dd-trace 5.59.0 → 5.60.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dd-trace",
-  "version": "5.59.0",
+  "version": "5.60.0",
   "description": "Datadog APM tracing client for JavaScript",
   "main": "index.js",
   "typings": "index.d.ts",
@@ -114,7 +114,7 @@
   ],
   "dependencies": {
     "@datadog/libdatadog": "0.7.0",
-    "@datadog/native-appsec": "10.0.0",
+    "@datadog/native-appsec": "10.0.1",
     "@datadog/native-iast-taint-tracking": "4.0.0",
     "@datadog/native-metrics": "3.1.1",
     "@datadog/pprof": "5.9.0",
@@ -173,7 +173,7 @@
     "graphql": "*",
     "jszip": "^3.10.1",
     "mocha": "^11.6.0",
-    "multer": "^2.0.1",
+    "multer": "^2.0.2",
     "nock": "^11.9.1",
     "nyc": "^15.1.0",
     "octokit": "^5.0.3",
@@ -187,5 +187,8 @@
     "workerpool": "^9.2.0",
     "yaml": "^2.8.0",
     "yarn-deduplicate": "^6.0.2"
+  },
+  "resolutions": {
+    "eslint-plugin-unicorn/@eslint/plugin-kit": "0.3.3"
   }
 }

package/packages/datadog-instrumentations/src/apollo-server.js

@@ -77,6 +77,17 @@ function apolloServerHook (apolloServer) {
   return apolloServer
 }
 
-addHook({ name: '@apollo/server', file: 'dist/cjs/ApolloServer.js', versions: ['>=4.0.0'] }, apolloServerHook)
-addHook({ name: '@apollo/server', file: 'dist/cjs/express4/index.js', versions: ['>=4.0.0'] }, apolloExpress4Hook)
-addHook({ name: '@apollo/server', file: 'dist/cjs/utils/HeaderMap.js', versions: ['>=4.0.0'] }, apolloHeaderMapHook)
+addHook(
+  { name: '@apollo/server', file: 'dist/cjs/ApolloServer.js', versions: ['>=4.0.0 <5.0.0'] },
+  apolloServerHook
+)
+
+addHook(
+  { name: '@apollo/server', file: 'dist/cjs/express4/index.js', versions: ['>=4.0.0 <5.0.0'] },
+  apolloExpress4Hook
+)
+
+addHook(
+  { name: '@apollo/server', file: 'dist/cjs/utils/HeaderMap.js', versions: ['>=4.0.0 <5.0.0'] },
+  apolloHeaderMapHook
+)

package/packages/datadog-instrumentations/src/openai.js

@@ -5,6 +5,7 @@ const shimmer = require('../../datadog-shimmer')
 
 const dc = require('dc-polyfill')
 const ch = dc.tracingChannel('apm:openai:request')
+const onStreamedChunkCh = dc.channel('apm:openai:request:chunk')
 
 const V4_PACKAGE_SHIMS = [
   {
@@ -160,79 +161,12 @@ addHook({ name: 'openai', file: 'dist/api.js', versions: ['>=3.0.0 <4'] }, expor
   return exports
 })
 
-function addStreamedChunk (content, chunk) {
-  content.usage = chunk.usage // add usage if it was specified to be returned
-  for (const choice of chunk.choices) {
-    const choiceIdx = choice.index
-    const oldChoice = content.choices.find(choice => choice?.index === choiceIdx)
-    if (oldChoice) {
-      if (!oldChoice.finish_reason) {
-        oldChoice.finish_reason = choice.finish_reason
-      }
-
-      // delta exists on chat completions
-      const delta = choice.delta
-
-      if (delta) {
-        const content = delta.content
-        if (content) {
-          if (oldChoice.delta.content) { // we don't want to append to undefined
-            oldChoice.delta.content += content
-          } else {
-            oldChoice.delta.content = content
-          }
-        }
-      } else {
-        const text = choice.text
-        if (text) {
-          if (oldChoice.text) {
-            oldChoice.text += text
-          } else {
-            oldChoice.text = text
-          }
-        }
-      }
-
-      // tools only exist on chat completions
-      const tools = delta && choice.delta.tool_calls
-
-      if (tools) {
-        oldChoice.delta.tool_calls = tools.map((newTool, toolIdx) => {
-          const oldTool = oldChoice.delta.tool_calls?.[toolIdx]
-
-          if (oldTool) {
-            oldTool.function.arguments += newTool.function.arguments
-            return oldTool
-          }
-
-          return newTool
-        })
-      }
-    } else {
-      // we don't know which choices arrive in which order
-      content.choices[choiceIdx] = choice
-    }
-  }
-}
-
-function convertBufferstoObjects (chunks) {
-  return Buffer
-    .concat(chunks) // combine the buffers
-    .toString() // stringify
-    .split(/(?=data:)/) // split on "data:"
-    .map(chunk => chunk.replaceAll('\n', '').slice(6)) // remove newlines and 'data: ' from the front
-    .slice(0, -1) // remove the last [DONE] message
-    .map(JSON.parse) // parse all of the returned objects
-}
-
 /**
  * For streamed responses, we need to accumulate all of the content in
  * the chunks, and let the combined content be the final response.
  * This way, spans look the same as when not streamed.
  */
-function wrapStreamIterator (response, options, n, ctx) {
-  let processChunksAsBuffers = false
-  let chunks = []
+function wrapStreamIterator (response, options, ctx) {
   return function (itr) {
     return function () {
       const iterator = itr.apply(this, arguments)
@@ -240,39 +174,11 @@ function wrapStreamIterator (response, options, n, ctx) {
         return next.apply(this, arguments)
           .then(res => {
             const { done, value: chunk } = res
-
-            if (chunk) {
-              chunks.push(chunk)
-              // TODO(BridgeAR): It likely depends on the options being passed
-              // through if the stream returns buffers or not. By reading that,
-              // we don't have to do the instanceof check anymore, which is
-              // relatively expensive.
-              if (chunk instanceof Buffer) {
-                // this operation should be safe
-                // if one chunk is a buffer (versus a plain object), the rest should be as well
-                processChunksAsBuffers = true
-              }
-            }
+            onStreamedChunkCh.publish({ ctx, chunk, done })
 
