dd-trace 5.103.0 → 5.104.0

package/packages/dd-trace/src/encode/agentless-ci-visibility.js

@@ -7,6 +7,7 @@ const {
   TELEMETRY_ENDPOINT_PAYLOAD_SERIALIZATION_MS,
   TELEMETRY_ENDPOINT_PAYLOAD_EVENTS_COUNT,
 } = require('../ci-visibility/telemetry')
+const { MsgpackChunk } = require('../msgpack')
 const { AgentEncoder } = require('./0.4')
 const { truncateSpan, normalizeSpan } = require('./tags-processors')
 
@@ -20,6 +21,9 @@ const TEST_AND_SPAN_KEYS_LENGTH = 11
 
 const INTAKE_SOFT_LIMIT = 2 * 1024 * 1024 // 2MB
 
+// Prefix is ~1 KB in practice; `MsgpackChunk` resizes on overflow.
+const PREFIX_CHUNK_INITIAL_SIZE = 2048
+
 function formatSpan (span) {
   let encodingVersion = ENCODING_VERSION
   if (span.type === 'test' && span.meta && span.meta.test_session_id) {
@@ -259,10 +263,6 @@ class AgentlessCiVisibilityEncoder extends AgentEncoder {
   }
 
   _encode (bytes, trace) {
-    if (this._isReset) {
-      this._encodePayloadStart(bytes)
-      this._isReset = false
-    }
     const startTime = Date.now()
 
     const events = trace.map(formatSpan)
@@ -281,20 +281,28 @@ class AgentlessCiVisibilityEncoder extends AgentEncoder {
 
   makePayload () {
     distributionMetric(TELEMETRY_ENDPOINT_PAYLOAD_EVENTS_COUNT, { endpoint: 'test_cycle' }, this._eventCount)
-    const bytes = this._traceBytes
-    const eventsOffset = this._eventsOffset
-    const eventsCount = this._eventCount
 
-    bytes.buffer[eventsOffset] = 0xDD
-    bytes.buffer[eventsOffset + 1] = eventsCount >> 24
-    bytes.buffer[eventsOffset + 2] = eventsCount >> 16
-    bytes.buffer[eventsOffset + 3] = eventsCount >> 8
-    bytes.buffer[eventsOffset + 4] = eventsCount
+    // Encode the payload prefix (version + metadata + events-array header) at flush time,
+    // not on the first `_encode`. The CI Visibility flow adds metadata across multiple
+    // diagnostic channels (`session:start` adds `test_session.name`, the async
+    // `library-configuration` callback adds capability tags). Any span finished between
+    // those calls would otherwise freeze the prefix with stale metadata.
+    const prefixBytes = new MsgpackChunk(PREFIX_CHUNK_INITIAL_SIZE)
+    this._encodePayloadStart(prefixBytes)
 
-    const traceSize = bytes.length
-    const buffer = Buffer.allocUnsafe(traceSize)
-
-    bytes.buffer.copy(buffer, 0, 0, traceSize)
+    const eventsOffset = this._eventsOffset
+    const eventsCount = this._eventCount
+    prefixBytes.buffer[eventsOffset] = 0xDD
+    prefixBytes.buffer[eventsOffset + 1] = eventsCount >> 24
+    prefixBytes.buffer[eventsOffset + 2] = eventsCount >> 16
+    prefixBytes.buffer[eventsOffset + 3] = eventsCount >> 8
+    prefixBytes.buffer[eventsOffset + 4] = eventsCount
+
+    const eventsBytes = this._traceBytes
+    const totalSize = prefixBytes.length + eventsBytes.length
+    const buffer = Buffer.allocUnsafe(totalSize)
+    prefixBytes.buffer.copy(buffer, 0, 0, prefixBytes.length)
+    eventsBytes.buffer.copy(buffer, prefixBytes.length, 0, eventsBytes.length)
 
     this.reset()
 
@@ -302,7 +310,8 @@ class AgentlessCiVisibilityEncoder extends AgentEncoder {
   }
 
