dd-trace 5.80.0 → 5.82.0

package/packages/dd-trace/src/appsec/remote_config.js

@@ -0,0 +1,177 @@
+'use strict'
+
+const log = require('../log')
+const { updateConfig } = require('../telemetry')
+const RemoteConfigCapabilities = require('../remote_config/capabilities')
+const { setCollectionMode } = require('./user_tracking')
+const Activation = require('./activation')
+
+let autoUserInstrumModeId
+let rc
+
+/**
+ * Configures remote config handlers for appsec features
+ *
+ * @param {object} rcInstance - RemoteConfig instance
+ * @param {object} config - Tracer config
+ * @param {object} appsec - Appsec module
+ */
+function enable (rcInstance, config, appsec) {
+  rc = rcInstance
+  const activation = Activation.fromConfig(config)
+
+  if (activation !== Activation.DISABLED) {
+    if (activation === Activation.ONECLICK) {
+      rc.updateCapabilities(RemoteConfigCapabilities.ASM_ACTIVATION, true)
+    }
+
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_AUTO_USER_INSTRUM_MODE, true)
+
+    rc.setProductHandler('ASM_FEATURES', (action, rcConfig, configId) => {
+      if (!rcConfig) return
+
+      // this is put before other handlers because it can reject the config
+      if (typeof rcConfig.auto_user_instrum?.mode === 'string') {
+        if (action === 'apply' || action === 'modify') {
+          // check if there is already a config applied with this field
+          if (autoUserInstrumModeId && configId !== autoUserInstrumModeId) {
+            log.error('[RC] Multiple auto_user_instrum received in ASM_FEATURES. Discarding config')
+            // eslint-disable-next-line no-throw-literal
+            throw 'Multiple auto_user_instrum.mode received in ASM_FEATURES'
+          }
+
+          setCollectionMode(rcConfig.auto_user_instrum.mode)
+          autoUserInstrumModeId = configId
+        } else if (configId === autoUserInstrumModeId) {
+          setCollectionMode(config.appsec.eventTracking.mode)
+          autoUserInstrumModeId = null
+        }
+      }
+
+      if (activation === Activation.ONECLICK) {
+        enableOrDisableAppsec(action, rcConfig, config, appsec)
+      }
+    })
+  }
+}
+
+/**
+ * Enables or disables appsec based on remote config
+ *
+ * @param {string} action - 'apply', 'modify', or 'unapply'
+ * @param {object} rcConfig - Remote config
+ * @param {object} config - Tracer config
+ * @param {object} appsec - Appsec module
+ */
+function enableOrDisableAppsec (action, rcConfig, config, appsec) {
+  if (typeof rcConfig.asm?.enabled === 'boolean') {
+    const isRemoteConfigControlling = action === 'apply' || action === 'modify'
+    const shouldEnable = isRemoteConfigControlling
+      ? rcConfig.asm.enabled // take control
+      : config.appsec.enabled // give back control to local config
+
+    if (shouldEnable) {
+      appsec.enable(config)
+    } else {
+      appsec.disable()
+    }
+
+    updateConfig([
+      {
+        name: 'appsec.enabled',
+        origin: isRemoteConfigControlling ? 'remote_config' : config.getOrigin('appsec.enabled'),
+        value: shouldEnable
+      }
+    ], config)
+  }
+}
+
+/**
+ * Enables WAF update capabilities for remote config
+ *
+ * @param {object} appsecConfig - Appsec config
+ */
+function enableWafUpdate (appsecConfig) {
+  if (rc && appsecConfig && !appsecConfig.rules) {
+    // dirty require to make startup faster for serverless
+    const { ASM_WAF_PRODUCTS } = require('./rc-products')
+    const RuleManager = require('./rule_manager')
+
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_IP_BLOCKING, true)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_USER_BLOCKING, true)
+    // TODO: we should have a different capability for rule override
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_DD_RULES, true)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_EXCLUSIONS, true)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_REQUEST_BLOCKING, true)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_RESPONSE_BLOCKING, true)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_CUSTOM_RULES, true)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_CUSTOM_BLOCKING_RESPONSE, true)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_TRUSTED_IPS, true)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_PROCESSOR_OVERRIDES, true)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_CUSTOM_DATA_SCANNERS, true)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_EXCLUSION_DATA, true)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_ENDPOINT_FINGERPRINT, true)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_SESSION_FINGERPRINT, true)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_NETWORK_FINGERPRINT, true)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_HEADER_FINGERPRINT, true)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_DD_MULTICONFIG, true)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_TRACE_TAGGING_RULES, true)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_EXTENDED_DATA_COLLECTION, true)
+
+    if (appsecConfig.rasp?.enabled) {
+      rc.updateCapabilities(RemoteConfigCapabilities.ASM_RASP_SQLI, true)
+      rc.updateCapabilities(RemoteConfigCapabilities.ASM_RASP_SSRF, true)
+      rc.updateCapabilities(RemoteConfigCapabilities.ASM_RASP_LFI, true)
+      rc.updateCapabilities(RemoteConfigCapabilities.ASM_RASP_SHI, true)
+      rc.updateCapabilities(RemoteConfigCapabilities.ASM_RASP_CMDI, true)
+    }
+
+    rc.subscribeProducts(...ASM_WAF_PRODUCTS)
+    rc.setBatchHandler(ASM_WAF_PRODUCTS, RuleManager.updateWafFromRC)
+  }
+}
+
+/**
+ * Disables WAF update capabilities for remote config
+ */
+function disableWafUpdate () {
+  if (rc) {
+    const { ASM_WAF_PRODUCTS } = require('./rc-products')
+    const RuleManager = require('./rule_manager')
+
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_IP_BLOCKING, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_USER_BLOCKING, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_DD_RULES, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_EXCLUSIONS, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_REQUEST_BLOCKING, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_RESPONSE_BLOCKING, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_CUSTOM_RULES, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_CUSTOM_BLOCKING_RESPONSE, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_TRUSTED_IPS, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_PROCESSOR_OVERRIDES, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_CUSTOM_DATA_SCANNERS, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_EXCLUSION_DATA, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_ENDPOINT_FINGERPRINT, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_SESSION_FINGERPRINT, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_NETWORK_FINGERPRINT, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_HEADER_FINGERPRINT, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_DD_MULTICONFIG, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_TRACE_TAGGING_RULES, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_EXTENDED_DATA_COLLECTION, false)
+
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_RASP_SQLI, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_RASP_SSRF, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_RASP_LFI, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_RASP_SHI, false)
+    rc.updateCapabilities(RemoteConfigCapabilities.ASM_RASP_CMDI, false)
+
+    rc.unsubscribeProducts(...ASM_WAF_PRODUCTS)
+    rc.removeBatchHandler(RuleManager.updateWafFromRC)
+  }
+}
+
+module.exports = {
+  enable,
+  enableWafUpdate,
+  disableWafUpdate
+}

