still took the no-content shortcut and forwarded those chunks unscanned. Deriving the set from ResponsesAPIStreamEvents keeps it complete as the enum grows, and the str guard in the reader already covers any event whose delta is not text. * fix(model_armor): scan responses deltas alongside the terminal body A /v1/responses stream spells out reasoning summaries and tool-call arguments in delta events that its terminal body never repeats, so scanning the body alone handed every summary delta to the client unscanned whenever the body carried text. * fix(model_armor): scan responses delta fields apart from each other A Responses turn spells out its reasoning summary, its visible answer and its tool-call arguments in separate delta events. Joining every delta into one string let a finding form across the boundary between two fields that each carry nothing to find, so a safe stream could be blocked. Group the deltas by the field they belong to, join a field's own deltas as they streamed, and keep the fields apart. * fix(model_armor): scan each responses field once, not twice Separating delta fields stopped the terminal body from matching the delta text, so a turn with two visible fields sent Model Armor both copies. Only the delta fields the body does not already carry are appended now. --------- Co-authored-by: yassin <yassin@berri.ai> |
||
|---|---|---|
| .. | ||
| azure | ||
| content_filter | ||
| guardrails_ai | ||
| openai | ||
| unified_guardrails | ||
| _cisco_ai_defense_test_utils.py | ||
| code_execution_compliance_dataset.json | ||
| test_aim.py | ||
| test_alice.py | ||
| test_bedrock_guardrails.py | ||
| test_bedrock_invoke_guardrail_checks.py | ||
| test_block_code_execution.py | ||
| test_block_code_execution_compliance.py | ||
| test_cato_networks.py | ||
| test_cisco_ai_defense_chat.py | ||
| test_cisco_ai_defense_mcp.py | ||
| test_compresr.py | ||
| test_crowdstrike_aidr.py | ||
| test_deepkeep.py | ||
| test_dynamoai.py | ||
| test_enkryptai.py | ||
| test_generic_guardrail_api.py | ||
| test_grayswan.py | ||
| test_headroom.py | ||
| test_hiddenlayer.py | ||
| test_lakera_ai_v2.py | ||
| test_lasso.py | ||
| test_mcp_end_user_permission.py | ||
| test_mcp_security.py | ||
| test_microsoft_purview.py | ||
| test_model_armor.py | ||
| test_noma.py | ||
| test_noma_v2.py | ||
| test_onyx.py | ||
| test_ovalix.py | ||
| test_pangea.py | ||
| test_panw_prisma_airs.py | ||
| test_presidio.py | ||
| test_presidio_union_fix.py | ||
| test_promptguard.py | ||
| test_qualifire.py | ||
| test_repelloai.py | ||
| test_response_rejection_guardrail_code.py | ||
| test_singulr.py | ||
| test_straiker.py | ||
| test_structured_messages_writeback.py | ||
| test_tool_permission.py | ||
| test_tool_policy_guardrail.py | ||
| test_vigil_guard.py | ||
| test_xecguard.py | ||