   _encodePayloadStart (bytes) {
-    // encodes the payload up to `events`. `events` will be encoded via _encode
+    // Encodes the payload up to (and including) the `events` array prefix. The 5 reserved
+    // bytes for the array length are patched in `makePayload`.
     const payload = {
       version: ENCODING_VERSION,
       metadata: {
@@ -346,7 +355,6 @@ class AgentlessCiVisibilityEncoder extends AgentEncoder {
       this._encodeMap(bytes, payload.metadata.test_session_end)
     }
     this._encodeString(bytes, 'events')
-    // Get offset of the events list to update the length of the array when calling `makePayload`
     this._eventsOffset = bytes.length
     bytes.reserve(5)
   }
@@ -354,7 +362,6 @@ class AgentlessCiVisibilityEncoder extends AgentEncoder {
   reset () {
     this._reset()
     this._eventCount = 0
-    this._isReset = true
   }
 }
 

package/packages/dd-trace/src/exporters/common/agents.js

@@ -4,6 +4,8 @@ const http = require('http')
 const https = require('https')
 const { storage } = require('../../../../datadog-core')
 
+const legacyStorage = storage('legacy')
+
 const keepAlive = true
 const maxSockets = 1
 
@@ -26,7 +28,7 @@ function createAgentClass (BaseAgent) {
     }
 
     _noop (callback) {
-      return storage('legacy').run({ noop: true }, callback)
+      return legacyStorage.run({ noop: true }, callback)
     }
   }
 

package/packages/dd-trace/src/exporters/common/request.js

@@ -20,6 +20,8 @@ const {
   markEndpointReached,
 } = require('./retry')
 
+const legacyStorage = storage('legacy')
+
 const maxActiveBufferSize = 1024 * 1024 * 64
 
 let activeBufferSize = 0
@@ -161,7 +163,7 @@ function request (data, options, callback) {
 
     activeBufferSize += options.headers['Content-Length'] ?? 0
 
-    storage('legacy').run({ noop: true }, () => {
+    legacyStorage.run({ noop: true }, () => {
       let finished = false
       const finalize = () => {
         if (finished) return

package/packages/dd-trace/src/id.js

@@ -13,6 +13,12 @@ let batch = 0
 class Identifier {
   /** @type {number[] | Uint8Array} */
   #buffer
+  /** @type {bigint | undefined} */
+  #bigInt
+  /** @type {string | undefined} */
+  #stringHex
+  /** @type {string | undefined} */
+  #stringDecimal
 
   /**
    * @param {string} value
@@ -29,16 +35,23 @@ class Identifier {
    * @returns {string}
    */
   toString (radix = 16) {
-    return radix === 16
-      ? Buffer.from(this.#buffer).toString('hex')
-      : toNumberString(this.#buffer, radix)
+    if (radix === 16) {
+      this.#stringHex ??= Buffer.from(this.#buffer).toString('hex')
+      return this.#stringHex
+    }
+    if (radix === 10) {
+      this.#stringDecimal ??= toNumberString(this.#buffer, 10)
+      return this.#stringDecimal
+    }
+    return toNumberString(this.#buffer, radix)
   }
 
   /**
    * @returns {bigint}
    */
   toBigInt () {
-    return Buffer.from(this.#buffer).readBigUInt64BE(0)
+    this.#bigInt ??= Buffer.from(this.#buffer).readBigUInt64BE(0)
+    return this.#bigInt
   }
 
   /**

package/packages/dd-trace/src/lambda/handler.js

@@ -6,8 +6,6 @@ const { ERROR_MESSAGE, ERROR_TYPE } = require('../constants')
 const { ImpendingTimeout } = require('./runtime/errors')
 const { extractContext } = require('./context')
 
-const globalTracer = global._ddtrace
-const tracer = globalTracer._tracer
 const timeoutChannel = channel('apm:aws:lambda:timeout')
 // Always crash the flushes when a message is received
 // from this channel.
@@ -25,8 +23,7 @@ let __lambdaTimeout
  */
 function checkTimeout (context) {
   const remainingTimeInMillis = context.getRemainingTimeInMillis()
-
-  const apmFlushDeadline = tracer._config.DD_APM_FLUSH_DEADLINE_MILLISECONDS
+  const apmFlushDeadline = global._ddtrace._tracer._config.DD_APM_FLUSH_DEADLINE_MILLISECONDS
 
   __lambdaTimeout = setTimeout(() => {
     timeoutChannel.publish()
@@ -42,6 +39,7 @@ function checkTimeout (context) {
  * Once that is done, it finishes the last span.
  */
 function crashFlush () {
+  const tracer = global._ddtrace._tracer
   const activeSpan = tracer.scope().active()
   if (activeSpan === null) {
     log.debug('An impending timeout was reached, but no root span was found. No error will be tagged.')

