dd-trace 5.105.0 → 5.107.0

package/index.d.ts

@@ -19,6 +19,12 @@ interface Tracer extends opentracing.Tracer {
 
   /**
    * Starts and returns a new Span representing a logical unit of work.
+   *
+   * The returned span is not activated on the current scope. Spans created
+   * while it is open — via {@link Tracer.trace} or auto-instrumentation — only
+   * nest under it when it is the active span, so wrap the work in
+   * {@link Scope.activate} (or use {@link Tracer.trace}) when child spans
+   * should descend from it.
    * @param {string} name The name of the operation.
    * @param {tracer.SpanOptions} [options] Options for the newly created span.
    * @returns {Span} A new Span object.
@@ -4000,6 +4006,14 @@ declare namespace tracer {
       template?: string | Message[]
     }
 
+    interface ToolDefinition {
+      name : string,
+      description? : string,
+      schema? : {[key : string] : any}
+      version? : string
+    }
+
+
     /**
      * Annotation options for LLM Observability spans.
      */
@@ -4046,6 +4060,12 @@ declare namespace tracer {
        * A Prompt object that represents the prompt used for an LLM call. Only used on `llm` spans.
        */
       prompt?: Prompt,
+
+      /**
+       * A list of ToolDefinition object that represents the tools available to the LLM for this span
+       * Each definition requires a `name` and optionally accepts `description`, `schema`, and `version`.
+       * */
+      toolDefinitions?: ToolDefinition[]
     }
 
     interface AnnotationContextOptions {
@@ -4161,7 +4181,6 @@ declare namespace tracer {
        */
       agentlessEnabled?: boolean,
     }
-
     /** @hidden */
     type spanKind = 'agent' | 'workflow' | 'task' | 'tool' | 'retrieval' | 'embedding' | 'llm'
   }

package/package.json

@@ -1,13 +1,12 @@
 {
   "name": "dd-trace",
-  "version": "5.105.0",
+  "version": "5.107.0",
   "description": "Datadog APM tracing client for JavaScript",
   "main": "index.js",
   "typings": "index.d.ts",
   "scripts": {
     "env": "bash ./plugin-env",
     "prepare": "node scripts/patch-istanbul-lib-coverage.js && cd vendor && npm ci --include=dev",
-    "preinstall": "node scripts/preinstall.js",
     "prepack": "node scripts/release/swap-v5-types.js",
     "bench": "node benchmark/index.js",
     "bench:e2e:test-optimization": "node benchmark/e2e-test-optimization/benchmark-run.js",
@@ -23,7 +22,7 @@
     "lint:fix": "node scripts/check_licenses.js && node scripts/check-no-coverage-artifacts.js && node scripts/check-no-mcr-images.js && node scripts/check-docker-image-shas.js && eslint . --concurrency=auto --max-warnings 0 --fix",
     "lint:inspect": "npx @eslint/config-inspector@latest",
     "lint:codeowners": "codeowners-audit",
-    "lint:codeowners:ci": "codeowners-audit --glob='**/*.spec.js' --glob='benchmark/sirun/**'",
+    "lint:codeowners:ci": "codeowners-audit --glob='**/*.spec.js' --glob='benchmark/sirun/**' --glob='.agents/**' --glob='.claude/**'",
     "release:proposal": "node scripts/release/proposal",
     "services": "node ./scripts/install_plugin_modules && node packages/dd-trace/test/setup/services",
     "test": "echo '\nError: The root \"npm test\" command is intentionally disabled.\n\nInstead, run specific test suites:\n  - npm run test:trace:core\n  - npm run test:appsec\n  - etc.\n\nOr run individual test files:\n  npx mocha path/to/test.spec.js\n\nSee CONTRIBUTING.md (Testing section) for more details.\n' && exit 1",
@@ -153,7 +152,6 @@
     "packages/datadog-instrumentations/orchestrion.yml",
     "README.md",
     "register.js",
-    "scripts/preinstall.js",
     "vendor/dist/**/*.d.ts",
     "vendor/dist/**/*.js",
     "vendor/dist/**/*.wasm",
@@ -166,11 +164,11 @@
     "opentracing": ">=0.14.7"
   },
   "optionalDependencies": {
-    "@datadog/libdatadog": "0.9.3",
+    "@datadog/libdatadog": "0.9.4",
     "@datadog/native-appsec": "11.0.1",
     "@datadog/native-iast-taint-tracking": "4.2.0",
     "@datadog/native-metrics": "3.1.2",
-    "@datadog/openfeature-node-server": "1.2.1",
+    "@datadog/openfeature-node-server": "2.0.0",
     "@datadog/pprof": "5.14.4",
     "@datadog/wasm-js-rewriter": "5.0.1",
     "@opentelemetry/api": ">=1.0.0 <1.10.0",
@@ -180,7 +178,7 @@
   "devDependencies": {
     "@actions/core": "^3.0.1",
     "@actions/github": "^9.1.1",
-    "@babel/helpers": "^7.29.2",
+    "@babel/helpers": "^7.29.7",
     "@eslint/eslintrc": "^3.3.5",
     "@eslint/js": "^9.39.2",
     "@msgpack/msgpack": "^3.1.3",

