dd-trace 5.106.0 → 5.107.0

package/packages/dd-trace/src/exporters/agent/index.js

@@ -2,7 +2,6 @@
 
 const { URL } = require('url')
 const log = require('../../log')
-const { getAgentUrl } = require('../../agent/url')
 const Writer = require('./writer')
 
 class AgentExporter {
@@ -11,7 +10,7 @@ class AgentExporter {
   constructor (config, prioritySampler) {
     this._config = config
     const { lookup, protocolVersion, stats = {}, apmTracingEnabled } = config
-    this._url = getAgentUrl(config)
+    this._url = config.url
 
     const headers = {}
     if (stats.enabled || apmTracingEnabled === false) {

package/packages/dd-trace/src/exporters/agentless/index.js

@@ -18,25 +18,21 @@ class AgentlessExporter {
 
   /**
    * @param {object} config - Configuration object
-   * @param {string} [config.site] - The Datadog site. Defaults to 'datadoghq.com'.
-   * @param {string} [config.url] - Override intake URL
+   * @param {string} [config.site] - The Datadog site. Defaults to 'datadoghq.com'.
    * @param {number} [config.flushInterval] - Batch flush interval in ms
    * @param {string} [config.env] - Environment name
    * @param {object} [config.tags] - Tags including runtime-id
    */
   constructor (config) {
     this._config = config
-    const { site = 'datadoghq.com', url } = config
+    const site = config.site ?? 'datadoghq.com'
 
     try {
-      this._url = url ? new URL(url) : new URL(`https://public-trace-http-intake.logs.${site}`)
+      // Agentless traffic carries the Datadog API key, so the intake is always the public https
+      // endpoint; never derive it from config.url (the agent's cleartext http) or the key leaks.
+      this._url = new URL(`https://public-trace-http-intake.logs.${site}`)
     } catch (err) {
-      log.error(
-        'Invalid URL configuration for agentless exporter. url=%s, site=%s. Error: %s',
-        url || 'not set',
-        site,
-        err.message
-      )
+      log.error('Invalid site for agentless exporter. site=%s. Error: %s', site, err.message)
       this._url = null
     }
 

package/packages/dd-trace/src/exporters/common/buffering-exporter.js

@@ -1,7 +1,6 @@
 'use strict'
 
 const { incrementCountMetric, TELEMETRY_EVENTS_ENQUEUED_FOR_SERIALIZATION } = require('../../ci-visibility/telemetry')
-const { getAgentUrl } = require('../../agent/url')
 
 /**
  * Base exporter that buffers traces until a writer is initialized.
@@ -14,7 +13,7 @@ class BufferingExporter {
 
   constructor (tracerConfig) {
     this._config = tracerConfig
-    this._url = getAgentUrl(tracerConfig)
+    this._url = tracerConfig.url
   }
 
   export (trace) {

package/packages/dd-trace/src/exporters/common/request.js

@@ -6,6 +6,7 @@
 const { Readable } = require('stream')
 const http = require('http')
 const https = require('https')
+const net = require('net')
 const zlib = require('zlib')
 
 const { storage } = require('../../../../datadog-core')
@@ -45,6 +46,17 @@ function parseUrl (urlObjOrString) {
   return url
 }
 
+/**
+ * @param {string} hostname Host as resolved by {@link parseUrl}; IPv6 is unbracketed (`::1`).
+ */
+function isLoopbackHost (hostname) {
+  // The 127.0.0.0/8 block is loopback, but only when the host is an actual IPv4 literal: a
+  // hostname like `127.evil.com` shares the prefix yet resolves anywhere, so net.isIPv4 gates it.
+  return hostname === 'localhost' ||
+    hostname === '::1' ||
+    (hostname.startsWith('127.') && net.isIPv4(hostname))
+}
+
 /**
  * @param {Buffer|string|Readable|Array<Buffer|string>} data
  * @param {object} options
@@ -67,6 +79,20 @@ function request (data, options, callback) {
     }
   }
 
+  // Never put the Datadog API key on a cleartext connection to a non-loopback host; that would
+  // expose it on the wire. Loopback (local agent, dev proxy, tests) is exempt. Strip the key
+  // rather than drop the request: the agent proxies telemetry with its own key, while an https
+  // intake URL is required to authenticate agentless traffic.
+  const hasApiKey = options.headers['dd-api-key'] !== undefined || options.headers['DD-API-KEY'] !== undefined
+  if (hasApiKey && options.protocol === 'http:' && !isLoopbackHost(options.hostname)) {
+    log.error(
+      'Not sending the Datadog API key over a non-TLS connection to %s. Configure an https intake URL.',
+      options.hostname
+    )
+    delete options.headers['dd-api-key']
+    delete options.headers['DD-API-KEY']
+  }
+
   if (data instanceof Readable) {
     const chunks = []
 

package/packages/dd-trace/src/exporters/span-stats/index.js

@@ -1,11 +1,10 @@
 'use strict'
 