             if (done) {
-              let body = {}
-              if (processChunksAsBuffers) {
-                chunks = convertBufferstoObjects(chunks)
-              }
-
-              if (chunks.length) {
-                // Define the initial body having all the content outside of choices from the first chunk
-                // this will include import data like created, id, model, etc.
-                body = { ...chunks[0], choices: Array.from({ length: n }) }
-                // Start from the first chunk, and add its choices into the body
-                for (const chunk_ of chunks) {
-                  addStreamedChunk(body, chunk_)
-                }
-              }
-
               finish(ctx, {
                 headers: response.headers,
-                data: body,
                 request: {
                   path: response.url,
                   method: options.method
@@ -312,17 +218,6 @@ for (const extension of extensions) {
           // chat.completions and completions
           const stream = streamedResponse && getOption(arguments, 'stream', false)
 
-          // we need to compute how many prompts we are sending in streamed cases for completions
-          // not applicable for chat completiond
-          let n
-          if (stream) {
-            n = getOption(arguments, 'n', 1)
-            const prompt = getOption(arguments, 'prompt')
-            if (Array.isArray(prompt) && typeof prompt[0] !== 'number') {
-              n *= prompt.length
-            }
-          }
-
           const client = this._client || this.client
 
           const ctx = {
@@ -348,7 +243,7 @@ for (const extension of extensions) {
                   const parsedPromise = origApiPromParse.apply(this, arguments)
                     .then(body => Promise.all([this.responsePromise, body]))
 
-                  return handleUnwrappedAPIPromise(parsedPromise, ctx, stream, n)
+                  return handleUnwrappedAPIPromise(parsedPromise, ctx, stream)
                 })
 
                 return unwrappedPromise
@@ -361,7 +256,7 @@ for (const extension of extensions) {
               const parsedPromise = origApiPromParse.apply(this, arguments)
                 .then(body => Promise.all([this.responsePromise, body]))
 
-              return handleUnwrappedAPIPromise(parsedPromise, ctx, stream, n)
+              return handleUnwrappedAPIPromise(parsedPromise, ctx, stream)
             })
 
             ch.end.publish(ctx)
@@ -375,15 +270,15 @@ for (const extension of extensions) {
   }
 }
 
-function handleUnwrappedAPIPromise (apiProm, ctx, stream, n) {
+function handleUnwrappedAPIPromise (apiProm, ctx, stream) {
   return apiProm
     .then(([{ response, options }, body]) => {
       if (stream) {
         if (body.iterator) {
-          shimmer.wrap(body, 'iterator', wrapStreamIterator(response, options, n, ctx))
+          shimmer.wrap(body, 'iterator', wrapStreamIterator(response, options, ctx))
         } else {
           shimmer.wrap(
-            body.response.body, Symbol.asyncIterator, wrapStreamIterator(response, options, n, ctx)
+            body.response.body, Symbol.asyncIterator, wrapStreamIterator(response, options, ctx)
           )
         }
       } else {
@@ -412,7 +307,11 @@ function finish (ctx, response, error) {
     ch.error.publish(ctx)
   }
 
-  ctx.result = response
+  // for successful streamed responses, we've already set the result on ctx.body,
+  // so we don't want to override it here
+  ctx.result ??= {}
+  Object.assign(ctx.result, response)
+
   ch.asyncEnd.publish(ctx)
 }
 

package/packages/datadog-plugin-google-cloud-vertexai/src/tracing.js

@@ -7,7 +7,6 @@ const makeUtilities = require('../../dd-trace/src/plugins/util/llm')
 
 const {
   extractModel,
-  extractSystemInstructions
 } = require('./utils')
 
 class GoogleCloudVertexAITracingPlugin extends TracingPlugin {
@@ -23,20 +22,18 @@ class GoogleCloudVertexAITracingPlugin extends TracingPlugin {
   }
 
   bindStart (ctx) {
-    const { instance, request, resource, stream } = ctx
+    const { instance, resource } = ctx
 
     const span = this.startSpan('vertexai.request', {
       service: this.config.service,
       resource,
       kind: 'client',
       meta: {
-        [MEASURED]: 1
+        [MEASURED]: 1,
+        'vertexai.request.model': extractModel(instance)
       }
     }, false)
 
-    const tags = this.tagRequest(request, instance, stream, span)
-    span.addTags(tags)
-
     const store = storage('legacy').getStore() || {}
     ctx.currentStore = { ...store, span }
 
@@ -47,157 +44,8 @@ class GoogleCloudVertexAITracingPlugin extends TracingPlugin {
     const span = ctx.currentStore?.span
     if (!span) return
 
