dd-trace 5.95.0 → 5.97.0

package/index.d.ts

@@ -130,6 +130,11 @@ interface Tracer extends opentracing.Tracer {
 
   appsec: tracer.Appsec;
 
+  /**
+   * Profiling API for attaching custom labels to profiler samples.
+   */
+  profiling: tracer.Profiling;
+
   TracerProvider: tracer.opentelemetry.TracerProvider;
 
   dogstatsd: tracer.DogStatsD;
@@ -786,6 +791,15 @@ declare namespace tracer {
          * Programmatic configuration takes precedence over the environment variables listed above.
          */
         enabled?: boolean,
+        /**
+         * Whether to request blocking mode when evaluating prompts via auto-instrumentation.
+         * When `true`, AI Guard will block requests that violate security policies.
+         * When `false`, AI Guard evaluates but never blocks (monitor-only mode).
+         * @default false
+         * @env DD_AI_GUARD_BLOCK
+         * Programmatic configuration takes precedence over the environment variables listed above.
+         */
+        block?: boolean,
         /**
          * URL of the AI Guard REST API.
          * @env DD_AI_GUARD_ENDPOINT
@@ -1561,6 +1575,35 @@ declare namespace tracer {
     trackUserLoginFailure(login: string, metadata?: any): void;
   }
 
+  export interface Profiling {
+    /**
+     * Declares the set of custom label keys that will be used with
+     * {@link runWithLabels}. This is used for profile upload metadata
+     * (so the Datadog UI knows which keys to index for filtering) and
+     * for pprof serialization optimization.
+     *
+     * @param keys Custom label key names.
+     */
+    setCustomLabelKeys(keys: Iterable<string>): void;
+
+    /**
+     * Runs a function with custom profiling labels attached to all wall profiler
+     * samples taken during its execution. Labels are key-value pairs that appear
+     * in the pprof output and can be used to filter flame graphs in the Datadog UI.
+     *
+     * Requires AsyncContextFrame (ACF) to be enabled. Supports nesting: inner
+     * calls merge labels with outer calls, with inner values taking precedence.
+     *
+     * When profiling is not enabled or ACF is not active, the function is still
+     * called but labels are silently dropped.
+     *
+     * @param labels Custom labels to attach to profiler samples.
+     * @param fn Function to execute with the labels.
+     * @returns The return value of fn.
+     */
+    runWithLabels<T>(labels: Record<string, string | number>, fn: () => T): T;
+  }
+
   export interface Appsec {
     /**
      * Links a successful login event to the current trace. Will link the passed user to the current trace with Appsec.setUser() internally.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dd-trace",
-  "version": "5.95.0",
+  "version": "5.97.0",
   "description": "Datadog APM tracing client for JavaScript",
   "main": "index.js",
   "typings": "index.d.ts",
@@ -11,6 +11,8 @@
     "bench": "node benchmark/index.js",
     "bench:e2e:test-optimization": "node benchmark/e2e-test-optimization/benchmark-run.js",
     "dependencies:dedupe": "yarn-deduplicate yarn.lock",
+    "generate:config:types": "node scripts/generate-config-types.js",
+    "verify:config:types": "node scripts/generate-config-types.js --check",
     "type:check": "tsc --noEmit -p tsconfig.dev.json",
     "type:doc:build": "cd docs && yarn && yarn build",
     "type:doc:test": "cd docs && yarn && yarn test",
@@ -139,10 +141,10 @@
   ],
   "dependencies": {
     "dc-polyfill": "^0.1.10",
-    "import-in-the-middle": "^3.0.0"
+    "import-in-the-middle": "^3.0.1"
   },
   "optionalDependencies": {
-    "@datadog/libdatadog": "0.9.2",
+    "@datadog/libdatadog": "0.9.3",
     "@datadog/native-appsec": "11.0.1",
     "@datadog/native-iast-taint-tracking": "4.1.0",
     "@datadog/native-metrics": "3.1.1",
@@ -166,19 +168,19 @@
     "@types/mocha": "^10.0.10",
     "@types/node": "^18.19.106",
     "@types/sinon": "^21.0.0",
-    "axios": "^1.13.4",
+    "axios": "^1.15.0",
     "benchmark": "^2.1.4",
     "body-parser": "^2.2.2",
     "bun": "1.3.11",
     "codeowners-audit": "^2.9.0",
     "eslint": "^9.39.2",
-    "eslint-plugin-cypress": "^6.2.1",
+    "eslint-plugin-cypress": "^6.2.2",
     "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-jsdoc": "^62.8.1",
+    "eslint-plugin-jsdoc": "^62.9.0",
     "eslint-plugin-mocha": "^11.2.0",
     "eslint-plugin-n": "^17.23.2",
     "eslint-plugin-promise": "^7.2.1",
-    "eslint-plugin-unicorn": "^63.0.0",
+    "eslint-plugin-unicorn": "^64.0.0",
     "express": "^5.1.0",
     "glob": "^10.4.5",
     "globals": "^17.2.0",
@@ -200,7 +202,7 @@
     "semver": "^7.7.2",
     "sinon": "^21.0.3",
     "tiktoken": "^1.0.21",
-    "typescript": "^5.9.2",
+    "typescript": "^6.0.2",
     "workerpool": "^10.0.0",
     "yaml": "^2.8.3",
     "yarn-deduplicate": "^6.0.2"

