dd-trace 5.110.0 → 5.111.0

package/packages/dd-trace/src/appsec/downstream_requests.js

@@ -41,7 +41,7 @@ function enable (_config) {
   downstreamAnalysisCount = new WeakMap()
   responseBodyIgnoredCount = new WeakMap()
 
-  const bodyAnalysisSampleRate = config.appsec.apiSecurity?.downstreamBodyAnalysisSampleRate
+  const bodyAnalysisSampleRate = config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE
   samplingRate = Math.min(Math.max(bodyAnalysisSampleRate, 0), 1)
 
   if (samplingRate !== bodyAnalysisSampleRate) {
@@ -105,7 +105,7 @@ function recordResponseBodyIgnored (req, tag) {
  * @returns {boolean} whether downstream response body should be collected for AppSec.
  */
 function evaluateResponseBodyCollection (originatingReq, res) {
-  const maxBytes = config.appsec.apiSecurity.maxDownstreamBodyBytes
+  const maxBytes = config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES
 
   const mime = extractMimeType(res.headers?.['content-type'])
   if (!mime || !SUPPORTED_RESPONSE_BODY_MIME_TYPES.has(mime)) {
@@ -137,7 +137,7 @@ function shouldSampleBody (req) {
   globalRequestCounter = (globalRequestCounter + 1n) & UINT64_MAX
 
   const currentCount = bodyAnalysisCount.get(req) || 0
-  if (currentCount >= config.appsec.apiSecurity?.maxDownstreamRequestBodyAnalysis) {
+  if (currentCount >= config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS) {
     return false
   }
 
@@ -166,7 +166,7 @@ function isRedirectResponse (res) {
  * @param {object} ctx http client instrumentation context (mutated).
  */
 function planResponseBodyCollection (originatingReq, res, ctx) {
-  if (!config?.appsec.apiSecurity) {
+  if (!config) {
     return
   }
 

package/packages/dd-trace/src/appsec/graphql.js

@@ -12,7 +12,7 @@ const {
 const waf = require('./waf')
 const addresses = require('./addresses')
 const {
-  startGraphqlResolve,
+  startGraphqlResolver,
   graphqlMiddlewareChannel,
   apolloHttpServerChannel,
   apolloChannel,
@@ -32,7 +32,7 @@ function disable () {
   disableGraphql()
 }
 
-function onGraphqlStartResolve ({ context, resolverInfo }) {
+function onGraphqlStartResolver ({ abortController, resolverInfo }) {
   const req = getActiveRequest()
 
   if (!req) return
@@ -46,7 +46,7 @@ function onGraphqlStartResolve ({ context, resolverInfo }) {
     if (requestData?.isInGraphqlRequest) {
       requestData.blocked = true
       requestData.wafAction = blockingAction
-      context?.abortController?.abort()
+      abortController?.abort()
     }
   }
 }
@@ -153,11 +153,11 @@ function disableApollo () {
 }
 
 function enableGraphql () {
-  startGraphqlResolve.subscribe(onGraphqlStartResolve)
+  startGraphqlResolver.subscribe(onGraphqlStartResolver)
 }
 
 function disableGraphql () {
-  if (startGraphqlResolve.hasSubscribers) startGraphqlResolve.unsubscribe(onGraphqlStartResolve)
+  if (startGraphqlResolver.hasSubscribers) startGraphqlResolver.unsubscribe(onGraphqlStartResolver)
 }
 
 module.exports = {

package/packages/dd-trace/src/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.js

@@ -15,6 +15,20 @@ const EXCLUDED_PATHS_FROM_STACK = getNodeModulesPaths('mongodb', 'mongoose', 'mq
 const SAFE_OPERATORS = new Set(['$eq', '$gt', '$gte', '$in', '$lt', '$lte', '$ne', '$nin',
   '$exists', '$type', '$mod', '$bitsAllClear', '$bitsAllSet', '$bitsAnyClear', '$bitsAnySet'])
 
