dd-trace 5.17.0 → 5.18.0

package/packages/dd-trace/src/appsec/telemetry.js

@@ -31,7 +31,10 @@ function newStore () {
   return {
     [DD_TELEMETRY_REQUEST_METRICS]: {
       duration: 0,
-      durationExt: 0
+      durationExt: 0,
+      raspDuration: 0,
+      raspDurationExt: 0,
+      raspEvalCount: 0
     }
   }
 }
@@ -76,6 +79,28 @@ function getOrCreateMetricTags (store, versionsTags) {
   return metricTags
 }
 
+function updateRaspRequestsMetricTags (metrics, req, raspRuleType) {
+  if (!req) return
+
+  const store = getStore(req)
+
+  // it does not depend on whether telemetry is enabled or not
+  addRaspRequestMetrics(store, metrics)
+
+  if (!enabled) return
+
+  const tags = { rule_type: raspRuleType, waf_version: metrics.wafVersion }
+  appsecMetrics.count('appsec.rasp.rule.eval', tags).inc(1)
+
+  if (metrics.wafTimeout) {
+    appsecMetrics.count('appsec.rasp.timeout', tags).inc(1)
+  }
+
+  if (metrics.ruleTriggered) {
+    appsecMetrics.count('appsec.rasp.rule.match', tags).inc(1)
+  }
+}
+
 function updateWafRequestsMetricTags (metrics, req) {
   if (!req) return
 
@@ -141,6 +166,12 @@ function addRequestMetrics (store, { duration, durationExt }) {
   store[DD_TELEMETRY_REQUEST_METRICS].durationExt += durationExt || 0
 }
 
+function addRaspRequestMetrics (store, { duration, durationExt }) {
+  store[DD_TELEMETRY_REQUEST_METRICS].raspDuration += duration || 0
+  store[DD_TELEMETRY_REQUEST_METRICS].raspDurationExt += durationExt || 0
+  store[DD_TELEMETRY_REQUEST_METRICS].raspEvalCount++
+}
+
 function getRequestMetrics (req) {
   if (req) {
     const store = getStore(req)
@@ -153,6 +184,7 @@ module.exports = {
   disable,
 
   updateWafRequestsMetricTags,
+  updateRaspRequestsMetricTags,
   incrementWafInitMetric,
   incrementWafUpdatesMetric,
   incrementWafRequestsMetric,

package/packages/dd-trace/src/appsec/waf/index.js

@@ -46,7 +46,7 @@ function update (newRules) {
   }
 }
 
-function run (data, req) {
+function run (data, req, raspRuleType) {
   if (!req) {
     const store = storage.getStore()
     if (!store || !store.req) {
@@ -59,7 +59,7 @@ function run (data, req) {
 
   const wafContext = waf.wafManager.getWAFContext(req)
 
-  return wafContext.run(data)
+  return wafContext.run(data, raspRuleType)
 }
 
 function disposeContext (req) {

package/packages/dd-trace/src/appsec/waf/waf_context_wrapper.js

@@ -19,7 +19,7 @@ class WAFContextWrapper {
     this.addressesToSkip = new Set()
   }
 
-  run ({ persistent, ephemeral }) {
+  run ({ persistent, ephemeral }, raspRuleType) {
     const payload = {}
     let payloadHasData = false
     const inputs = {}
@@ -72,7 +72,7 @@ class WAFContextWrapper {
         blockTriggered,
         wafVersion: this.wafVersion,
         wafTimeout: result.timeout
-      })
+      }, raspRuleType)
 
       if (ruleTriggered) {
         Reporter.reportAttack(JSON.stringify(result.events))

package/packages/dd-trace/src/ci-visibility/exporters/ci-visibility-exporter.js

@@ -190,7 +190,8 @@ class CiVisibilityExporter extends AgentInfoExporter {
       requireGit,
       isEarlyFlakeDetectionEnabled,
       earlyFlakeDetectionNumRetries,
-      earlyFlakeDetectionFaultyThreshold
+      earlyFlakeDetectionFaultyThreshold,
+      isFlakyTestRetriesEnabled
     } = remoteConfiguration
     return {
       isCodeCoverageEnabled,
@@ -199,7 +200,8 @@ class CiVisibilityExporter extends AgentInfoExporter {
       requireGit,
       isEarlyFlakeDetectionEnabled: isEarlyFlakeDetectionEnabled && this._config.isEarlyFlakeDetectionEnabled,
       earlyFlakeDetectionNumRetries,
-      earlyFlakeDetectionFaultyThreshold
+      earlyFlakeDetectionFaultyThreshold,
+      isFlakyTestRetriesEnabled
     }
   }
 

package/packages/dd-trace/src/ci-visibility/requests/get-library-configuration.js