package/packages/datadog-esbuild/index.js

@@ -2,7 +2,6 @@
 
 const { execSync } = require('node:child_process')
 const fs = require('node:fs')
-const RAW_BUILTINS = require('node:module').builtinModules
 const path = require('node:path')
 const { pathToFileURL, fileURLToPath } = require('node:url')
 
@@ -25,15 +24,27 @@ for (const hook of Object.values(hooks)) {
   }
 }
 
+function moduleOfInterestKey (name, file) {
+  return file ? `${name}/${file}` : name
+}
+
+const builtinModules = new Set(require('module').builtinModules)
+
+function addModuleOfInterest (name, file) {
+  if (!name) return
+
+  modulesOfInterest.add(moduleOfInterestKey(name, file))
+
+  if (builtinModules.has(name)) {
+    modulesOfInterest.add(moduleOfInterestKey(`node:${name}`, file))
+  }
+}
+
 const modulesOfInterest = new Set()
 
-for (const instrumentation of Object.values(instrumentations)) {
+for (const [name, instrumentation] of Object.entries(instrumentations)) {
   for (const entry of instrumentation) {
-    if (entry.file) {
-      modulesOfInterest.add(`${entry.name}/${entry.file}`) // e.g. "redis/my/file.js"
-    } else {
-      modulesOfInterest.add(entry.name) // e.g. "redis"
-    }
+    addModuleOfInterest(name, entry.file)
   }
 }
 
@@ -41,7 +52,7 @@ const CHANNEL = 'dd-trace:bundler:load'
 
 const builtins = new Set()
 
-for (const builtin of RAW_BUILTINS) {
+for (const builtin of builtinModules) {
   builtins.add(builtin)
   builtins.add(`node:${builtin}`)
 }
@@ -247,7 +258,7 @@ ${build.initialOptions.banner.js}`
       }
 
       try {
-        const packageJson = JSON.parse(fs.readFileSync(/** @type {string} */ (pathToPackageJson)).toString())
+        const packageJson = JSON.parse(fs.readFileSync(/** @type {string} */(pathToPackageJson)).toString())
 
         const isESM = isESMFile(fullPathToModule, pathToPackageJson, packageJson)
         if (isESM && !interceptedESMModules.has(fullPathToModule)) {

package/packages/datadog-instrumentations/src/ai.js

@@ -3,11 +3,113 @@
 const { channel, tracingChannel } = require('dc-polyfill')
 const shimmer = require('../../datadog-shimmer')
 const { addHook, getHooks } = require('./helpers/instrument')
+const { convertVercelPromptToMessages, buildOutputMessages } = require('./helpers/ai-messages')
 