package/packages/dd-trace/src/llmobs/sdk.js

@@ -55,6 +55,11 @@ class LLMObs extends NoopLLMObs {
   }
 
   enable (options = {}) {
+    logger.warn(
+      'Enabling LLM Observability via `llmobs.enable()` is deprecated and will be removed in dd-trace@7.0.0. ' +
+      'Please instantiate LLM Observability via DD_LLMOBS_ENABLED or `tracer.init({ llmobs: ...options })`.'
+    )
+
     if (this.enabled) {
       logger.debug('LLMObs is already enabled.')
       return
@@ -79,6 +84,11 @@ class LLMObs extends NoopLLMObs {
   }
 
   disable () {
+    logger.warn(
+      'Disabling LLM Observability via `llmobs.disable()` is deprecated and will be removed in dd-trace@7.0.0. ' +
+      'Set DD_LLMOBS_ENABLED=false to disable LLM Observability.'
+    )
+
     if (!this.enabled) {
       logger.debug('LLMObs is already disabled.')
       return

package/packages/dd-trace/src/log/writer.js

@@ -3,6 +3,8 @@
 const { storage } = require('../../../datadog-core')
 const { LogChannel } = require('./channels')
 
+const legacyStorage = storage('legacy')
+
 const defaultLogger = {
   debug: msg => console.debug(msg), /* eslint-disable-line no-console */
   info: msg => console.info(msg), /* eslint-disable-line no-console */
@@ -15,7 +17,7 @@ let logger = defaultLogger
 let logChannel = new LogChannel()
 
 function withNoop (fn) {
-  storage('legacy').run({ noop: true }, fn)
+  legacyStorage.run({ noop: true }, fn)
 }
 
 function toggleSubscription (enable, level) {

package/packages/dd-trace/src/noop/span.js

@@ -4,9 +4,11 @@ const id = require('../id')
 const { storage } = require('../../../datadog-core') // TODO: noop storage?
 const NoopSpanContext = require('./span_context')
 
+const legacyStorage = storage('legacy')
+
 class NoopSpan {
   constructor (tracer, parent) {
-    this._store = storage('legacy').getHandle()
+    this._store = legacyStorage.getHandle()
     this._noopTracer = tracer
     this._noopContext = this._createContext(parent)
   }

package/packages/dd-trace/src/openfeature/writers/exposures.js

@@ -8,8 +8,14 @@ const {
   EVP_PAYLOAD_SIZE_LIMIT,
   EVP_EVENT_SIZE_LIMIT,
 } = require('../constants/constants')
+const log = require('../../log')
 const BaseFFEWriter = require('./base')
 
+// Disabled-state cap. Drops invalidate experiment results because the provider's
+// exposure dedupe cache keeps masking dropped events after recovery. The first
+// drop emits a warning and `droppedEventCount` accumulates the cumulative loss.
+const PENDING_MAX_EVENTS = 1000
+
 /**
  * @typedef {object} ExposureEvent
  * @property {number} timestamp - Unix timestamp in milliseconds
@@ -42,11 +48,21 @@ const BaseFFEWriter = require('./base')
  * ExposuresWriter is responsible for sending exposure events to the Datadog Agent.
  */
 class ExposuresWriter extends BaseFFEWriter {
+  // Disabled until the agent strategy probe resolves.
+  #enabled = false
+
+  /** @type {ExposureEvent[]} */
+  #pendingEvents = []
+
+  /** @type {ExposureContext} */
+  #context
+
+  #dropWarned = false
+
   /**
    * @param {import('../../config/config-base')} config - Tracer configuration object
    */
   constructor (config) {
-    // Build full EVP endpoint path
     const basePath = EVP_PROXY_AGENT_BASE_PATH.replace(/\/+$/, '')
     const endpoint = EXPOSURES_ENDPOINT.replace(/^\/+/, '')
     const fullEndpoint = `${basePath}/${endpoint}`
@@ -60,33 +76,33 @@ class ExposuresWriter extends BaseFFEWriter {
         [EVP_SUBDOMAIN_HEADER_NAME]: EVP_SUBDOMAIN_VALUE,
       },
     })
-    this._enabled = false // Start disabled until agent strategy is set
-    this._pendingEvents = [] // Buffer events until enabled
 
+    /** @type {ExposureContext} */
     const context = {
       service: config.service,
     }
-    // Only include version and env if they are defined
+
     if (config.version !== undefined) {
       context.version = config.version
     }
+
     if (config.env !== undefined) {
       context.env = config.env
     }
 