-    const { result } = ctx
-
-    const response = result?.response
-    if (response) {
-      const tags = this.tagResponse(response, span)
-      span.addTags(tags)
-    }
-
     span.finish()
   }
-
-  /**
-   * Generate the request tags.
-   *
-   * @param {Object} request
-   * @param {Object} instance
-   * @param {boolean} stream
-   * @param {Span} span
-   * @returns {Object}
-   */
-  tagRequest (request, instance, stream, span) {
-    const model = extractModel(instance)
-    const tags = {
-      'vertexai.request.model': model
-    }
-
-    const history = instance.historyInternal
-
-    let contents = typeof request === 'string' || Array.isArray(request) ? request : request.contents
-    if (history) {
-      contents = [...history, ...(Array.isArray(contents) ? contents : [contents])]
-    }
-
-    const generationConfig = instance.generationConfig || {}
-    for (const key of Object.keys(generationConfig)) {
-      const transformedKey = key.replaceAll(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase()
-      tags[`vertexai.request.generation_config.${transformedKey}`] = JSON.stringify(generationConfig[key])
-    }
-
-    if (stream) {
-      tags['vertexai.request.stream'] = true
-    }
-
-    if (!this.isPromptCompletionSampled(span)) return tags
-
-    const systemInstructions = extractSystemInstructions(instance)
-
-    for (const [idx, systemInstruction] of systemInstructions.entries()) {
-      tags[`vertexai.request.system_instruction.${idx}.text`] = systemInstruction
-    }
-
-    if (typeof contents === 'string') {
-      tags['vertexai.request.contents.0.text'] = contents
-      return tags
-    }
-
-    for (const [contentIdx, content] of contents.entries()) {
-      this.tagRequestContent(tags, content, contentIdx)
-    }
-
-    return tags
-  }
-
-  tagRequestPart (part, tags, partIdx, contentIdx) {
-    tags[`vertexai.request.contents.${contentIdx}.parts.${partIdx}.text`] = this.normalize(part.text)
-
-    const functionCall = part.functionCall
-    const functionResponse = part.functionResponse
-
-    if (functionCall) {
-      tags[`vertexai.request.contents.${contentIdx}.parts.${partIdx}.function_call.name`] = functionCall.name
-      tags[`vertexai.request.contents.${contentIdx}.parts.${partIdx}.function_call.args`] =
-              this.normalize(JSON.stringify(functionCall.args))
-    }
-    if (functionResponse) {
-      tags[`vertexai.request.contents.${contentIdx}.parts.${partIdx}.function_response.name`] =
-              functionResponse.name
-      tags[`vertexai.request.contents.${contentIdx}.parts.${partIdx}.function_response.response`] =
-              this.normalize(JSON.stringify(functionResponse.response))
-    }
-  }
-
-  tagRequestContent (tags, content, contentIdx) {
-    if (typeof content === 'string') {
-      tags[`vertexai.request.contents.${contentIdx}.text`] = this.normalize(content)
-      return
-    }
-
-    if (content.text || content.functionCall || content.functionResponse) {
-      this.tagRequestPart(content, tags, 0, contentIdx)
-      return
-    }
-
-    const { role, parts } = content
-    if (role) {
-      tags[`vertexai.request.contents.${contentIdx}.role`] = role
-    }
-
-    for (const [partIdx, part] of parts.entries()) {
-      this.tagRequestPart(part, tags, partIdx, contentIdx)
-    }
-  }
-
-  /**
-   * Generate the response tags.
-   *
-   * @param {Object} response
-   * @param {Span} span
-   * @returns {Object}
-   */
-  tagResponse (response, span) {
-    const tags = {}
-    const isSampled = this.isPromptCompletionSampled(span)
-
-    const candidates = response.candidates
-    for (const [candidateIdx, candidate] of candidates.entries()) {
-      const finishReason = candidate.finishReason
-      if (finishReason) {
-        tags[`vertexai.response.candidates.${candidateIdx}.finish_reason`] = finishReason
-      }
-      const candidateContent = candidate.content
-      const role = candidateContent.role
-      tags[`vertexai.response.candidates.${candidateIdx}.content.role`] = role
-
-      if (!isSampled) continue
-
-      const parts = candidateContent.parts
-      for (const [partIdx, part] of parts.entries()) {
-        const text = part.text
-        tags[`vertexai.response.candidates.${candidateIdx}.content.parts.${partIdx}.text`] =
-          this.normalize(String(text))
-
-        const functionCall = part.functionCall
-        if (!functionCall) continue
-
-        tags[`vertexai.response.candidates.${candidateIdx}.content.parts.${partIdx}.function_call.name`] =
-          functionCall.name
-        tags[`vertexai.response.candidates.${candidateIdx}.content.parts.${partIdx}.function_call.args`] =
-          this.normalize(JSON.stringify(functionCall.args))
-      }
-    }
-
-    const tokenCounts = response.usageMetadata
-    if (tokenCounts) {
-      tags['vertexai.response.usage.prompt_tokens'] = tokenCounts.promptTokenCount
-      tags['vertexai.response.usage.completion_tokens'] = tokenCounts.candidatesTokenCount
-      tags['vertexai.response.usage.total_tokens'] = tokenCounts.totalTokenCount
-    }
-
-    return tags
-  }
 }
 