package/packages/dd-trace/src/appsec/reporter.js

@@ -1,11 +1,13 @@
 'use strict'
 
-const dc = require('dc-polyfill')
 const zlib = require('zlib')
+const dc = require('dc-polyfill')
 
 const { storage } = require('../../../datadog-core')
 const web = require('../plugins/util/web')
 const { ipHeaderList } = require('../plugins/util/ip_extractor')
+const { keepTrace } = require('../priority_sampler')
+const { ASM } = require('../standalone/product')
 const {
   incrementWafInitMetric,
   incrementWafUpdatesMetric,
@@ -16,8 +18,6 @@ const {
   updateRaspRuleSkippedMetricTags,
   getRequestMetrics
 } = require('./telemetry')
-const { keepTrace } = require('../priority_sampler')
-const { ASM } = require('../standalone/product')
 const { DIAGNOSTIC_KEYS } = require('./waf/diagnostics')
 
 const REQUEST_HEADER_TAG_PREFIX = 'http.request.headers.'
@@ -546,10 +546,6 @@ function finishRequest (req, res, storedResponseHeaders, requestBody) {
     reportRequestBody(rootSpan, requestBody)
   }
 
-  if (tags['appsec.event'] === 'true' && typeof req.route?.path === 'string') {
-    newTags['http.endpoint'] = req.route.path
-  }
-
   rootSpan.addTags(newTags)
 }
 

package/packages/dd-trace/src/appsec/rule_manager.js

@@ -1,14 +1,12 @@
 'use strict'
 
-const fs = require('fs')
+const { readFileSync } = require('node:fs')
+
 const waf = require('./waf')
 const { DIAGNOSTIC_KEYS } = require('./waf/diagnostics')
-const { ACKNOWLEDGED, ERROR } = require('../remote_config/apply_states')
-const Reporter = require('./reporter')
-
 const blocking = require('./blocking')
-
-const ASM_PRODUCTS = new Set(['ASM', 'ASM_DD', 'ASM_DATA'])
+const Reporter = require('./reporter')
+const { ASM_WAF_PRODUCTS_SET } = require('./rc-products')
 