+// Scope a marked child store for a query's deferred execution so the nested mongodb
+// driver query skips re-analysis. `bindStore` enters the child only for that async
+// scope and restores the parent on its own, so no marker can be stranded for a later
+// request to inherit, and two concurrent queries of the same request each branch from
+// the shared parent rather than from each other.
+function markExecStore () {
+  const store = storage('legacy').getStore()
+  if (store && !store.nosqlAnalyzed && getIastContext(store)) {
+    return { ...store, nosqlAnalyzed: true }
+  }
+
+  return store
+}
+
 class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
   constructor () {
     super(NOSQL_MONGODB_INJECTION)
@@ -27,7 +41,7 @@ class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
     // Anything that accesses the storage is context dependent
     const onStart = ({ filters }) => {
       const store = storage('legacy').getStore()
-      if (store && !store.nosqlAnalyzed && filters?.length) {
+      if (store && !store.nosqlAnalyzed && filters?.length && getIastContext(store)) {
         for (const filter of filters) {
           this.analyze({ filter }, store)
         }
@@ -36,30 +50,23 @@ class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
       return store
     }
 
-    const onStartAndEnterWithStore = (message) => {
-      const store = onStart(message || {})
-      if (store) {
-        storage('legacy').enterWith({ ...store, nosqlAnalyzed: true, nosqlParentStore: store })
-      }
-    }
-
-    // Anything that accesses the storage is context dependent
-    // eslint-disable-next-line unicorn/consistent-function-scoping
-    const onFinish = () => {
-      const store = storage('legacy').getStore()
-      if (store?.nosqlParentStore) {
-        storage('legacy').enterWith(store.nosqlParentStore)
-      }
+    // mquery analyzes and marks on the same channel: its tracing start both reaches
+    // the driver scope and is the first place the filters are available.
+    const onStartAndBind = (message) => {
+      onStart(message)
+      return markExecStore()
     }
 
     this.addSub('datadog:mongodb:collection:filter:start', onStart)
 
-    this.addSub('datadog:mongoose:model:filter:start', onStartAndEnterWithStore)
-    this.addSub('datadog:mongoose:model:filter:finish', onFinish)
+    // A mongoose query builds, executes, and reaches the driver in separate async
+    // steps. The filters are analyzed at the build, but the marker is bound around
+    // the execution channel, where the driver call still runs under the parent store.
+    this.addSub('datadog:mongoose:model:filter:start', onStart)
+    this.addBind('datadog:mongoose:model:filter:exec', markExecStore)
 
     this.addSub('datadog:mquery:filter:prepare', onStart)
-    this.addSub('tracing:datadog:mquery:filter:start', onStartAndEnterWithStore)
-    this.addSub('tracing:datadog:mquery:filter:asyncEnd', onFinish)
+    this.addBind('tracing:datadog:mquery:filter:start', onStartAndBind)
   }
 
   configureSanitizers () {

package/packages/dd-trace/src/appsec/iast/security-controls/index.js

@@ -21,10 +21,10 @@ let controlsKeys
 let hooks
 
 function configure (iastConfig) {
-  if (!iastConfig?.securityControlsConfiguration) return
+  if (!iastConfig.DD_IAST_SECURITY_CONTROLS_CONFIGURATION) return
 
   try {
-    controls = parse(iastConfig.securityControlsConfiguration)
+    controls = parse(iastConfig.DD_IAST_SECURITY_CONTROLS_CONFIGURATION)
     if (controls?.size > 0) {
       hooks = new WeakSet()
       controlsKeys = [...controls.keys()]

package/packages/dd-trace/src/appsec/iast/telemetry/index.js

@@ -6,7 +6,8 @@ const { initRequestNamespace, finalizeRequestNamespace, globalNamespace } = requ
 
 class Telemetry {
   configure (config, verbosity) {
-    const telemetryAndMetricsEnabled = config?.telemetry?.enabled && config.telemetry.metrics
+    const telemetryAndMetricsEnabled = config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED &&
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED
 