-    this._context = context
+    this.#context = context
   }
 
   /**
    * @param {boolean} enabled - Whether to enable the writer
    */
   setEnabled (enabled) {
-    this._enabled = enabled
+    this.#enabled = enabled
 
-    if (enabled && this._pendingEvents.length > 0) {
+    if (enabled && this.#pendingEvents.length > 0) {
       // Flush all pending events as a batch
-      super.append(this._pendingEvents)
-      this._pendingEvents = []
+      super.append(this.#pendingEvents)
+      this.#pendingEvents = []
     }
   }
 
@@ -95,24 +111,38 @@ class ExposuresWriter extends BaseFFEWriter {
    * @param {ExposureEvent|ExposureEvent[]} events - Exposure event(s) to append
    */
   append (events) {
-    if (!this._enabled) {
-      // Buffer events until writer is ready
-      if (Array.isArray(events)) {
-        this._pendingEvents.push(...events)
-      } else {
-        this._pendingEvents.push(events)
-      }
+    if (this.#enabled) {
+      super.append(events)
       return
     }
-    super.append(events)
+
+    const eventArray = Array.isArray(events) ? events : [events]
+    this.#pendingEvents.push(...eventArray)
+    if (this.#pendingEvents.length > PENDING_MAX_EVENTS) {
+      const dropped = this.#pendingEvents.length - PENDING_MAX_EVENTS
+      this.#pendingEvents.splice(0, dropped)
+      this._droppedEvents += dropped
+      if (!this.#dropWarned) {
+        this.#dropWarned = true
+        log.warn(
+          '%s dropped exposure event(s) at cap %d. This may invalidate experiment results.',
+          this.constructor.name, PENDING_MAX_EVENTS)
+      }
+    }
+  }
+
+  /**
+   * @returns {number} Cumulative number of exposure events dropped due to buffer overflow.
+   */
+  get droppedEventCount () {
+    return this._droppedEvents
   }
 
   /**
    * Flushes buffered exposure events to the agent
    */
   flush () {
-    if (!this._enabled) {
-      // Don't flush when disabled
+    if (!this.#enabled) {
       return
     }
     super.flush()
@@ -125,6 +155,7 @@ class ExposuresWriter extends BaseFFEWriter {
    */
   makePayload (events) {
     const formattedEvents = events.map(event => {
+      /** @type {ExposureEvent} */
       return {
         timestamp: event.timestamp || Date.now(),
         allocation: {
@@ -145,7 +176,7 @@ class ExposuresWriter extends BaseFFEWriter {
     })
 
     return {
-      context: this._context,
+      context: this.#context,
       exposures: formattedEvents,
     }
   }

package/packages/dd-trace/src/opentelemetry/metrics/periodic_metric_reader.js

@@ -336,7 +336,7 @@ class MetricAggregator {
       }
     }
 
-    this.#applyDeltaTemporality(metricsMap, lastExportedState)
+    this.#applyDeltaTemporality(metricsMap.values(), lastExportedState)
     return metricsMap
   }
 

package/packages/dd-trace/src/plugins/apollo.js

@@ -3,13 +3,15 @@
 const { storage } = require('../../../datadog-core')
 const TracingPlugin = require('./tracing')
 
+const legacyStorage = storage('legacy')
+
 class ApolloBasePlugin extends TracingPlugin {
   static id = 'apollo.gateway'
   static type = 'web'
   static kind = 'server'
 
   bindStart (ctx) {
-    const store = storage('legacy').getStore()
+    const store = legacyStorage.getStore()
     const childOf = store ? /** @type {import('../opentracing/span') | undefined} */ (store.span) : null
 
     const span = this.startSpan(this.getOperationName(), {

package/packages/dd-trace/src/plugins/ci_plugin.js

@@ -82,6 +82,8 @@ const {
   DD_CAPABILITIES_TEST_IMPACT_ANALYSIS,
 } = require('./util/test')
 
