dd-trace 5.132.0 → 5.134.0

package/packages/dd-trace/src/otel-thread-ctx.js

@@ -20,8 +20,9 @@
 // and the OTel ContextManager activates spans via
 // storage('legacy').run({ span: ddSpan }, ...), so the active span
 // our writer reads from legacy storage is the same DatadogSpan in
-// both cases. The OTel-visible trace/span IDs come from the same
-// _ddContext.toTraceId/toSpanId calls we use here.
+// both cases. The record's trace/span IDs are read from the same
+// Identifier bytes (and _dd.p.tid) behind _ddContext.toTraceId/toSpanId,
+// and the spec pins them byte-for-byte to those methods.
 
 const { isMainThread, threadId } = require('worker_threads')
 
@@ -40,6 +41,10 @@ const {
 } = require('./profiling/webspan-utils')
 const webTagsCache = require('./web-tags-cache')
 
+/** @typedef {import('./opentracing/span')} DatadogSpan */
+/** @typedef {import('./opentracing/span_context')} DatadogSpanContext */
+/** @typedef {InstanceType<typeof import('@datadog/pprof').otelThreadCtx.ThreadContext>} ThreadContext */
+
 // OTEP-4947 duplicates are last-wins, so appending a later endpoint value would
 // correctly overwrite an earlier one — but an out-of-process reader sampling the
 // record mid-request would still see the interim value (e.g. a bare `GET`) as
@@ -124,6 +129,7 @@ function traceFlagsOf (spanContext) {
 //             waiting on; undefined while the span has no web-server ancestry.
 //             Distinguishes a stale announcement from a live one when a nearer
 //             web-server span takes over.
+//   awaitsOwnEndpoint: this is the request span, waiting on its own endpoint.
 const CachedSym = Symbol('OtelThreadCtx.cached')
 
 let started = false
@@ -131,12 +137,59 @@ let ThreadContext
 let getContext
 let clearContext
 
+// Reusable: the ThreadContext constructor copies the ids into its own record.
+const traceIdBytes = Buffer.alloc(16)
+const spanIdBytes = new Uint8Array(8)
+
+/**
+ * Same bytes as decoding toTraceId(true); unexpected shapes fall back to that.
+ *
+ * @param {DatadogSpanContext} spanContext
+ * @returns {Uint8Array}
+ */
+function getTraceIdBytes (spanContext) {
+  const low = spanContext._traceId.toBuffer()
+  if (low.length === 16) {
+    for (let i = 0; i < 16; i++) traceIdBytes[i] = low[i]
+    return traceIdBytes
+  }
+  if (low.length !== 8) return Buffer.from(spanContext.toTraceId(true), 'hex')
+  const high = spanContext._trace.tags['_dd.p.tid']
+  if (high) {
+    // write() stops at the first non-hex character, so only a valid _dd.p.tid fills all 8 bytes.
+    if (typeof high !== 'string' || high.length !== 16 || traceIdBytes.write(high, 0, 8, 'hex') !== 8) {
+      return Buffer.from(spanContext.toTraceId(true), 'hex')
+    }
+  } else {
+    for (let i = 0; i < 8; i++) traceIdBytes[i] = 0
+  }
+  for (let i = 0; i < 8; i++) traceIdBytes[i + 8] = low[i]
+  return traceIdBytes
+}
+
+/**
+ * @param {DatadogSpanContext} spanContext
+ * @returns {Uint8Array}
+ */
+function getSpanIdBytes (spanContext) {
+  const bytes = spanContext._spanId.toBuffer()
+  if (bytes.length !== 8) return Buffer.from(spanContext.toSpanId(true), 'hex')
+  for (let i = 0; i < 8; i++) spanIdBytes[i] = bytes[i]
+  return spanIdBytes
+}
+
+/**
+ * @param {DatadogSpan} span
+ * @returns {ThreadContext | undefined} The span's record, or undefined when the span's trace or span id is malformed.
+ */
 function getOrBuildContext (span) {
   let cached = span[CachedSym]
   if (cached !== undefined && cached.context !== undefined) return cached.context
   const spanContext = span.context()
-  const traceId = Uint8Array.from(Buffer.from(spanContext.toTraceId(true), 'hex'))
-  const spanId = Uint8Array.from(Buffer.from(spanContext.toSpanId(true), 'hex'))
+  const traceId = getTraceIdBytes(spanContext)
+  const spanId = getSpanIdBytes(spanContext)
+  // The native constructor throws on any other id length, and onEnter runs inside user code.
+  if (traceId.length !== 16 || spanId.length !== 8) return
   // Local root span: the first entry in the trace's started-spans list, or
   // this span itself when it IS the root. Encoded as 16-char lowercase hex
   // per the libdatadog convention.
@@ -152,7 +205,7 @@ function getOrBuildContext (span) {
   attrs[THREAD_NAME_IDX] = THREAD_NAME
   attrs[THREAD_ID_IDX] = THREAD_ID
   if (cached === undefined) {
-    cached = {}
+    cached = { context: undefined, webTags: undefined, awaitsOwnEndpoint: false }
     span[CachedSym] = cached
   }
   // The flags are the one part of the record that can still change after
@@ -163,17 +216,22 @@ function getOrBuildContext (span) {
   // built before the decision keeps reading as not sampled.
   cached.context = new ThreadContext(traceId, spanId, traceFlagsOf(spanContext), attrs)
   cached.webTags = webTags
-  if (endpoint === undefined) awaitEndpoint(webTags, cached)
+  if (endpoint === undefined) awaitEndpoint(span, webTags, cached)
   return cached.context
 }
 