@@ -93,7 +93,8 @@ function getLibraryConfiguration ({
               tests_skipping: isSuitesSkippingEnabled,
               itr_enabled: isItrEnabled,
               require_git: requireGit,
-              early_flake_detection: earlyFlakeDetectionConfig
+              early_flake_detection: earlyFlakeDetectionConfig,
+              flaky_test_retries_enabled: isFlakyTestRetriesEnabled
             }
           }
         } = JSON.parse(res)
@@ -107,7 +108,8 @@ function getLibraryConfiguration ({
           earlyFlakeDetectionNumRetries:
             earlyFlakeDetectionConfig?.slow_test_retries?.['5s'] || DEFAULT_EARLY_FLAKE_DETECTION_NUM_RETRIES,
           earlyFlakeDetectionFaultyThreshold:
-            earlyFlakeDetectionConfig?.faulty_session_threshold ?? DEFAULT_EARLY_FLAKE_DETECTION_ERROR_THRESHOLD
+            earlyFlakeDetectionConfig?.faulty_session_threshold ?? DEFAULT_EARLY_FLAKE_DETECTION_ERROR_THRESHOLD,
+          isFlakyTestRetriesEnabled
         }
 
         log.debug(() => `Remote settings: ${JSON.stringify(settings)}`)

package/packages/dd-trace/src/config.js

@@ -26,50 +26,104 @@ const telemetryCounters = {
   'otel.env.invalid': {}
 }
 
-function getCounter (event, ddVar, otelVar, otelTracesSamplerArg) {
+function getCounter (event, ddVar, otelVar) {
   const counters = telemetryCounters[event]
   const tags = []
+  const ddVarPrefix = 'config.datadog:'
+  const otelVarPrefix = 'config.opentelemetry:'
+  if (ddVar) {
+    ddVar = ddVarPrefix + ddVar
+    tags.push(ddVar)
+  }
+  if (otelVar) {
+    otelVar = otelVarPrefix + otelVar
+    tags.push(otelVar)
+  }
 
-  if (ddVar) tags.push(ddVar)
-  if (otelVar) tags.push(otelVar)
-  if (otelTracesSamplerArg) tags.push(otelTracesSamplerArg)
-
-  if (!(ddVar in counters)) counters[ddVar] = {}
+  if (!(otelVar in counters)) counters[otelVar] = {}
 
   const counter = tracerMetrics.count(event, tags)
-  counters[ddVar][otelVar] = counter
+  counters[otelVar][ddVar] = counter
   return counter
 }
 
 const otelDdEnvMapping = {
-  DD_TRACE_LOG_LEVEL: 'OTEL_LOG_LEVEL',
-  DD_TRACE_PROPAGATION_STYLE: 'OTEL_PROPAGATORS',
-  DD_SERVICE: 'OTEL_SERVICE_NAME',
-  DD_TRACE_SAMPLE_RATE: 'OTEL_TRACES_SAMPLER',
-  DD_TRACE_ENABLED: 'OTEL_TRACES_EXPORTER',
-  DD_RUNTIME_METRICS_ENABLED: 'OTEL_METRICS_EXPORTER',
-  DD_TAGS: 'OTEL_RESOURCE_ATTRIBUTES',
-  DD_TRACE_OTEL_ENABLED: 'OTEL_SDK_DISABLED'
+  OTEL_LOG_LEVEL: 'DD_TRACE_LOG_LEVEL',
+  OTEL_PROPAGATORS: 'DD_TRACE_PROPAGATION_STYLE',
+  OTEL_SERVICE_NAME: 'DD_SERVICE',
+  OTEL_TRACES_SAMPLER: 'DD_TRACE_SAMPLE_RATE',
+  OTEL_TRACES_SAMPLER_ARG: 'DD_TRACE_SAMPLE_RATE',
+  OTEL_TRACES_EXPORTER: 'DD_TRACE_ENABLED',
+  OTEL_METRICS_EXPORTER: 'DD_RUNTIME_METRICS_ENABLED',
+  OTEL_RESOURCE_ATTRIBUTES: 'DD_TAGS',
+  OTEL_SDK_DISABLED: 'DD_TRACE_OTEL_ENABLED',
+  OTEL_LOGS_EXPORTER: undefined
 }
 