+const legacyStorage = storage('legacy')
+
 const FRAMEWORK_TO_TRIMMED_COMMAND = {
   vitest: 'vitest run',
   mocha: 'mocha',
@@ -147,7 +149,7 @@ module.exports = class CiPlugin extends Plugin {
 
     this.addSub(`ci:${this.constructor.id}:library-configuration`, (ctx) => {
       const { onDone, frameworkVersion } = ctx
-      ctx.currentStore = storage('legacy').getStore()
+      ctx.currentStore = legacyStorage.getStore()
 
       if (!this.tracer._exporter || !this.tracer._exporter.getLibraryConfiguration) {
         return onDone({ err: new Error('Test optimization was not initialized correctly') })
@@ -249,18 +251,6 @@ module.exports = class CiPlugin extends Plugin {
         integrationName: this.constructor.id,
       })
       setItrSkippingEnabledTagFromLibraryConfig(this, frameworkVersion)
-      // only for vitest
-      // These are added for the worker threads to use
-      if (this.constructor.id === 'vitest') {
-        // TODO: Figure out alternative ways to pass this information to the worker threads
-        // eslint-disable-next-line eslint-rules/eslint-process-env
-        process.env.DD_CIVISIBILITY_TEST_SESSION_ID = this.testSessionSpan.context().toTraceId()
-        // eslint-disable-next-line eslint-rules/eslint-process-env
-        process.env.DD_CIVISIBILITY_TEST_MODULE_ID = this.testModuleSpan.context().toSpanId()
-        // eslint-disable-next-line eslint-rules/eslint-process-env
-        process.env.DD_CIVISIBILITY_TEST_COMMAND = this.command
-      }
-
       this.telemetry.ciVisEvent(TELEMETRY_EVENT_CREATED, 'module')
     })
 

package/packages/dd-trace/src/plugins/log_plugin.js

@@ -4,6 +4,8 @@ const { LOG } = require('../../../../ext/formats')
 const { storage } = require('../../../datadog-core')
 const Plugin = require('./plugin')
 
+const legacyStorage = storage('legacy')
+
 function messageProxy (message, holder) {
   return new Proxy(message, {
     get (target, key) {
@@ -38,7 +40,7 @@ module.exports = class LogPlugin extends Plugin {
     super(...args)
 
     this.addSub(`apm:${this.constructor.id}:log`, (arg) => {
-      const span = storage('legacy').getStore()?.span
+      const span = legacyStorage.getStore()?.span
 
       // NOTE: This needs to run whether or not there is a span
       // so service, version, and env will always get injected.

package/packages/dd-trace/src/plugins/tracing.js

@@ -5,6 +5,8 @@ const analyticsSampler = require('../analytics_sampler')
 const { COMPONENT, SVC_SRC_KEY } = require('../constants')
 const Plugin = require('./plugin')
 
+const legacyStorage = storage('legacy')
+
 class TracingPlugin extends Plugin {
   constructor (...args) {
     super(...args)
@@ -16,7 +18,7 @@ class TracingPlugin extends Plugin {
   }
 
   get activeSpan () {
-    const store = /** @type {{ span?: import('../../../..').Span }} */ (storage('legacy').getStore())
+    const store = /** @type {{ span?: import('../../../..').Span }} */ (legacyStorage.getStore())
 
     return store?.span
   }
@@ -193,7 +195,7 @@ class TracingPlugin extends Plugin {
       serviceSource = service ? 'opt.plugin' : undefined
     }
 
-    const store = storage('legacy').getStore()
+    const store = legacyStorage.getStore()
     if (store && childOf === undefined) {
       childOf = /** @type {import('../opentracing/span') | undefined} */ (store.span)
     }
@@ -226,7 +228,7 @@ class TracingPlugin extends Plugin {
 
     // TODO: Remove this after migration to TracingChannel is done.
     if (enterOrCtx === true) {
-      storage('legacy').enterWith({ ...store, span })
+      legacyStorage.enterWith({ ...store, span })
     } else if (enterOrCtx) {
       enterOrCtx.parentStore = store
       enterOrCtx.currentStore = { ...store, span }

package/packages/dd-trace/src/plugins/util/git.js

@@ -37,6 +37,8 @@ const {
 const { filterSensitiveInfoFromRepository } = require('./url')
 const { cachedExec } = require('./git-cache')
 
+const legacyStorage = storage('legacy')
+
 const GIT_REV_LIST_MAX_BUFFER = 12 * 1024 * 1024 // 12MB
 
 function sanitizedExec (
@@ -47,7 +49,7 @@ function sanitizedExec (
   errorMetric,
   shouldTrim = true
 ) {
-  return storage('legacy').run({ noop: true }, () => {
+  return legacyStorage.run({ noop: true }, () => {
     let startTime
     if (operationMetric) {
       incrementCountMetric(operationMetric.name, operationMetric.tags)

package/packages/dd-trace/src/plugins/util/test.js

@@ -267,6 +267,87 @@ function getSessionItrSkippingEnabledTags (sessionSpan) {
   return {}
 }
 