 /*
   ASM Actions must be tracked in order to update the defaultBlockingActions in blocking. These actions are used
@@ -16,9 +14,21 @@ const ASM_PRODUCTS = new Set(['ASM', 'ASM_DD', 'ASM_DATA'])
  */
 let appliedActions = new Map()
 
+/**
+ * @typedef {object} AsmConfigFile
+ * @property {Array<Record<string, unknown>>} [actions]
+ */
+
+/**
+ * @typedef {import('./waf').WAFConfig & { rules?: string }} AppSecConfig
+ */
+
+/**
+ * @param {AppSecConfig} config
+ */
 function loadRules (config) {
   const defaultRules = config.rules
-    ? JSON.parse(fs.readFileSync(config.rules))
+    ? JSON.parse(readFileSync(config.rules, 'utf8'))
     : require('./recommended.json')
 
   waf.init(defaultRules, config)
@@ -26,19 +36,26 @@ function loadRules (config) {
   blocking.setDefaultBlockingActionParameters(defaultRules?.actions)
 }
 
-function updateWafFromRC ({ toUnapply, toApply, toModify }) {
+/**
+ * Apply ASM remote-config updates to the WAF in a single batch.
+ *
+ * @param {import('../remote_config/manager').RcBatchUpdateTransaction} transaction
+ */
+function updateWafFromRC (transaction) {
+  const { toUnapply, toApply, toModify } = transaction
+
   const newActions = new SpyMap(appliedActions)
 
   let wafUpdated = false
   let wafUpdatedFailed = false
 
   for (const item of toUnapply) {
-    if (!ASM_PRODUCTS.has(item.product)) continue
+    if (!ASM_WAF_PRODUCTS_SET.has(item.product)) continue
 
     try {
       waf.removeConfig(item.path)
 
-      item.apply_state = ACKNOWLEDGED
+      transaction.ack(item.path)
       wafUpdated = true
 
       // ASM actions
@@ -46,30 +63,30 @@ function updateWafFromRC ({ toUnapply, toApply, toModify }) {
         newActions.delete(item.id)
       }
     } catch (e) {
-      item.apply_state = ERROR
-      item.apply_error = e.toString()
+      transaction.error(item.path, e)
       wafUpdatedFailed = true
     }
   }
 
   for (const item of [...toApply, ...toModify]) {
-    if (!ASM_PRODUCTS.has(item.product)) continue
+    if (!ASM_WAF_PRODUCTS_SET.has(item.product)) continue
 
     try {
       waf.updateConfig(item.product, item.id, item.path, item.file)
 
-      item.apply_state = ACKNOWLEDGED
+      transaction.ack(item.path)
       wafUpdated = true
 
       // ASM actions
-      if (item.product === 'ASM' && item.file?.actions?.length) {
-        newActions.set(item.id, item.file.actions)
+      if (item.product === 'ASM') {
+        const asmFile = /** @type {AsmConfigFile} */ (item.file)
+        if (asmFile?.actions?.length) {
+          newActions.set(item.id, asmFile.actions)
+        }
       }
     } catch (e) {
-      item.apply_state = ERROR
-      item.apply_error = e instanceof waf.WafUpdateError
-        ? JSON.stringify(extractErrors(e.diagnosticErrors))
-        : e.toString()
+      const error = e instanceof waf.WafUpdateError ? JSON.stringify(extractErrors(e.diagnosticErrors)) : e
+      transaction.error(item.path, error)
       wafUpdatedFailed = true
     }
   }

package/packages/dd-trace/src/appsec/sdk/index.js

@@ -1,5 +1,6 @@
 'use strict'
 
+const { setTemplates } = require('../blocking')
 const {
   trackUserLoginSuccessEvent,
   trackUserLoginFailureEvent,
@@ -8,7 +9,6 @@ const {
   trackUserLoginFailureV2
 } = require('./track_event')
 const { checkUserAndSetUser, blockRequest } = require('./user_blocking')
-const { setTemplates } = require('../blocking')
 const { setUser } = require('./set_user')
 
 class EventTrackingV2 {

package/packages/dd-trace/src/appsec/sdk/set_user.js

@@ -1,9 +1,9 @@
 'use strict'
 