-const otelInvalidEnv = ['OTEL_LOGS_EXPORTER']
+const VALID_PROPAGATION_STYLES = new Set(['datadog', 'tracecontext', 'b3', 'b3 single header', 'none'])
 
-function checkIfBothOtelAndDdEnvVarSet () {
-  for (const [ddVar, otelVar] of Object.entries(otelDdEnvMapping)) {
-    if (process.env[ddVar] && process.env[otelVar]) {
-      log.warn(`both ${ddVar} and ${otelVar} environment variables are set`)
-      getCounter('otel.env.hiding', ddVar, otelVar,
-        otelVar === 'OTEL_TRACES_SAMPLER' &&
-        process.env.OTEL_TRACES_SAMPLER_ARG
-          ? 'OTEL_TRACES_SAMPLER_ARG'
-          : undefined).inc()
+const VALID_LOG_LEVELS = new Set(['debug', 'info', 'warn', 'error'])
+
+function getFromOtelSamplerMap (otelTracesSampler, otelTracesSamplerArg) {
+  const OTEL_TRACES_SAMPLER_MAPPING = {
+    always_on: '1.0',
+    always_off: '0.0',
+    traceidratio: otelTracesSamplerArg,
+    parentbased_always_on: '1.0',
+    parentbased_always_off: '0.0',
+    parentbased_traceidratio: otelTracesSamplerArg
+  }
+  return OTEL_TRACES_SAMPLER_MAPPING[otelTracesSampler]
+}
+
+function validateOtelPropagators (propagators) {
+  if (!process.env.PROPAGATION_STYLE_EXTRACT &&
+    !process.env.PROPAGATION_STYLE_INJECT &&
+    !process.env.DD_TRACE_PROPAGATION_STYLE &&
+    process.env.OTEL_PROPAGATORS) {
+    for (const style in propagators) {
+      if (!VALID_PROPAGATION_STYLES.has(style)) {
+        log.warn('unexpected value for OTEL_PROPAGATORS environment variable')
+        getCounter('otel.env.invalid', 'DD_TRACE_PROPAGATION_STYLE', 'OTEL_PROPAGATORS').inc()
+      }
     }
   }
+}
 