 // Enlist a record built without an endpoint, so the resolution announcement for
 // its request fills it in.
-function awaitEndpoint (webTags, cached) {
+function awaitEndpoint (span, webTags, cached) {
   // No web-server span in this span's ancestry, so no endpoint is coming. Should
   // one appear later, webTagsCache announces that separately — see
   // onWebTagsResolved.
   if (webTags === undefined) return
+  // The request span waits on its own announcement; only descendants need the shared list.
+  if (webTags === span.context().getTags()) {
+    cached.awaitsOwnEndpoint = true
+    return
+  }
   const waiting = pendingEndpoints.get(webTags)
   if (waiting === undefined) {
     pendingEndpoints.set(webTags, [cached])
@@ -193,12 +251,13 @@ function appendEndpoint (context, endpoint) {
 
 function onEnter () {
   if (!started) return
-  const span = getActiveSpan()
-  if (!span) {
-    clearContext()
+  const span = /** @type {DatadogSpan | null | undefined} */ (getActiveSpan())
+  const context = span && getOrBuildContext(span)
+  if (!context) {
+    // Clearing an empty frame would still make pprof install a new AsyncContextFrame.
+    if (getContext() !== undefined) clearContext()
     return
   }
-  const context = getOrBuildContext(span)
   // Skip if this CPED already holds the same context. Same allocation-churn
   // fix as the wall profiler in dd-trace-js#8638.
   if (getContext() === context) return
@@ -246,11 +305,18 @@ function onSpanFinished (span) {
 function onEndpointResolved (span) {
   if (!started) return
   const webTags = span.context().getTags()
+  const own = span[CachedSym]
+  const ownWaits = own !== undefined && own.awaitsOwnEndpoint
   const waiting = pendingEndpoints.get(webTags)
-  if (waiting === undefined) return
+  if (!ownWaits && waiting === undefined) return
   const endpoint = finalEndpoint(webTags)
   // webTagsCache only announces settled endpoints, so this is belt and braces.
   if (endpoint === undefined) return
+  if (ownWaits) {
+    own.awaitsOwnEndpoint = false
+    if (own.context !== undefined && own.webTags === webTags) appendEndpoint(own.context, endpoint)
+  }
+  if (waiting === undefined) return
   pendingEndpoints.delete(webTags)
   for (const cached of waiting) {
     // A record whose span has since been attributed to a nearer web-server span
@@ -281,7 +347,7 @@ function onWebTagsResolved (span) {
     // ThreadContext would strand every async-context frame holding this one.
     // The work is still nested in the outer request, which makes that the least
     // wrong of the values available.
-    awaitEndpoint(webTags, cached)
+    awaitEndpoint(span, webTags, cached)
   } else {
     appendEndpoint(cached.context, endpoint)
   }

package/packages/dd-trace/src/plugin_manager.js

@@ -102,8 +102,7 @@ module.exports = class PluginManager {
   loadPlugin (name) {
     const Plugin = pluginClasses[name]
 