     this.verbosity = telemetryAndMetricsEnabled ? getVerbosity(verbosity) : Verbosity.OFF
     this.enabled = this.verbosity !== Verbosity.OFF

package/packages/dd-trace/src/appsec/index.js

@@ -16,6 +16,8 @@ const {
   fastifyCookieParser,
   incomingHttpRequestStart,
   incomingHttpRequestEnd,
+  lambdaStartInvocation,
+  lambdaEndInvocation,
   passportVerify,
   passportUser,
   expressSession,
@@ -43,6 +45,7 @@ const { isBlocked, block, callBlockDelegation, setTemplates, getBlockingAction }
 const { getActiveRequest } = require('./store')
 const UserTracking = require('./user_tracking')
 const graphql = require('./graphql')
+const lambda = require('./lambda')
 const rasp = require('./rasp')
 
 const responseAnalyzedSet = new WeakSet()
@@ -99,11 +102,15 @@ function enable (_config) {
     stripeCheckoutSessionCreate.subscribe(onStripeCheckoutSessionCreate)
     stripePaymentIntentCreate.subscribe(onStripePaymentIntentCreate)
     stripeConstructEvent.subscribe(onStripeConstructEvent)
+    lambdaStartInvocation.subscribe(lambda.onLambdaStartInvocation)
+    lambdaEndInvocation.subscribe(lambda.onLambdaEndInvocation)
 
     isEnabled = true
     config = _config
   } catch (err) {
-    if (!IS_SERVERLESS) {
+    if (IS_SERVERLESS) {
+      log.debug('[ASM] Serverless mode: suppressing error log, calling disable()')
+    } else {
       log.error('[ASM] Unable to start AppSec', err)
     }
 
@@ -544,6 +551,8 @@ function disable () {
   if (stripeCheckoutSessionCreate.hasSubscribers) stripeCheckoutSessionCreate.unsubscribe(onStripeCheckoutSessionCreate)
   if (stripePaymentIntentCreate.hasSubscribers) stripePaymentIntentCreate.unsubscribe(onStripePaymentIntentCreate)
   if (stripeConstructEvent.hasSubscribers) stripeConstructEvent.unsubscribe(onStripeConstructEvent)
+  if (lambdaStartInvocation.hasSubscribers) lambdaStartInvocation.unsubscribe(lambda.onLambdaStartInvocation)
+  if (lambdaEndInvocation.hasSubscribers) lambdaEndInvocation.unsubscribe(lambda.onLambdaEndInvocation)
 }
 