-  for (const otelVar of otelInvalidEnv) {
-    if (process.env[otelVar]) {
-      log.warn(`${otelVar} is not supported by the Datadog SDK`)
-      getCounter('otel.env.invalid', otelVar).inc()
+function validateEnvVarType (envVar) {
+  const value = process.env[envVar]
+  switch (envVar) {
+    case 'OTEL_LOG_LEVEL':
+      return VALID_LOG_LEVELS.has(value)
+    case 'OTEL_PROPAGATORS':
+    case 'OTEL_RESOURCE_ATTRIBUTES':
+    case 'OTEL_SERVICE_NAME':
+      return typeof value === 'string'
+    case 'OTEL_TRACES_SAMPLER':
+      return getFromOtelSamplerMap(value, process.env.OTEL_TRACES_SAMPLER_ARG) !== undefined
+    case 'OTEL_TRACES_SAMPLER_ARG':
+      return !isNaN(parseFloat(value))
+    case 'OTEL_SDK_DISABLED':
+      return value.toLowerCase() === 'true' || value.toLowerCase() === 'false'
+    case 'OTEL_TRACES_EXPORTER':
+    case 'OTEL_METRICS_EXPORTER':
+    case 'OTEL_LOGS_EXPORTER':
+      return value.toLowerCase() === 'none'
+    default:
+      return false
+  }
+}
+
+function checkIfBothOtelAndDdEnvVarSet () {
+  for (const [otelEnvVar, ddEnvVar] of Object.entries(otelDdEnvMapping)) {
+    if (ddEnvVar && process.env[ddEnvVar] && process.env[otelEnvVar]) {
+      log.warn(`both ${ddEnvVar} and ${otelEnvVar} environment variables are set`)
+      getCounter('otel.env.hiding', ddEnvVar, otelEnvVar).inc()
+    }
+
+    if (process.env[otelEnvVar] && !validateEnvVarType(otelEnvVar)) {
+      log.warn(`unexpected value for ${otelEnvVar} environment variable`)
+      getCounter('otel.env.invalid', ddEnvVar, otelEnvVar).inc()
     }
   }
 }
@@ -80,9 +134,9 @@ const fromEntries = Object.fromEntries || (entries =>
 // eslint-disable-next-line max-len
 const qsRegex = '(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?|access_?|secret_?)key(?:_?id)?|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:(?:\\s|%20)*(?:=|%3D)[^&]+|(?:"|%22)(?:\\s|%20)*(?::|%3A)(?:\\s|%20)*(?:"|%22)(?:%2[^2]|%[^2]|[^"%])+(?:"|%22))|bearer(?:\\s|%20)+[a-z0-9\\._\\-]+|token(?::|%3A)[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L](?:[\\w=-]|%3D)+\\.ey[I-L](?:[\\w=-]|%3D)+(?:\\.(?:[\\w.+\\/=-]|%3D|%2F|%2B)+)?|[\\-]{5}BEGIN(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY[\\-]{5}[^\\-]+[\\-]{5}END(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY|ssh-rsa(?:\\s|%20)*(?:[a-z0-9\\/\\.+]|%2F|%5C|%2B){100,}'
 // eslint-disable-next-line max-len
-const defaultWafObfuscatorKeyRegex = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?)key)|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)|bearer|authorization'
+const defaultWafObfuscatorKeyRegex = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:[_-]?phrase)?|secret(?:[_-]?key)?|(?:(?:api|private|public|access)[_-]?)key)|(?:(?:auth|access|id|refresh)[_-]?)?token|consumer[_-]?(?:id|key|secret)|sign(?:ed|ature)|bearer|authorization|jsessionid|phpsessid|asp\\.net[_-]sessionid|sid|jwt'
 // eslint-disable-next-line max-len
-const defaultWafObfuscatorValueRegex = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?|access_?|secret_?)key(?:_?id)?|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:\\s*=[^;]|"\\s*:\\s*"[^"]+")|bearer\\s+[a-z0-9\\._\\-]+|token:[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L][\\w=-]+\\.ey[I-L][\\w=-]+(?:\\.[\\w.+\\/=-]+)?|[\\-]{5}BEGIN[a-z\\s]+PRIVATE\\sKEY[\\-]{5}[^\\-]+[\\-]{5}END[a-z\\s]+PRIVATE\\sKEY|ssh-rsa\\s*[a-z0-9\\/\\.+]{100,}'
+const defaultWafObfuscatorValueRegex = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:[_-]?phrase)?|secret(?:[_-]?key)?|(?:(?:api|private|public|access)[_-]?)key(?:[_-]?id)?|(?:(?:auth|access|id|refresh)[_-]?)?token|consumer[_-]?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?|jsessionid|phpsessid|asp\\.net(?:[_-]|-)sessionid|sid|jwt)(?:\\s*=[^;]|"\\s*:\\s*"[^"]+")|bearer\\s+[a-z0-9\\._\\-]+|token:[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L][\\w=-]+\\.ey[I-L][\\w=-]+(?:\\.[\\w.+\\/=-]+)?|[\\-]{5}BEGIN[a-z\\s]+PRIVATE\\sKEY[\\-]{5}[^\\-]+[\\-]{5}END[a-z\\s]+PRIVATE\\sKEY|ssh-rsa\\s*[a-z0-9\\/\\.+]{100,}'
 const runtimeId = uuid()
 
