dd-trace 5.109.0 → 5.111.0

package/packages/dd-trace/src/plugins/util/http-otel-semantics.js

@@ -0,0 +1,276 @@
+'use strict'
+
+const { extractPathFromUrl } = require('./url')
+
+// OpenTelemetry HTTP semantic-convention attribute names, emitted in place of
+// the Datadog ones when `DD_TRACE_OTEL_SEMANTICS_ENABLED` is set.
+// See https://opentelemetry.io/docs/specs/semconv/http/http-spans/
+const HTTP_REQUEST_METHOD = 'http.request.method'
+const HTTP_RESPONSE_STATUS_CODE = 'http.response.status_code'
+const URL_FULL = 'url.full'
+const URL_PATH = 'url.path'
+const URL_SCHEME = 'url.scheme'
+const URL_QUERY = 'url.query'
+const SERVER_ADDRESS = 'server.address'
+const SERVER_PORT = 'server.port'
+const USER_AGENT_ORIGINAL = 'user_agent.original'
+const CLIENT_ADDRESS = 'client.address'
+const NETWORK_PEER_ADDRESS = 'network.peer.address'
+const HTTP_REQUEST_METHOD_ORIGINAL = 'http.request.method_original'
+
+// Known HTTP methods (RFC 9110 + PATCH RFC 5789 + QUERY httpbis draft). A verb
+// outside this set is reported as `_OTHER` with the raw value preserved on
+// `http.request.method_original`, per the OTel HTTP semantic conventions.
+const KNOWN_METHODS = new Set([
+  'CONNECT', 'DELETE', 'GET', 'HEAD', 'OPTIONS', 'PATCH', 'POST', 'PUT', 'QUERY', 'TRACE',
+])
+
+// Datadog HTTP meta keys replaced by OTel names — omitted when rebuilding meta.
+const DD_HTTP_META_KEYS = new Set([
+  'http.method', 'http.status_code', 'http.useragent', 'http.client_ip', 'http.endpoint', 'http.url', 'out.host',
+])
+const NETWORK_DESTINATION_PORT = 'network.destination.port'
+
+// IPv6 literals arrive bracketed (URL.hostname / out.host = `[::1]`); OTel
+// `server.address` is the bare address.
+function stripIpv6Brackets (host) {
+  return host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host
+}
+
+/**
+ * @typedef {object} ServerUrlParts
+ * @property {string} [scheme] value for `url.scheme`
+ * @property {string} [address] value for `server.address`
+ * @property {number} [port] value for `server.port`
+ * @property {string} path value for `url.path`
+ * @property {string} [query] value for `url.query` (omitted when empty)
+ */
+
+/**
+ * Decompose a server request URL into the OpenTelemetry `url.*` / `server.*`
+ * parts. Structural fields (scheme, address, port, path) are read from the raw
+ * URL; the query is taken from the already-obfuscated URL so the configured
+ * query-string obfuscation is preserved.
+ *
+ * @param {string} rawUrl full request URL (`scheme://host[:port]/path?query`)
+ * @param {string} obfuscatedUrl same URL with its query string obfuscated
+ * @returns {ServerUrlParts}
+ */
+function decomposeServerUrl (rawUrl, obfuscatedUrl) {
+  let scheme
+  let address
+  let port
+  let path
+
+  try {
+    const parsed = new URL(rawUrl)
+    scheme = parsed.protocol.length > 1 ? parsed.protocol.slice(0, -1) : undefined
+    // `extractURL` builds `http://undefined/...` when the Host header is absent; skip that.
+    const hostname = parsed.hostname
+    if (hostname && hostname !== 'undefined') {
+      address = stripIpv6Brackets(hostname)
+    }
+    if (parsed.port) {
+      const parsedPort = Number.parseInt(parsed.port)
+      if (parsedPort > 0) port = parsedPort
+    }
+    path = parsed.pathname || '/'
+  } catch {
+    // Malformed or relative URL: fall back to a best-effort path only.
+    path = extractPathFromUrl(rawUrl)
+  }
+
+  let query
+  const queryIndex = obfuscatedUrl.indexOf('?')
+  if (queryIndex !== -1) {
+    const rawQuery = obfuscatedUrl.slice(queryIndex + 1)
+    if (rawQuery) query = rawQuery
+  }
+
+  return { scheme, address, port, path, query }