 /**

package/packages/dd-trace/src/appsec/lambda.js

@@ -0,0 +1,135 @@
+'use strict'
+
+const { HTTP_CLIENT_IP } = require('../../../../ext/tags')
+
+const log = require('../log')
+const addresses = require('./addresses')
+const Reporter = require('./reporter')
+const waf = require('./waf')
+
+// Tracks spans for which start-invocation has been processed, so that
+// end-invocation can gate correctly
+const activeInvocations = new WeakSet()
+
+/**
+ * Maps pre-extracted HTTP data from the Lambda event to WAF addresses,
+ * runs the WAF, and reports results on the span.
+ *
+ * @param {{ span: object, headers: Record<string, string>, method: string, path: string,
+ *           query: Record<string, string | string[]> | undefined, body: string | object | undefined,
+ *           isBase64Encoded: boolean, clientIp: string | undefined,
+ *           pathParams: Record<string, string> | undefined,
+ *           cookies: Record<string, string> | undefined,
+ *           route: string | undefined }} data
+ */
+function onLambdaStartInvocation (data) {
+  try {
+    const { span, headers, method, path, query, body, clientIp, pathParams, cookies } = data
+
+    if (!span) {
+      log.warn('[ASM] No span provided in Lambda start invocation')
+      return
+    }
+
+    activeInvocations.add(span)
+
+    span.addTags({
+      '_dd.appsec.enabled': 1,
+      '_dd.runtime_family': 'nodejs',
+    })
+
+    const persistent = {}
+
+    if (path) {
+      persistent[addresses.HTTP_INCOMING_URL] = path
+    }
+
+    if (method) {
+      persistent[addresses.HTTP_INCOMING_METHOD] = method
+    }
+
+    if (headers) {
+      // Cookie header is already stripped by the Lambda layer's event-data-extractor
+      persistent[addresses.HTTP_INCOMING_HEADERS] = headers
+    }
+
+    if (clientIp) {
+      span.setTag(HTTP_CLIENT_IP, clientIp)
+      persistent[addresses.HTTP_CLIENT_IP] = clientIp
+    }
+
+    if (query) {
+      persistent[addresses.HTTP_INCOMING_QUERY] = query
+    }
+
+    if (body !== undefined && body !== null) {
+      persistent[addresses.HTTP_INCOMING_BODY] = body
+    }
+
+    if (pathParams) {
+      persistent[addresses.HTTP_INCOMING_PARAMS] = pathParams
+    }
+
+    if (cookies) {
+      persistent[addresses.HTTP_INCOMING_COOKIES] = cookies
+    }
+
+    waf.run({ persistent }, span, undefined, span)
+  } catch (err) {
+    log.error('[ASM] Error in Lambda start-invocation handler', err)
+  }
+}
+
+/**
+ * Maps response data to WAF addresses, runs a final WAF pass,
+ * disposes the WAF context, and finishes the request report.
+ *
+ * @param {{ span: object, statusCode: string | undefined,
+ *           responseHeaders: Record<string, string> | undefined }} data
+ */
+function onLambdaEndInvocation (data) {
+  try {
+    const { span, statusCode, responseHeaders } = data
+
+    if (!span) {
+      log.warn('[ASM] No span provided in Lambda end invocation')
+      return
+    }
+
+    if (!activeInvocations.has(span)) {
+      return
+    }
+
+    activeInvocations.delete(span)
+
+    let hasPersistentData = false
+    const persistent = {}
+
+    if (statusCode) {
+      persistent[addresses.HTTP_INCOMING_RESPONSE_CODE] = String(statusCode)
+      hasPersistentData = true
+    }
+
+    if (responseHeaders) {
+      const filteredHeaders = { ...responseHeaders }
+      delete filteredHeaders['set-cookie']
+      persistent[addresses.HTTP_INCOMING_RESPONSE_HEADERS] = filteredHeaders
+      hasPersistentData = true
+    }
+
+    if (hasPersistentData) {
+      waf.run({ persistent }, span, undefined, span)
+    }
+
+    waf.disposeContext(span)
+
+    Reporter.finishRequest(span, null, {}, undefined, span)
+  } catch (err) {
+    log.error('[ASM] Error in Lambda end-invocation handler', err)
+  }
+}
+
+module.exports = {
+  onLambdaStartInvocation,
+  onLambdaEndInvocation,
+}

package/packages/dd-trace/src/appsec/reporter.js

@@ -318,13 +318,21 @@ function reportWafConfigUpdate (product, rcConfigId, diagnostics, wafVersion) {
   }
 }
 
-function reportMetrics (metrics, raspRule, req) {
+/**
+ * @param {object} metrics - WAF run metrics
+ * @param {string} [raspRule] - RASP rule identifier
+ * @param {object} [req] - Request key (plain object for lambda)
+ * @param {object} [rootSpan] - Root span (required for lambda)
+ */
+function reportMetrics (metrics, raspRule, req, rootSpan) {
   if (!req) {
     req = getActiveRequest()
   }
-  const rootSpan = req && web.root(req)
+  if (!rootSpan) {
+    rootSpan = req && web.root(req)
+  }
 
-  if (!rootSpan) return
+  if (!req || !rootSpan) return
 
   if (metrics.rulesVersion) {
     rootSpan.setTag('_dd.appsec.event_rules.version', metrics.rulesVersion)
@@ -353,13 +361,26 @@ function reportTruncationMetrics (rootSpan, metrics) {
   }
 }
 