 module.exports = GoogleCloudVertexAITracingPlugin

package/packages/datadog-plugin-openai/src/stream-helpers.js

@@ -0,0 +1,114 @@
+'use strict'
+
+/**
+ * Combines legacy OpenAI streamed chunks into a single object.
+ * These legacy chunks are returned as buffers instead of individual objects.
+ * @param {readonly Uint8Array[]} chunks
+ * @returns {Array<Record<string, any>>}
+ */
+function convertBuffersToObjects (chunks) {
+  return Buffer
+    .concat(chunks) // combine the buffers
+    .toString() // stringify
+    .split(/(?=data:)/) // split on "data:"
+    .map(chunk => chunk.replaceAll('\n', '').slice(6)) // remove newlines and 'data: ' from the front
+    .slice(0, -1) // remove the last [DONE] message
+    .map(JSON.parse) // parse all of the returned objects
+}
+
+/**
+ * Common function for combining chunks with n choices into a single response body.
+ * The shared logic will add a new choice index entry if it doesn't exist, and otherwise
+ * hand off to a onChoice handler to add that choice to the previously stored choice.
+ *
+ * @param {Array<Record<string, any>>} chunks
+ * @param {number} n
+ * @param {function(Record<string, any>, Record<string, any>): void} onChoice
+ * @returns {Record<string, any>}
+ */
+function constructResponseFromStreamedChunks (chunks, n, onChoice) {
+  const body = { ...chunks[0], choices: Array.from({ length: n }) }
+
+  for (const chunk of chunks) {
+    body.usage = chunk.usage
+    for (const choice of chunk.choices) {
+      const choiceIdx = choice.index
+      const oldChoice = body.choices.find(choice => choice?.index === choiceIdx)
+
+      if (!oldChoice) {
+        body.choices[choiceIdx] = choice
+        continue
+      }
+
+      if (!oldChoice.finish_reason) {
+        oldChoice.finish_reason = choice.finish_reason
+      }
+
+      onChoice(choice, oldChoice)
+    }
+  }
+
+  return body
+}
+
+/**
+ * Constructs the entire response from a stream of OpenAI completion chunks,
+ * mainly combining the text choices of each chunk into a single string per choice.
+ * @param {Array<Record<string, any>>} chunks
+ * @param {number} n the number of choices to expect in the response
+ * @returns {Record<string, any>}
+ */
+function constructCompletionResponseFromStreamedChunks (chunks, n) {
+  return constructResponseFromStreamedChunks(chunks, n, (choice, oldChoice) => {
+    const text = choice.text
+    if (text) {
+      if (oldChoice.text) {
+        oldChoice.text += text
+      } else {
+        oldChoice.text = text
+      }
+    }
+  })
+}
+
+/**
+ * Constructs the entire response from a stream of OpenAI chat completion chunks,
+ * mainly combining the text choices of each chunk into a single string per choice.
+ * @param {Array<Record<string, any>>} chunks
+ * @param {number} n the number of choices to expect in the response
+ * @returns {Record<string, any>}
+ */
+function constructChatCompletionResponseFromStreamedChunks (chunks, n) {
+  return constructResponseFromStreamedChunks(chunks, n, (choice, oldChoice) => {
+    const delta = choice.delta
+    if (!delta) return
+
+    const content = delta.content
+    if (content) {
+      if (oldChoice.delta.content) {
+        oldChoice.delta.content += content
+      } else {
+        oldChoice.delta.content = content
+      }
+    }
+
+    const tools = delta.tool_calls
+    if (!tools) return
+
+    oldChoice.delta.tool_calls = tools.map((newTool, toolIdx) => {
+      const oldTool = oldChoice.delta.tool_calls?.[toolIdx]
+      if (oldTool) {
+        oldTool.function.arguments += newTool.function.arguments
+        return oldTool
+      }
+
+      return newTool
+    })
+  })
+}
+
+module.exports = {
+  convertBuffersToObjects,
+  constructCompletionResponseFromStreamedChunks,
+  constructChatCompletionResponseFromStreamedChunks
+}

package/packages/datadog-plugin-openai/src/tracing.js

@@ -10,6 +10,11 @@ const { MEASURED } = require('../../../ext/tags')
 const { estimateTokens } = require('./token-estimator')
 
 const makeUtilities = require('../../dd-trace/src/plugins/util/llm')
+const {
+  convertBuffersToObjects,
+  constructCompletionResponseFromStreamedChunks,
+  constructChatCompletionResponseFromStreamedChunks
+} = require('./stream-helpers')
 
 let normalize
 
@@ -48,6 +53,39 @@ class OpenAiTracingPlugin extends TracingPlugin {
 
       normalize = utilities.normalize
     }
+
+    this.addSub('apm:openai:request:chunk', ({ ctx, chunk, done }) => {
+      if (!ctx.chunks) ctx.chunks = []
+
+      if (chunk) ctx.chunks.push(chunk)
+      if (!done) return
+
+      let chunks = ctx.chunks
+      if (chunks.length === 0) return
+
+      const firstChunk = chunks[0]
+      // OpenAI in legacy versions returns chunked buffers instead of objects.
+      // These buffers will need to be combined and coalesced into a list of object chunks.
+      if (firstChunk instanceof Buffer) {
+        chunks = convertBuffersToObjects(chunks)
+      }
+
+      const methodName = ctx.currentStore.normalizedMethodName
+      let n = 1
+      const prompt = ctx.args[0].prompt
+      if (Array.isArray(prompt) && typeof prompt[0] !== 'number') {
+        n *= prompt.length
+      }
+
+      let response = {}
+      if (methodName === 'createCompletion') {
+        response = constructCompletionResponseFromStreamedChunks(chunks, n)
+      } else if (methodName === 'createChatCompletion') {
+        response = constructChatCompletionResponseFromStreamedChunks(chunks, n)
+      }
+
+      ctx.result = { data: response }
+    })
   }
 
   configure (config) {

package/packages/dd-trace/src/appsec/reporter.js

@@ -3,7 +3,6 @@
 const dc = require('dc-polyfill')
 const zlib = require('zlib')
 
-const Limiter = require('../rate_limiter')
 const { storage } = require('../../../datadog-core')
 const web = require('../plugins/util/web')
 const { ipHeaderList } = require('../plugins/util/ip_extractor')
@@ -15,7 +14,6 @@ const {
   updateWafRequestsMetricTags,
   updateRaspRequestsMetricTags,
   updateRaspRuleSkippedMetricTags,
-  updateRateLimitedMetric,
   getRequestMetrics
 } = require('./telemetry')
 const { keepTrace } = require('../priority_sampler')
@@ -31,9 +29,6 @@ const COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE = 256
 
 const telemetryLogCh = dc.channel('datadog:telemetry:log')
 