 function maybeFile (filepath) {
@@ -235,6 +289,9 @@ class Config {
       options.tracePropagationStyle,
       defaultPropagationStyle
     )
+
+    validateOtelPropagators(PROPAGATION_STYLE_INJECT)
+
     const DD_TRACE_PROPAGATION_EXTRACT_FIRST = coalesce(
       process.env.DD_TRACE_PROPAGATION_EXTRACT_FIRST,
       false
@@ -440,6 +497,10 @@ class Config {
     this._setValue(defaults, 'appsec.rateLimit', 100)
     this._setValue(defaults, 'appsec.rules', undefined)
     this._setValue(defaults, 'appsec.sca.enabled', null)
+    this._setValue(defaults, 'appsec.standalone.enabled', undefined)
+    this._setValue(defaults, 'appsec.stackTrace.enabled', true)
+    this._setValue(defaults, 'appsec.stackTrace.maxDepth', 32)
+    this._setValue(defaults, 'appsec.stackTrace.maxStackTraces', 2)
     this._setValue(defaults, 'appsec.wafTimeout', 5e3) // µs
     this._setValue(defaults, 'clientIpEnabled', false)
     this._setValue(defaults, 'clientIpHeader', null)
@@ -524,10 +585,13 @@ class Config {
       DD_APPSEC_ENABLED,
       DD_APPSEC_HTTP_BLOCKED_TEMPLATE_HTML,
       DD_APPSEC_HTTP_BLOCKED_TEMPLATE_JSON,
+      DD_APPSEC_MAX_STACK_TRACES,
+      DD_APPSEC_MAX_STACK_TRACE_DEPTH,
       DD_APPSEC_OBFUSCATION_PARAMETER_KEY_REGEXP,
       DD_APPSEC_OBFUSCATION_PARAMETER_VALUE_REGEXP,
       DD_APPSEC_RULES,
       DD_APPSEC_SCA_ENABLED,
+      DD_APPSEC_STACK_TRACE_ENABLED,
       DD_APPSEC_RASP_ENABLED,
       DD_APPSEC_TRACE_RATE_LIMIT,
       DD_APPSEC_WAF_TIMEOUT,
@@ -536,6 +600,7 @@ class Config {
       DD_DOGSTATSD_HOSTNAME,
       DD_DOGSTATSD_PORT,
       DD_ENV,
+      DD_EXPERIMENTAL_APPSEC_STANDALONE_ENABLED,
       DD_EXPERIMENTAL_PROFILING_ENABLED,
       JEST_WORKER_ID,
       DD_IAST_DEDUPLICATION_ENABLED,
@@ -627,6 +692,12 @@ class Config {
     this._setString(env, 'appsec.rules', DD_APPSEC_RULES)
     // DD_APPSEC_SCA_ENABLED is never used locally, but only sent to the backend
     this._setBoolean(env, 'appsec.sca.enabled', DD_APPSEC_SCA_ENABLED)
+    this._setBoolean(env, 'appsec.standalone.enabled', DD_EXPERIMENTAL_APPSEC_STANDALONE_ENABLED)
+    this._setBoolean(env, 'appsec.stackTrace.enabled', DD_APPSEC_STACK_TRACE_ENABLED)
+    this._setValue(env, 'appsec.stackTrace.maxDepth', maybeInt(DD_APPSEC_MAX_STACK_TRACE_DEPTH))
+    this._envUnprocessed['appsec.stackTrace.maxDepth'] = DD_APPSEC_MAX_STACK_TRACE_DEPTH
+    this._setValue(env, 'appsec.stackTrace.maxStackTraces', maybeInt(DD_APPSEC_MAX_STACK_TRACES))
+    this._envUnprocessed['appsec.stackTrace.maxStackTraces'] = DD_APPSEC_MAX_STACK_TRACES
     this._setValue(env, 'appsec.wafTimeout', maybeInt(DD_APPSEC_WAF_TIMEOUT))
     this._envUnprocessed['appsec.wafTimeout'] = DD_APPSEC_WAF_TIMEOUT
     this._setBoolean(env, 'clientIpEnabled', DD_TRACE_CLIENT_IP_ENABLED)
@@ -701,15 +772,8 @@ class Config {
       : undefined
     this._setBoolean(env, 'runtimeMetrics', DD_RUNTIME_METRICS_ENABLED ||
     otelSetRuntimeMetrics)
-    const OTEL_TRACES_SAMPLER_MAPPING = {
-      always_on: '1.0',
-      always_off: '0.0',
-      traceidratio: OTEL_TRACES_SAMPLER_ARG,
-      parentbased_always_on: '1.0',
-      parentbased_always_off: '0.0',
-      parentbased_traceidratio: OTEL_TRACES_SAMPLER_ARG
-    }
-    this._setUnit(env, 'sampleRate', DD_TRACE_SAMPLE_RATE || OTEL_TRACES_SAMPLER_MAPPING[OTEL_TRACES_SAMPLER])
+    this._setUnit(env, 'sampleRate', DD_TRACE_SAMPLE_RATE ||
+    getFromOtelSamplerMap(OTEL_TRACES_SAMPLER, OTEL_TRACES_SAMPLER_ARG))
     this._setValue(env, 'sampler.rateLimit', DD_TRACE_RATE_LIMIT)
     this._setSamplingRule(env, 'sampler.rules', safeJsonParse(DD_TRACE_SAMPLING_RULES))
     this._envUnprocessed['sampler.rules'] = DD_TRACE_SAMPLING_RULES
@@ -767,6 +831,12 @@ class Config {
     this._setValue(opts, 'appsec.rateLimit', maybeInt(options.appsec.rateLimit))
     this._optsUnprocessed['appsec.rateLimit'] = options.appsec.rateLimit
     this._setString(opts, 'appsec.rules', options.appsec.rules)
+    this._setBoolean(opts, 'appsec.standalone.enabled', options.experimental?.appsec?.standalone?.enabled)
+    this._setBoolean(opts, 'appsec.stackTrace.enabled', options.appsec.stackTrace?.enabled)
+    this._setValue(opts, 'appsec.stackTrace.maxDepth', maybeInt(options.appsec.stackTrace?.maxDepth))
+    this._optsUnprocessed['appsec.stackTrace.maxDepth'] = options.appsec.stackTrace?.maxDepth
+    this._setValue(opts, 'appsec.stackTrace.maxStackTraces', maybeInt(options.appsec.stackTrace?.maxStackTraces))
+    this._optsUnprocessed['appsec.stackTrace.maxStackTraces'] = options.appsec.stackTrace?.maxStackTraces
     this._setValue(opts, 'appsec.wafTimeout', maybeInt(options.appsec.wafTimeout))
     this._optsUnprocessed['appsec.wafTimeout'] = options.appsec.wafTimeout
     this._setBoolean(opts, 'clientIpEnabled', options.clientIpEnabled)

