dd-trace 5.132.0 → 5.134.0

package/packages/dd-trace/src/appsec/api_security/sampler.js

@@ -58,9 +58,7 @@ function disable () {
  * @returns {'sample' | 'missing_route' | 'skip'}
  */
 function sampleRootSpanRequest (rootSpan, request, record = false) {
-  if (!enabled) return SamplingDecision.SKIP
-
-  if (!rootSpan) return SamplingDecision.SKIP
+  if (!enabled || !rootSpan) return SamplingDecision.SKIP
 
   const { method, statusCode, route, blocked = false } = request ?? {}
 
@@ -102,9 +100,7 @@ function sampleRequest (req, res, record = false) {
   if (!enabled) return SamplingDecision.SKIP
 
   const rootSpan = web.root(req)
-  if (!rootSpan) return SamplingDecision.SKIP
-
-  if (isRejected(rootSpan)) return SamplingDecision.SKIP
+  if (!rootSpan || isRejected(rootSpan)) return SamplingDecision.SKIP
 
   const statusCode = res.statusCode
   const route = getRouteOrEndpoint(web.getContext(req), statusCode)

package/packages/dd-trace/src/appsec/downstream_requests.js

@@ -163,15 +163,7 @@ function isRedirectResponse (res) {
  * @param {object} ctx http client instrumentation context (mutated).
  */
 function planResponseBodyCollection (originatingReq, res, ctx) {
-  if (!config) {
-    return
-  }
-
-  if (isRedirectResponse(res)) {
-    return
-  }
-
-  if (!shouldSampleBody(originatingReq)) {
+  if (!config || isRedirectResponse(res) || !shouldSampleBody(originatingReq)) {
     return
   }
 

package/packages/dd-trace/src/appsec/handlers/http-request.js

@@ -60,9 +60,7 @@ function onRequestCookieParser ({ req, res, abortController, cookies }) {
   if (!cookies || typeof cookies !== 'object') return
 
   const rootSpan = web.root(req)
-  if (!rootSpan) return
-
-  if (isEmpty(cookies)) return
+  if (!rootSpan || isEmpty(cookies)) return
   analyzedCookies.add(cookies)
 
   const results = waf.run({
@@ -189,9 +187,7 @@ function onRequestQueryParsed ({ req, res, query, abortController }) {
   }
 
   const rootSpan = web.root(req)
-  if (!rootSpan) return
-
-  if (isEmpty(query)) return
+  if (!rootSpan || isEmpty(query)) return
 
   const results = waf.run({
     persistent: {
@@ -204,9 +200,7 @@ function onRequestQueryParsed ({ req, res, query, abortController }) {
 
 function onRequestProcessParams ({ req, res, abortController, params }) {
   const rootSpan = web.root(req)
-  if (!rootSpan) return
-
-  if (!params || typeof params !== 'object' || isEmpty(params)) return
+  if (!rootSpan || !params || typeof params !== 'object' || isEmpty(params)) return
 
   const results = waf.run({
     persistent: {

package/packages/dd-trace/src/appsec/handlers/http-response.js

@@ -11,8 +11,13 @@ const { storedResponseHeaders, copyHeadersOmitting } = require('./http-shared')
 const responseAnalyzedSet = new WeakSet()
 
 function onResponseBody ({ req, res, body }) {
-  if (!body || typeof body !== 'object') return
-  if (apiSecurity.sampleRequest(req, res) !== apiSecurity.SamplingDecision.SAMPLE) return
+  if (
+    !body ||
+    typeof body !== 'object' ||
+    apiSecurity.sampleRequest(req, res) !== apiSecurity.SamplingDecision.SAMPLE
+  ) {
+    return
+  }
 
   // we don't support blocking at this point, so no results needed
   waf.run({

package/packages/dd-trace/src/appsec/iast/analyzers/path-traversal-analyzer.js

@@ -2,6 +2,7 @@
 
 const path = require('path')
 