-const { getAgentUrl } = require('../../agent/url')
 const { Writer } = require('./writer')
 
 class SpanStatsExporter {
   constructor (config) {
-    this._url = getAgentUrl(config)
+    this._url = config.url
     this._writer = new Writer({ url: this._url })
   }
 

package/packages/dd-trace/src/llmobs/plugins/genai/index.js

@@ -5,6 +5,7 @@ const {
   getOperation,
   extractMetrics,
   extractMetadata,
+  extractToolDefinitions,
   aggregateStreamingChunks,
   formatInputMessages,
   formatEmbeddingInput,
@@ -79,6 +80,9 @@ class GenAiLLMObsPlugin extends LLMObsPlugin {
     const metadata = extractMetadata(config)
     this._tagger.tagMetadata(span, metadata)
 
+    const toolDefinitions = extractToolDefinitions(config)
+    if (toolDefinitions.length > 0) this._tagger.tagToolDefinitions(span, toolDefinitions)
+
     if (error) {
       this._tagger.tagLLMIO(span, inputMessages, [{ content: '' }])
       return

package/packages/dd-trace/src/llmobs/plugins/genai/util.js

@@ -155,6 +155,50 @@ function extractMetadata (config) {
   return metadata
 }
 
+/**
+ * Extract tool definitions from config
+ * @param {object} config
+ * @returns {Array}
+ */
+function extractToolDefinitions (config) {
+  const toolDefinitions = []
+
+  if (!Array.isArray(config?.tools)) {
+    return toolDefinitions
+  }
+
+  for (const tool of config.tools) {
+    // Only extract tools with valid function declarations
+    if (!Array.isArray(tool?.functionDeclarations)) {
+      continue
+    }
+
+    for (const currDeclaration of tool.functionDeclarations) {
+      // A valid declaration must have a name
+      if (!currDeclaration?.name) {
+        continue
+      }
+
+      const toolDef = { name: currDeclaration.name }
+
+      if (currDeclaration.description !== undefined) {
+        toolDef.description = currDeclaration.description
+      }
+
+      // Parameters can be in two different fields depending on user input
+      if (currDeclaration.parameters !== undefined) {
+        toolDef.schema = currDeclaration.parameters
+      } else if (currDeclaration.parametersJsonSchema !== undefined) {
+        toolDef.schema = currDeclaration.parametersJsonSchema
+      }
+
+      toolDefinitions.push(toolDef)
+    }
+  }
+
+  return toolDefinitions
+}
+
 /**
  * Format function call message
  * @param {Array} parts
@@ -498,6 +542,7 @@ module.exports = {
   getOperation,
   extractMetrics,
   extractMetadata,
+  extractToolDefinitions,
   aggregateStreamingChunks,
   formatInputMessages,
   formatEmbeddingInput,

package/packages/dd-trace/src/llmobs/sdk.js

@@ -259,7 +259,7 @@ class LLMObs extends NoopLLMObs {
         throw new Error('LLMObs span must have a span kind specified')
       }
 
-      const { inputData, outputData, metadata, metrics, tags, prompt, costTags } = options
+      const { inputData, outputData, metadata, metrics, tags, prompt, costTags, toolDefinitions } = options
 
       if (inputData || outputData) {
         if (spanKind === 'llm') {
@@ -289,6 +289,9 @@ class LLMObs extends NoopLLMObs {
       if (prompt) {
         this._tagger.tagPrompt(span, prompt)
       }
+      if (toolDefinitions != null) {
+        this._tagger.tagToolDefinitions(span, toolDefinitions)
+      }
     } catch (e) {
       if (e.ddErrorTag) {
         err = e.ddErrorTag

package/packages/dd-trace/src/llmobs/span_processor.js

@@ -332,8 +332,24 @@ class LLMObsSpanProcessor {
     return tags
   }
 
+  /**
+   * @param {Record<string, unknown>} tags
+   */
   #objectTagsToStringArrayTags (tags) {
-    return Object.entries(tags).map(([key, value]) => `${key}:${value ?? ''}`)
+    const out = []
+    for (const [key, value] of Object.entries(tags)) {
+      // Comma is the intake-side tag delimiter, so a single `"key:v1,v2"`
+      // entry fans into two orphan tags. One-per-element keeps each value
+      // addressable; empty arrays fall through to the scalar branch and
+      // still emit `key:` so `_dd.cost_tags` references keep finding a
+      // wire entry.
+      if (Array.isArray(value) && value.length > 0) {
+        for (const item of value) out.push(`${key}:${item ?? ''}`)
+      } else {
+        out.push(`${key}:${value ?? ''}`)
+      }
+    }
+    return out
   }
 