package/packages/dd-trace/src/constants.js

@@ -32,5 +32,7 @@ module.exports = {
   PEER_SERVICE_SOURCE_KEY: '_dd.peer.service.source',
   PEER_SERVICE_REMAP_KEY: '_dd.peer.service.remapped_from',
   SCI_REPOSITORY_URL: '_dd.git.repository_url',
-  SCI_COMMIT_SHA: '_dd.git.commit.sha'
+  SCI_COMMIT_SHA: '_dd.git.commit.sha',
+  APM_TRACING_ENABLED_KEY: '_dd.apm.enabled',
+  APPSEC_PROPAGATION_KEY: '_dd.p.appsec'
 }

package/packages/dd-trace/src/datastreams/processor.js

@@ -211,7 +211,8 @@ class DataStreamsProcessor {
       Stats,
       TracerVersion: pkg.version,
       Version: this.version,
-      Lang: 'javascript'
+      Lang: 'javascript',
+      Tags: Object.entries(this.tags).map(([key, value]) => `${key}:${value}`)
     }
     this.writer.flush(payload)
   }

package/packages/dd-trace/src/exporters/agent/index.js

@@ -7,7 +7,7 @@ const Writer = require('./writer')
 class AgentExporter {
   constructor (config, prioritySampler) {
     this._config = config
-    const { url, hostname, port, lookup, protocolVersion, stats = {} } = config
+    const { url, hostname, port, lookup, protocolVersion, stats = {}, appsec } = config
     this._url = url || new URL(format({
       protocol: 'http:',
       hostname: hostname || 'localhost',
@@ -15,7 +15,7 @@ class AgentExporter {
     }))
 
     const headers = {}
-    if (stats.enabled) {
+    if (stats.enabled || appsec?.standalone?.enabled) {
       headers['Datadog-Client-Computed-Stats'] = 'yes'
     }
 

package/packages/dd-trace/src/format.js

@@ -53,6 +53,7 @@ function formatSpan (span) {
     resource: String(spanContext._name),
     error: 0,
     meta: {},
+    meta_struct: span.meta_struct,
     metrics: {},
     start: Math.round(span._startTime * 1e6),
     duration: Math.round(span._duration * 1e6),

package/packages/dd-trace/src/opentracing/propagation/text_map.js

@@ -6,9 +6,13 @@ const DatadogSpanContext = require('../span_context')
 const log = require('../../log')
 const TraceState = require('./tracestate')
 const tags = require('../../../../../ext/tags')
+const { channel } = require('dc-polyfill')
 
 const { AUTO_KEEP, AUTO_REJECT, USER_KEEP } = require('../../../../../ext/priority')
 
+const injectCh = channel('dd-trace:span:inject')
+const extractCh = channel('dd-trace:span:extract')
+
 const traceKey = 'x-datadog-trace-id'
 const spanKey = 'x-datadog-parent-id'
 const originKey = 'x-datadog-origin'
@@ -54,6 +58,10 @@ class TextMapPropagator {
     this._injectB3SingleHeader(spanContext, carrier)
     this._injectTraceparent(spanContext, carrier)
 