-const { getRootSpan } = require('./utils')
 const log = require('../../log')
 const waf = require('../waf')
 const addresses = require('../addresses')
+const { getRootSpan } = require('./utils')
 
 function setUserTags (user, rootSpan) {
   for (const k of Object.keys(user)) {

package/packages/dd-trace/src/appsec/sdk/track_event.js

@@ -1,13 +1,13 @@
 'use strict'
 
 const log = require('../../log')
-const { getRootSpan } = require('./utils')
-const { setUserTags } = require('./set_user')
 const waf = require('../waf')
 const { keepTrace } = require('../../priority_sampler')
 const addresses = require('../addresses')
 const { ASM } = require('../../standalone/product')
 const { incrementSdkEventMetric } = require('../telemetry')
+const { setUserTags } = require('./set_user')
+const { getRootSpan } = require('./utils')
 
 /**
  * @deprecated in favor of trackUserLoginSuccessV2

package/packages/dd-trace/src/appsec/sdk/user_blocking.js

@@ -2,11 +2,11 @@
 
 const { USER_ID } = require('../addresses')
 const waf = require('../waf')
-const { getRootSpan } = require('./utils')
 const { block, getBlockingAction } = require('../blocking')
 const { storage } = require('../../../../datadog-core')
-const { setUserTags } = require('./set_user')
 const log = require('../../log')
+const { setUserTags } = require('./set_user')
+const { getRootSpan } = require('./utils')
 
 function isUserBlocked (user) {
   const results = waf.run({ persistent: { [USER_ID]: user.id } })

package/packages/dd-trace/src/appsec/user_tracking.js

@@ -2,11 +2,11 @@
 
 const crypto = require('crypto')
 const log = require('../log')
+const { keepTrace } = require('../priority_sampler')
+const { ASM } = require('../standalone/product')
 const telemetry = require('./telemetry')
 const addresses = require('./addresses')
-const { keepTrace } = require('../priority_sampler')
 const waf = require('./waf')
-const { ASM } = require('../standalone/product')
 
 // the RFC doesn't include '_id', but it's common in MongoDB
 const USER_ID_FIELDS = ['id', '_id', 'email', 'username', 'login', 'user']

package/packages/dd-trace/src/appsec/waf/index.js

@@ -19,7 +19,17 @@ class WafUpdateError extends Error {
 
 let limiter = new Limiter(100)
 
+/** @typedef {import('./waf_manager')} WAFManager */
+
+/** @type {typeof import('./waf_manager') | null} */
+let WAFManager = null
+
+/**
+ * @typedef {import('./waf_manager').WAFManagerConfig & { rateLimit: number }} WAFConfig
+ */
+
 const waf = {
+  /** @type {WAFManager | null} */
   wafManager: null,
   init,
   destroy,
@@ -31,13 +41,17 @@ const waf = {
   WafUpdateError
 }
 
+/**
+ * @param {object} rules
+ * @param {WAFConfig} config
+ */
 function init (rules, config) {
   destroy()
 
   limiter = new Limiter(config.rateLimit)
 
-  // dirty require to make startup faster for serverless
-  const WAFManager = require('./waf_manager')
+  // Lazy loading improves the startup time
+  WAFManager = require('./waf_manager')
 
   waf.wafManager = new WAFManager(rules, config)
 
@@ -70,7 +84,7 @@ function updateConfig (product, configId, configPath, config) {
 
   try {
     if (product === 'ASM_DD') {
-      waf.wafManager.removeConfig(waf.wafManager.constructor.defaultWafConfigPath)
+      waf.wafManager.removeConfig((/** @type {NonNullable<typeof WAFManager>} */ (WAFManager)).defaultWafConfigPath)
     }
 
     const updateSucceeded = waf.wafManager.updateConfig(configPath, config)

package/packages/dd-trace/src/appsec/waf/waf_manager.js

@@ -6,9 +6,20 @@ const WAFContextWrapper = require('./waf_context_wrapper')
 
 const contexts = new WeakMap()
 
+/**
+ * @typedef {object} WAFManagerConfig
+ * @property {number} wafTimeout - Maximum time in microseconds for WAF execution
+ * @property {string} obfuscatorKeyRegex - Regex to redact sensitive data by key
+ * @property {string} obfuscatorValueRegex - Regex to redact sensitive data by value
+ */
+
 class WAFManager {
   static defaultWafConfigPath = 'datadog/00/ASM_DD/default/config'
 