-// default limiter, configurable with setRateLimit()
-let limiter = new Limiter(100)
-
 const config = {
   headersExtendedCollectionEnabled: false,
   maxHeadersCollected: 0,
@@ -91,7 +86,6 @@ const NON_EXTENDED_REQUEST_HEADERS = new Set([...requestHeadersList, ...eventHea
 const NON_EXTENDED_RESPONSE_HEADERS = new Set(contentHeaderList)
 
 function init (_config) {
-  limiter = new Limiter(_config.rateLimit)
   config.headersExtendedCollectionEnabled = _config.extendedHeadersCollection.enabled
   config.maxHeadersCollected = _config.extendedHeadersCollection.maxHeaders
   config.headersRedaction = _config.extendedHeadersCollection.redaction
@@ -325,12 +319,6 @@ function reportAttack (attackData) {
     'appsec.event': 'true'
   }
 
-  if (limiter.isAllowed()) {
-    keepTrace(rootSpan, ASM)
-  } else {
-    updateRateLimitedMetric(req)
-  }
-
   // TODO: maybe add this to format.js later (to take decision as late as possible)
   if (!currentTags['_dd.origin']) {
     newTags['_dd.origin'] = 'appsec'
@@ -430,8 +418,8 @@ function isRaspAttack (events) {
   return events.some(e => e.rule?.tags?.module === 'rasp')
 }
 
-function isFingerprintAttribute (attribute) {
-  return attribute.startsWith('_dd.appsec.fp')
+function isSchemaAttribute (attribute) {
+  return attribute.startsWith('_dd.appsec.s.')
 }
 
 function reportAttributes (attributes) {
@@ -444,7 +432,7 @@ function reportAttributes (attributes) {
 
   const tags = {}
   for (let [tag, value] of Object.entries(attributes)) {
-    if (!isFingerprintAttribute(tag)) {
+    if (isSchemaAttribute(tag)) {
       const gzippedValue = zlib.gzipSync(JSON.stringify(value))
       value = gzippedValue.toString('base64')
     }

package/packages/dd-trace/src/appsec/waf/index.js

@@ -3,6 +3,11 @@
 const { storage } = require('../../../../datadog-core')
 const log = require('../../log')
 const Reporter = require('../reporter')
+const Limiter = require('../../rate_limiter')
+const { keepTrace } = require('../../priority_sampler')
+const { ASM } = require('../../standalone/product')
+const web = require('../../plugins/util/web')
+const { updateRateLimitedMetric } = require('../telemetry')
 
 class WafUpdateError extends Error {
   constructor (diagnosticErrors) {
@@ -12,6 +17,8 @@ class WafUpdateError extends Error {
   }
 }
 
+let limiter = new Limiter(100)
+
 const waf = {
   wafManager: null,
   init,
@@ -27,6 +34,8 @@ const waf = {
 function init (rules, config) {
   destroy()
 
+  limiter = new Limiter(config.rateLimit)
+
   // dirty require to make startup faster for serverless
   const WAFManager = require('./waf_manager')
 
@@ -99,8 +108,18 @@ function run (data, req, raspRule) {
   }
 
   const wafContext = waf.wafManager.getWAFContext(req)
+  const result = wafContext.run(data, raspRule)
+
+  if (result?.keep) {
+    if (limiter.isAllowed()) {
+      const rootSpan = web.root(req)
+      keepTrace(rootSpan, ASM)
+    } else {
+      updateRateLimitedMetric(req)
+    }
+  }
 
-  return wafContext.run(data, raspRule)
+  return result
 }
 
 function disposeContext (req) {

package/packages/dd-trace/src/ci-visibility/dynamic-instrumentation/index.js

@@ -5,6 +5,7 @@ const { Worker, threadId: parentThreadId } = require('worker_threads')
 const { randomUUID } = require('crypto')
 const log = require('../../log')
 const { getEnvironmentVariables } = require('../../config-helper')
+const getDebuggerConfig = require('../../debugger/config')
 
 const probeIdToResolveBreakpointSet = new Map()
 const probeIdToResolveBreakpointRemove = new Map()
@@ -82,7 +83,7 @@ class TestVisDynamicInstrumentation {
           DD_INSTRUMENTATION_TELEMETRY_ENABLED: 'false'
         },
         workerData: {
-          config: this._config.serialize(),
+          config: getDebuggerConfig(this._config),
           parentThreadId,
           probePort: probeChannel.port1,
           configPort: configChannel.port1,

package/packages/dd-trace/src/config.js

@@ -1546,22 +1546,6 @@ class Config {
       }
     }
   }
-
-  // TODO: Refactor the Config class so it never produces any config objects that are incompatible with MessageChannel
-  /**
-   * Serializes the config object so it can be passed over a Worker Thread MessageChannel.
-   * @returns {Object} The serialized config object.
-   */
-  serialize () {
-    // URL objects cannot be serialized over the MessageChannel, so we need to convert them to strings first
-    if (this.url instanceof URL) {
-      const config = { ...this }
-      config.url = this.url.toString()
-      return config
-    }
-
-    return this
-  }
 }
 
 function handleOtel (tagString) {

package/packages/dd-trace/src/debugger/config.js

@@ -0,0 +1,16 @@
+'use strict'
+
+module.exports = function getDebuggerConfig (config) {
+  return {
+    commitSHA: config.commitSHA,
+    debug: config.debug,
+    dynamicInstrumentation: config.dynamicInstrumentation,
+    hostname: config.hostname,
+    logLevel: config.logLevel,
+    port: config.port,
+    repositoryUrl: config.repositoryUrl,
+    runtimeId: config.tags['runtime-id'],
+    service: config.service,
+    url: config.url?.toString(),
+  }
+}

package/packages/dd-trace/src/debugger/devtools_client/breakpoints.js

@@ -12,7 +12,7 @@ const {
   breakpointToProbes,
   probeToLocation
 } = require('./state')
-const log = require('../../log')
+const log = require('./log')
 
 let sessionStarted = false
 const probes = new Map()