+    if (injectCh.hasSubscribers) {
+      injectCh.publish({ spanContext, carrier })
+    }
+
     log.debug(() => `Inject into carrier: ${JSON.stringify(pick(carrier, logKeys))}.`)
   }
 
@@ -62,6 +70,10 @@ class TextMapPropagator {
 
     if (!spanContext) return spanContext
 
+    if (extractCh.hasSubscribers) {
+      extractCh.publish({ spanContext, carrier })
+    }
+
     log.debug(() => `Extract from carrier: ${JSON.stringify(pick(carrier, logKeys))}.`)
 
     return spanContext

package/packages/dd-trace/src/opentracing/span.js

@@ -99,7 +99,10 @@ class DatadogSpan {
       unfinishedRegistry.register(this, operationName, this)
     }
     spanleak.addSpan(this, operationName)
-    startCh.publish(this)
+
+    if (startCh.hasSubscribers) {
+      startCh.publish({ span: this, fields })
+    }
   }
 
   toString () {

package/packages/dd-trace/src/opentracing/tracer.js

@@ -19,7 +19,7 @@ const REFERENCE_CHILD_OF = 'child_of'
 const REFERENCE_FOLLOWS_FROM = 'follows_from'
 
 class DatadogTracer {
-  constructor (config) {
+  constructor (config, prioritySampler) {
     const Exporter = getExporter(config.experimental.exporter)
 
     this._config = config
@@ -28,7 +28,7 @@ class DatadogTracer {
     this._env = config.env
     this._logInjection = config.logInjection
     this._debug = config.debug
-    this._prioritySampler = new PrioritySampler(config.env, config.sampler)
+    this._prioritySampler = prioritySampler ?? new PrioritySampler(config.env, config.sampler)
     this._exporter = new Exporter(config, this._prioritySampler)
     this._processor = new SpanProcessor(this._exporter, this._prioritySampler, config)
     this._url = this._exporter._url

package/packages/dd-trace/src/plugins/ci_plugin.js

@@ -91,6 +91,13 @@ module.exports = class CiPlugin extends Plugin {
           ...testModuleSpanMetadata
         }
       })
+      // only for vitest
+      // These are added for the worker threads to use
+      if (this.constructor.id === 'vitest') {
+        process.env.DD_CIVISIBILITY_TEST_SESSION_ID = this.testSessionSpan.context().toTraceId()
+        process.env.DD_CIVISIBILITY_TEST_MODULE_ID = this.testModuleSpan.context().toSpanId()
+      }
+
       this.telemetry.ciVisEvent(TELEMETRY_EVENT_CREATED, 'module')
     })
 

package/packages/dd-trace/src/plugins/index.js

@@ -18,6 +18,7 @@ module.exports = {
   get '@opensearch-project/opensearch' () { return require('../../../datadog-plugin-opensearch/src') },
   get '@redis/client' () { return require('../../../datadog-plugin-redis/src') },
   get '@smithy/smithy-client' () { return require('../../../datadog-plugin-aws-sdk/src') },
+  get '@vitest/runner' () { return require('../../../datadog-plugin-vitest/src') },
   get aerospike () { return require('../../../datadog-plugin-aerospike/src') },
   get amqp10 () { return require('../../../datadog-plugin-amqp10/src') },
   get amqplib () { return require('../../../datadog-plugin-amqplib/src') },
@@ -54,6 +55,7 @@ module.exports = {
   get 'microgateway-core' () { return require('../../../datadog-plugin-microgateway-core/src') },
   get mocha () { return require('../../../datadog-plugin-mocha/src') },
   get 'mocha-each' () { return require('../../../datadog-plugin-mocha/src') },
+  get vitest () { return require('../../../datadog-plugin-vitest/src') },
   get workerpool () { return require('../../../datadog-plugin-mocha/src') },
   get moleculer () { return require('../../../datadog-plugin-moleculer/src') },
   get mongodb () { return require('../../../datadog-plugin-mongodb-core/src') },

package/packages/dd-trace/src/plugins/util/test.js

@@ -95,6 +95,9 @@ const MOCHA_WORKER_TRACE_PAYLOAD_CODE = 80
 const EFD_STRING = "Retried by Datadog's Early Flake Detection"
 const EFD_TEST_NAME_REGEX = new RegExp(EFD_STRING + ' \\(#\\d+\\): ', 'g')
 