+  /**
+   * @param {object} rules
+   * @param {WAFManagerConfig} config
+   */
   constructor (rules, config) {
     this.config = config
     this.wafTimeout = config.wafTimeout

package/packages/dd-trace/src/azure_metadata.js

@@ -3,8 +3,8 @@
 // Modeled after https://github.com/DataDog/libdatadog/blob/f3994857a59bb5679a65967138c5a3aec418a65f/ddcommon/src/azure_app_services.rs
 
 const os = require('os')
-const { getIsAzureFunction } = require('./serverless')
 const { getEnvironmentVariable, getEnvironmentVariables } = require('../../dd-trace/src/config-helper')
+const { getIsAzureFunction, getIsFlexConsumptionAzureFunction } = require('./serverless')
 
 function extractSubscriptionID (ownerName) {
   if (ownerName !== undefined) {
@@ -38,6 +38,7 @@ function buildMetadata () {
   const {
     COMPUTERNAME,
     DD_AAS_DOTNET_EXTENSION_VERSION,
+    DD_AZURE_RESOURCE_GROUP,
     FUNCTIONS_EXTENSION_VERSION,
     FUNCTIONS_WORKER_RUNTIME,
     FUNCTIONS_WORKER_RUNTIME_VERSION,
@@ -56,7 +57,12 @@ function buildMetadata () {
     ? ['functionapp', 'function']
     : ['app', 'app']
 
-  const resourceGroup = WEBSITE_RESOURCE_GROUP ?? extractResourceGroup(WEBSITE_OWNER_NAME)
+  // Azure Functions on Flex Consumption plans require the `DD_AZURE_RESOURCE_GROUP` env var.
+  // If this logic ever changes, update the logic in `libdatadog`, `serverless-components/src/datadog-trace-agent`,
+  // and the serverless compat layers accordingly.
+  const resourceGroup = getIsFlexConsumptionAzureFunction()
+    ? (DD_AZURE_RESOURCE_GROUP ?? WEBSITE_RESOURCE_GROUP ?? extractResourceGroup(WEBSITE_OWNER_NAME))
+    : (WEBSITE_RESOURCE_GROUP ?? extractResourceGroup(WEBSITE_OWNER_NAME))
 
   return trimObject({
     extensionVersion: DD_AAS_DOTNET_EXTENSION_VERSION,

package/packages/dd-trace/src/ci-visibility/dynamic-instrumentation/worker/index.js

@@ -2,6 +2,7 @@
 
 const {
   workerData: {
+    config,
     breakpointSetChannel,
     breakpointHitChannel,
     breakpointRemoveChannel
@@ -21,6 +22,7 @@ const {
   getStackFromCallFrames
 } = require('../../../debugger/devtools_client/state')
 const log = require('../../../log')
+const processTags = require('../../../process-tags')
 
 let sessionStarted = false
 
@@ -36,7 +38,7 @@ session.on('Debugger.paused', async ({ params: { hitBreakpoints: [hitBreakpoint]
 
   const stack = getStackFromCallFrames(callFrames)
 
-  const getLocalState = await getLocalStateForCallFrame(callFrames[0])
+  const { processLocalState } = await getLocalStateForCallFrame(callFrames[0])
 
   await session.post('Debugger.resume')
 
@@ -48,15 +50,15 @@ session.on('Debugger.paused', async ({ params: { hitBreakpoints: [hitBreakpoint]
       version: '0',
       location: probe.location
     },
+    captures: {
+      lines: { [probe.location.lines[0]]: { locals: processLocalState() } }
+    },
     stack,
     language: 'javascript'
   }
 
-  const state = getLocalState()
-  if (state) {
-    snapshot.captures = {
-      lines: { [probe.location.lines[0]]: { locals: state } }
-    }
+  if (config.propagateProcessTags?.enabled) {
+    snapshot[processTags.DYNAMIC_INSTRUMENTATION_FIELD_NAME] = processTags.tagsObject
   }
 
   breakpointHitChannel.postMessage({ snapshot })

package/packages/dd-trace/src/ci-visibility/exporters/agentless/index.js

@@ -1,10 +1,10 @@
 'use strict'
 
 const URL = require('url').URL
-const Writer = require('./writer')
-const CoverageWriter = require('./coverage-writer')
 const CiVisibilityExporter = require('../ci-visibility-exporter')
 const log = require('../../../log')
+const Writer = require('./writer')
+const CoverageWriter = require('./coverage-writer')
 