package/packages/datadog-core/src/storage.js

@@ -3,37 +3,26 @@
 const { AsyncLocalStorage } = require('async_hooks')
 
 /**
- * This is exactly the same as AsyncLocalStorage, with the exception that it
- * uses a WeakMap to store the store object. This is because ALS stores the
- * store object as a property of the resource object, which causes all sorts
- * of problems with logging and memory. We substitute the `store` object with
- * a "handle" object, which is used as a key in a WeakMap, where the values
- * are the real store objects.
+ * `AsyncLocalStorage` with a `getHandle()` escape hatch: a span stashes the
+ * active handle at creation (see opentracing/span.js) so a later context can
+ * recover its store without holding the store itself.
+ *
+ * Under AsyncContextFrame — Node's default ALS backend on every release that
+ * ships it — the active value lives in the context frame and is never written
+ * to the async resource, so the store is held directly and the handle is the
+ * store. Pre-ACF `async_hooks` instead pinned the value onto the resource
+ * object, where it was visible to logging and retained with the resource
+ * graph; the `!isACFActive` block below restores the original WeakMap-handle
+ * indirection that kept the real store off the resource on those runtimes.
  *
  * @template T
  * @typedef {Record<string, T>} Store
  */
 class DatadogStorage extends AsyncLocalStorage {
   /**
-   * @param {Store<unknown>} [store]
-   * @override
-   */
-  enterWith (store) {
-    const handle = { noop: store?.noop }
-    stores.set(handle, store)
-    super.enterWith(handle)
-  }
-
-  /**
-   * This is method is a passthrough to the real `getStore()`, so that, when we
-   * need it, we can use the handle rather than our mapped store.
-   *
-   * It's only here because stores are currently used for a bunch of things,
-   * and we don't want to hold on to all of them in spans
-   * (see opentracing/span.js). Using a namespaced storage for spans would
-   * solve this.
-   *
-   * TODO: Refactor the Scope class to use a span-only store and remove this.
+   * Passthrough to the real `getStore()`. A span stashes this handle and feeds
+   * it back to `getStore(handle)` later. Identical in both modes: under ACF the
+   * handle is the store; without ACF it is the WeakMap key.
    *
    * @returns {Store<unknown>}
    */
@@ -42,22 +31,13 @@ class DatadogStorage extends AsyncLocalStorage {
   }
 
   /**
-   * Here, we replicate the behavior of the original `getStore()` method by
-   * passing in the handle, which we retrieve by calling it on super. Handles
-   * retrieved through `getHandle()` can also be passed in to be used as the
-   * key. This is useful if you've stashed a handle somewhere and want to
-   * retrieve the store with it.
-   * @param {object} [handle]
+   * @param {Store<unknown>} [handle] A handle from `getHandle()`; defaults to
+   * the active one. Under ACF the handle is the store, so it is returned as-is.
    * @returns {Store<unknown> | undefined}
    * @override
    */
   getStore (handle) {
-    if (!handle) {
-      handle = super.getStore()
-    }
-    if (handle) {
-      return stores.get(handle)
-    }
+    return handle ?? super.getStore()
   }
 }
 
@@ -77,12 +57,37 @@ if (!isACFActive) {
   const superGetStore = AsyncLocalStorage.prototype.getStore
   const superEnterWith = AsyncLocalStorage.prototype.enterWith
 