-    if (!Plugin) return
-    if (!this._tracerConfig) return // TODO: don't wait for tracer to be initialized
+    if (!Plugin || !this._tracerConfig) return // TODO: don't wait for tracer to be initialized
 
     // Check if this is a Test Optimization plugin and Test Optimization is not enabled
     if (TEST_OPTIMIZATION_PLUGINS.has(name) && !this._tracerConfig.isCiVisibility) {

package/packages/dd-trace/src/plugins/database.js

@@ -25,7 +25,7 @@ class DatabasePlugin extends StoragePlugin {
   // trails ddh — so per-query work shrinks to encoding dddb / dddbs / ddh and concatenating.
   #dbmEnvFragment
   #dbmEndFragment
-  // Cache the rendered prefix per `${db.name}\0${out.host}\0${dbmService}`. The triple is
+  // Cache the rendered prefix per `${db.name}\0${out.host}\0${serviceName}`. The triple is
   // connection-stable for a real workload, so the steady state is one `LRUCache.get` plus the
   // optional per-call `,ddprs='...'` suffix.
   #dbmPrefixCache = new LRUCache({ max: DBM_PREFIX_CACHE_MAX })
@@ -61,23 +61,15 @@ class DatabasePlugin extends StoragePlugin {
       this.#dbmPrefixCache.set(cacheKey, prefix)
     }
 
-    if (peerData !== undefined && peerData[PEER_SERVICE_SOURCE_KEY] === PEER_SERVICE_KEY) {
-      return `${prefix},ddprs='${encode(peerData[PEER_SERVICE_KEY])}'`
+    // `dddbs` never follows the peer service: it is always the configured database service, and the
+    // peer service is reported through `ddprs` only, and only when it was set explicitly.
+    const peerService = peerData?.[PEER_SERVICE_KEY]
+    if (peerService && peerData[PEER_SERVICE_SOURCE_KEY] === PEER_SERVICE_KEY) {
+      return `${prefix},ddprs='${encode(peerService)}'`
     }
     return prefix
   }
 
-  /**
-   * @param {string} tracerService
-   * @param {object} peerData
-   */
-  #getDbmServiceName (tracerService, peerData) {
-    if (this._tracerConfig.spanComputePeerService) {
-      return this.getPeerServiceRemap(peerData)[PEER_SERVICE_KEY] || tracerService
-    }
-    return tracerService
-  }
-
   /**
    * @param {import('../../../..').Span} span
    * @param {string} serviceName
@@ -91,8 +83,7 @@ class DatabasePlugin extends StoragePlugin {
     }
 
     const peerData = this.getPeerService(span.context().getTags())
-    const dbmService = this.#getDbmServiceName(serviceName, peerData)
-    const servicePropagation = this.#createDBMPropagationCommentService(dbmService, span, peerData)
+    const servicePropagation = this.#createDBMPropagationCommentService(serviceName, span, peerData)
 
     let dbmComment = servicePropagation
 

package/packages/dd-trace/src/plugins/tracing.js

@@ -267,7 +267,6 @@ class TracingPlugin extends Plugin {
     analyticsSampler.sample(span, config.measured)
 
     // TODO: Remove this after migration to TracingChannel is done.
-    // eslint-disable-next-line unicorn/no-unnecessary-boolean-comparison -- Context objects use the other branch.
     if (enterOrCtx === true) {
       legacyStorage.enterWith({ ...store, span })
     } else if (enterOrCtx) {

package/packages/dd-trace/src/plugins/util/git.js

@@ -3,8 +3,10 @@
 const os = require('os')
 const path = require('path')
 const fs = require('fs')
+const { execFileSync } = require('node:child_process')
 
 const log = require('../../log')
+const { getEnvironmentVariables } = require('../../config/helper')
 const {
   incrementCountMetric,
   distributionMetric,
@@ -45,12 +47,12 @@ const legacyStorage = storage('legacy')
 const GIT_REV_LIST_MAX_BUFFER = 12 * 1024 * 1024 // 12MB
 