package/packages/dd-trace/src/debugger/devtools_client/config.js

@@ -2,14 +2,10 @@
 
 const { workerData: { config: parentConfig, parentThreadId, configPort } } = require('node:worker_threads')
 const { format } = require('node:url')
-const log = require('../../log')
+const log = require('./log')
 
 const config = module.exports = {
-  dynamicInstrumentation: parentConfig.dynamicInstrumentation,
-  runtimeId: parentConfig.tags['runtime-id'],
-  service: parentConfig.service,
-  commitSHA: parentConfig.commitSHA,
-  repositoryUrl: parentConfig.repositoryUrl,
+  ...parentConfig,
   parentThreadId,
   maxTotalPayloadSize: 5 * 1024 * 1024 // 5MB
 }

package/packages/dd-trace/src/debugger/devtools_client/index.js

@@ -9,7 +9,7 @@ const { getStackFromCallFrames } = require('./state')
 const { ackEmitting } = require('./status')
 const { parentThreadId } = require('./config')
 const { MAX_SNAPSHOTS_PER_SECOND_GLOBALLY } = require('./defaults')
-const log = require('../../log')
+const log = require('./log')
 const { version } = require('../../../../../package.json')
 const { NODE_MAJOR } = require('../../../../../version')
 

package/packages/dd-trace/src/debugger/devtools_client/log.js

@@ -0,0 +1,19 @@
+'use strict'
+
+const { workerData } = require('node:worker_threads')
+
+// For testing purposes, we allow `workerData` to be undefined and fallback to a default config
+const { config: { debug, logLevel }, logPort } = workerData ?? { config: { debug: false } }
+
+const LEVELS = ['error', 'warn', 'info', 'debug']
+const on = (level, ...args) => {
+  if (typeof args[0] === 'function') {
+    args = [args[0]()]
+  }
+  logPort.postMessage({ level, args })
+}
+const off = () => {}
+
+for (const level of LEVELS) {
+  module.exports[level] = debug && LEVELS.indexOf(logLevel) >= LEVELS.indexOf(level) ? on.bind(null, level) : off
+}

package/packages/dd-trace/src/debugger/devtools_client/remote_config.js

@@ -3,7 +3,7 @@
 const { workerData: { probePort } } = require('node:worker_threads')
 const { addBreakpoint, removeBreakpoint, modifyBreakpoint } = require('./breakpoints')
 const { ackReceived, ackInstalled, ackError } = require('./status')
-const log = require('../../log')
+const log = require('./log')
 
 // Example log line probe (simplified):
 // {

package/packages/dd-trace/src/debugger/devtools_client/send.js

@@ -7,7 +7,7 @@ const config = require('./config')
 const JSONBuffer = require('./json-buffer')
 const request = require('../../exporters/common/request')
 const { GIT_COMMIT_SHA, GIT_REPOSITORY_URL } = require('../../plugins/util/tags')
-const log = require('../../log')
+const log = require('./log')
 const { version } = require('../../../../../package.json')
 const { getEnvironmentVariable } = require('../../config-helper')
 

package/packages/dd-trace/src/debugger/devtools_client/snapshot/index.js

@@ -2,7 +2,7 @@
 
 const { getRuntimeObject } = require('./collector')
 const { processRawState } = require('./processor')
-const log = require('../../../log')
+const log = require('../log')
 
 const DEFAULT_MAX_REFERENCE_DEPTH = 3
 const DEFAULT_MAX_COLLECTION_SIZE = 100

package/packages/dd-trace/src/debugger/devtools_client/state.js

@@ -4,7 +4,7 @@ const { join, dirname } = require('path')
 const { normalize } = require('source-map/lib/util')
 const { loadSourceMapSync } = require('./source-maps')
 const session = require('./session')
-const log = require('../../log')
+const log = require('./log')
 
 const WINDOWS_DRIVE_LETTER_REGEX = /[a-zA-Z]/
 

package/packages/dd-trace/src/debugger/devtools_client/status.js

@@ -5,7 +5,7 @@ const config = require('./config')
 const JSONBuffer = require('./json-buffer')
 const request = require('../../exporters/common/request')
 const FormData = require('../../exporters/common/form-data')
-const log = require('../../log')
+const log = require('./log')
 
 module.exports = {
   ackReceived,

package/packages/dd-trace/src/debugger/index.js

@@ -4,6 +4,7 @@ const { readFile } = require('fs')
 const { types } = require('util')
 const { join } = require('path')
 const { Worker, MessageChannel, threadId: parentThreadId } = require('worker_threads')
+const getDebuggerConfig = require('./config')
 const log = require('../log')
 
 let worker = null
@@ -25,6 +26,7 @@ function start (config, rc) {
 
   const rcAckCallbacks = new Map()
   const probeChannel = new MessageChannel()
+  const logChannel = new MessageChannel()
   configChannel = new MessageChannel()
 
   process[Symbol.for('datadog:node:util:types')] = types
@@ -54,18 +56,24 @@ function start (config, rc) {
   })
   probeChannel.port2.on('messageerror', (err) => log.error('[debugger] received "messageerror" on probe port', err))
 
+  logChannel.port2.on('message', ({ level, args }) => {
+    log[level](...args)
+  })
+  logChannel.port2.on('messageerror', (err) => log.error('[debugger] received "messageerror" on log port', err))
+
   worker = new Worker(
     join(__dirname, 'devtools_client', 'index.js'),
     {
       execArgv: [], // Avoid worker thread inheriting the `-r` command line argument
       env, // Avoid worker thread inheriting the `NODE_OPTIONS` environment variable (in case it contains `-r`)
       workerData: {
-        config: config.serialize(),
+        config: getDebuggerConfig(config),
         parentThreadId,
         probePort: probeChannel.port1,
+        logPort: logChannel.port1,
         configPort: configChannel.port1
       },
-      transferList: [probeChannel.port1, configChannel.port1]
+      transferList: [probeChannel.port1, logChannel.port1, configChannel.port1]
     }
   )
 
