dd-trace 5.133.0 → 5.134.0

package/packages/dd-trace/src/llmobs/span_processor.js

@@ -16,6 +16,8 @@ const {
   METADATA,
   COST_TAGS,
   AGENT_MANIFEST,
+  AGENT_VERSION,
+  AGENT_VERSION_TAG_KEY,
   TOOL_DEFINITIONS,
   EXPERIMENT_INPUT,
   EXPERIMENT_OUTPUT,
@@ -32,6 +34,7 @@ const {
   PARENT_ID_KEY,
   PARENT_AGENT_NAME,
   PARENT_AGENT_SPAN_ID,
+  PARENT_AGENT_VERSION,
   SESSION_ID,
   NAME,
   INPUT_PROMPT,
@@ -406,6 +409,15 @@ class LLMObsSpanProcessor {
     const existingTags = LLMObsTagger.tagMap.get(span)?.[TAGS] || {}
     if (existingTags) tags = { ...tags, ...existingTags }
 
+    const mlObsTags = LLMObsTagger.tagMap.get(span)
+    // Resolved here because a span can become an agent after registration. An agent without its own version, and
+    // any other span, reports the version inherited at registration. Either wins over a user
+    // tag of the same name.
+    const agentVersion = mlObsTags?.[SPAN_KIND] === 'agent'
+      ? mlObsTags[AGENT_VERSION] || mlObsTags[PARENT_AGENT_VERSION]
+      : mlObsTags?.[PARENT_AGENT_VERSION]
+    if (agentVersion) tags[AGENT_VERSION_TAG_KEY] = agentVersion
+
     return tags
   }
 

package/packages/dd-trace/src/llmobs/tagger.js

@@ -19,6 +19,7 @@ const {
   METADATA,
   COST_TAGS,
   AGENT_MANIFEST,
+  AGENT_VERSION,
   METRICS,
   TOOL_DEFINITIONS,
   PARENT_ID_KEY,
@@ -28,6 +29,7 @@ const {
   NAME,
   PARENT_AGENT_NAME,
   PARENT_AGENT_SPAN_ID,
+  PARENT_AGENT_VERSION,
   PROPAGATED_PARENT_ID_KEY,
   PROPAGATED_PARENT_AGENT_ID_KEY,
   PROPAGATED_PARENT_AGENT_NAME_KEY,
@@ -116,6 +118,7 @@ class LLMObsTagger {
     kind,
     name,
     integration,
+    agentVersion,
     _decorator,
   } = {}) {
     // Do not register it in the map if it does not have an LLMObs span kind.
@@ -193,6 +196,8 @@ class LLMObsTagger {
       storage.getStore()?.agentDeclarations
     )
     if (agentDeclarations) this.#applyAgentDeclarations(span, agentDeclarations)
+    // The span's own version wins over the enclosing contexts.
+    if (agentVersion) this._setTag(span, AGENT_VERSION, agentVersion)
 
     // apply annotation context name
     const annotationContextName = annotationContext?.name
@@ -213,15 +218,16 @@ class LLMObsTagger {
 
   /**
    * Applies the agents declared by the enclosing annotation contexts, outermost first, to every span in the block.
-   * The manifest is emitted only if the span is an agent when it finishes, since some integrations promote a span
-   * to an agent after registration.
+   * Both are emitted only if the span is an agent when it finishes, since some integrations promote a span to an
+   * agent after registration.
    *
    * @param {import('../opentracing/span')} span
    * @param {import('./agent-manifest').AgentDeclaration[]} declarations
    */
   #applyAgentDeclarations (span, declarations) {
     for (const declaration of declarations) {
-      this.#tagAgentManifestFields(span, declaration.manifest)
+      if (declaration.version) this._setTag(span, AGENT_VERSION, declaration.version)
+      if (declaration.manifest) this.#tagAgentManifestFields(span, declaration.manifest)
     }
   }
 
@@ -233,7 +239,9 @@ class LLMObsTagger {
    */
   tagAgent (span, agent) {
     const declaration = buildAgentDeclaration(agent)
-    if (declaration) this.#tagAgentManifestFields(span, declaration.manifest)
+    if (!declaration) return
+    if (declaration.version) this._setTag(span, AGENT_VERSION, declaration.version)
+    if (declaration.manifest) this.#tagAgentManifestFields(span, declaration.manifest)
   }
 