 function sanitizedExec (
-  cmd,
   flags,
   operationMetric,
   durationMetric,
   errorMetric,
-  shouldTrim = true
+  shouldTrim = true,
+  executionOptions
 ) {
   return legacyStorage.run({ noop: true }, () => {
     let startTime
@@ -61,7 +63,14 @@ function sanitizedExec (
       startTime = Date.now()
     }
     try {
-      let result = cachedExec(cmd, flags, { stdio: 'pipe' }).toString()
+      const exec = executionOptions?.uncached ? execFileSync : cachedExec
+      /** @type {import('node:child_process').ExecFileSyncOptions} */
+      const options = { stdio: 'pipe' }
+      if (executionOptions?.timeout) options.timeout = executionOptions.timeout
+      if (executionOptions?.localOnly) {
+        options.env = { ...getEnvironmentVariables(), GIT_NO_LAZY_FETCH: '1', GIT_ALLOW_PROTOCOL: '' }
+      }
+      let result = exec('git', flags, options).toString()
 
       if (shouldTrim) {
         result = result.replaceAll(/(\r\n|\n|\r)/g, '')
@@ -80,6 +89,7 @@ function sanitizedExec (
         })
       }
       log.error('Git plugin error executing command', err)
+      if (executionOptions?.throwOnError) throw err
       return ''
     }
   })
@@ -104,18 +114,19 @@ function isGitAvailable () {
   }
 }
 
-function isShallowRepository () {
+function isShallowRepository (uncached = false) {
   return sanitizedExec(
-    'git',
     ['rev-parse', '--is-shallow-repository'],
     { name: TELEMETRY_GIT_COMMAND, tags: { command: 'check_shallow' } },
     { name: TELEMETRY_GIT_COMMAND_MS, tags: { command: 'check_shallow' } },
-    { name: TELEMETRY_GIT_COMMAND_ERRORS, tags: { command: 'check_shallow' } }
+    { name: TELEMETRY_GIT_COMMAND_ERRORS, tags: { command: 'check_shallow' } },
+    true,
+    { uncached }
   ) === 'true'
 }
 
 function getGitVersion () {
-  const gitVersionString = sanitizedExec('git', ['version'])
+  const gitVersionString = sanitizedExec(['version'])
   const gitVersionMatches = /** @type {RegExpMatch} */ (gitVersionString.match(/git version (\d+)\.(\d+)\.(\d+)/))
   try {
     return {
@@ -138,8 +149,8 @@ function unshallowRepository (parentOnly = false) {
     log.warn('Git version is <2.27, so git unshallow will not proceed')
     return
   }
-  const defaultRemoteName = sanitizedExec('git', ['config', '--default', 'origin', '--get', 'clone.defaultRemoteName'])
-  const revParseHead = sanitizedExec('git', ['rev-parse', 'HEAD'])
+  const defaultRemoteName = sanitizedExec(['config', '--default', 'origin', '--get', 'clone.defaultRemoteName'])
+  const revParseHead = sanitizedExec(['rev-parse', 'HEAD'])
 
   const baseGitOptions = [
     'fetch',
@@ -167,7 +178,6 @@ function unshallowRepository (parentOnly = false) {
       { command: 'unshallow', errorType: err.code, exitCode: err.status || err.errno }
     )
     const upstreamRemote = sanitizedExec(
-      'git',
       ['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{upstream}']
     )
     flags = [
@@ -186,7 +196,6 @@ function unshallowRepository (parentOnly = false) {
       )
       // We use sanitizedExec here because if this last option fails, we'll give up.
       sanitizedExec(
-        'git',
         baseGitOptions,
         null,
         null,
@@ -199,7 +208,6 @@ function unshallowRepository (parentOnly = false) {
 
 function getRepositoryUrl () {
   return sanitizedExec(
-    'git',
     ['config', '--get', 'remote.origin.url'],
     { name: TELEMETRY_GIT_COMMAND, tags: { command: 'get_repository' } },
     { name: TELEMETRY_GIT_COMMAND_MS, tags: { command: 'get_repository' } },
@@ -228,23 +236,29 @@ function getLatestCommits () {
 }
 
