dd-trace 5.99.0 → 5.100.0

package/packages/datadog-plugin-bullmq/src/producer.js

@@ -1,8 +1,22 @@
 'use strict'
 
+const log = require('../../dd-trace/src/log')
 const ProducerPlugin = require('../../dd-trace/src/plugins/producer')
 const { DsmPathwayCodec, getMessageSize } = require('../../dd-trace/src/datastreams')
 
+// Customer-controlled metadata may be malformed JSON. Returning a fresh `{}`
+// on parse failure keeps the publish path alive instead of throwing into
+// `Queue.add` / `Queue.addBulk`.
+function parseTelemetryMetadata (raw) {
+  if (!raw) return {}
+  try {
+    return JSON.parse(raw)
+  } catch (error) {
+    log.warn('bullmq: ignoring malformed telemetry.metadata: %s', error.message)
+    return {}
+  }
+}
+
 class BaseBullmqProducerPlugin extends ProducerPlugin {
   static id = 'bullmq'
 
@@ -45,9 +59,9 @@ class BaseBullmqProducerPlugin extends ProducerPlugin {
   _injectIntoOpts (span, opts) {
     const carrier = {}
     this.tracer.inject(span, 'text_map', carrier)
-    const existing = opts.telemetry?.metadata ? JSON.parse(opts.telemetry.metadata) : {}
-    existing._datadog = carrier
-    opts.telemetry = { metadata: JSON.stringify(existing), omitContext: true }
+    const metadata = parseTelemetryMetadata(opts.telemetry?.metadata)
+    metadata._datadog = carrier
+    opts.telemetry = { metadata: JSON.stringify(metadata), omitContext: true }
   }
 
   setProducerCheckpoint (span, ctx) {
@@ -56,10 +70,10 @@ class BaseBullmqProducerPlugin extends ProducerPlugin {
     const dataStreamsContext = this.tracer.setCheckpoint(edgeTags, span, payloadSize)
 
     if (optsTarget && typeof optsTarget === 'object') {
-      const existing = optsTarget.telemetry?.metadata ? JSON.parse(optsTarget.telemetry.metadata) : {}
-      DsmPathwayCodec.encode(dataStreamsContext, existing._datadog || existing)
-      if (!existing._datadog) existing._datadog = {}
-      optsTarget.telemetry = { metadata: JSON.stringify(existing), omitContext: true }
+      const metadata = parseTelemetryMetadata(optsTarget.telemetry?.metadata)
+      DsmPathwayCodec.encode(dataStreamsContext, metadata._datadog || metadata)
+      if (!metadata._datadog) metadata._datadog = {}
+      optsTarget.telemetry = { metadata: JSON.stringify(metadata), omitContext: true }
     }
   }
 
@@ -161,10 +175,10 @@ class QueueAddBulkPlugin extends BaseBullmqProducerPlugin {
       const payloadSize = getMessageSize(job.data)
       const dataStreamsContext = this.tracer.setCheckpoint(edgeTags, span, payloadSize)
       job.opts = job.opts || {}
-      const existing = job.opts.telemetry?.metadata ? JSON.parse(job.opts.telemetry.metadata) : {}
-      DsmPathwayCodec.encode(dataStreamsContext, existing._datadog || existing)
-      if (!existing._datadog) existing._datadog = {}
-      job.opts.telemetry = { metadata: JSON.stringify(existing), omitContext: true }
+      const metadata = parseTelemetryMetadata(job.opts.telemetry?.metadata)
+      DsmPathwayCodec.encode(dataStreamsContext, metadata._datadog || metadata)
+      if (!metadata._datadog) metadata._datadog = {}
+      job.opts.telemetry = { metadata: JSON.stringify(metadata), omitContext: true }
     }
   }
 }