   /**
@@ -276,8 +284,9 @@ class LLMObsTagger {
 
   /**
    * Store the nearest agent ancestor on the span so it can be surfaced as
-   * `meta.agent_attribution` at finish. Resolved once here, at registration, so downstream
-   * children inherit it with a single lookup rather than walking the ancestor chain.
+   * `meta.agent_attribution` at finish, along with that agent's version, which the agent panel reads
+   * off each span to attribute its spend. Resolved once here, at registration, so downstream children
+   * inherit it with a single lookup rather than walking the ancestor chain.
    *
    * @param {import('../opentracing/span')} span
    * @param {import('../opentracing/span')} [parent] the LLMObs parent span, if any
@@ -285,10 +294,10 @@ class LLMObsTagger {
   // TODO: spans whose kind changes after registration (e.g. claude-agent-sdk tools promoted to
   // sub-agents) will not retroactively update already-finished children's attribution. Follow up.
   #tagAgentAttribution (span, parent) {
-    let name, spanId
+    let name, spanId, version
     if (registry.has(parent)) {
       // Local LLMObs parent: attribute to it if it is an agent, else inherit its resolution.
-      ({ name, spanId } = resolveAgentAttribution(registry.get(parent), parent))
+      ({ name, spanId, version } = resolveAgentAttribution(registry.get(parent), parent))
     } else if (span.context()._trace.tags[PROPAGATED_PARENT_ID_KEY]) {
       // Distributed LLMObs parent: inherit the nearest agent propagated from upstream. The
       // name may be absent when the upstream hop ran an older SDK or its name was not
@@ -300,6 +309,7 @@ class LLMObsTagger {
 
     if (name != null) this._setTag(span, PARENT_AGENT_NAME, name)
     if (spanId != null) this._setTag(span, PARENT_AGENT_SPAN_ID, spanId)
+    if (version) this._setTag(span, PARENT_AGENT_VERSION, version)
   }
 
   // TODO: similarly for the following `tag` methods,

package/packages/dd-trace/src/llmobs/util.js

@@ -8,8 +8,10 @@ const {
   SPAN_KINDS,
   SPAN_KIND,
   NAME,
+  AGENT_VERSION,
   PARENT_AGENT_NAME,
   PARENT_AGENT_SPAN_ID,
+  PARENT_AGENT_VERSION,
 } = require('./constants/tags')
 
 const DECIMAL_TRACE_ID_REGEX = /^\d+$/
@@ -325,14 +327,18 @@ function agentNameWireSafe (name) {
  *
  * @param {Record<string, unknown> | undefined} tags - Registry entry for the parent span.
  * @param {import('../opentracing/span')} [span] - The parent span itself (needed for span id / name).
- * @returns {{ name: string | undefined, spanId: string | undefined }}
+ * @returns {{ name: string | undefined, spanId: string | undefined, version: string | undefined }}
  */
 function resolveAgentAttribution (tags, span) {
-  if (!tags) return { name: undefined, spanId: undefined }
+  if (!tags) return { name: undefined, spanId: undefined, version: undefined }
   if (tags[SPAN_KIND] === 'agent') {
-    return { name: tags[NAME] || span._name, spanId: span.context().toSpanId() }
+    return {
+      name: tags[NAME] || span._name,
+      spanId: span.context().toSpanId(),
+      version: tags[AGENT_VERSION] || tags[PARENT_AGENT_VERSION],
+    }
   }
-  return { name: tags[PARENT_AGENT_NAME], spanId: tags[PARENT_AGENT_SPAN_ID] }
+  return { name: tags[PARENT_AGENT_NAME], spanId: tags[PARENT_AGENT_SPAN_ID], version: tags[PARENT_AGENT_VERSION] }
 }
 
 function spanHasError (span) {

package/packages/dd-trace/src/openfeature/index.js

@@ -33,6 +33,12 @@ function _handleFlush () {
  * @param {import('../config')} config - Tracer configuration object
  */
 function enable (config) {
+  if (config.featureFlags?.DD_FEATURE_FLAGS_EXPOSURES_DATADOG_LOGGING_ENABLED === false) {
+    log.debug('Feature Flags: Datadog exposure logging disabled; set %s=true to enable',
+      'DD_FEATURE_FLAGS_EXPOSURES_DATADOG_LOGGING_ENABLED')
+    return
+  }
+
   if (exposuresWriter) {
     log.warn('%s already enabled', exposuresWriter.constructor.name)
     return

package/packages/dd-trace/src/openfeature/writers/util.js

@@ -31,14 +31,14 @@ const deliveryStrategies = new WeakMap()
 let missingRouteWarningLogged = false
 