 function getGitDiff (baseCommit, targetCommit) {
+  // Fetch the required snapshots explicitly; a depth-1 metadata fetch does not provide their ancestry.
+  for (const commit of targetCommit ? [baseCommit, targetCommit] : [baseCommit]) {
+    if (!hasLocalGitObject(commit)) {
+      // Use the current checkout state so a stale cache cannot shorten a complete clone.
+      fetchHeadCommitSha(commit, isShallowRepository(true))
+    }
+  }
   const flags = ['diff', '-U0', '--word-diff=porcelain', baseCommit]
   if (targetCommit) {
     flags.push(targetCommit)
   }
   return sanitizedExec(
-    'git',
     flags,
     { name: TELEMETRY_GIT_COMMAND, tags: { command: 'diff' } },
     { name: TELEMETRY_GIT_COMMAND_MS, tags: { command: 'diff' } },
     { name: TELEMETRY_GIT_COMMAND_ERRORS, tags: { command: 'diff' } },
-    false // important not to trim or we'll lose the line breaks which we need to detect impacted tests
+    false, // important not to trim or we'll lose the line breaks which we need to detect impacted tests
+    { uncached: true }
   )
 }
 
 function getGitRemoteName () {
   const upstreamRemote = sanitizedExec(
-    'git',
     ['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{upstream}'],
     { name: TELEMETRY_GIT_COMMAND, tags: { command: 'get_remote_name' } },
     { name: TELEMETRY_GIT_COMMAND_MS, tags: { command: 'get_remote_name' } },
@@ -256,7 +270,6 @@ function getGitRemoteName () {
   }
 
   const remotes = sanitizedExec(
-    'git',
     ['remote'],
     { name: TELEMETRY_GIT_COMMAND, tags: { command: 'get_remote_name' } },
     { name: TELEMETRY_GIT_COMMAND_MS, tags: { command: 'get_remote_name' } },
@@ -269,7 +282,6 @@ function getGitRemoteName () {
 
 function getSourceBranch () {
   return sanitizedExec(
-    'git',
     ['rev-parse', '--abbrev-ref', 'HEAD'],
     { name: TELEMETRY_GIT_COMMAND, tags: { command: 'get_source_branch' } },
     { name: TELEMETRY_GIT_COMMAND_MS, tags: { command: 'get_source_branch' } },
@@ -315,7 +327,6 @@ function checkAndFetchBranch (branch, remoteName) {
 
 function getLocalBranches (remoteName) {
   const localBranches = sanitizedExec(
-    'git',
     ['for-each-ref', '--format=%(refname:short)', `refs/remotes/${remoteName}`],
     { name: TELEMETRY_GIT_COMMAND, tags: { command: 'get_local_branches' } },
     { name: TELEMETRY_GIT_COMMAND_MS, tags: { command: 'get_local_branches' } },
@@ -331,7 +342,6 @@ function getLocalBranches (remoteName) {
 
 function getMergeBase (baseBranch, sourceBranch) {
   return sanitizedExec(
-    'git',
     ['merge-base', baseBranch, sourceBranch],
     { name: TELEMETRY_GIT_COMMAND, tags: { command: 'get_merge_base' } },
     { name: TELEMETRY_GIT_COMMAND_MS, tags: { command: 'get_merge_base' } },
@@ -341,7 +351,6 @@ function getMergeBase (baseBranch, sourceBranch) {
 
 function getCounts (sourceBranch, candidateBranch) {
   const counts = sanitizedExec(
-    'git',
     ['rev-list', '--left-right', '--count', `${candidateBranch}...${sourceBranch}`],
     { name: TELEMETRY_GIT_COMMAND, tags: { command: 'get_counts' } },
     { name: TELEMETRY_GIT_COMMAND_MS, tags: { command: 'get_counts' } },
@@ -460,7 +469,6 @@ function generatePackFilesForCommits (commitsToUpload) {
 
 function getRepositoryRoot () {
   return sanitizedExec(
-    'git',
     ['rev-parse', '--show-toplevel']
   )
 }
@@ -477,6 +485,7 @@ function getGitMetadata (ciMetadata) {
     authorEmail: ciAuthorEmail,
     ciWorkspacePath,
     headCommitSha,
+    pullRequestBaseBranchSha,
   } = ciMetadata
 