+const { APPSEC_FS_STORAGE } = require('../../rasp/fs-plugin')
 const { getIastContext } = require('../iast-context')
 const { storage } = require('../../../../../datadog-core')
 const { PATH_TRAVERSAL } = require('../vulnerabilities')
@@ -29,10 +30,10 @@ class PathTraversalAnalyzer extends InjectionAnalyzer {
 
   onConfigure () {
     this.addSub('apm:fs:operation:start', (obj) => {
-      const store = storage('legacy').getStore()
-      const outOfReqOrChild = !store?.fs?.root
+      const fs = storage(APPSEC_FS_STORAGE).getStore()
+      const outOfReqOrChild = !fs?.root
 
-      // we could filter out all the nested fs.operations based on store.fs.root
+      // we could filter out all the nested fs.operations based on fs.root
       // but if we spect a store in the context to be present we are going to exclude
       // all out_of_the_request fs.operations
       // AppsecFsPlugin must be enabled

package/packages/dd-trace/src/appsec/iast/analyzers/set-cookies-header-interceptor.js

@@ -17,10 +17,7 @@ class SetCookiesHeaderInterceptor extends Plugin {
 
   _handleCookies (name, value, res) {
     if (name.toLowerCase() === 'set-cookie') {
-      let allCookies = value
-      if (typeof value === 'string') {
-        allCookies = [value]
-      }
+      const allCookies = typeof value === 'string' ? [value] : value
       const alreadyCheckedCookies = this._getAlreadyCheckedCookiesInResponse(res)
 
       let location

package/packages/dd-trace/src/appsec/iast/path-line.js

@@ -66,7 +66,8 @@ function getCallSiteFramesForLocation (callSiteFrames, externallyExcludedPaths)
 
       if (
         !isExcluded(callsite, externallyExcludedPaths) &&
-        (!filepath.includes(pathLine.ddBasePath) || globalThis.__DD_ESBUILD_IAST_WITH_NO_SM)
+        (pathLine.ddBasePath === undefined || !filepath.includes(pathLine.ddBasePath) ||
+          globalThis.__DD_ESBUILD_IAST_WITH_NO_SM)
       ) {
         clientFrames.push(callsite)
       }

package/packages/dd-trace/src/appsec/iast/taint-tracking/operations-taint-object.js

@@ -3,9 +3,11 @@
 const TaintedUtils = require('@datadog/native-iast-taint-tracking')
 const { IAST_TRANSACTION_ID } = require('../iast-context')
 const log = require('../../../log')
+const { typedArrayLength } = require('../../../util')
 const { HTTP_REQUEST_PARAMETER } = require('./source-types')
 
-const SEPARATOR = '\u0000' // Unit Separator (cannot be in URL keys)
+const SEPARATOR = '\0' // Unit Separator (cannot be in URL keys)
+const MAX_TRAVERSED_BINARY_VIEW_LENGTH = 1024
 
 function taintObject (iastContext, object, type) {
   let result = object
@@ -31,6 +33,10 @@ function taintObject (iastContext, object, type) {
         } else if (typeof value === 'object' && !visited.has(value)) {
           visited.add(value)
 
+          // Binary view elements are numbers, but named properties may hold strings. Their keys cannot be listed
+          // without also materializing one key per element, so only small views are walked.
+          if (ArrayBuffer.isView(value) && typedArrayLength(value) > MAX_TRAVERSED_BINARY_VIEW_LENGTH) continue
+
           for (const key of Object.keys(value)) {
             queue.push({ parent: value, property: property ? `${property}.${key}` : key, value: value[key], key })
           }

package/packages/dd-trace/src/appsec/iast/taint-tracking/plugin.js

@@ -264,9 +264,7 @@ class TaintTrackingPlugin extends SourceIastPlugin {
   }
 
   _taintDatabaseResult (result, dbOrigin, iastContext, name) {
-    if (!iastContext) return result
-
-    if (this._rowsToTaint === 0) return result
+    if (!iastContext || this._rowsToTaint === 0) return result
 
     if (Array.isArray(result)) {
       for (let i = 0; i < result.length && i < this._rowsToTaint; i++) {

package/packages/dd-trace/src/appsec/iast/taint-tracking/rewriter-esm.mjs

@@ -31,9 +31,7 @@ export async function initialize (data) {
 export async function load (url, context, nextLoad) {
   const result = await nextLoad(url, context)
 