 /**
- * Logs the unavailable exposure-delivery warning once.
+ * Logs the unavailable event-delivery warning once.
  *
  */
-function warnExposureDeliveryUnavailable () {
+function warnEventDeliveryUnavailable () {
   if (missingRouteWarningLogged) return
   missingRouteWarningLogged = true
   logger.warn(
-    'Feature Flags exposure delivery is disabled because no compatible local EVP route or direct intake ' +
+    'Feature Flags event delivery is disabled because no compatible local EVP route or direct intake ' +
     'credentials are available.'
   )
 }
@@ -169,7 +169,7 @@ function setAgentlessStrategy (config, setWriterEnabledValue) {
       if (error) {
         logger.debug('FFE Writer disabled - error getting local receiver info: %s', error.message)
       }
-      warnExposureDeliveryUnavailable()
+      warnEventDeliveryUnavailable()
       markUnavailable()
     })
   }

package/packages/dd-trace/src/opentelemetry/trace/otlp_transformer.js

@@ -95,6 +95,11 @@ const DD_ERROR_META_KEYS = new Set(['error.message'])
 class OtlpTraceTransformer extends OtlpTransformerBase {
   #otelTraceSemanticsEnabled
 
+  // Span meta entries with the same key and value as a resource attribute are already carried by
+  // the resource (e.g. DD_TAGS), so they are not repeated as span attributes.
+  /** @type {import('@opentelemetry/api').Attributes} */
+  #resourceAttributes
+
   /**
    * Creates a new OtlpTraceTransformer instance.
    *
@@ -104,6 +109,16 @@ class OtlpTraceTransformer extends OtlpTransformerBase {
   constructor (resourceAttributes, otelTraceSemanticsEnabled) {
     super(resourceAttributes, 'http/json', 'traces')
     this.#otelTraceSemanticsEnabled = otelTraceSemanticsEnabled
+    this.#resourceAttributes = resourceAttributes
+  }
+
+  /**
+   * @override
+   * @param {import('@opentelemetry/api').Attributes} resourceAttributes - Resource attributes
+   */
+  updateResourceAttributes (resourceAttributes) {
+    super.updateResourceAttributes(resourceAttributes)
+    this.#resourceAttributes = resourceAttributes
   }
 
   /**
@@ -216,11 +231,13 @@ class OtlpTraceTransformer extends OtlpTransformerBase {
       }
     }
 
-    // Add meta string tags, skipping keys that map to dedicated OTLP fields
+    // Add meta string tags, skipping keys that map to dedicated OTLP fields and tags the
+    // resource already carries with the same value (e.g. global tags from DD_TAGS)
     if (span.meta) {
       for (const [key, value] of Object.entries(span.meta)) {
         if (EXCLUDED_META_KEYS.has(key)) continue
         if (this.#otelTraceSemanticsEnabled && DD_ERROR_META_KEYS.has(key)) continue
+        if (this.#resourceAttributes[key] === value) continue
         attributes.push({ key, value: { stringValue: value } })
       }
     }

package/packages/dd-trace/src/plugin_manager.js

@@ -102,8 +102,7 @@ module.exports = class PluginManager {
   loadPlugin (name) {
     const Plugin = pluginClasses[name]
 
-    if (!Plugin) return
-    if (!this._tracerConfig) return // TODO: don't wait for tracer to be initialized
+    if (!Plugin || !this._tracerConfig) return // TODO: don't wait for tracer to be initialized
 
     // Check if this is a Test Optimization plugin and Test Optimization is not enabled
     if (TEST_OPTIMIZATION_PLUGINS.has(name) && !this._tracerConfig.isCiVisibility) {

package/packages/dd-trace/src/plugins/tracing.js

@@ -267,7 +267,6 @@ class TracingPlugin extends Plugin {
     analyticsSampler.sample(span, config.measured)
 