+  // Without ACF, ALS writes the entered value onto the async resource. Keep the
+  // real store off the resource by entering a small handle and mapping it to
+  // the store through a WeakMap, then reversing the lookup on read.
+  const stores = new WeakMap()
+
   /**
-   * Override the `run` method to manually call `enterWith` and `getStore`
-   * when not using AsyncContextFrame.
-   *
-   * Without ACF, super.run() won't call this.enterWith(), so the WeakMap handle
-   * is never created and getStore() would fail.
+   * @param {Store<unknown>} [store]
+   */
+  DatadogStorage.prototype.enterWith = function enterWith (store) {
+    const handle = { noop: store?.noop }
+    stores.set(handle, store)
+    superEnterWith.call(this, handle)
+  }
+
+  /**
+   * @param {object} [handle]
+   * @returns {Store<unknown> | undefined}
+   */
+  DatadogStorage.prototype.getStore = function getStore (handle) {
+    if (!handle) {
+      handle = superGetStore.call(this)
+    }
+    if (handle) {
+      return stores.get(handle)
+    }
+  }
+
+  /**
+   * Without ACF, `super.run()` does not delegate to `enterWith()`, so the
+   * WeakMap handle is never created and `getStore()` would miss. Drive the
+   * handle path manually and restore the prior handle on the way out.
    *
    * @template R
    * @template {unknown[]} TArgs
@@ -103,12 +108,6 @@ if (!isACFActive) {
   }
 }
 
-/**
- * This is the map from handles to real stores, used in the class above.
- * @type {WeakMap<WeakKey, Store<unknown>|undefined>}
- */
-const stores = new WeakMap()
-
 /**
  * For convenience, we use the `storage` function as a registry of namespaces
  * corresponding to DatadogStorage instances. This lets us have separate

package/packages/datadog-esbuild/index.js

@@ -347,10 +347,15 @@ register(${JSON.stringify(toRegister)}, _, set, get, ${JSON.stringify(data.raw)}
         }
       } else {
         const fileCode = fs.readFileSync(args.path, 'utf8')
+        // Don't spread `...arguments`: esbuild's minifier can rewrite the surrounding
+        // `__commonJS` factory into an arrow function whose `arguments` resolves to the
+        // ESM top-level scope (see issue #8681). Pass `(module.exports, module)`
+        // explicitly; the IIFE declares no parameters so esbuild's static `require()`
+        // resolution inside `fileCode` is preserved through the factory's closure.
         contents = `
         (function() {
           ${fileCode}
-        })(...arguments);
+        })(module.exports, module);
         {
           const dc = require('dc-polyfill');
           const ch = dc.channel('${CHANNEL}');

package/packages/datadog-instrumentations/src/ai.js

@@ -2,8 +2,8 @@
 
 const { channel, tracingChannel } = require('dc-polyfill')
 const shimmer = require('../../datadog-shimmer')
-const { addHook, getHooks } = require('./helpers/instrument')
 const { convertVercelPromptToMessages, buildOutputMessages } = require('./helpers/ai-messages')
+const { addHook, getHooks } = require('./helpers/instrument')
 
 const vercelAiTracingChannel = tracingChannel('dd-trace:vercel-ai')
 const vercelAiSpanSetAttributesChannel = channel('dd-trace:vercel-ai:span:setAttributes')
@@ -15,12 +15,21 @@ const wrappedModels = new WeakSet()
 /**
  * Publishes already-converted AI-style messages to the AI Guard evaluation channel.
  *
+ * Subscribers push async work into `pending` and abort `abortController` to block.
+ *
  * @param {Array<object>} messages - AI-style messages to evaluate.
  * @returns {Promise<void>}
  */
 function publishEvaluation (messages) {
-  return new Promise((resolve, reject) => {
-    aiguardChannel.publish({ messages, integration: 'ai', resolve, reject })
+  const abortController = new AbortController()
+  const ctx = { messages, integration: 'ai', abortController, pending: [] }
+
+  aiguardChannel.publish(ctx)
+
+  return Promise.all(ctx.pending).then(() => {
+    if (abortController.signal.aborted) {
+      throw abortController.signal.reason
+    }
   })
 }
 

package/packages/datadog-instrumentations/src/aws-sdk.js

@@ -233,13 +233,14 @@ function wrapSmithySend (send) {
 }
 
 function handleCompletion (result, ctx, channels) {
-  const iterator = result?.body?.[Symbol.asyncIterator]
+  const streamable = result?.body ?? result?.stream
+  const iterator = streamable?.[Symbol.asyncIterator]
   if (!iterator) {
     channels.complete.publish(ctx)
     return
   }
 