-function reportAttack ({ events: attackData, actions }, req) {
+// NOTE: `req` in the WAF execution path may be any object, not necessarily
+// an HTTP IncomingMessage. In Lambda, it is a plain context key ({}) with no
+// HTTP properties. Always guard HTTP-specific property access
+// See tests in lambda.spec.js for enforcement.
+
+/**
+ * @param {{ events: Array, actions: object }} result - WAF result with attack data
+ * @param {object} [req] - Request key. May be an HTTP IncomingMessage or a plain object (Lambda)
+ * @param {object} [rootSpan] - Root span (required for lambda)
+ */
+function reportAttack ({ events: attackData, actions }, req, rootSpan) {
   if (!req) {
     req = getActiveRequest()
   }
 
-  const rootSpan = web.root(req)
-  if (!rootSpan) return
+  if (!rootSpan) {
+    rootSpan = web.root(req)
+  }
+
+  if (!req || !rootSpan) return
 
   const spanContext = rootSpan.context()
 
@@ -494,14 +515,21 @@ function isSchemaAttribute (attribute) {
   return attribute.startsWith('_dd.appsec.s.')
 }
 
-function reportAttributes (attributes, req) {
+/**
+ * @param {object} [attributes] - WAF result attributes
+ * @param {object} [req] - Request key (plain object for lambda)
+ * @param {object} [rootSpan] - Root span (required for lambda)
+ */
+function reportAttributes (attributes, req, rootSpan) {
   if (!attributes) return
 
   if (!req) {
     req = getActiveRequest()
   }
 
-  const rootSpan = web.root(req)
+  if (!rootSpan) {
+    rootSpan = web.root(req)
+  }
 
   if (!rootSpan) return
 
@@ -517,8 +545,17 @@ function reportAttributes (attributes, req) {
   rootSpan.addTags(tags)
 }
 
-function finishRequest (req, res, storedResponseHeaders, requestBody) {
-  const rootSpan = web.root(req)
+/**
+ * @param {object} [req] - Request key (null for Lambda)
+ * @param {object} [res] - Response object (null for lambda)
+ * @param {object} storedResponseHeaders
+ * @param {object} [requestBody]
+ * @param {object} [rootSpan] - Root span (required for lambda)
+ */
+function finishRequest (req, res, storedResponseHeaders, requestBody, rootSpan) {
+  if (!rootSpan) {
+    rootSpan = web.root(req)
+  }
   if (!rootSpan) return
 
   if (metricsQueue.size) {
@@ -569,6 +606,8 @@ function finishRequest (req, res, storedResponseHeaders, requestBody) {
     rootSpan.setTag('_dd.appsec.rasp.rule.eval', metrics.raspEvalCount)
   }
 
+  if (!req) return
+
   incrementWafRequestsMetric(req)
 
   const tags = rootSpan.context().getTags()

package/packages/dd-trace/src/appsec/telemetry/index.js

@@ -27,7 +27,7 @@ const metricsStoreMap = new WeakMap()
 let enabled = false
 
 function enable (config) {
-  enabled = config.telemetry?.enabled && config.telemetry?.metrics
+  enabled = config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED && config.telemetry.DD_TELEMETRY_METRICS_ENABLED
 }
 
 function disable () {

package/packages/dd-trace/src/appsec/waf/index.js

@@ -110,7 +110,19 @@ function removeConfig (configPath) {
   }
 }
 
-function run (data, req, raspRule) {
+// `req` in the WAF execution path may be any object, not necessarily
+// an HTTP IncomingMessage (it is a plain object for lambda).
+// Always guard HTTP-specific property access.
+// @see packages/dd-trace/test/appsec/lambda.spec.js
+
+/**
+ * @param {object} data - WAF address data ({ persistent, ephemeral })
+ * @param {object} req - Request key for WAF context lookup. May be an HTTP
+ *   IncomingMessage or a plain object (Lambda invocation key).
+ * @param {string} [raspRule] - RASP rule identifier
+ * @param {object} [rootSpan] - Root span to tag (required for Lambda)
+ */
+function run (data, req, raspRule, rootSpan) {
   if (!req) {
     req = getActiveRequest()
     if (!req) {
@@ -120,12 +132,12 @@ function run (data, req, raspRule) {
   }
 