   // With stdio: 'pipe', errors in this command will not be output to the parent process,
@@ -488,19 +497,36 @@ function getGitMetadata (ciMetadata) {
     committerName,
     committerEmail,
     committerDate,
-  ] = sanitizedExec('git', ['show', '-s', '--format=%an,%ae,%aI,%cn,%ce,%cI']).split(',')
+  ] = sanitizedExec(['show', '-s', '--format=%an,%ae,%aI,%cn,%ce,%cI']).split(',')
 
   const tags = {
     [GIT_COMMIT_MESSAGE]:
-      commitMessage || sanitizedExec('git', ['show', '-s', '--format=%B'], null, null, null, false),
-    [GIT_BRANCH]: branch || sanitizedExec('git', ['rev-parse', '--abbrev-ref', 'HEAD']),
-    [GIT_COMMIT_SHA]: commitSHA || sanitizedExec('git', ['rev-parse', 'HEAD']),
+      commitMessage || sanitizedExec(['show', '-s', '--format=%B'], null, null, null, false),
+    [GIT_BRANCH]: branch || sanitizedExec(['rev-parse', '--abbrev-ref', 'HEAD']),
+    [GIT_COMMIT_SHA]: commitSHA || sanitizedExec(['rev-parse', 'HEAD']),
     [CI_WORKSPACE_PATH]: ciWorkspacePath || getRepositoryRoot(),
   }
 
   if (headCommitSha) {
-    if (isShallowRepository()) {
-      fetchHeadCommitSha(headCommitSha)
+    const shallow = isShallowRepository(true)
+    const fetchedAtDepthOne = shallow && fetchHeadCommitSha(headCommitSha)
+    const headFlags = [
+      'show',
+      '-s',
+      '--format=\'%H","%aI","%an","%ae","%cI","%cn","%ce","%B\'',
+      headCommitSha,
+    ]
+    // Only explicit, bounded fetches may contact the remote during head metadata recovery.
+    const headOptions = { uncached: true, localOnly: true }
+    let headInfo = sanitizedExec(headFlags, null, null, null, false, headOptions)
+    if (!headInfo && (fetchedAtDepthOne || !shallow)) {
+      fetchHeadCommitSha(headCommitSha, false)
+      headInfo = sanitizedExec(headFlags, null, null, null, false, headOptions)
+    }
+
+    // Prepare a known diff base while the remote is available, including when Git upload is disabled.
+    if (shallow && pullRequestBaseBranchSha && !hasLocalGitObject(pullRequestBaseBranchSha)) {
+      fetchHeadCommitSha(pullRequestBaseBranchSha)
     }
 
     const [
@@ -512,19 +538,7 @@ function getGitMetadata (ciMetadata) {
       headCommitterName,
       headCommitterEmail,
       headCommitMessage,
-    ] = sanitizedExec(
-      'git',
-      [
-        'show',
-        '-s',
-        '--format=\'%H","%aI","%an","%ae","%cI","%cn","%ce","%B\'',
-        headCommitSha,
-      ],
-      null,
-      null,
-      null,
-      false
-    ).split('","')
+    ] = headInfo.split('","')
 
     if (gitHeadCommitSha) {
       tags[GIT_COMMIT_HEAD_AUTHOR_DATE] = headAuthorDate
@@ -539,7 +553,7 @@ function getGitMetadata (ciMetadata) {
 
   const entries = [
     GIT_REPOSITORY_URL,
-    filterSensitiveInfoFromRepository(repositoryUrl || sanitizedExec('git', ['ls-remote', '--get-url'])),
+    filterSensitiveInfoFromRepository(repositoryUrl || sanitizedExec(['ls-remote', '--get-url'])),
     GIT_COMMIT_AUTHOR_DATE, authorDate,
     GIT_COMMIT_AUTHOR_NAME, ciAuthorName || authorName,
     GIT_COMMIT_AUTHOR_EMAIL, ciAuthorEmail || authorEmail,
@@ -563,7 +577,6 @@ function getGitInformationDiscrepancy () {
   const gitRepositoryUrl = getRepositoryUrl()
 
   const gitCommitSHA = sanitizedExec(
-    'git',
     ['rev-parse', 'HEAD'],
     { name: TELEMETRY_GIT_COMMAND, tags: { command: 'get_commit_sha' } },
     { name: TELEMETRY_GIT_COMMAND_MS, tags: { command: 'get_commit_sha' } },
@@ -573,24 +586,51 @@ function getGitInformationDiscrepancy () {
   return { gitRepositoryUrl, gitCommitSHA }
 }
 