+}
+
+const ERROR_TYPE = 'error.type'
+
+function toHttpScheme (scheme) {
+  if (scheme === 'ws') return 'http'
+  if (scheme === 'wss') return 'https'
+  return scheme
+}
+
+/**
+ * Redact any userinfo embedded in a URL's authority, since `url.full` must not
+ * leak credentials: `user:pass@host` -> `REDACTED:REDACTED@host`, `user@host` ->
+ * `REDACTED@host`. Returns the URL unchanged when no userinfo is present.
+ *
+ * @param {string} url
+ * @returns {string}
+ */
+function redactUrlCredentials (url) {
+  const schemeEnd = url.indexOf('://')
+  if (schemeEnd === -1) return url
+  const authorityStart = schemeEnd + 3
+
+  let authorityEnd = url.length
+  for (let i = authorityStart; i < url.length; i++) {
+    const char = url[i]
+    if (char === '/' || char === '?' || char === '#') {
+      authorityEnd = i
+      break
+    }
+  }
+
+  // userinfo runs to the LAST '@' in the authority (WHATWG); using the first
+  // '@' would leak the remainder, e.g. `user:p@ss@host`.
+  const at = url.lastIndexOf('@', authorityEnd - 1)
+  if (at < authorityStart) return url
+
+  const redacted = url.slice(authorityStart, at).includes(':') ? 'REDACTED:REDACTED' : 'REDACTED'
+  return url.slice(0, authorityStart) + redacted + url.slice(at)
+}
+
+/**
+ * The scheme's default port, used as the `server.port` fallback for client spans
+ * (the attribute is required for clients but the explicit port is absent for
+ * default-port requests).
+ *
+ * @param {string} [url]
+ * @returns {number | undefined}
+ */
+function defaultPortForUrl (url) {
+  if (url === undefined) return
+  if (url.startsWith('https:') || url.startsWith('wss:')) return 443
+  if (url.startsWith('http:') || url.startsWith('ws:')) return 80
+}
+
+/**
+ * @typedef {object} FormattedHttpSpan
+ * @property {Record<string, string>} meta
+ * @property {Record<string, number>} metrics
+ * @property {number} error
+ */
+
+/**
+ * Rewrite a formatted span's Datadog HTTP tags to OpenTelemetry HTTP
+ * semantic-convention names, in place. Called at serialization time (from
+ * `span_format`) when `DD_TRACE_OTEL_SEMANTICS_ENABLED` is set, so every HTTP
+ * integration is covered from one place. No-op for non-HTTP spans. The span
+ * keeps the Datadog tag names throughout its lifetime — only the serialized
+ * output is renamed — so runtime consumers (peer.service, AppSec, trace stats)
+ * are unaffected.
+ *
+ * @param {FormattedHttpSpan} formattedSpan
+ */
+function applyHttpOtelSemantics (formattedSpan) {
+  const meta = formattedSpan.meta
+  const metrics = formattedSpan.metrics
+  const method = meta['http.method']
+  const url = meta['http.url']
+  if (method === undefined && url === undefined) return
+
+  // Rebuild meta/metrics as fresh objects that omit the renamed Datadog HTTP
+  // keys. Deleting them in place demotes the formatted span to V8 dictionary
+  // mode (~40% slower than this rebuild, measured); a fresh object keeps fast
+  // properties and can't leak a renamed key as `undefined` on the OTLP path.
+  const newMeta = {}
+  for (const key of Object.keys(meta)) {
+    if (!DD_HTTP_META_KEYS.has(key)) newMeta[key] = meta[key]
+  }
+  const newMetrics = {}
+  for (const key of Object.keys(metrics)) {
+    if (key !== NETWORK_DESTINATION_PORT) newMetrics[key] = metrics[key]
+  }
+
+  const kind = meta['span.kind']
+
+  if (method !== undefined) {
+    if (KNOWN_METHODS.has(method)) {
+      newMeta[HTTP_REQUEST_METHOD] = method
+    } else {
+      // Unknown verb: bucket to `_OTHER`, preserve the raw value, and use the
+      // literal "HTTP" in the span name (the spec forbids the URL path there).