     // TODO: Remove this after migration to TracingChannel is done.
-    // eslint-disable-next-line unicorn/no-unnecessary-boolean-comparison -- Context objects use the other branch.
     if (enterOrCtx === true) {
       legacyStorage.enterWith({ ...store, span })
     } else if (enterOrCtx) {

package/packages/dd-trace/src/plugins/util/git.js

@@ -3,8 +3,10 @@
 const os = require('os')
 const path = require('path')
 const fs = require('fs')
+const { execFileSync } = require('node:child_process')
 
 const log = require('../../log')
+const { getEnvironmentVariables } = require('../../config/helper')
 const {
   incrementCountMetric,
   distributionMetric,
@@ -49,7 +51,8 @@ function sanitizedExec (
   operationMetric,
   durationMetric,
   errorMetric,
-  shouldTrim = true
+  shouldTrim = true,
+  executionOptions
 ) {
   return legacyStorage.run({ noop: true }, () => {
     let startTime
@@ -60,7 +63,14 @@ function sanitizedExec (
       startTime = Date.now()
     }
     try {
-      let result = cachedExec('git', flags, { stdio: 'pipe' }).toString()
+      const exec = executionOptions?.uncached ? execFileSync : cachedExec
+      /** @type {import('node:child_process').ExecFileSyncOptions} */
+      const options = { stdio: 'pipe' }
+      if (executionOptions?.timeout) options.timeout = executionOptions.timeout
+      if (executionOptions?.localOnly) {
+        options.env = { ...getEnvironmentVariables(), GIT_NO_LAZY_FETCH: '1', GIT_ALLOW_PROTOCOL: '' }
+      }
+      let result = exec('git', flags, options).toString()
 
       if (shouldTrim) {
         result = result.replaceAll(/(\r\n|\n|\r)/g, '')
@@ -79,6 +89,7 @@ function sanitizedExec (
         })
       }
       log.error('Git plugin error executing command', err)
+      if (executionOptions?.throwOnError) throw err
       return ''
     }
   })
@@ -103,12 +114,14 @@ function isGitAvailable () {
   }
 }
 
-function isShallowRepository () {
+function isShallowRepository (uncached = false) {
   return sanitizedExec(
     ['rev-parse', '--is-shallow-repository'],
     { name: TELEMETRY_GIT_COMMAND, tags: { command: 'check_shallow' } },
     { name: TELEMETRY_GIT_COMMAND_MS, tags: { command: 'check_shallow' } },
-    { name: TELEMETRY_GIT_COMMAND_ERRORS, tags: { command: 'check_shallow' } }
+    { name: TELEMETRY_GIT_COMMAND_ERRORS, tags: { command: 'check_shallow' } },
+    true,
+    { uncached }
   ) === 'true'
 }
 
@@ -223,6 +236,13 @@ function getLatestCommits () {
 }
 
 function getGitDiff (baseCommit, targetCommit) {
+  // Fetch the required snapshots explicitly; a depth-1 metadata fetch does not provide their ancestry.
+  for (const commit of targetCommit ? [baseCommit, targetCommit] : [baseCommit]) {
+    if (!hasLocalGitObject(commit)) {
+      // Use the current checkout state so a stale cache cannot shorten a complete clone.
+      fetchHeadCommitSha(commit, isShallowRepository(true))
+    }
+  }
   const flags = ['diff', '-U0', '--word-diff=porcelain', baseCommit]
   if (targetCommit) {
     flags.push(targetCommit)
@@ -232,7 +252,8 @@ function getGitDiff (baseCommit, targetCommit) {
     { name: TELEMETRY_GIT_COMMAND, tags: { command: 'diff' } },
     { name: TELEMETRY_GIT_COMMAND_MS, tags: { command: 'diff' } },
     { name: TELEMETRY_GIT_COMMAND_ERRORS, tags: { command: 'diff' } },
-    false // important not to trim or we'll lose the line breaks which we need to detect impacted tests
+    false, // important not to trim or we'll lose the line breaks which we need to detect impacted tests
+    { uncached: true }
   )
 }
 
@@ -464,6 +485,7 @@ function getGitMetadata (ciMetadata) {
     authorEmail: ciAuthorEmail,
     ciWorkspacePath,
     headCommitSha,
+    pullRequestBaseBranchSha,
   } = ciMetadata
 