-  shimmer.wrap(result.body, Symbol.asyncIterator, function (asyncIterator) {
+  shimmer.wrap(streamable, Symbol.asyncIterator, function (asyncIterator) {
     return function (...args) {
       const iterator = asyncIterator.apply(this, args)
       shimmer.wrap(iterator, 'next', function (next) {

package/packages/datadog-instrumentations/src/body-parser.js

@@ -6,7 +6,10 @@ const { channel, addHook, AsyncResource } = require('./helpers/instrument')
 const bodyParserReadCh = channel('datadog:body-parser:read:finish')
 
 function publishRequestBodyAndNext (req, res, next) {
-  return shimmer.wrapFunction(next, next => function (...args) {
+  // Named `next`/arity-1 mirrors the express continuation so wrapCallback skips
+  // its name/length rewrite; `_error` only pads the arity and `arguments`
+  // forwards whatever next was called with.
+  return shimmer.wrapCallback(next, original => function next (_error) {
     if (bodyParserReadCh.hasSubscribers && req) {
       const abortController = new AbortController()
       const body = req.body
@@ -16,7 +19,7 @@ function publishRequestBodyAndNext (req, res, next) {
       if (abortController.signal.aborted) return
     }
 
-    return next.apply(this, args)
+    return original.apply(this, arguments)
   })
 }
 

package/packages/datadog-instrumentations/src/connect.js

@@ -90,7 +90,8 @@ function wrapLayerHandle (layer) {
 }
 
 function wrapNext (req, next) {
-  return shimmer.wrapFunction(next, next => function (error) {
+  // Mirror next's name/arity so wrapCallback skips its per-call identity rewrite.
+  return shimmer.wrapCallback(next, original => function next (error) {
     if (error) {
       errorChannel.publish({ req, error })
     }
@@ -98,7 +99,7 @@ function wrapNext (req, next) {
     nextChannel.publish({ req })
     finishChannel.publish({ req })
 
-    next.apply(this, arguments)
+    original.apply(this, arguments)
   })
 }
 

package/packages/datadog-instrumentations/src/cookie-parser.js

@@ -6,7 +6,8 @@ const { channel, addHook } = require('./helpers/instrument')
 const cookieParserReadCh = channel('datadog:cookie-parser:read:finish')
 
 function publishRequestCookieAndNext (req, res, next) {
-  return shimmer.wrapFunction(next, next => function cookieParserWrapper (...args) {
+  // Mirror next's name/arity so wrapCallback skips its per-call identity rewrite.
+  return shimmer.wrapCallback(next, original => function next (_error) {
     if (cookieParserReadCh.hasSubscribers && req) {
       const abortController = new AbortController()
 
@@ -17,7 +18,7 @@ function publishRequestCookieAndNext (req, res, next) {
       if (abortController.signal.aborted) return
     }
 
-    return next.apply(this, args)
+    return original.apply(this, arguments)
   })
 }
 

package/packages/datadog-instrumentations/src/cucumber-worker-threads.js

@@ -0,0 +1,19 @@
+'use strict'
+
+const { createRequire } = require('node:module')
+const path = require('node:path')
+
+const { patchCucumberWorkerRunTestCase } = require('./cucumber')
+
+const appRequire = createRequire(path.join(process.cwd(), 'package.json'))
+
+try {
+  // Cucumber v13 parallel workers start from an ESM worker.mjs entrypoint, which
+  // statically imports the internal runtime Worker before it runs support-code
+  // requireModules. The regular module hook does not patch that internal worker
+  // import, so this preload is injected into requireModules to patch the cached Worker
+  // prototype before Cucumber constructs the worker instance.
+  patchCucumberWorkerRunTestCase(appRequire('@cucumber/cucumber/lib/runtime/worker'), true)
+} catch {
+  // Ignore preload failures so cucumber can keep running if its internals change.
+}