-  if (!port) return result
-  if (!result.source) return result
-  if (url.includes(ddTraceDir) || url.includes('iitm=true')) return result
+  if (!port || !result.source || url.includes(ddTraceDir) || url.includes('iitm=true')) return result
 
   let passes
   try {

package/packages/dd-trace/src/appsec/iast/telemetry/iast-metric.js

@@ -24,12 +24,7 @@ function formatTags (tags, tagKey) {
 }
 
 function getNamespace (scope, context) {
-  let namespace = globalNamespace
-
-  if (scope === Scope.REQUEST) {
-    namespace = getNamespaceFromContext(context) || globalNamespace
-  }
-  return namespace
+  return scope === Scope.REQUEST ? getNamespaceFromContext(context) || globalNamespace : globalNamespace
 }
 
 class IastMetric {

package/packages/dd-trace/src/appsec/lambda.js

@@ -169,9 +169,7 @@ function parseResponseBody (rawBody, headers, isBase64Encoded) {
   // A handler that answered with the payload itself needs no parsing, and no content type either.
   if (typeof rawBody === 'object') return rawBody
 
-  if (typeof rawBody !== 'string') return
-
-  if (!isJsonContentType(headers?.['content-type'])) return
+  if (typeof rawBody !== 'string' || !isJsonContentType(headers?.['content-type'])) return
 
   if (isOverSizeCap(rawBody, isBase64Encoded)) {
     log.debug('[ASM] Lambda response body larger than %d bytes, skipping schema extraction',

package/packages/dd-trace/src/appsec/rasp/fs-plugin.js

@@ -1,11 +1,13 @@
 'use strict'
 
-const Plugin = require('../../plugins/plugin')
+const dc = require('dc-polyfill')
+
 const { storage } = require('../../../../datadog-core')
 const log = require('../../log')
 
 const RASP_MODULE = 'rasp'
 const IAST_MODULE = 'iast'
+const APPSEC_FS_STORAGE = 'appsec-fs'
 
 const enabledFor = {
   [RASP_MODULE]: false,
@@ -13,42 +15,53 @@ const enabledFor = {
 }
 
 let fsPlugin
-
-function getStoreToStart (fsProps, store = storage('legacy').getStore()) {
-  if (store && !store.fs?.opExcluded) {
+const legacyStorage = storage('legacy')
+const appsecFsStorage = storage(APPSEC_FS_STORAGE)
+const fsOperationStart = dc.channel('apm:fs:operation:start')
+const fsOperationFinish = dc.channel('apm:fs:operation:finish')
+const responseRenderStart = dc.channel('tracing:datadog:express:response:render:start')
+const responseRenderEnd = dc.channel('tracing:datadog:express:response:render:end')
+
+function getStoreToStart (fsProps, store = appsecFsStorage.getStore()) {
+  // Only track operations inside a traced context, like a request. Callbacks of fs streams and watchers keep
+  // the state of the operation that created them, so state created outside of one would leak into every request
+  // of a server started from such a callback. The tracing fs plugin enters a noop store when no span is active.
+  const legacyStore = legacyStorage.getStore()
+  if (!legacyStore || legacyStore.noop) return
+
+  if (!store || !store.opExcluded) {
     return {
       ...store,
-      fs: {
-        ...store.fs,
-        ...fsProps,
-        parentStore: store,
-      },
+      ...fsProps,
+      parentStore: store,
     }
   }
 