   // With stdio: 'pipe', errors in this command will not be output to the parent process,
@@ -486,8 +508,25 @@ function getGitMetadata (ciMetadata) {
   }
 
   if (headCommitSha) {
-    if (isShallowRepository()) {
-      fetchHeadCommitSha(headCommitSha)
+    const shallow = isShallowRepository(true)
+    const fetchedAtDepthOne = shallow && fetchHeadCommitSha(headCommitSha)
+    const headFlags = [
+      'show',
+      '-s',
+      '--format=\'%H","%aI","%an","%ae","%cI","%cn","%ce","%B\'',
+      headCommitSha,
+    ]
+    // Only explicit, bounded fetches may contact the remote during head metadata recovery.
+    const headOptions = { uncached: true, localOnly: true }
+    let headInfo = sanitizedExec(headFlags, null, null, null, false, headOptions)
+    if (!headInfo && (fetchedAtDepthOne || !shallow)) {
+      fetchHeadCommitSha(headCommitSha, false)
+      headInfo = sanitizedExec(headFlags, null, null, null, false, headOptions)
+    }
+
+    // Prepare a known diff base while the remote is available, including when Git upload is disabled.
+    if (shallow && pullRequestBaseBranchSha && !hasLocalGitObject(pullRequestBaseBranchSha)) {
+      fetchHeadCommitSha(pullRequestBaseBranchSha)
     }
 
     const [
@@ -499,18 +538,7 @@ function getGitMetadata (ciMetadata) {
       headCommitterName,
       headCommitterEmail,
       headCommitMessage,
-    ] = sanitizedExec(
-      [
-        'show',
-        '-s',
-        '--format=\'%H","%aI","%an","%ae","%cI","%cn","%ce","%B\'',
-        headCommitSha,
-      ],
-      null,
-      null,
-      null,
-      false
-    ).split('","')
+    ] = headInfo.split('","')
 
     if (gitHeadCommitSha) {
       tags[GIT_COMMIT_HEAD_AUTHOR_DATE] = headAuthorDate
@@ -558,23 +586,51 @@ function getGitInformationDiscrepancy () {
   return { gitRepositoryUrl, gitCommitSHA }
 }
 
-function fetchHeadCommitSha (headSha) {
-  const remoteName = getGitRemoteName()
+/** @param {string} sha */
+function hasLocalGitObject (sha) {
+  return legacyStorage.run({ noop: true }, () => {
+    try {
+      execFileSync('git', ['cat-file', '-e', sha], {
+        stdio: 'pipe',
+        // Older Git versions ignore GIT_NO_LAZY_FETCH, so also disallow transports for this local-only probe.
+        env: { ...getEnvironmentVariables(), GIT_NO_LAZY_FETCH: '1', GIT_ALLOW_PROTOCOL: '' },
+      })
+      return true
+    } catch {
+      return false
+    }
+  })
+}
 
-  sanitizedExec(
-    [
-      'fetch',
-      '--update-shallow',
-      '--filter=blob:none',
-      '--recurse-submodules=no',
-      '--no-write-fetch-head',
-      remoteName,
-      headSha,
-    ],
-    { name: TELEMETRY_GIT_COMMAND, tags: { command: 'fetch_head_commit_sha' } },
-    { name: TELEMETRY_GIT_COMMAND_MS, tags: { command: 'fetch_head_commit_sha' } },
-    { name: TELEMETRY_GIT_COMMAND_ERRORS, tags: { command: 'fetch_head_commit_sha' } }
-  )
+function fetchHeadCommitSha (headSha, useDepth = true) {
+  const remoteName = getGitRemoteName()
+  // Existing heads retain the original repair/history behavior; a failed bounded fetch also retries that path.
+  const depths = useDepth && !hasLocalGitObject(headSha) ? [true, false] : [false]
+  for (const shallow of depths) {
+    try {
+      sanitizedExec(
+        [
+          'fetch',
+          ...(shallow ? ['--depth=1'] : []),
+          '--update-shallow',
+          '--filter=blob:none',
+          '--recurse-submodules=no',
+          '--no-write-fetch-head',
+          remoteName,
+          headSha,
+        ],
+        { name: TELEMETRY_GIT_COMMAND, tags: { command: 'fetch_head_commit_sha' } },
+        { name: TELEMETRY_GIT_COMMAND_MS, tags: { command: 'fetch_head_commit_sha' } },
+        { name: TELEMETRY_GIT_COMMAND_ERRORS, tags: { command: 'fetch_head_commit_sha' } },
+        true,
+        { uncached: true, throwOnError: true, timeout: 5000 }
+      )
+      return shallow
+    } catch {
+      // sanitizedExec records the failure; retry without a depth limit if the bounded fetch failed.
+    }
+  }
+  return false
 }
 