 const vercelAiTracingChannel = tracingChannel('dd-trace:vercel-ai')
 const vercelAiSpanSetAttributesChannel = channel('dd-trace:vercel-ai:span:setAttributes')
+const aiguardChannel = channel('dd-trace:ai:aiguard')
 
 const tracers = new WeakSet()
+const wrappedModels = new WeakSet()
+
+/**
+ * Publishes already-converted AI guard style messages to the AIGuard channel.
+ *
+ * @param {Array<object>} messages - AI guard style messages to evaluate
+ * @returns {Promise<void>}
+ */
+function publishToAIGuard (messages) {
+  return new Promise((resolve, reject) => {
+    aiguardChannel.publish({ messages, resolve, reject })
+  })
+}
+
+/**
+ * Wraps a Vercel AI language model's doGenerate and doStream methods to evaluate
+ * messages with AIGuard.
+ *
+ * @param {object} model - A Vercel AI language model instance
+ */
+function wrapModelWithAIGuard (model) {
+  if (!model || wrappedModels.has(model)) return
+  wrappedModels.add(model)
+
+  if (typeof model.doGenerate === 'function') {
+    shimmer.wrap(model, 'doGenerate', function (original) {
+      return function (options) {
+        const originalResult = original.call(this, options)
+
+        if (!aiguardChannel.hasSubscribers) return originalResult
+        if (!options.prompt?.length) return originalResult
+
+        const inputMessages = convertVercelPromptToMessages(options.prompt)
+        if (!inputMessages.length) return originalResult
+
+        // Run AI Guard input evaluation and LLM call in parallel.
+        // The LLM has no side effects so it is safe to discard its result if AI Guard blocks.
+        return Promise.all([publishToAIGuard(inputMessages), originalResult])
+          .then(([, result]) => {
+            if (!result.content?.length) return result
+            return publishToAIGuard(buildOutputMessages(inputMessages, result.content))
+              .then(() => result)
+          })
+      }
+    })
+  }
+
+  if (typeof model.doStream === 'function') {
+    shimmer.wrap(model, 'doStream', function (original) {
+      return function (options) {
+        const originalResult = original.call(this, options)
+
+        if (!aiguardChannel.hasSubscribers) return originalResult
+        if (!options.prompt?.length) return originalResult
+
+        const inputMessages = convertVercelPromptToMessages(options.prompt)
+        if (!inputMessages.length) return originalResult
+
+        // Run AI Guard input evaluation and LLM call in parallel.
+        // The LLM has no side effects so it is safe to discard its result if AI Guard blocks.
+        return Promise.all([publishToAIGuard(inputMessages), originalResult])
+          .then(([, result]) => {
+            const chunks = []
+            const reader = result.stream.getReader()
+
+            function readAll () {
+              return reader.read().then(({ done, value }) => {
+                if (done) return
+                chunks.push(value)
+                return readAll()
+              })
+            }
+
+            return readAll().then(() => {
+              const toolCalls = chunks.filter(c => c?.type === 'tool-call')
+              const text = chunks.filter(c => c?.type === 'text-delta').map(c => c.textDelta).join('')
+              const content = toolCalls.length ? toolCalls : text ? [{ type: 'text', text }] : []
+
+              const evaluate = content.length
+                ? publishToAIGuard(buildOutputMessages(inputMessages, content))
+                : Promise.resolve()
+
+              return evaluate.then(() => {
+                // eslint-disable-next-line n/no-unsupported-features/node-builtins
+                const stream = new ReadableStream({
+                  start (controller) {
+                    for (const chunk of chunks) {
+                      controller.enqueue(chunk)
+                    }
+                    controller.close()
+                  },
+                })
+                return { ...result, stream }
+              })
+            })
+          })
+      }
+    })
+  }
+}
 
 function wrapTracer (tracer) {
   if (tracers.has(tracer)) {
@@ -114,6 +216,16 @@ for (const hook of getHooks('ai')) {
       },
     })
 