@@ -94,13 +102,15 @@ function start (config, rc) {
   worker.unref()
   probeChannel.port1.unref()
   probeChannel.port2.unref()
+  logChannel.port1.unref()
+  logChannel.port2.unref()
   configChannel.port1.unref()
   configChannel.port2.unref()
 }
 
 function configure (config) {
   if (configChannel === null) return
-  configChannel.port2.postMessage(config.serialize())
+  configChannel.port2.postMessage(getDebuggerConfig(config))
 }
 
 function readProbeFile (path, cb) {

package/packages/dd-trace/src/plugins/util/ci.js

@@ -27,7 +27,8 @@ const {
   GIT_COMMIT_COMMITTER_EMAIL,
   CI_NODE_LABELS,
   CI_NODE_NAME,
-  PR_NUMBER
+  PR_NUMBER,
+  CI_JOB_ID
 } = require('./tags')
 const { filterSensitiveInfoFromRepository } = require('./url')
 const { getEnvironmentVariable, getEnvironmentVariables } = require('../../config-helper')
@@ -210,7 +211,8 @@ module.exports = {
         [CI_NODE_LABELS]: CI_RUNNER_TAGS,
         [CI_NODE_NAME]: CI_RUNNER_ID,
         [GIT_PULL_REQUEST_BASE_BRANCH]: CI_MERGE_REQUEST_TARGET_BRANCH_NAME,
-        [PR_NUMBER]: CI_MERGE_REQUEST_IID
+        [PR_NUMBER]: CI_MERGE_REQUEST_IID,
+        [CI_JOB_ID]: GITLAB_CI_JOB_ID
       }
     }
 
@@ -247,7 +249,8 @@ module.exports = {
           CIRCLE_WORKFLOW_ID,
           CIRCLE_BUILD_NUM,
         }),
-        [PR_NUMBER]: CIRCLE_PR_NUMBER
+        [PR_NUMBER]: CIRCLE_PR_NUMBER,
+        [CI_JOB_ID]: CIRCLE_BUILD_NUM
       }
     }
 
@@ -298,7 +301,8 @@ module.exports = {
           GITHUB_REPOSITORY,
           GITHUB_RUN_ID,
           GITHUB_RUN_ATTEMPT
-        })
+        }),
+        [CI_JOB_ID]: GITHUB_JOB
       }
       if (GITHUB_BASE_REF) { // `pull_request` or `pull_request_target` event
         tags[GIT_PULL_REQUEST_BASE_BRANCH] = GITHUB_BASE_REF
@@ -407,7 +411,8 @@ module.exports = {
         [CI_JOB_NAME]: SYSTEM_JOBDISPLAYNAME,
         [CI_ENV_VARS]: JSON.stringify({ SYSTEM_TEAMPROJECTID, BUILD_BUILDID, SYSTEM_JOBID }),
         [PR_NUMBER]: SYSTEM_PULLREQUEST_PULLREQUESTNUMBER,
-        [GIT_PULL_REQUEST_BASE_BRANCH]: SYSTEM_PULLREQUEST_TARGETBRANCH
+        [GIT_PULL_REQUEST_BASE_BRANCH]: SYSTEM_PULLREQUEST_TARGETBRANCH,
+        [CI_JOB_ID]: SYSTEM_JOBID
       }
 
       if (SYSTEM_TEAMFOUNDATIONSERVERURI && SYSTEM_TEAMPROJECTID && BUILD_BUILDID) {
@@ -510,7 +515,8 @@ module.exports = {
         BUILDKITE_MESSAGE,
         BUILDKITE_AGENT_ID,
         BUILDKITE_PULL_REQUEST,
-        BUILDKITE_PULL_REQUEST_BASE_BRANCH
+        BUILDKITE_PULL_REQUEST_BASE_BRANCH,
+        BUILDKITE_CI_JOB_ID
       } = env
 
       const extraTags = Object.keys(env).filter(envVar =>
@@ -542,6 +548,7 @@ module.exports = {
         [CI_NODE_NAME]: BUILDKITE_AGENT_ID,
         [CI_NODE_LABELS]: JSON.stringify(extraTags),
         [PR_NUMBER]: BUILDKITE_PULL_REQUEST,
+        [CI_JOB_ID]: BUILDKITE_CI_JOB_ID
       }
 
       if (BUILDKITE_PULL_REQUEST) {
@@ -682,7 +689,8 @@ module.exports = {
           CODEBUILD_BUILD_ARN,
           DD_PIPELINE_EXECUTION_ID,
           DD_ACTION_EXECUTION_ID
-        })
+        }),
+        [CI_JOB_ID]: DD_ACTION_EXECUTION_ID
       }
     }
 

package/packages/dd-trace/src/plugins/util/git.js

@@ -22,9 +22,9 @@ const {
   GIT_COMMIT_HEAD_AUTHOR_DATE,
   GIT_COMMIT_HEAD_AUTHOR_EMAIL,
   GIT_COMMIT_HEAD_AUTHOR_NAME,
-  GIT_COMMIT_HEAD_COMMITER_DATE,
-  GIT_COMMIT_HEAD_COMMITER_EMAIL,
-  GIT_COMMIT_HEAD_COMMITER_NAME,
+  GIT_COMMIT_HEAD_COMMITTER_DATE,
+  GIT_COMMIT_HEAD_COMMITTER_EMAIL,
+  GIT_COMMIT_HEAD_COMMITTER_NAME,
   GIT_COMMIT_HEAD_MESSAGE
 } = require('./tags')
 const {
@@ -503,9 +503,9 @@ function getGitMetadata (ciMetadata) {
     tags[GIT_COMMIT_HEAD_AUTHOR_DATE] = headAuthorDate
     tags[GIT_COMMIT_HEAD_AUTHOR_EMAIL] = headAuthorEmail
     tags[GIT_COMMIT_HEAD_AUTHOR_NAME] = headAuthorName
-    tags[GIT_COMMIT_HEAD_COMMITER_DATE] = headCommitterDate
-    tags[GIT_COMMIT_HEAD_COMMITER_EMAIL] = headCommitterEmail
-    tags[GIT_COMMIT_HEAD_COMMITER_NAME] = headCommitterName
+    tags[GIT_COMMIT_HEAD_COMMITTER_DATE] = headCommitterDate
+    tags[GIT_COMMIT_HEAD_COMMITTER_EMAIL] = headCommitterEmail
+    tags[GIT_COMMIT_HEAD_COMMITTER_NAME] = headCommitterName
   }
 