   /**

package/packages/dd-trace/src/llmobs/tagger.js

@@ -43,7 +43,7 @@ const {
   INSTRUMENTATION_METHOD_ANNOTATED,
 } = require('./constants/tags')
 const { storage } = require('./storage')
-const { findGenAIAncestorSpanId, validateCostTags, writeBridgeTags } = require('./util')
+const { findGenAIAncestorSpanId, validateCostTags, writeBridgeTags, validateToolDefinitions } = require('./util')
 
 // global registry of LLMObs spans
 // maps LLMObs spans to their annotations
@@ -176,8 +176,10 @@ class LLMObsTagger {
   }
 
   tagToolDefinitions (span, toolDefinitions) {
-    if (Array.isArray(toolDefinitions) && toolDefinitions.length > 0) {
-      this._setTag(span, TOOL_DEFINITIONS, toolDefinitions)
+    const validatedToolDefinitions = validateToolDefinitions(toolDefinitions)
+
+    if (validatedToolDefinitions.length > 0) {
+      this._setTag(span, TOOL_DEFINITIONS, validatedToolDefinitions)
     } else {
       this.#handleFailure('Tool definitions must be a non-empty array.', 'invalid_tool_definitions')
     }

package/packages/dd-trace/src/llmobs/util.js

@@ -89,6 +89,59 @@ function validateCostTags (span, costTags, source, spanTags) {
   return [...validatedCostTags]
 }
 
+// Validates tool definition entires
+function validateToolDefinitions (toolDefinitions) {
+  if (!Array.isArray(toolDefinitions)) {
+    log.warn('toolDefinitions must be an array.')
+    return []
+  }
+  const validated = []
+
+  for (let i = 0; i < toolDefinitions.length; i++) {
+    const currToolDef = toolDefinitions[i]
+    if (!currToolDef || typeof currToolDef !== 'object') {
+      log.warn('Tool definition at index %d must be an object. Skipping.', i)
+      continue
+    }
+
+    // Name is not optional
+    if (!currToolDef.name || typeof currToolDef.name !== 'string' || currToolDef.name.length <= 0) {
+      log.warn('Tool definition at index %d must have a non empty string "name". Skipping.', i)
+      continue
+    }
+    const validatedToolDef = { name: currToolDef.name }
+
+    // Description, Schema, and Version are optional types
+    if (currToolDef.description !== undefined) {
+      if (typeof currToolDef.description === 'string') {
+        validatedToolDef.description = currToolDef.description
+      } else {
+        log.warn('Tool definition "description" at index %d must be a string. Skipping field.', i)
+      }
+    }
+
+    if (currToolDef.schema !== undefined) {
+      if (currToolDef.schema !== null && typeof currToolDef.schema === 'object' && !Array.isArray(currToolDef.schema)) {
+        validatedToolDef.schema = currToolDef.schema
+      } else {
+        log.warn('Tool definition "schema" at index %d must be a plain object. Skipping field.', i)
+      }
+    }
+
+    if (currToolDef.version !== undefined) {
+      if (typeof currToolDef.version === 'string') {
+        validatedToolDef.version = currToolDef.version
+      } else {
+        log.warn('Tool definition "version" at index %d must be a string. Skipping field.', i)
+      }
+    }
+
+    validated.push(validatedToolDef)
+  }
+
+  return validated
+}
+
 // extracts the argument names from a function string
 function parseArgumentNames (str) {
   const result = []
@@ -318,4 +371,5 @@ module.exports = {
   safeJsonParse,
   spanHasError,
   writeBridgeTags,
+  validateToolDefinitions,
 }

package/packages/dd-trace/src/llmobs/writers/base.js

@@ -14,7 +14,6 @@ const {
   EVP_SUBDOMAIN_HEADER_NAME,
   EVP_PROXY_AGENT_BASE_PATH,
 } = require('../constants/writers')
-const { getAgentUrl } = require('../../agent/url')
 const { parseResponseAndLog } = require('./util')
 
