fix: instrument both builds of a dual-package provider SDK (#26)

Author: PabloPardoGarcia

package-lock.json

@@ -59,9 +59,9 @@
     "@opentelemetry/semantic-conventions": "^1.43.0"
   },
   "peerDependencies": {
-    "@arizeai/openinference-instrumentation-anthropic": "^0.1.20",
+    "@arizeai/openinference-instrumentation-anthropic": "^0.2.1",
     "@arizeai/openinference-instrumentation-langchain": "^4.0.17",
-    "@arizeai/openinference-instrumentation-openai": "^4.1.8",
+    "@arizeai/openinference-instrumentation-openai": "^4.2.1",
     "@arizeai/openinference-vercel": "^3.1.4",
     "@langchain/core": "^1.0.0 || ^0.3.0",
     "@modelcontextprotocol/sdk": "^1.30.0",
@@ -89,9 +89,9 @@
   },
   "devDependencies": {
     "@anthropic-ai/sdk": "^0.65.0",
-    "@arizeai/openinference-instrumentation-anthropic": "0.1.20",
+    "@arizeai/openinference-instrumentation-anthropic": "0.2.1",
     "@arizeai/openinference-instrumentation-langchain": "4.0.17",
-    "@arizeai/openinference-instrumentation-openai": "^4.1.8",
+    "@arizeai/openinference-instrumentation-openai": "^4.2.1",
     "@arizeai/openinference-vercel": "^3.1.4",
     "@biomejs/biome": "^1.9.0",
     "@langchain/core": "^1.2.5",

package.json

@@ -183,18 +183,27 @@ export function cachedCjsExports(
  * Patch the build of a dual-package provider SDK that this process is actually
  * using. `openai` and `@anthropic-ai/sdk` ship separate CJS and ESM builds
  * with separate class objects, and the OpenInference require hook only ever
- * sees the CJS one, so a pure-ESM app would silently get no spans. Their
- * `patch()` is also guarded by a module-global flag
- * (github.com/Arize-ai/openinference/issues/3557), so only ONE build can be
- * patched per process and the choice matters:
+ * sees the CJS one, so a pure-ESM app would silently get no spans:
  *
  * - CJS build already in `require.cache` → the app requires it, patch that
  *   copy. This also covers a require that happened BEFORE init(), which the
  *   require hook alone never repairs.
  * - Otherwise → import the ESM build and patch it. In an ESM app every static
- *   import already ran before init(), so this is the copy in use. The one
- *   pattern this trades away is a CJS app whose only require of the provider
- *   comes after init(): it gets the ESM build patched instead (documented).
+ *   import already ran before init(), so this is the copy in use.
+ *
+ * Picking one build used to be forced on us: `patch()` was guarded by a
+ * module-global flag (github.com/Arize-ai/openinference/issues/3557) that let
+ * only ONE build be patched per process, so a CJS app whose only require came
+ * after init() got the ESM build patched and nothing else. That flag is now
+ * scoped to the patched class (instrumentation-anthropic >= 0.2.1,
+ * -openai >= 4.2.1, the floor package.json pins), so the require hook can
+ * still patch a later CJS require on top of whatever we patched here — the
+ * case above is covered without this function choosing differently.
+ *
+ * What remains uncovered is narrower: a HYBRID app that has already loaded
+ * both builds before init(). The cached CJS copy wins here and the ESM one
+ * goes unpatched. Patching both is now permitted and would close it, at the
+ * cost of importing a build the app may never use.
  *
  * The patchable is a plain-object wrapper, never the ESM namespace itself:
  * `patch()` writes an `openInferencePatched` marker onto what it receives, and

src/instrumentation.ts

@@ -94,7 +94,7 @@ describe("the openai entry in a pure-ESM consumer", () => {
 });
 
 describe("the anthropic entry in a pure-ESM consumer", () => {
-  it("patches the ESM build, and the flag leaves a later CJS require unpatched", async () => {
+  it("patches the ESM build, and a later CJS require is patched too", async () => {
     const { provider } = recordingProvider();
     const enabled = await enableInstrumentations(makeSink(), provider, ["anthropic"]);
     expect(enabled).toContain("anthropic");
@@ -106,20 +106,24 @@ describe("the anthropic entry in a pure-ESM consumer", () => {
     };
     expect(isWrapped(EsmAnthropic.Messages.prototype.create)).toBe(true);
 
-    // Documents the residual gap, not an aspiration: OpenInference's global
-    // patched flag (Arize-ai/openinference#3557) means the CJS build of the
-    // same package can no longer be patched in this process. A CJS require
-    // that only happens after init() therefore stays uninstrumented. If this
-    // assertion starts failing after an OpenInference upgrade, the upstream
-    // fix landed: patch BOTH builds unconditionally and drop the
-    // cache-checking heuristic.
+    // This used to assert `false`, documenting the gap left by OpenInference's
+    // module-global patched flag (Arize-ai/openinference#3557): whichever build
+    // was patched first blocked the other, so a CJS require arriving after
+    // init() stayed uninstrumented. The guard is now scoped to the patched
+    // class (instrumentation-anthropic >= 0.2.1, -openai >= 4.2.1), so the
+    // require hook is free to patch the CJS build even though we already
+    // patched the ESM one. Two DIFFERENT class objects, both wrapped.
+    //
+    // Keep asserting it: this is what proves the floor in package.json is
+    // doing its job. Against an older instrumentation it fails, which is the
+    // signal we want if the range is ever loosened.
     const cjs = createRequire(import.meta.url)("@anthropic-ai/sdk") as {
       default?: { Messages: { prototype: { create: unknown } } };
       Anthropic?: { Messages: { prototype: { create: unknown } } };
     };
     const CjsAnthropic = cjs.default ?? cjs.Anthropic;
     expect(CjsAnthropic).toBeDefined();
     expect(EsmAnthropic).not.toBe(CjsAnthropic);
-    expect(isWrapped(CjsAnthropic?.Messages.prototype.create)).toBe(false);
+    expect(isWrapped(CjsAnthropic?.Messages.prototype.create)).toBe(true);
   });
 });