   const wafContext = waf.wafManager.getWAFContext(req)
-  const result = wafContext.run(data, raspRule, req)
+  const result = wafContext.run(data, raspRule, req, rootSpan)
 
   if (result?.keep) {
     if (limiter.isAllowed()) {
-      const rootSpan = web.root(req)
-      keepTrace(rootSpan, ASM)
+      const span = rootSpan || web.root(req)
+      keepTrace(span, ASM)
     } else {
       updateRateLimitedMetric(req)
     }

package/packages/dd-trace/src/appsec/waf/waf_context_wrapper.js

@@ -36,7 +36,7 @@ class WAFContextWrapper {
     }
   }
 
-  run ({ persistent, ephemeral }, raspRule, req) {
+  run ({ persistent, ephemeral }, raspRule, req, rootSpan) {
     if (this.ddwafContext.disposed) {
       log.warn('[ASM] Calling run on a disposed context')
       if (raspRule) {
@@ -156,10 +156,10 @@ class WAFContextWrapper {
       metrics.wafTimeout = result.timeout
 
       if (ruleTriggered) {
-        Reporter.reportAttack(result, req)
+        Reporter.reportAttack(result, req, rootSpan)
       }
 
-      Reporter.reportAttributes(result.attributes, req)
+      Reporter.reportAttributes(result.attributes, req, rootSpan)
 
       return result
     } catch (err) {
@@ -171,7 +171,7 @@ class WAFContextWrapper {
         wafRunFinished.publish({ payload })
       }
 
-      Reporter.reportMetrics(metrics, raspRule, req)
+      Reporter.reportMetrics(metrics, raspRule, req, rootSpan)
     }
   }
 

package/packages/dd-trace/src/ci-visibility/early-flake-detection/get-known-tests.js

@@ -17,6 +17,7 @@ const {
 
 const { getNumFromKnownTests } = require('../../plugins/util/test')
 const { buildCacheKey, writeToCache, withCache } = require('../requests/fs-cache')
+const { validateKnownTestsResponse } = require('../test-optimization-http-cache-schema')
 
 const MAX_KNOWN_TESTS_PAGES = 10_000
 
@@ -52,6 +53,19 @@ function mergeKnownTests (aggregate, page) {
   return aggregate
 }
 
+function parseJsonResponse (rawJson) {
+  return typeof rawJson === 'string' ? JSON.parse(rawJson) : rawJson
+}
+
+function parseKnownTestsResponse (rawJson, options = {}) {
+  const parsedResponse = parseJsonResponse(rawJson)
+  if (options.validateRequiredFields) {
+    validateKnownTestsResponse(parsedResponse)
+  }
+  const { data: { attributes: { tests } } } = parsedResponse
+  return tests
+}
+
 function getKnownTests ({
   url,
   isEvpProxy,
@@ -151,12 +165,12 @@ function fetchFromApi ({
     options.path = `${evpProxyPrefix}/api/v2/ci/libraries/tests`
     options.headers['X-Datadog-EVP-Subdomain'] = 'api'
   } else {
-    const { apiKey } = getConfig()
-    if (!apiKey) {
+    const { DD_API_KEY } = getConfig()
+    if (!DD_API_KEY) {
       return done(new Error('Known tests were not fetched because Datadog API key is not defined.'))
     }
 
-    options.headers['dd-api-key'] = apiKey
+    options.headers['dd-api-key'] = DD_API_KEY
   }
 
   const configurations = {
@@ -211,8 +225,9 @@ function fetchFromApi ({
       try {
         totalResponseBytes += res.length
 