 class LLMObsBuffer {
@@ -210,7 +209,7 @@ class BaseLLMObsWriter {
 
     const overrideOriginEnv = getEnvironmentVariable('_DD_LLMOBS_OVERRIDE_ORIGIN')
     const overrideOriginUrl = overrideOriginEnv && new URL(overrideOriginEnv)
-    const base = overrideOriginUrl ?? getAgentUrl(this._config)
+    const base = overrideOriginUrl ?? this._config.url
 
     return {
       url: base,

package/packages/dd-trace/src/llmobs/writers/util.js

@@ -4,7 +4,6 @@ const logger = require('../../log')
 const { EVP_PROXY_AGENT_BASE_PATH } = require('../constants/writers')
 const telemetry = require('../telemetry')
 const { fetchAgentInfo } = require('../../agent/info')
-const { getAgentUrl } = require('../../agent/url')
 
 /**
  * @param {import('../../config/config-base')} config
@@ -17,7 +16,7 @@ function setAgentStrategy (config, setWritersAgentlessValue) {
     return
   }
 
-  fetchAgentInfo(getAgentUrl(config), (err, agentInfo) => {
+  fetchAgentInfo(config.url, (err, agentInfo) => {
     if (err) {
       setWritersAgentlessValue(true)
       return

package/packages/dd-trace/src/openfeature/writers/base.js

@@ -2,7 +2,6 @@
 
 const request = require('../../exporters/common/request')
 const { safeJSONStringify } = require('../../exporters/common/util')
-const { getAgentUrl } = require('../../agent/url')
 
 const log = require('../../log')
 
@@ -37,7 +36,7 @@ class BaseFFEWriter {
 
     this._config = config
     this._endpoint = endpoint
-    this._baseUrl = agentUrl ?? this._getAgentUrl()
+    this._baseUrl = agentUrl ?? config.url
     this._payloadSizeLimit = payloadSizeLimit
     this._eventSizeLimit = eventSizeLimit
     this._headers = headers || {}
@@ -154,14 +153,6 @@ class BaseFFEWriter {
     }
   }
 
-  /**
-   * @private
-   * @returns {URL} Constructs agent URL from config
-   */
-  _getAgentUrl () {
-    return getAgentUrl(this._config)
-  }
-
   /**
    * @private
    * @param {Array<object>} payload - Payload to encode

package/packages/dd-trace/src/openfeature/writers/util.js

@@ -3,7 +3,6 @@
 const logger = require('../../log')
 const { EVP_PROXY_AGENT_BASE_PATH } = require('../constants/constants')
 const { fetchAgentInfo } = require('../../agent/info')
-const { getAgentUrl } = require('../../agent/url')
 
 /**
  * Determines if the agent supports EVP proxy and sets the writer enabled state accordingly
@@ -11,7 +10,7 @@ const { getAgentUrl } = require('../../agent/url')
  * @param {Function} setWriterEnabledValue - Callback to set the writer enabled state
  */
 function setAgentStrategy (config, setWriterEnabledValue) {
-  fetchAgentInfo(getAgentUrl(config), (err, agentInfo) => {
+  fetchAgentInfo(config.url, (err, agentInfo) => {
     if (err) {
       logger.debug('FFE Writer disabled - error getting agent info:', err.message)
       setWriterEnabledValue(false)

package/packages/dd-trace/src/opentelemetry/metrics/instruments.js

@@ -50,7 +50,7 @@ class Instrument {
    * Creates a measurement object for recording metric values.
    * @param {string} type - Metric type from METRIC_TYPES
    * @param {number} value - Numeric value to record
-   * @param {Attributes} attributes - Key-value pairs for metric dimensions
+   * @param {Attributes} [attributes] - Key-value pairs for metric dimensions
    * @returns {Measurement} Measurement object with metadata and timestamp
    */
   createMeasurement (type, value, attributes) {
@@ -73,9 +73,9 @@ class Instrument {
  * @class Counter
  */
 class Counter extends Instrument {
-  add (value, attributes = {}) {
+  add (value, attributes) {
     if (value < 0) return
-    this.reader?.record(this.createMeasurement(METRIC_TYPES.COUNTER, value, attributes))
+    this.reader.record(this.createMeasurement(METRIC_TYPES.COUNTER, value, attributes))
   }
 }
 