+// Flaky test retries
+const NUM_FAILED_TEST_RETRIES = 5
+
 module.exports = {
   TEST_CODE_OWNERS,
   TEST_FRAMEWORK,
@@ -167,7 +170,8 @@ module.exports = {
   TEST_BROWSER_DRIVER,
   TEST_BROWSER_DRIVER_VERSION,
   TEST_BROWSER_NAME,
-  TEST_BROWSER_VERSION
+  TEST_BROWSER_VERSION,
+  NUM_FAILED_TEST_RETRIES
 }
 
 // Returns pkg manager and its version, separated by '-', e.g. npm-8.15.0 or yarn-1.22.19

package/packages/dd-trace/src/priority_sampler.js

@@ -4,6 +4,7 @@ const RateLimiter = require('./rate_limiter')
 const Sampler = require('./sampler')
 const { setSamplingRules } = require('./startup-log')
 const SamplingRule = require('./sampling_rule')
+const { hasOwn } = require('./util')
 
 const {
   SAMPLING_MECHANISM_DEFAULT,
@@ -66,7 +67,7 @@ class PrioritySampler {
     if (context._sampling.priority !== undefined) return
     if (!root) return // noop span
 
-    const tag = this._getPriorityFromTags(context._tags)
+    const tag = this._getPriorityFromTags(context._tags, context)
 
     if (this.validate(tag)) {
       context._sampling.priority = tag
@@ -202,8 +203,4 @@ class PrioritySampler {
   }
 }
 
-function hasOwn (object, prop) {
-  return Object.prototype.hasOwnProperty.call(object, prop)
-}
-
 module.exports = PrioritySampler

package/packages/dd-trace/src/profiling/profiler.js

@@ -69,7 +69,7 @@ class Profiler extends EventEmitter {
       setLogger(config.logger)
 
       mapper = await maybeSourceMap(config.sourceMap, SourceMapper, config.debugSourceMaps)
-      if (config.SourceMap && config.debugSourceMaps) {
+      if (config.sourceMap && config.debugSourceMaps) {
         this._logger.debug(() => {
           return mapper.infoMap.size === 0
             ? 'Found no source maps'

package/packages/dd-trace/src/proxy.js

@@ -15,6 +15,7 @@ const NoopDogStatsDClient = require('./noop/dogstatsd')
 const spanleak = require('./spanleak')
 const { SSIHeuristics } = require('./profiling/ssi-heuristics')
 const telemetryLog = require('dc-polyfill').channel('datadog:telemetry:log')
+const appsecStandalone = require('./appsec/standalone')
 
 class LazyModule {
   constructor (provider) {
@@ -178,7 +179,8 @@ class Tracer extends NoopProxy {
         this._modules.appsec.enable(config)
       }
       if (!this._tracingInitialized) {
-        this._tracer = new DatadogTracer(config)
+        const prioritySampler = appsecStandalone.configure(config)
+        this._tracer = new DatadogTracer(config, prioritySampler)
         this.appsec = new AppsecSdk(this._tracer, config)
         this._tracingInitialized = true
       }

package/packages/dd-trace/src/rate_limiter.js

@@ -3,9 +3,9 @@
 const limiter = require('limiter')
 
 class RateLimiter {
-  constructor (rateLimit) {
+  constructor (rateLimit, interval = 'second') {
     this._rateLimit = parseInt(rateLimit)
-    this._limiter = new limiter.RateLimiter(this._rateLimit, 'second')
+    this._limiter = new limiter.RateLimiter(this._rateLimit, interval)
     this._tokensRequested = 0
     this._prevIntervalTokens = 0
     this._prevTokensRequested = 0

package/packages/dd-trace/src/span_stats.js

@@ -126,7 +126,8 @@ class SpanStatsProcessor {
     port,
     url,
     env,
-    tags
+    tags,
+    appsec
   } = {}) {
     this.exporter = new SpanStatsExporter({
       hostname,
@@ -138,12 +139,12 @@ class SpanStatsProcessor {
     this.bucketSizeNs = interval * 1e9
     this.buckets = new TimeBuckets()
     this.hostname = os.hostname()
-    this.enabled = enabled
+    this.enabled = enabled && !appsec?.standalone?.enabled
     this.env = env
     this.tags = tags || {}
     this.sequence = 0
 
-    if (enabled) {
+    if (this.enabled) {
       this.timer = setInterval(this.onInterval.bind(this), interval * 1e3)
       this.timer.unref()
     }