+      // Known-method names are already `{method} {route}`.
+      newMeta[HTTP_REQUEST_METHOD] = '_OTHER'
+      newMeta[HTTP_REQUEST_METHOD_ORIGINAL] = method
+      const resource = formattedSpan.resource
+      if (typeof resource === 'string') {
+        if (resource === method) {
+          formattedSpan.resource = 'HTTP'
+        } else if (resource.startsWith(`${method} `)) {
+          formattedSpan.resource = `HTTP${resource.slice(method.length)}`
+        }
+      }
+    }
+  }
+
+  const status = meta['http.status_code']
+  let statusCode
+  if (status !== undefined) {
+    // OTel types http.response.status_code as an int, so emit it as a numeric
+    // metric (the OTLP exporter serializes meta as stringValue but metrics as
+    // intValue) — mirroring how server.port is handled below. Guard against a
+    // non-numeric status, which would otherwise write a NaN metric.
+    statusCode = Number.parseInt(status)
+    if (Number.isFinite(statusCode)) newMetrics[HTTP_RESPONSE_STATUS_CODE] = statusCode
+  }
+
+  const userAgent = meta['http.useragent']
+  if (userAgent !== undefined) newMeta[USER_AGENT_ORIGINAL] = userAgent
+
+  const clientIp = meta['http.client_ip']
+  if (clientIp !== undefined) newMeta[CLIENT_ADDRESS] = clientIp
+
+  // http.endpoint is Datadog-only (omitted above); it has no OTel equivalent.
+
+  if (kind === 'server') {
+    // FIXME: some server frameworks (e.g. Next.js — `packages/datadog-plugin-next`)
+    // never populate `http.url`, so the OTel `url.*` / `server.*` attributes below
+    // can't be derived and are omitted for those spans. This needs a fix; the
+    // short-term option is to set `http.url` in those integrations so they emit
+    // the full server attribute set.
+    if (url !== undefined) {
+      // The query in `http.url` is already obfuscated per config, so it is preserved.
+      const { scheme, address, port, path, query } = decomposeServerUrl(url, url)
+      if (path !== undefined) newMeta[URL_PATH] = path
+      if (scheme !== undefined) newMeta[URL_SCHEME] = toHttpScheme(scheme)
+      if (query !== undefined) newMeta[URL_QUERY] = query
+      if (address !== undefined) newMeta[SERVER_ADDRESS] = address
+      if (port !== undefined) newMetrics[SERVER_PORT] = port
+    }
+  } else {
+    if (url !== undefined) {
+      // url.full must not carry embedded credentials.
+      newMeta[URL_FULL] = redactUrlCredentials(url)
+    }
+    const outHost = meta['out.host']
+    if (outHost !== undefined) newMeta[SERVER_ADDRESS] = stripIpv6Brackets(outHost)
+    const clientPort = metrics[NETWORK_DESTINATION_PORT]
+    if (clientPort === undefined) {
+      // server.port is required for client spans; fall back to the scheme default.
+      const defaultPort = defaultPortForUrl(url)
+      if (defaultPort !== undefined) newMetrics[SERVER_PORT] = defaultPort
+    } else {
+      newMetrics[SERVER_PORT] = clientPort
+    }
+  }
+
+  // OTel error semantics for an error response (no-clobber on an exception-derived
+  // type): server spans are errors on 5xx only (4xx MUST be left unset per the
+  // spec); client spans on any status >= 400.
+  if (status !== undefined && newMeta[ERROR_TYPE] === undefined) {
+    const isError = kind === 'server' ? statusCode >= 500 : statusCode >= 400
+    if (isError) {
+      newMeta[ERROR_TYPE] = status
+      formattedSpan.error = 1
+    }
+  }
+
+  formattedSpan.meta = newMeta
+  formattedSpan.metrics = newMetrics
+}
+
+module.exports = {
+  NETWORK_PEER_ADDRESS, // imported by web.js (set from req.socket, not at serialization)
+  decomposeServerUrl, // exercised directly by the helper spec
+  applyHttpOtelSemantics,
+}