   return store
 }
 
-class AppsecFsPlugin extends Plugin {
+class AppsecFsPlugin {
   enable () {
-    this.addBind('apm:fs:operation:start', this._onFsOperationStart)
-    this.addBind('apm:fs:operation:finish', this._onFsOperationFinishOrRenderEnd)
-    this.addBind('tracing:datadog:express:response:render:start', this._onResponseRenderStart)
-    this.addBind('tracing:datadog:express:response:render:end', this._onFsOperationFinishOrRenderEnd)
-    // We might have to add the same subscribers for fastify later
-
-    super.configure(true)
+    // The tracing fs plugin binds the legacy store on these channels. AppSec
+    // keeps its fs-only state in a dedicated storage namespace to avoid
+    // clobbering tracing state while still tracking nested operations.
+    fsOperationStart.bindStore(appsecFsStorage, this._onFsOperationStart)
+    fsOperationFinish.bindStore(appsecFsStorage, this._onFsOperationFinishOrRenderEnd)
+    responseRenderStart.bindStore(appsecFsStorage, this._onResponseRenderStart)
+    responseRenderEnd.bindStore(appsecFsStorage, this._onFsOperationFinishOrRenderEnd)
   }
 
   disable () {
-    super.configure(false)
+    fsOperationStart.unbindStore(appsecFsStorage)
+    fsOperationFinish.unbindStore(appsecFsStorage)
+    responseRenderStart.unbindStore(appsecFsStorage)
+    responseRenderEnd.unbindStore(appsecFsStorage)
   }
 
   _onFsOperationStart () {
-    const store = storage('legacy').getStore()
-    if (store) {
-      return getStoreToStart({ root: store.fs?.root === undefined }, store)
-    }
+    const store = appsecFsStorage.getStore()
+
+    return getStoreToStart({ root: store?.root === undefined }, store)
   }
 
   _onResponseRenderStart () {
@@ -56,11 +69,7 @@ class AppsecFsPlugin extends Plugin {
   }
 
   _onFsOperationFinishOrRenderEnd () {
-    const store = storage('legacy').getStore()
-    if (store?.fs) {
-      return store.fs.parentStore
-    }
-    return store
+    return appsecFsStorage.getStore()?.parentStore
   }
 }
 
@@ -97,6 +106,7 @@ module.exports = {
   disable,
 
   AppsecFsPlugin,
+  APPSEC_FS_STORAGE,
 
   RASP_MODULE,
   IAST_MODULE,

package/packages/dd-trace/src/appsec/rasp/lfi.js

@@ -6,9 +6,14 @@ const { fsOperationStart, incomingHttpRequestStart, expressResponseRenderStart }
 const { storage } = require('../../../../datadog-core')
 const web = require('../../plugins/util/web')
 const { FS_OPERATION_PATH } = require('../addresses')
-const { getRequest } = require('../store')
+const { getActiveRequest } = require('../store')
 const waf = require('../waf')
-const { enable: enableFsPlugin, disable: disableFsPlugin, RASP_MODULE } = require('./fs-plugin')
+const {
+  APPSEC_FS_STORAGE,
+  enable: enableFsPlugin,
+  disable: disableFsPlugin,
+  RASP_MODULE,
+} = require('./fs-plugin')
 const { RULE_TYPES, handleResult } = require('./utils')
 
 let config
@@ -59,11 +64,10 @@ function analyzeLfiInResponseRender (ctx) {
 }
 
 function analyzeLfi (ctx) {
-  const store = storage('legacy').getStore()
-  const fs = store?.fs
+  const fs = storage(APPSEC_FS_STORAGE).getStore()
   if (!fs) return
 
-  const req = getRequest(store)
+  const req = getActiveRequest()
   if (!req) return
 
   const res = web.getContext(req)?.res

package/packages/dd-trace/src/appsec/reporter.js

@@ -8,7 +8,7 @@ const web = require('../plugins/util/web')
 const { ipHeaderList } = require('../plugins/util/ip_extractor')
 const { keepTrace } = require('../priority_sampler')
 const { ASM } = require('../standalone/product')
-const { isEmpty, truncateString } = require('../util')
+const { isEmpty, truncateString, typedArrayLength } = require('../util')
 const { getActiveRequest } = require('./store')
 const {
   incrementWafInitMetric,
@@ -431,6 +431,20 @@ function reportAttack ({ events: attackData, actions }, req, rootSpan) {
   }
 }
 