 class AgentlessCiVisibilityExporter extends CiVisibilityExporter {
   constructor (config) {

package/packages/dd-trace/src/ci-visibility/exporters/ci-visibility-exporter.js

@@ -2,7 +2,6 @@
 
 const URL = require('url').URL
 
-const { sendGitMetadata: sendGitMetadataRequest } = require('./git/git_metadata')
 const { getLibraryConfiguration: getLibraryConfigurationRequest } = require('../requests/get-library-configuration')
 const { getSkippableSuites: getSkippableSuitesRequest } = require('../intelligent-test-runner/get-skippable-suites')
 const { getKnownTests: getKnownTestsRequest } = require('../early-flake-detection/get-known-tests')
@@ -11,6 +10,7 @@ const { getTestManagementTests: getTestManagementTestsRequest } =
 const log = require('../../log')
 const AgentInfoExporter = require('../../exporters/common/agent-info-exporter')
 const { GIT_REPOSITORY_URL, GIT_COMMIT_SHA } = require('../../plugins/util/tags')
+const { sendGitMetadata: sendGitMetadataRequest } = require('./git/git_metadata')
 
 function getTestConfigurationTags (tags) {
   if (!tags) {

package/packages/dd-trace/src/ci-visibility/exporters/test-worker/index.js

@@ -1,6 +1,5 @@
 'use strict'
 
-const Writer = require('./writer')
 const {
   JEST_WORKER_COVERAGE_PAYLOAD_CODE,
   JEST_WORKER_TRACE_PAYLOAD_CODE,
@@ -12,6 +11,7 @@ const {
   VITEST_WORKER_LOGS_PAYLOAD_CODE
 } = require('../../../plugins/util/test')
 const { getEnvironmentVariable } = require('../../../config-helper')
+const Writer = require('./writer')
 
 function getInterprocessTraceCode () {
   if (getEnvironmentVariable('JEST_WORKER_ID')) {

package/packages/dd-trace/src/ci-visibility/test-management/get-test-management-tests.js

@@ -14,7 +14,8 @@ function getTestManagementTests ({
   commitMessage,
   sha,
   commitHeadSha,
-  commitHeadMessage
+  commitHeadMessage,
+  branch
 }, done) {
   const options = {
     path: '/api/v2/test/libraries/test-management/tests',
@@ -49,7 +50,8 @@ function getTestManagementTests ({
       attributes: {
         repository_url: repositoryUrl,
         commit_message: commitHeadMessage || commitMessage,
-        sha: commitHeadSha || sha
+        sha: commitHeadSha || sha,
+        branch
       }
     }
   })

package/packages/dd-trace/src/config/remote_config.js

@@ -0,0 +1,34 @@
+'use strict'
+
+const RemoteConfigCapabilities = require('../remote_config/capabilities')
+
+/**
+ * Configures remote config for core APM tracing functionality
+ *
+ * @param {object} rc - RemoteConfig instance
+ * @param {object} config - Tracer config
+ * @param {Function} enableOrDisableTracing - Function to enable/disable tracing based on config
+ */
+function enable (rc, config, enableOrDisableTracing) {
+  // Register core APM tracing capabilities
+  rc.updateCapabilities(RemoteConfigCapabilities.APM_TRACING_CUSTOM_TAGS, true)
+  rc.updateCapabilities(RemoteConfigCapabilities.APM_TRACING_HTTP_HEADER_TAGS, true)
+  rc.updateCapabilities(RemoteConfigCapabilities.APM_TRACING_LOGS_INJECTION, true)
+  rc.updateCapabilities(RemoteConfigCapabilities.APM_TRACING_SAMPLE_RATE, true)
+  rc.updateCapabilities(RemoteConfigCapabilities.APM_TRACING_ENABLED, true)
+  rc.updateCapabilities(RemoteConfigCapabilities.APM_TRACING_SAMPLE_RULES, true)
+
+  // APM_TRACING product handler - manages tracer configuration
+  rc.setProductHandler('APM_TRACING', (action, conf) => {
+    if (action === 'unapply') {
+      config.configure({}, true)
+    } else {
+      config.configure(conf.lib_config, true)
+    }
+    enableOrDisableTracing(config, rc)
+  })
+}
+
+module.exports = {
+  enable
+}