package/packages/dd-trace/src/plugins/util/llm.js

@@ -37,7 +37,12 @@ function isPromptCompletionSampled (sampler, span) {
 
 module.exports = function makeUtilities (integrationName, tracerConfig) {
   const integrationConfig = tracerConfig[integrationName] || {}
-  const { spanCharLimit, spanPromptCompletionSampleRate } = integrationConfig
+  // The per-integration config is keyed by the canonical environment variable
+  // names (e.g. `DD_LANGCHAIN_SPAN_CHAR_LIMIT`), nested under the integration's
+  // namespace. Derive those leaf names from the integration name.
+  const prefix = `DD_${integrationName.toUpperCase()}_`
+  const spanCharLimit = integrationConfig[`${prefix}SPAN_CHAR_LIMIT`]
+  const spanPromptCompletionSampleRate = integrationConfig[`${prefix}SPAN_PROMPT_COMPLETION_SAMPLE_RATE`]
 
   const sampler = new Sampler(spanPromptCompletionSampleRate ?? 1)
 

package/packages/dd-trace/src/plugins/util/test.js

@@ -22,17 +22,40 @@ const { SAMPLING_RULE_DECISION } = require('../../constants')
 const { AUTO_KEEP } = require('../../../../../ext/priority')
 const { version: ddTraceVersion } = require('../../../../../package.json')
 const {
+  CI_JOB_ID,
   GIT_BRANCH,
   GIT_COMMIT_SHA,
   GIT_REPOSITORY_URL,
   GIT_TAG,
+  GIT_COMMIT_AUTHOR_DATE,
   GIT_COMMIT_AUTHOR_EMAIL,
   GIT_COMMIT_AUTHOR_NAME,
+  GIT_COMMIT_COMMITTER_DATE,
+  GIT_COMMIT_COMMITTER_EMAIL,
+  GIT_COMMIT_COMMITTER_NAME,
   GIT_COMMIT_MESSAGE,
+  GIT_COMMIT_HEAD_AUTHOR_DATE,
+  GIT_COMMIT_HEAD_AUTHOR_EMAIL,
+  GIT_COMMIT_HEAD_AUTHOR_NAME,
+  GIT_COMMIT_HEAD_COMMITTER_DATE,
+  GIT_COMMIT_HEAD_COMMITTER_EMAIL,
+  GIT_COMMIT_HEAD_COMMITTER_NAME,
+  GIT_COMMIT_HEAD_MESSAGE,
   CI_WORKSPACE_PATH,
+  CI_PIPELINE_ID,
+  CI_PIPELINE_NAME,
+  CI_PIPELINE_NUMBER,
   CI_PIPELINE_URL,
   CI_JOB_NAME,
+  CI_JOB_URL,
+  CI_NODE_LABELS,
+  CI_NODE_NAME,
+  CI_PROVIDER_NAME,
+  CI_STAGE_NAME,
   GIT_COMMIT_HEAD_SHA,
+  GIT_PULL_REQUEST_BASE_BRANCH,
+  GIT_PULL_REQUEST_BASE_BRANCH_HEAD_SHA,
+  GIT_PULL_REQUEST_BASE_BRANCH_SHA,
 } = require('./tags')
 const { getRuntimeAndOSMetadata } = require('./env')
 const { getCIMetadata } = require('./ci')
@@ -89,6 +112,12 @@ const TEST_RETRY_REASON = 'test.retry_reason'
 const TEST_HAS_FAILED_ALL_RETRIES = 'test.has_failed_all_retries'
 const TEST_IS_MODIFIED = 'test.is_modified'
 const TEST_HAS_DYNAMIC_NAME = '_dd.has_dynamic_name'
+const EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS = [
+  { limitMs: 5 * 1000, key: '5s' },
+  { limitMs: 10 * 1000, key: '10s' },
+  { limitMs: 30 * 1000, key: '30s' },
+  { limitMs: 5 * 60 * 1000, key: '5m' },
+]
 const CI_APP_ORIGIN = 'ciapp-test'
 