+/**
+ * Copies the first elements by index, the one typed array access that user code cannot override, unlike `subarray`,
+ * `toJSON` or their species constructors. The result keeps the shape `Buffer#toJSON` and `Object.keys` produce.
+ *
+ * @param {import('../util').BinaryView} view
+ */
+function truncateTypedArray (view) {
+  const data = new Array(COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE)
+  for (let i = 0; i < COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE; i++) {
+    data[i] = view[i]
+  }
+  return Buffer.isBuffer(view) ? { type: 'Buffer', data } : { ...data }
+}
+
 function truncateRequestBody (target, depth = 0) {
   switch (typeof target) {
     case 'string':
@@ -447,6 +461,12 @@ function truncateRequestBody (target, depth = 0) {
         return { truncated: true }
       }
 
+      // `Buffer#toJSON` and `Object.keys` both materialize one entry per byte, so cut large binary views down
+      // before they are serialized.
+      if (ArrayBuffer.isView(target) && typedArrayLength(target) > COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE) {
+        return { value: truncateTypedArray(target), truncated: true }
+      }
+
       if (typeof target.toJSON === 'function') {
         try {
           return truncateRequestBody(target.toJSON(), depth + 1)

package/packages/dd-trace/src/appsec/stack_trace.js

@@ -34,8 +34,9 @@ function getCallSiteList (maxDepth = 100, constructorOpt) {
 
 function filterOutFramesFromLibrary (callSiteList) {
   return callSiteList.filter(callSite => {
-    if (globalThis.__DD_ESBUILD_IAST_WITH_NO_SM) {
-      // bundled and no SourceMap, not possible to discriminate if the frame comes from dd-trace code or not
+    if (globalThis.__DD_ESBUILD_IAST_WITH_NO_SM || ddBasePath === undefined) {
+      // bundled without a SourceMap, or dd-trace's location is unknown: not possible to discriminate if the frame
+      // comes from dd-trace code or not
       return true
     }
 
@@ -81,8 +82,7 @@ function getCallsiteFrames (maxDepth = 32, constructorOpt = getCallsiteFrames, c
 }
 
 function reportStackTrace (rootSpan, stackId, frames, namespace = STACK_TRACE_NAMESPACES.RASP) {
-  if (!rootSpan) return
-  if (!Array.isArray(frames)) return
+  if (!rootSpan || !Array.isArray(frames)) return
 
   if (!rootSpan.meta_struct) {
     rootSpan.meta_struct = {}

package/packages/dd-trace/src/ci-visibility/dynamic-atr-retries.js

@@ -86,12 +86,9 @@ function getDynamicAtrBuckets (value) {
  * @param {number[] | null} customBuckets
  */
 function getDynamicAtrRetryCount (durationMs, efdRetryPolicy, customBuckets) {
-  let retryCount
-  if (customBuckets) {
-    retryCount = customBuckets[retryBucketIndexForDuration(durationMs)]
-  } else {
-    retryCount = retriesForDuration(durationMs, efdRetryPolicy)
-  }
+  const retryCount = customBuckets
+    ? customBuckets[retryBucketIndexForDuration(durationMs)]
+    : retriesForDuration(durationMs, efdRetryPolicy)
   return Math.max(1, retryCount)
 }
 

package/packages/dd-trace/src/ci-visibility/dynamic-instrumentation/worker/index.js

@@ -228,9 +228,10 @@ async function addBreakpoint (probe) {
   }
 }
 
-function start () {
+async function start () {
+  await session.post('Debugger.enable')
+  // Only flag the session as started once enabled, so the next probe retries a failed start and reports its cause
   sessionStarted = true
-  return session.post('Debugger.enable') // return instead of await to reduce number of promises created
 }
 
 function drainBreakpointHitRequests () {

package/packages/dd-trace/src/ci-visibility/exporters/ci-validation/msgpack-to-json.js