+/**
+ * Starts supported test optimization requests together when each feature is enabled.
+ *
+ * @param {{
+ *   isKnownTestsEnabled: boolean,
+ *   isTestManagementTestsEnabled: boolean,
+ *   isSuitesSkippingEnabled?: boolean,
+ *   getKnownTests: () => Promise<object>,
+ *   getTestManagementTests: () => Promise<object>,
+ *   getSkippableSuites?: () => Promise<object>
+ * }} options - Test optimization request factories.
+ * @returns {Promise<{
+ *   knownTestsResponse?: object,
+ *   testManagementTestsResponse?: object,
+ *   skippableSuitesResponse?: object
+ * }>}
+ */
+function getTestOptimizationRequestResults ({
+  isKnownTestsEnabled,
+  isTestManagementTestsEnabled,
+  isSuitesSkippingEnabled,
+  getKnownTests,
+  getTestManagementTests,
+  getSkippableSuites,
+}) {
+  const requestPromises = []
+  const responseNames = []
+
+  if (isKnownTestsEnabled) {
+    addTestOptimizationRequest(requestPromises, responseNames, 'knownTestsResponse', getKnownTests)
+  }
+
+  if (isTestManagementTestsEnabled) {
+    addTestOptimizationRequest(
+      requestPromises,
+      responseNames,
+      'testManagementTestsResponse',
+      getTestManagementTests
+    )
+  }
+
+  if (isSuitesSkippingEnabled && getSkippableSuites) {
+    addTestOptimizationRequest(requestPromises, responseNames, 'skippableSuitesResponse', getSkippableSuites)
+  }
+
+  if (!requestPromises.length) {
+    return Promise.resolve({})
+  }
+
+  return Promise.allSettled(requestPromises).then(requestResults => {
+    const responses = {}
+
+    for (let index = 0; index < requestResults.length; index++) {
+      const requestResult = requestResults[index]
+      responses[responseNames[index]] = requestResult.status === 'fulfilled'
+        ? requestResult.value
+        : { err: requestResult.reason }
+    }
+
+    return responses
+  })
+}
+
+/**
+ * Starts a test optimization request.
+ *
+ * @param {Promise<object>[]} requestPromises - Test optimization request promises.
+ * @param {string[]} responseNames - Response keys matching request promises.
+ * @param {string} responseName - Response key for this request.
+ * @param {() => Promise<object>} getRequest - Test optimization request factory.
+ */
+function addTestOptimizationRequest (requestPromises, responseNames, responseName, getRequest) {
+  responseNames.push(responseName)
+
+  try {
+    requestPromises.push(Promise.resolve(getRequest()))
+  } catch (err) {
+    requestPromises.push(Promise.reject(err))
+  }
+}
+
 module.exports = {
   TEST_CODE_OWNERS,
   TEST_SESSION_NAME,
@@ -383,6 +464,7 @@ module.exports = {
   DD_CI_LIBRARY_CONFIGURATION_ERROR_KNOWN_TESTS,
   DD_CI_LIBRARY_CONFIGURATION_ERROR_TEST_MANAGEMENT_TESTS,
   getSessionItrSkippingEnabledTags,
+  getTestOptimizationRequestResults,
   checkShaDiscrepancies,
   getPullRequestDiff,
   getPullRequestBaseBranch,

package/packages/dd-trace/src/plugins/util/web.js

@@ -400,6 +400,17 @@ function addRequestTags (context, spanType) {
     }
   }
 
+  // Datadog scan/test markers, tagged unconditionally so the API endpoint
+  // reducer can keep scan/test traffic out of the API inventory.
+  const endpointScan = req.headers['x-datadog-endpoint-scan']
+  if (endpointScan !== undefined) {
+    span.setTag(`${HTTP_REQUEST_HEADERS}.x-datadog-endpoint-scan`, endpointScan)
+  }
+  const securityTest = req.headers['x-datadog-security-test']
+  if (securityTest !== undefined) {
+    span.setTag(`${HTTP_REQUEST_HEADERS}.x-datadog-security-test`, securityTest)
+  }
+
   addHeaders(context)
 }