 // Matches patterns that are almost certainly runtime-generated values in test names:
@@ -198,6 +227,43 @@ const TEST_LEVEL_EVENT_TYPES = [
   'test_module_end',
   'test_session_end',
 ]
+const TEST_LEVELS_METADATA = 'test_levels'
+const TEST_LEVELS_METADATA_TAGS = [
+  CI_JOB_ID,
+  CI_JOB_NAME,
+  CI_JOB_URL,
+  CI_NODE_LABELS,
+  CI_NODE_NAME,
+  CI_PIPELINE_ID,
+  CI_PIPELINE_NAME,
+  CI_PIPELINE_NUMBER,
+  CI_PIPELINE_URL,
+  CI_PROVIDER_NAME,
+  CI_STAGE_NAME,
+  CI_WORKSPACE_PATH,
+  GIT_BRANCH,
+  GIT_COMMIT_AUTHOR_DATE,
+  GIT_COMMIT_AUTHOR_EMAIL,
+  GIT_COMMIT_AUTHOR_NAME,
+  GIT_COMMIT_COMMITTER_DATE,
+  GIT_COMMIT_COMMITTER_EMAIL,
+  GIT_COMMIT_COMMITTER_NAME,
+  GIT_COMMIT_HEAD_AUTHOR_DATE,
+  GIT_COMMIT_HEAD_AUTHOR_EMAIL,
+  GIT_COMMIT_HEAD_AUTHOR_NAME,
+  GIT_COMMIT_HEAD_COMMITTER_DATE,
+  GIT_COMMIT_HEAD_COMMITTER_EMAIL,
+  GIT_COMMIT_HEAD_COMMITTER_NAME,
+  GIT_COMMIT_HEAD_MESSAGE,
+  GIT_COMMIT_HEAD_SHA,
+  GIT_COMMIT_MESSAGE,
+  GIT_COMMIT_SHA,
+  GIT_PULL_REQUEST_BASE_BRANCH,
+  GIT_PULL_REQUEST_BASE_BRANCH_HEAD_SHA,
+  GIT_PULL_REQUEST_BASE_BRANCH_SHA,
+  GIT_REPOSITORY_URL,
+  GIT_TAG,
+]
 const TEST_RETRY_REASON_TYPES = {
   efd: 'early_flake_detection',
   atr: 'auto_test_retry',
@@ -398,6 +464,7 @@ module.exports = {
   getCodeOwnersFileEntries,
   getCodeOwnersForFilename,
   getTestCommonTags,
+  getTestLevelsMetadataTags,
   getTestSessionCommonTags,
   getTestModuleCommonTags,
   getTestSuiteCommonTags,
@@ -432,6 +499,7 @@ module.exports = {
   removeInvalidMetadata,
   parseAnnotations,
   getIsFaultyEarlyFlakeDetection,
+  EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS,
   getEfdRetryCount,
   getMaxEfdRetryCount,
   TEST_BROWSER_DRIVER,
@@ -448,6 +516,7 @@ module.exports = {
   DD_CAPABILITIES_TEST_MANAGEMENT_ATTEMPT_TO_FIX,
   DD_CAPABILITIES_FAILED_TEST_REPLAY,
   TEST_LEVEL_EVENT_TYPES,
+  TEST_LEVELS_METADATA,
   TEST_RETRY_REASON_TYPES,
   getNumFromKnownTests,
   getFileAndLineNumberFromError,
@@ -700,6 +769,24 @@ function getTestParametersString (parametersByTestName, testName) {
   }
 }
 