   const entries = [

package/packages/dd-trace/src/plugins/util/tags.js

@@ -16,9 +16,9 @@ const GIT_COMMIT_HEAD_MESSAGE = 'git.commit.head.message'
 const GIT_COMMIT_HEAD_AUTHOR_DATE = 'git.commit.head.author.date'
 const GIT_COMMIT_HEAD_AUTHOR_EMAIL = 'git.commit.head.author.email'
 const GIT_COMMIT_HEAD_AUTHOR_NAME = 'git.commit.head.author.name'
-const GIT_COMMIT_HEAD_COMMITER_DATE = 'git.commit.head.commiter.date'
-const GIT_COMMIT_HEAD_COMMITER_EMAIL = 'git.commit.head.commiter.email'
-const GIT_COMMIT_HEAD_COMMITER_NAME = 'git.commit.head.commiter.name'
+const GIT_COMMIT_HEAD_COMMITTER_DATE = 'git.commit.head.committer.date'
+const GIT_COMMIT_HEAD_COMMITTER_EMAIL = 'git.commit.head.committer.email'
+const GIT_COMMIT_HEAD_COMMITTER_NAME = 'git.commit.head.committer.name'
 
 const GIT_PULL_REQUEST_BASE_BRANCH_SHA = 'git.pull_request.base_branch_sha'
 const GIT_PULL_REQUEST_BASE_BRANCH = 'git.pull_request.base_branch'
@@ -31,6 +31,7 @@ const CI_PROVIDER_NAME = 'ci.provider.name'
 const CI_WORKSPACE_PATH = 'ci.workspace_path'
 const CI_JOB_URL = 'ci.job.url'
 const CI_JOB_NAME = 'ci.job.name'
+const CI_JOB_ID = 'ci.job.id'
 const CI_STAGE_NAME = 'ci.stage.name'
 const CI_NODE_NAME = 'ci.node.name'
 const CI_NODE_LABELS = 'ci.node.labels'
@@ -56,9 +57,9 @@ module.exports = {
   GIT_COMMIT_HEAD_AUTHOR_DATE,
   GIT_COMMIT_HEAD_AUTHOR_EMAIL,
   GIT_COMMIT_HEAD_AUTHOR_NAME,
-  GIT_COMMIT_HEAD_COMMITER_DATE,
-  GIT_COMMIT_HEAD_COMMITER_EMAIL,
-  GIT_COMMIT_HEAD_COMMITER_NAME,
+  GIT_COMMIT_HEAD_COMMITTER_DATE,
+  GIT_COMMIT_HEAD_COMMITTER_EMAIL,
+  GIT_COMMIT_HEAD_COMMITTER_NAME,
   GIT_PULL_REQUEST_BASE_BRANCH_SHA,
   GIT_PULL_REQUEST_BASE_BRANCH,
   CI_PIPELINE_ID,
@@ -69,6 +70,7 @@ module.exports = {
   CI_WORKSPACE_PATH,
   CI_JOB_URL,
   CI_JOB_NAME,
+  CI_JOB_ID,
   CI_STAGE_NAME,
   CI_ENV_VARS,
   CI_NODE_NAME,

package/packages/dd-trace/src/remote_config/capabilities.js

@@ -29,5 +29,6 @@ module.exports = {
   ASM_NETWORK_FINGERPRINT: 1n << 34n,
   ASM_HEADER_FINGERPRINT: 1n << 35n,
   ASM_RASP_CMDI: 1n << 37n,
-  ASM_DD_MULTICONFIG: 1n << 42n
+  ASM_DD_MULTICONFIG: 1n << 42n,
+  ASM_TRACE_TAGGING_RULES: 1n << 43n,
 }

package/packages/dd-trace/src/remote_config/index.js

@@ -95,6 +95,7 @@ function enableWafUpdate (appsecConfig) {
     rc.updateCapabilities(RemoteConfigCapabilities.ASM_NETWORK_FINGERPRINT, true)
     rc.updateCapabilities(RemoteConfigCapabilities.ASM_HEADER_FINGERPRINT, true)
     rc.updateCapabilities(RemoteConfigCapabilities.ASM_DD_MULTICONFIG, true)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_TRACE_TAGGING_RULES, true)
 
     if (appsecConfig.rasp?.enabled) {
       rc.updateCapabilities(RemoteConfigCapabilities.ASM_RASP_SQLI, true)
@@ -132,6 +133,7 @@ function disableWafUpdate () {
     rc.updateCapabilities(RemoteConfigCapabilities.ASM_NETWORK_FINGERPRINT, false)
     rc.updateCapabilities(RemoteConfigCapabilities.ASM_HEADER_FINGERPRINT, false)
     rc.updateCapabilities(RemoteConfigCapabilities.ASM_DD_MULTICONFIG, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_TRACE_TAGGING_RULES, false)
 
     rc.updateCapabilities(RemoteConfigCapabilities.ASM_RASP_SQLI, false)
     rc.updateCapabilities(RemoteConfigCapabilities.ASM_RASP_SSRF, false)