 module.exports = {

package/packages/dd-trace/src/plugins/util/stacktrace.js

@@ -12,8 +12,9 @@ const NODE_MODULES_PATTERN_START = `node_modules${sep}`
  * current file path ends with the expected path structure from the repo root.
  * This is needed for local and CI where dd-trace-js is not in node_modules.
  * In production, these frames are already filtered by isNodeModulesFrame.
+ * Bundled into ESM output, `__filename` is not defined, and dd-trace is not running from its repo.
  */
-const SHOULD_FILTER_DD_TRACE_INSTRUMENTAION = __filename.endsWith(
+const SHOULD_FILTER_DD_TRACE_INSTRUMENTAION = typeof __filename === 'string' && __filename.endsWith(
   join('packages', 'dd-trace', 'src', 'plugins', 'util', 'stacktrace.js')
 )
 

package/packages/dd-trace/src/plugins/util/test.js

@@ -799,6 +799,8 @@ function getTestEnvironmentMetadata (testFramework, config, shouldSkipGitMetadat
       commitMessage,
       ciWorkspacePath,
       headCommitSha,
+      pullRequestBaseBranchSha: userProvidedGitMetadata[GIT_PULL_REQUEST_BASE_BRANCH_SHA] ||
+        ciMetadata[GIT_PULL_REQUEST_BASE_BRANCH_SHA],
     })
   }
 

package/packages/dd-trace/src/plugins/util/web.js

@@ -321,20 +321,16 @@ const web = {
     const writeHead = res.writeHead
 
     return function (statusCode, statusMessage, headers) {
-      // CORS preflight tagging only matters for OPTIONS requests. Skip the
-      // getHeaders() spread + isOriginAllowed work entirely for the common
-      // GET / POST / etc. case. Node's http module passes `req.method`
-      // through unchanged, so all standard methods are uppercase; the
-      // `toLowerCase` fallback covers any non-standard caller.
       if (req.method === 'OPTIONS' || req.method.toLowerCase() === 'options') {
-        headers = typeof statusMessage === 'string' ? headers : statusMessage
-        headers = { ...res.getHeaders(), ...headers }
-
-        if (isOriginAllowed(req, headers)) {
-          addAllowHeaders(req, res, headers)
+        const headerIndex = typeof statusMessage === 'string' || headers != null ? 2 : 1
+        const updatedHeaders = addAllowHeaders(req, res, arguments[headerIndex])
+        if (updatedHeaders) {
+          arguments[headerIndex] = updatedHeaders
+          const result = writeHead.apply(this, arguments)
+          if (context.config.headers.length > 0) context.responseHeaders = updatedHeaders
+          return result
         }
       }
-
       return writeHead.apply(this, arguments)
     }
   },
@@ -362,8 +358,28 @@ function normalizeHeadersCarrier (headers) {
   return carrier
 }
 
+/**
+ * @param {import('node:http').IncomingMessage} req
+ * @param {import('node:http').ServerResponse | import('node:http2').Http2ServerResponse} res
+ * @param {ResponseHeaders} headers
+ */
 function addAllowHeaders (req, res, headers) {
-  const allowHeaders = splitHeader(headers['access-control-allow-headers'])
+  if (!req.headers.origin || !req.headers['access-control-request-headers'] ||
+      res.headersSent || res.stream?.destroyed || res.stream?.closed) return
+
+  const originKey = findHeader(headers, 'access-control-allow-origin')
+  const allowOrigin = originKey === undefined
+    ? res.getHeader('access-control-allow-origin')
+    : getHeaderValue(headers, originKey)
+  if (allowOrigin !== '*' && allowOrigin !== req.headers.origin) return
+
+  const allowKey = findHeader(headers, 'access-control-allow-headers')
+  const existing = allowKey === undefined
+    ? res.getHeader('access-control-allow-headers')
+    : getHeaderValue(headers, allowKey)
+  if (allowKey !== undefined && existing == null) return
+
+  const allowHeaders = splitHeader(existing)
   const requestHeaders = splitHeader(req.headers['access-control-request-headers'])
   const contextHeaders = [
     'baggage',
@@ -384,19 +400,69 @@ function addAllowHeaders (req, res, headers) {
   }
 