+/**
+ * Extracts CI and Git tags that apply to every test level.
+ *
+ * @param {TestEnvironmentMetadata} testEnvironmentMetadata
+ * @returns {Record<string, string|number>}
+ */
+function getTestLevelsMetadataTags (testEnvironmentMetadata) {
+  const testLevelsMetadataTags = {}
+  for (let i = 0; i < TEST_LEVELS_METADATA_TAGS.length; i++) {
+    const key = TEST_LEVELS_METADATA_TAGS[i]
+    const value = testEnvironmentMetadata[key]
+    if (value !== undefined) {
+      testLevelsMetadataTags[key] = value
+    }
+  }
+  return testLevelsMetadataTags
+}
+
 function getTestTypeFromFramework (testFramework) {
   if (testFramework === 'playwright' || testFramework === 'cypress') {
     return 'browser'
@@ -1367,13 +1454,7 @@ function parseAnnotations (annotations) {
  * @returns {number}
  */
 function getEfdRetryCount (durationMs, slowTestRetries) {
-  const thresholds = [
-    { limitMs: 5 * 1000, key: '5s' },
-    { limitMs: 10 * 1000, key: '10s' },
-    { limitMs: 30 * 1000, key: '30s' },
-    { limitMs: 5 * 60 * 1000, key: '5m' },
-  ]
-  for (const { limitMs, key } of thresholds) {
+  for (const { limitMs, key } of EARLY_FLAKE_DETECTION_RETRY_THRESHOLDS) {
     if (durationMs < limitMs) {
       return slowTestRetries[key] ?? 0
     }
@@ -1536,7 +1617,7 @@ function isFailedTestReplaySupported (testFramework, frameworkVersion) {
     : true
 }
 
-function getLibraryCapabilitiesTags (testFramework, frameworkVersion) {
+function getLibraryCapabilitiesTags (testFramework, frameworkVersion, options = {}) {
   return {
     [DD_CAPABILITIES_TEST_IMPACT_ANALYSIS]: isTiaSupported(testFramework)
       ? '1'
@@ -1558,7 +1639,8 @@ function getLibraryCapabilitiesTags (testFramework, frameworkVersion) {
       isAttemptToFixSupported(testFramework, frameworkVersion)
         ? '5'
         : undefined,
-    [DD_CAPABILITIES_FAILED_TEST_REPLAY]: isFailedTestReplaySupported(testFramework, frameworkVersion)
+    [DD_CAPABILITIES_FAILED_TEST_REPLAY]: !options.omitFailedTestReplay &&
+      isFailedTestReplaySupported(testFramework, frameworkVersion)
       ? '1'
       : undefined,
   }

package/packages/dd-trace/src/plugins/util/url.js

@@ -2,6 +2,8 @@
 
 const { URL } = require('url')
 
+const log = require('../../log')
+
 const HTTP2_HEADER_AUTHORITY = ':authority'
 const HTTP2_HEADER_SCHEME = ':scheme'
 const HTTP2_HEADER_PATH = ':path'
@@ -60,6 +62,69 @@ function obfuscateQs (config, url) {
   return `${path}?${qs}`
 }
 