+    // resolveLanguageModel is called by all LLM entry points (generateText, streamText,
+    // generateObject, streamObject)
+    tracingChannel('orchestrion:ai:resolveLanguageModel').subscribe({
+      end (ctx) {
+        wrapModelWithAIGuard(ctx.result)
+      },
+    })
+
     return exports
   })
 }
+
+module.exports = { wrapModelWithAIGuard }

package/packages/datadog-instrumentations/src/child_process.js

@@ -14,11 +14,6 @@ const childProcessChannel = dc.tracingChannel('datadog:child_process:execution')
 // ignored exec method because it calls to execFile directly
 const execAsyncMethods = ['execFile', 'spawn', 'fork']
 
-const names = ['child_process', 'node:child_process']
-
-// child_process and node:child_process returns the same object instance, we only want to add hooks once
-let patched = false
-
 function throwSyncError (error) {
   throw error
 }
@@ -37,19 +32,14 @@ function returnSpawnSyncError (error, context) {
   return context.result
 }
 
-for (const name of names) {
-  addHook({ name }, childProcess => {
-    if (!patched) {
-      patched = true
-      shimmer.massWrap(childProcess, execAsyncMethods, wrapChildProcessAsyncMethod(childProcess.ChildProcess))
-      shimmer.wrap(childProcess, 'execSync', wrapChildProcessSyncMethod(throwSyncError, true))
-      shimmer.wrap(childProcess, 'execFileSync', wrapChildProcessSyncMethod(throwSyncError))
-      shimmer.wrap(childProcess, 'spawnSync', wrapChildProcessSyncMethod(returnSpawnSyncError))
-    }
+addHook({ name: 'child_process' }, childProcess => {
+  shimmer.massWrap(childProcess, execAsyncMethods, wrapChildProcessAsyncMethod(childProcess.ChildProcess))
+  shimmer.wrap(childProcess, 'execSync', wrapChildProcessSyncMethod(throwSyncError, true))
+  shimmer.wrap(childProcess, 'execFileSync', wrapChildProcessSyncMethod(throwSyncError))
+  shimmer.wrap(childProcess, 'spawnSync', wrapChildProcessSyncMethod(returnSpawnSyncError))
 
-    return childProcess
-  })
-}
+  return childProcess
+})
 
 function normalizeArgs (args, shell) {
   const childProcessInfo = {

package/packages/datadog-instrumentations/src/crypto.js

@@ -11,9 +11,8 @@ const cryptoCipherCh = channel('datadog:crypto:cipher:start')
 
 const hashMethods = ['createHash', 'createHmac', 'createSign', 'createVerify', 'sign', 'verify']
 const cipherMethods = ['createCipheriv', 'createDecipheriv']
-const names = ['crypto', 'node:crypto']
 
-addHook({ name: names }, crypto => {
+addHook({ name: 'crypto' }, crypto => {
   shimmer.massWrap(crypto, hashMethods, wrapCryptoMethod(cryptoHashCh))
   shimmer.massWrap(crypto, cipherMethods, wrapCryptoMethod(cryptoCipherCh))
   return crypto

package/packages/datadog-instrumentations/src/cucumber.js

@@ -61,6 +61,8 @@ const numRetriesByPickleId = new Map()
 const numAttemptToCtx = new Map()
 const newTestsByTestFullname = new Map()
 const modifiedTestsByPickleId = new Map()
+// Pickle IDs for tests that are genuinely new (not in known tests list).
+const newTestPickleIds = new Set()
 
 let eventDataCollector = null
 let pickleByFile = {}
@@ -359,7 +361,7 @@ function wrapRun (pl, isLatestVersion, version) {
         }
 
         if (isKnownTestsEnabled && status !== 'skip') {
-          isNew = numRetries !== undefined
+          isNew = newTestPickleIds.has(this.pickle.id)
         }
 
         if (isNew || isModified) {
@@ -714,6 +716,7 @@ function getWrappedRunTestCase (runTestCaseFunction, isNewerCucumberVersion = fa
     if (isKnownTestsEnabled && !isAttemptToFix) {
       isNew = isNewTest(testSuitePath, pickle.name)
       if (isNew) {
+        newTestPickleIds.add(pickle.id)
         numRetriesByPickleId.set(pickle.id, 0)
       }
     }