@@ -224,7 +224,7 @@ class MsgpackJsonConverter {
    * @param {number} value decoded floating-point value
    */
   #writeFloat (value) {
-    if (!Number.isFinite(value)) throw new Error('MessagePack validation payload contains a non-finite number.')
+    if (!Number.isFinite(value)) throw new TypeError('MessagePack validation payload contains a non-finite number.')
     this.#writer.write(Object.is(value, -0) ? '-0' : String(value))
   }
 

package/packages/dd-trace/src/ci-visibility/exporters/ci-visibility-exporter.js

@@ -114,10 +114,14 @@ function isValidRetryCount (value) {
  * @param {unknown} retryPolicy - Candidate retry policy.
  */
 function isValidCachedEfdRetryPolicy (retryPolicy) {
-  if (retryPolicy === null || typeof retryPolicy !== 'object' || Array.isArray(retryPolicy)) return false
-  if (!isValidRetryCount(retryPolicy.schedulingRetryCount)) return false
-  if (!Array.isArray(retryPolicy.durationRetryCounts) ||
-    retryPolicy.durationRetryCounts.length !== EMPTY_EFD_RETRY_POLICY.durationRetryCounts.length) {
+  if (
+    retryPolicy === null ||
+    typeof retryPolicy !== 'object' ||
+    Array.isArray(retryPolicy) ||
+    !isValidRetryCount(retryPolicy.schedulingRetryCount) ||
+    !Array.isArray(retryPolicy.durationRetryCounts) ||
+    retryPolicy.durationRetryCounts.length !== EMPTY_EFD_RETRY_POLICY.durationRetryCounts.length
+  ) {
     return false
   }
 
@@ -152,9 +156,11 @@ function isValidCachedSettings (settings) {
   }
   if (settings.isDiEnabled && !settings.isFlakyTestRetriesEnabled) return false
   if (settings.isEarlyFlakeDetectionEnabled && !settings.isKnownTestsEnabled) return false
-  if (!isValidCachedEfdRetryPolicy(settings.earlyFlakeDetectionRetryPolicy)) return false
-  if (!isNonNegativeSafeInteger(settings.earlyFlakeDetectionFaultyThreshold) ||
-    settings.earlyFlakeDetectionFaultyThreshold > 100) {
+  if (
+    !isValidCachedEfdRetryPolicy(settings.earlyFlakeDetectionRetryPolicy) ||
+    !isNonNegativeSafeInteger(settings.earlyFlakeDetectionFaultyThreshold) ||
+    settings.earlyFlakeDetectionFaultyThreshold > 100
+  ) {
     return false
   }
   return settings.testManagementAttemptToFixRetries === undefined ||

package/packages/dd-trace/src/ci-visibility/exporters/settings-cache-key.js

@@ -12,8 +12,7 @@ const getConfig = require('../../config')
  * @param {object} configuration - Request configuration for the settings endpoint.
  */
 function buildSettingsCacheKey (configuration) {
-  const config = getConfig()
-  const { testOptimization } = config
+  const { testOptimization } = getConfig()
   return buildCacheKey('settings', [
     tracerVersion,
     configuration.url?.href,

package/packages/dd-trace/src/ci-visibility/exporters/test-worker/index.js

@@ -35,10 +35,7 @@ function getInterprocessTraceCode () {
   if (DD_PLAYWRIGHT_WORKER) {
     return PLAYWRIGHT_WORKER_TRACE_PAYLOAD_CODE
   }
-  if (getEnvironmentVariable('TINYPOOL_WORKER_ID')) {
-    return VITEST_WORKER_TRACE_PAYLOAD_CODE
-  }
-  if (DD_VITEST_WORKER) {
+  if (getEnvironmentVariable('TINYPOOL_WORKER_ID') || DD_VITEST_WORKER) {
     return VITEST_WORKER_TRACE_PAYLOAD_CODE
   }
   return null
@@ -62,10 +59,7 @@ function getInterprocessLogsCode () {
   if (getEnvironmentVariable('MOCHA_WORKER_ID') === 'webdriverio') {
     return MOCHA_WORKER_LOGS_PAYLOAD_CODE
   }
-  if (getEnvironmentVariable('TINYPOOL_WORKER_ID')) {
-    return VITEST_WORKER_LOGS_PAYLOAD_CODE
-  }
-  if (getConfig().DD_VITEST_WORKER) {
+  if (getEnvironmentVariable('TINYPOOL_WORKER_ID') || getConfig().DD_VITEST_WORKER) {
     return VITEST_WORKER_LOGS_PAYLOAD_CODE
   }
   return null