+const qsObfuscatorCache = new Map()
+
+/**
+ * Compile the configured query-string obfuscator (a regex string, or a boolean)
+ * into the boolean / RegExp form that `obfuscateQs` consumes. The compiled regex
+ * is cached, since the configuration is stable for the process lifetime.
+ *
+ * @param {{ queryStringObfuscation?: boolean | string }} config
+ * @returns {boolean | RegExp}
+ */
+function getQsObfuscator (config) {
+  const obfuscator = config.queryStringObfuscation
+
+  if (typeof obfuscator === 'boolean') return obfuscator
+
+  if (typeof obfuscator === 'string') {
+    const cached = qsObfuscatorCache.get(obfuscator)
+    if (cached !== undefined) return cached
+
+    let compiled = true
+    if (obfuscator === '') {
+      compiled = false // disable obfuscator
+    } else if (obfuscator !== '.*') { // '.*' optimizes to a full redact (true)
+      try {
+        compiled = new RegExp(obfuscator, 'gi')
+      } catch (err) {
+        log.error('Error getting qs obfuscator', err)
+      }
+    }
+
+    qsObfuscatorCache.set(obfuscator, compiled)
+    return compiled
+  }
+
+  if (Object.hasOwn(config, 'queryStringObfuscation')) {
+    log.error('Expected `queryStringObfuscation` to be a regex string or boolean.')
+  }
+
+  return true
+}
+
+/**
+ * Build a client span's `http.url` with its query retained but obfuscated per
+ * `config.queryStringObfuscation` (OTel `url.full` is the absolute URL including
+ * the redacted query). Falls back to `strippedUrl` when there is no query.
+ * Callers gate this behind `DD_TRACE_OTEL_SEMANTICS_ENABLED`, so the default
+ * (flag off) hot path stays a plain tag assignment.
+ *
+ * @param {{ queryStringObfuscation?: boolean | string }} config
+ * @param {string} base `scheme://host[:port]`
+ * @param {string} [pathname] raw request path, may include `?query`
+ * @param {string} strippedUrl `base` + query-stripped path (used when there is no query)
+ * @returns {string}
+ */
+function buildClientHttpUrl (config, base, pathname, strippedUrl) {
+  if (pathname?.includes('?')) {
+    // `config.queryStringObfuscation` is the raw config value here (client plugins
+    // don't normalize it the way the server does), so compile it first.
+    return obfuscateQs({ queryStringObfuscation: getQsObfuscator(config) }, `${base}${pathname}`)
+  }
+  return strippedUrl
+}
+
 /**
  * Extract URL path from URL using regex pattern instead of Node.js URL API because:
  *
@@ -139,7 +204,9 @@ function filterSensitiveInfoFromRepository (repositoryUrl) {
 module.exports = {
   extractURL,
   obfuscateQs,
+  getQsObfuscator,
+  buildClientHttpUrl,
   calculateHttpEndpoint,
   filterSensitiveInfoFromRepository,
-  extractPathFromUrl, // test only
+  extractPathFromUrl, // used by http-otel-semantics decomposeServerUrl fallback (and tests)
 }

package/packages/dd-trace/src/plugins/util/web.js

@@ -13,7 +13,8 @@ const { storage } = require('../../../../datadog-core')
 const legacyStorage = storage('legacy')
 const urlFilter = require('./urlfilter')
 const { createInferredProxySpan, finishInferredProxySpan } = require('./inferred_proxy')
-const { extractURL, obfuscateQs, calculateHttpEndpoint } = require('./url')
+const { extractURL, obfuscateQs, getQsObfuscator, calculateHttpEndpoint } = require('./url')
+const { NETWORK_PEER_ADDRESS } = require('./http-otel-semantics')
 
 const WEB = types.WEB
 const SERVER = kinds.SERVER
@@ -389,6 +390,15 @@ function addRequestTags (context, spanType) {
     [HTTP_USERAGENT]: req.headers['user-agent'],
   })
 
+  // OTel `network.peer.address` is the immediate socket peer. It has no Datadog
+  // equivalent and the socket isn't available at serialization, so (unlike the
+  // other HTTP attributes, which are renamed centrally in span_format) it is set
+  // here directly when OTel semantics are enabled.
+  if (config.DD_TRACE_OTEL_SEMANTICS_ENABLED) {
+    const peerAddress = req.socket?.remoteAddress
+    if (peerAddress) span.setTag(NETWORK_PEER_ADDRESS, peerAddress)
+  }
+
   // if client ip has already been set by appsec, no need to run it again
   if (config.extractIp && !spanContext.hasTag(HTTP_CLIENT_IP)) {
     const clientIp = config.extractIp(config, req)
@@ -433,26 +443,25 @@ function applyRouteOrEndpointTag (context) {
   if (!span) return
   const spanContext = span.context()
 