   if (allowHeaders.length > 0) {
-    res.setHeader('access-control-allow-headers', uniq(allowHeaders).join(','))
+    const value = uniq(allowHeaders).join(',')
+    if (headers) return setAllowHeaders(headers, allowKey, value)
+    res.setHeader('access-control-allow-headers', value)
+  }
+}
+
+/** @typedef {import('node:http').OutgoingHttpHeader} HeaderValue */
+/** @typedef {import('node:http').OutgoingHttpHeaders | Array<HeaderValue | [string, HeaderValue]>} ResponseHeaders */
+
+/**
+ * @param {ResponseHeaders} headers
+ * @param {string} name
+ */
+function findHeader (headers, name) {
+  if (!headers) return
+  if (Array.isArray(headers)) {
+    const tuples = Array.isArray(headers[0])
+    for (let i = headers.length - (tuples ? 1 : 2); i >= 0; i -= tuples ? 1 : 2) {
+      const key = tuples ? headers[i][0] : headers[i]
+      if (typeof key === 'string' && key.toLowerCase() === name) return tuples ? i : i + 1
+    }
+  } else {
+    const keys = Object.keys(headers)
+    for (let i = keys.length - 1; i >= 0; i--) {
+      if (keys[i].toLowerCase() === name) return keys[i]
+    }
   }
 }
 
-function isOriginAllowed (req, headers) {
-  const origin = req.headers.origin
-  const allowOrigin = headers['access-control-allow-origin']
+/**
+ * @param {ResponseHeaders} headers
+ * @param {string | number} key
+ */
+function getHeaderValue (headers, key) {
+  return Array.isArray(headers) && Array.isArray(headers[0]) ? headers[key][1] : headers[key]
+}
 
-  return origin && (allowOrigin === '*' || allowOrigin === origin)
+/**
+ * @param {ResponseHeaders} headers
+ * @param {string | number | undefined} key
+ * @param {string} value
+ */
+function setAllowHeaders (headers, key, value) {
+  if (Array.isArray(headers)) {
+    const result = []
+    const tuples = Array.isArray(headers[0])
+    // Native writeHead ignores custom array iterators.
+    for (let i = 0; i < headers.length; i++) result.push(headers[i])
+    if (key !== undefined) {
+      result[key] = tuples ? [headers[key][0], value] : value
+    } else if (tuples) {
+      result.push(['access-control-allow-headers', value])
+    } else {
+      result.push('access-control-allow-headers', value)
+    }
+    return result
+  }
+  return { ...headers, [key ?? 'access-control-allow-headers']: value }
 }
 
 function splitHeader (str) {
-  return typeof str === 'string' ? str.split(',').map((header) => header.trim()) : []
+  if (Array.isArray(str)) str = str.join(',')
+  return str === undefined ? [] : String(str).split(',').map((header) => header.trim())
 }
 
 function addRequestTags (context, spanType) {
@@ -527,10 +593,14 @@ function addRequestHeaders (context) {
 }
 
 function addResponseHeaders (context) {
-  const { res, config, span, inferredProxySpan } = context
+  const { res, config, span, inferredProxySpan, responseHeaders } = context
 
   for (const [key, tag] of config.headers) {
-    const resHeader = res.getHeader(key)
+    let resHeader = res.getHeader(key)
+    if (resHeader === undefined && responseHeaders) {
+      const headerKey = findHeader(responseHeaders, key)
+      if (headerKey !== undefined) resHeader = getHeaderValue(responseHeaders, headerKey)
+    }
     if (resHeader) {
       const tagName = tag || `${HTTP_RESPONSE_HEADERS}.${key}`
       span.setTag(tagName, resHeader)

package/packages/dd-trace/src/span_stats.js

@@ -208,6 +208,7 @@ class SpanStatsProcessor {
       env,
       tags,
       version: appVersion,
+      reportHostname,
       _DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL: flushIntervalMs,
     } = config
     if (!otlpExporter) {
@@ -217,7 +218,9 @@ class SpanStatsProcessor {
     this.interval = intervalMs / 1e3
     this.bucketSizeNs = intervalMs * 1e6
     this.buckets = new TimeBuckets(Boolean(otlpExporter))
-    this.hostname = os.hostname()
+    // A non-empty client hostname takes precedence over the agent's own hostname for the resulting
+    // metrics, so only send it when explicitly requested.
+    this.hostname = reportHostname ? os.hostname() : ''
     this.enabled = enabled
     this.otlpExporter = otlpExporter || null
     this.env = env