-        const { data: { attributes } } = JSON.parse(res)
-        const { tests: pageTests, page_info: responsePageInfo } = attributes
+        const parsedResponse = parseJsonResponse(res)
+        const pageTests = parseKnownTestsResponse(parsedResponse)
+        const { page_info: responsePageInfo } = parsedResponse.data.attributes
 
         aggregateTests = mergeKnownTests(aggregateTests, pageTests)
 
@@ -251,4 +266,4 @@ function fetchFromApi ({
   fetchPage(null)
 }
 
-module.exports = { getKnownTests }
+module.exports = { getKnownTests, parseKnownTestsResponse }

package/packages/dd-trace/src/ci-visibility/exporters/agent-proxy/index.js

@@ -40,7 +40,7 @@ class AgentProxyCiVisibilityExporter extends CiVisibilityExporter {
       lookup,
       protocolVersion,
       headers,
-      isTestDynamicInstrumentationEnabled,
+      testOptimization,
     } = config
 
     fetchAgentInfo(this._url, (err, agentInfo) => {
@@ -68,7 +68,7 @@ class AgentProxyCiVisibilityExporter extends CiVisibilityExporter {
           evpProxyPrefix,
         })
         this._codeCoverageReportUrl = this._url
-        if (isTestDynamicInstrumentationEnabled) {
+        if (testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED) {
           const canFowardLogs = getCanForwardDebuggerLogs(err, agentInfo)
           if (canFowardLogs) {
             const DynamicInstrumentationLogsWriter = require('../agentless/di-logs-writer')

package/packages/dd-trace/src/ci-visibility/exporters/agentless/coverage-writer.js

@@ -29,7 +29,7 @@ class Writer extends BaseWriter {
       path: '/api/v2/citestcov',
       method: 'POST',
       headers: {
-        'dd-api-key': getConfig().apiKey,
+        'dd-api-key': getConfig().DD_API_KEY,
         ...form.getHeaders(),
       },
       timeout: 15_000,

package/packages/dd-trace/src/ci-visibility/exporters/agentless/di-logs-writer.js

@@ -26,7 +26,7 @@ class DynamicInstrumentationLogsWriter extends BaseWriter {
       path: '/api/v2/logs',
       method: 'POST',
       headers: {
-        'dd-api-key': getConfig().apiKey,
+        'dd-api-key': getConfig().DD_API_KEY,
         'Content-Type': 'application/json',
       },
       timeout: this.timeout,

package/packages/dd-trace/src/ci-visibility/exporters/agentless/index.js

@@ -9,7 +9,8 @@ const CoverageWriter = require('./coverage-writer')
 class AgentlessCiVisibilityExporter extends CiVisibilityExporter {
   constructor (config) {
     super(config)
-    const { tags, site, DD_CIVISIBILITY_AGENTLESS_URL: url, isTestDynamicInstrumentationEnabled } = config
+    const { tags, site, testOptimization } = config
+    const { DD_CIVISIBILITY_AGENTLESS_URL: url } = testOptimization
     // we don't need to request /info because we are using agentless by configuration
     this._isInitialized = true
     this._resolveCanUseCiVisProtocol(true)
@@ -23,7 +24,7 @@ class AgentlessCiVisibilityExporter extends CiVisibilityExporter {
 
     this._codeCoverageReportUrl = url || new URL(`https://ci-intake.${site}`)
 
-    if (isTestDynamicInstrumentationEnabled) {
+    if (testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED) {
       const DynamicInstrumentationLogsWriter = require('./di-logs-writer')
       this._logsUrl = url || new URL(`https://http-intake.logs.${site}`)
       this._logsWriter = new DynamicInstrumentationLogsWriter({ url: this._logsUrl, tags })

package/packages/dd-trace/src/ci-visibility/exporters/agentless/writer.js

@@ -30,7 +30,7 @@ class Writer extends BaseWriter {
       path: '/api/v2/citestcycle',
       method: 'POST',
       headers: {
-        'dd-api-key': getConfig().apiKey,
+        'dd-api-key': getConfig().DD_API_KEY,
         'Content-Type': 'application/msgpack',
       },
       timeout: 15_000,