@@ -85,8 +85,8 @@ class Counter extends Instrument {
  * @class UpDownCounter
  */
 class UpDownCounter extends Instrument {
-  add (value, attributes = {}) {
-    this.reader?.record(this.createMeasurement(METRIC_TYPES.UPDOWNCOUNTER, value, attributes))
+  add (value, attributes) {
+    this.reader.record(this.createMeasurement(METRIC_TYPES.UPDOWNCOUNTER, value, attributes))
   }
 }
 
@@ -96,9 +96,9 @@ class UpDownCounter extends Instrument {
  * @class Histogram
  */
 class Histogram extends Instrument {
-  record (value, attributes = {}) {
+  record (value, attributes) {
     if (value < 0) return
-    this.reader?.record(this.createMeasurement(METRIC_TYPES.HISTOGRAM, value, attributes))
+    this.reader.record(this.createMeasurement(METRIC_TYPES.HISTOGRAM, value, attributes))
   }
 }
 
@@ -108,8 +108,8 @@ class Histogram extends Instrument {
  * @class Gauge
  */
 class Gauge extends Instrument {
-  record (value, attributes = {}) {
-    this.reader?.record(this.createMeasurement(METRIC_TYPES.GAUGE, value, attributes))
+  record (value, attributes) {
+    this.reader.record(this.createMeasurement(METRIC_TYPES.GAUGE, value, attributes))
   }
 }
 
@@ -136,7 +136,7 @@ class ObservableInstrument extends Instrument {
   addCallback (callback) {
     if (typeof callback !== 'function') return
     this.#callbacks.push(callback)
-    this.reader?.observableInstruments.add(this)
+    this.reader.observableInstruments.add(this)
   }
 
   /**
@@ -150,7 +150,7 @@ class ObservableInstrument extends Instrument {
       this.#callbacks.splice(index, 1)
       if (this.#callbacks.length === 0) {
         // Remove instrument from collection when no callbacks remain
-        this.reader?.observableInstruments.delete(this)
+        this.reader.observableInstruments.delete(this)
       }
     }
   }
@@ -163,8 +163,8 @@ class ObservableInstrument extends Instrument {
   collect () {
     const observations = []
     const observableResult = {
-      observe: (value, attributes = {}) => {
-        observations.push(this.createMeasurement(this.#type, value, attributes))
+      observe: (value, attributes) => {
+        observations.push(this.createObservation(value, attributes))
       },
     }
 
@@ -179,6 +179,18 @@ class ObservableInstrument extends Instrument {
 
     return observations
   }
+
+  /**
+   * Builds a measurement for this instrument's metric type. Keeps the type
+   * encapsulated so callers (e.g. batch observable callbacks) don't read it.
+   *
+   * @param {number} value
+   * @param {Attributes} attributes
+   * @returns {Measurement}
+   */
+  createObservation (value, attributes) {
+    return this.createMeasurement(this.#type, value, attributes)
+  }
 }
 
 /**
@@ -219,6 +231,7 @@ module.exports = {
   UpDownCounter,
   Histogram,
   Gauge,
+  ObservableInstrument,
   ObservableGauge,
   ObservableCounter,
   ObservableUpDownCounter,

package/packages/dd-trace/src/opentelemetry/metrics/meter.js

@@ -1,7 +1,6 @@
 'use strict'
 
 const { VERSION: packageVersion } = require('../../../../../version')
-const log = require('../../log')
 const {
   Counter, UpDownCounter, Histogram, Gauge, ObservableGauge, ObservableCounter, ObservableUpDownCounter,
 } = require('./instruments')
@@ -148,23 +147,21 @@ class Meter {
   }
 
   /**
-   * Adds a batch observable callback (not implemented).
+   * Registers a batch observable callback for the given observables.
    *
-   * @param {Function} callback - Batch observable callback
-   * @param {Array} observables - Array of observable instruments
+   * @param {Function} callback
+   * @param {Array} observables
    */
   addBatchObservableCallback (callback, observables) {
-    log.warn('addBatchObservableCallback is not implemented')
+    this.meterProvider.reader.addBatchObservableCallback(callback, observables)
   }
 
   /**
-   * Removes a batch observable callback (not implemented).
-   *
-   * @param {Function} callback - Batch observable callback
-   * @param {Array} observables - Array of observable instruments
+   * @param {Function} callback
+   * @param {Array} observables
    */
   removeBatchObservableCallback (callback, observables) {
-    log.warn('removeBatchObservableCallback is not implemented')
+    this.meterProvider.reader.removeBatchObservableCallback(callback, observables)
   }
 }