-function fetchHeadCommitSha (headSha) {
-  const remoteName = getGitRemoteName()
+/** @param {string} sha */
+function hasLocalGitObject (sha) {
+  return legacyStorage.run({ noop: true }, () => {
+    try {
+      execFileSync('git', ['cat-file', '-e', sha], {
+        stdio: 'pipe',
+        // Older Git versions ignore GIT_NO_LAZY_FETCH, so also disallow transports for this local-only probe.
+        env: { ...getEnvironmentVariables(), GIT_NO_LAZY_FETCH: '1', GIT_ALLOW_PROTOCOL: '' },
+      })
+      return true
+    } catch {
+      return false
+    }
+  })
+}
 
-  sanitizedExec(
-    'git',
-    [
-      'fetch',
-      '--update-shallow',
-      '--filter=blob:none',
-      '--recurse-submodules=no',
-      '--no-write-fetch-head',
-      remoteName,
-      headSha,
-    ],
-    { name: TELEMETRY_GIT_COMMAND, tags: { command: 'fetch_head_commit_sha' } },
-    { name: TELEMETRY_GIT_COMMAND_MS, tags: { command: 'fetch_head_commit_sha' } },
-    { name: TELEMETRY_GIT_COMMAND_ERRORS, tags: { command: 'fetch_head_commit_sha' } }
-  )
+function fetchHeadCommitSha (headSha, useDepth = true) {
+  const remoteName = getGitRemoteName()
+  // Existing heads retain the original repair/history behavior; a failed bounded fetch also retries that path.
+  const depths = useDepth && !hasLocalGitObject(headSha) ? [true, false] : [false]
+  for (const shallow of depths) {
+    try {
+      sanitizedExec(
+        [
+          'fetch',
+          ...(shallow ? ['--depth=1'] : []),
+          '--update-shallow',
+          '--filter=blob:none',
+          '--recurse-submodules=no',
+          '--no-write-fetch-head',
+          remoteName,
+          headSha,
+        ],
+        { name: TELEMETRY_GIT_COMMAND, tags: { command: 'fetch_head_commit_sha' } },
+        { name: TELEMETRY_GIT_COMMAND_MS, tags: { command: 'fetch_head_commit_sha' } },
+        { name: TELEMETRY_GIT_COMMAND_ERRORS, tags: { command: 'fetch_head_commit_sha' } },
+        true,
+        { uncached: true, throwOnError: true, timeout: 5000 }
+      )
+      return shallow
+    } catch {
+      // sanitizedExec records the failure; retry without a depth limit if the bounded fetch failed.
+    }
+  }
+  return false
 }
 
 module.exports = {

package/packages/dd-trace/src/plugins/util/inferred_proxy.js

@@ -51,11 +51,7 @@ const supportedProxies = {
 }
 
 function createInferredProxySpan (headers, childOf, tracer, reqCtx, traceCtx, config, startSpanHelper) {
-  if (!headers) {
-    return null
-  }
-
-  if (!tracer._config?.inferredProxyServicesEnabled) {
+  if (!headers || !tracer._config?.inferredProxyServicesEnabled) {
     return null
   }
 

package/packages/dd-trace/src/plugins/util/stacktrace.js

@@ -12,8 +12,9 @@ const NODE_MODULES_PATTERN_START = `node_modules${sep}`
  * current file path ends with the expected path structure from the repo root.
  * This is needed for local and CI where dd-trace-js is not in node_modules.
  * In production, these frames are already filtered by isNodeModulesFrame.
+ * Bundled into ESM output, `__filename` is not defined, and dd-trace is not running from its repo.
  */
-const SHOULD_FILTER_DD_TRACE_INSTRUMENTAION = __filename.endsWith(
+const SHOULD_FILTER_DD_TRACE_INSTRUMENTAION = typeof __filename === 'string' && __filename.endsWith(
   join('packages', 'dd-trace', 'src', 'plugins', 'util', 'stacktrace.js')
 )