package/packages/dd-trace/src/ci-visibility/resolve-runfile-path.js

@@ -0,0 +1,54 @@
+'use strict'
+
+const fs = require('node:fs')
+const path = require('node:path')
+
+const log = require('../log')
+
+/**
+ * @param {string} filePath
+ * @param {Record<string, string | undefined>} env
+ */
+function resolveRunfilePath (filePath, env) {
+  if (fs.existsSync(filePath)) return filePath
+
+  const runfilesDir = env.RUNFILES_DIR
+  if (runfilesDir) {
+    const candidate = path.join(runfilesDir, filePath)
+    if (fs.existsSync(candidate)) return candidate
+  }
+
+  const manifestCandidate = resolveFromManifest(filePath, env.RUNFILES_MANIFEST_FILE)
+  if (manifestCandidate) return manifestCandidate
+
+  const testSrcdir = env.TEST_SRCDIR
+  if (testSrcdir) {
+    const candidate = path.join(testSrcdir, filePath)
+    if (fs.existsSync(candidate)) return candidate
+  }
+
+  return filePath
+}
+
+/**
+ * @param {string} filePath
+ * @param {string | undefined} runfilesManifest
+ */
+function resolveFromManifest (filePath, runfilesManifest) {
+  if (!runfilesManifest || !fs.existsSync(runfilesManifest)) return
+
+  try {
+    const lines = fs.readFileSync(runfilesManifest, 'utf8').split('\n')
+    for (const line of lines) {
+      const separatorIndex = line.indexOf(' ')
+      if (separatorIndex <= 0 || line.slice(0, separatorIndex) !== filePath) continue
+
+      const resolvedPath = line.slice(separatorIndex + 1).trim()
+      if (resolvedPath) return resolvedPath
+    }
+  } catch (err) {
+    log.debug('Failed to resolve Test Optimization runfile from %s: %s', runfilesManifest, err.message)
+  }
+}
+
+module.exports = resolveRunfilePath

package/packages/dd-trace/src/ci-visibility/test-optimization-http-cache-schema.js

@@ -75,14 +75,12 @@ function validateSettingsResponse (response, options = {}) {
   assertBooleanFields(attributes.test_management, ['enabled'], 'settings test_management')
   assertOptionalBoundedNumber(
     attributes.early_flake_detection.faulty_session_threshold,
-    'settings early_flake_detection faulty_session_threshold',
-    { integer: true }
+    'settings early_flake_detection faulty_session_threshold'
   )
   assertRetryMap(attributes.early_flake_detection.slow_test_retries)
   assertOptionalBoundedNumber(
     attributes.test_management.attempt_to_fix_retries,
-    'settings test_management attempt_to_fix_retries',
-    { integer: true }
+    'settings test_management attempt_to_fix_retries'
   )
 }
 
@@ -214,10 +212,9 @@ function assertBooleanFields (object, keys, endpoint) {
   }
 }
 
-function assertOptionalBoundedNumber (value, endpoint, { integer = false } = {}) {
+function assertOptionalBoundedNumber (value, endpoint) {
   if (value === undefined) return
-  if (!Number.isFinite(value) || (integer && !Number.isInteger(value)) ||
-    value < 0 || value > MAX_RETRIES) {
+  if (!Number.isFinite(value) || !Number.isInteger(value) || value < 0 || value > MAX_RETRIES) {
     throw new TypeError(`Invalid ${endpoint}: value must be between 0 and ${MAX_RETRIES}`)
   }
 }
@@ -230,7 +227,7 @@ function assertRetryMap (retries) {
     if (!RETRY_THRESHOLD_PATTERN.test(threshold)) {
       throw new TypeError('Invalid early flake detection retry threshold: expected a duration such as 5s')
     }
-    assertOptionalBoundedNumber(count, `early flake detection retry count ${threshold}`, { integer: true })
+    assertOptionalBoundedNumber(count, `early flake detection retry count ${threshold}`)
   }
 }