-  // AppSec calls `web.setRouteOrEndpointTag` from a pre-finish hook so the
-  // route/endpoint tags are available for API Security sampling, and the
-  // normal finish-time path runs this again. Either tag being present
-  // means the work has already been done; paths are stable between the
-  // two calls, so the second pass has nothing to add.
-  if (spanContext.hasTag(HTTP_ROUTE) || spanContext.hasTag(HTTP_ENDPOINT)) return
+  // AppSec runs this from a pre-finish hook and the finish path runs it
+  // again. http.route is terminal once set; nothing supersedes it.
+  if (spanContext.hasTag(HTTP_ROUTE)) return
 
   // Skip the `Array.prototype.join` builtin in the empty / single-segment
   // cases; `paths[0]` covers both (`undefined` is falsy for the empty case).
   const route = paths.length > 1 ? paths.join('') : paths[0]
 
   if (route) {
-    // Use http.route from trusted framework instrumentation.
+    // A framework route supersedes any http.endpoint fallback a pre-finish
+    // call stamped before the route resolved; it must not be gated on
+    // HTTP_ENDPOINT.
     span.setTag(HTTP_ROUTE, route)
     return
   }
 
-  if (!config.resourceRenamingEnabled) return
+  // Route unavailable. Compute the http.endpoint fallback once across both calls.
+  if (!config.resourceRenamingEnabled || spanContext.hasTag(HTTP_ENDPOINT)) return
 
-  // Route is unavailable, compute http.endpoint once.
   const url = spanContext.getTag(HTTP_URL)
   const endpoint = url ? calculateHttpEndpoint(url) : '/'
   span.setTag(HTTP_ENDPOINT, endpoint)
@@ -543,30 +552,4 @@ function getMiddlewareSetting (config) {
   return true
 }
 
-function getQsObfuscator (config) {
-  const obfuscator = config.queryStringObfuscation
-
-  if (typeof obfuscator === 'boolean') {
-    return obfuscator
-  }
-
-  if (typeof obfuscator === 'string') {
-    if (obfuscator === '') return false // disable obfuscator
-
-    if (obfuscator === '.*') return true // optimize full redact
-
-    try {
-      return new RegExp(obfuscator, 'gi')
-    } catch (err) {
-      log.error('Web plugin error getting qs obfuscator', err)
-    }
-  }
-
-  if (config.hasOwnProperty('queryStringObfuscation')) {
-    log.error('Expected `queryStringObfuscation` to be a regex string or boolean.')
-  }
-
-  return true
-}
-
 module.exports = web

package/packages/dd-trace/src/priority_sampler.js

@@ -19,6 +19,7 @@ const RateLimiter = require('./rate_limiter')
 const Sampler = require('./sampler')
 const { setSamplingRules } = require('./startup-log')
 const SamplingRule = require('./sampling_rule')
+const { formatKnuthRate } = require('./util')
 
 const {
   SAMPLING_MECHANISM_DEFAULT,
@@ -36,19 +37,6 @@ const {
 
 const DEFAULT_KEY = 'service:,env:'
 
-/**
- * Formats a sampling rate as a string with up to 6 decimal digits and no trailing zeros.
- *
- * @param {number} rate
- */
-function formatKnuthRate (rate) {
-  const string = Number(rate).toFixed(6)
-  for (let i = string.length - 1; i > 0; i--) {
-    if (string[i] === '0') continue
-    return string.slice(0, i + (string[i] === '.' ? 0 : 1))
-  }
-}
-
 const defaultSampler = new Sampler(AUTO_KEEP)
 
 /**