package/packages/datadog-plugin-cypress/src/cypress-plugin.js

@@ -55,7 +55,9 @@ const {
   TEST_IS_MODIFIED,
   TEST_HAS_DYNAMIC_NAME,
   DYNAMIC_NAME_RE,
-  logDynamicNamesWarning,
+  recordAttemptToFixExecution,
+  logAttemptToFixTestExecution,
+  logTestOptimizationSummary,
   getPullRequestBaseBranch,
   TEST_FINAL_STATUS,
 } = require('../../dd-trace/src/plugins/util/test')
@@ -278,9 +280,8 @@ function getFinalStatus ({
   isQuarantined,
   isDisabled,
 }) {
-  // If the test is quarantined or disabled, regardless of its actual execution result or active retry features,
-  // the final status of its last execution should be reported as 'skip'.
-  if (isQuarantined || isDisabled || status === 'skip') {
+  // If the test is quarantined or disabled, its final status is skip unless attempt-to-fix takes precedence.
+  if (status === 'skip' || (retryKind !== FINAL_STATUS_RETRY_KIND.atf && (isQuarantined || isDisabled))) {
     return 'skip'
   }
 
@@ -322,6 +323,8 @@ class CypressPlugin {
   isImpactedTestsEnabled = false
   modifiedFiles = []
   newTestsWithDynamicNames = new Set()
+  attemptToFixExecutions = new Map()
+  loggedAttemptToFixTests = new Set()
 
   constructor () {
     const {
@@ -394,6 +397,8 @@ class CypressPlugin {
     this.testManagementTests = undefined
     this.isImpactedTestsEnabled = false
     this.modifiedFiles = []
+    this.attemptToFixExecutions = new Map()
+    this.loggedAttemptToFixTests = new Set()
     this.activeTestSpan = null
     this.testSuiteSpan = null
     this.testModuleSpan = null
@@ -800,7 +805,10 @@ class CypressPlugin {
         this.testSessionSpan.setTag(TEST_MANAGEMENT_ENABLED, 'true')
       }
 
-      logDynamicNamesWarning(this.newTestsWithDynamicNames)
+      logTestOptimizationSummary({
+        attemptToFixExecutions: this.attemptToFixExecutions,
+        newTestsWithDynamicNames: this.newTestsWithDynamicNames,
+      })
 
       this.testModuleSpan.finish()
       this.ciVisEvent(TELEMETRY_EVENT_FINISHED, 'module')
@@ -939,10 +947,10 @@ class CypressPlugin {
         if (cypressTest.displayError) {
           latestError = new Error(cypressTest.displayError)
         }
-        // Update test status - but NOT for quarantined tests where we intentionally
+        // Update test status - but NOT for non-ATF quarantined tests where we intentionally
         // report 'fail' to Datadog even though Cypress sees it as 'pass'
         const isQuarantinedTest = finishedTest.testSpan?.context()?._tags?.[TEST_MANAGEMENT_IS_QUARANTINED] === 'true'
-        if (cypressTestStatus !== finishedTest.testStatus && !isQuarantinedTest) {
+        if (cypressTestStatus !== finishedTest.testStatus && (!isQuarantinedTest || finishedTest.isAttemptToFix)) {
           finishedTest.testSpan.setTag(TEST_STATUS, cypressTestStatus)
           finishedTest.testSpan.setTag('error', latestError)
         }
@@ -1050,6 +1058,10 @@ class CypressPlugin {
           return { shouldSkip: true }
         }
 
+        if (isAttemptToFix) {
+          logAttemptToFixTestExecution(testSuite, testName, this.loggedAttemptToFixTests)
+        }
+
         // For disabled tests (not attemptToFix), skip them
         if (!isAttemptToFix && isDisabled) {
           return { shouldSkip: true }
@@ -1090,6 +1102,7 @@ class CypressPlugin {
           isAttemptToFix,
           isModified,
           isQuarantined: isQuarantinedFromSupport,
+          isDisabled: isDisabledFromSupport,
         } = test
         if (coverage && this.isCodeCoverageEnabled && this.tracer._tracer._exporter?.exportCoverage) {
           const coverageFiles = getCoveredFilenamesFromCoverage(coverage)
@@ -1119,6 +1132,7 @@ class CypressPlugin {
           this.testStatuses[testName] = [testStatus]
         }
         const testStatuses = this.testStatuses[testName]
+        const activeSpanTags = this.activeTestSpan.context()._tags
 
         if (error) {
           this.activeTestSpan.setTag('error', error)
@@ -1194,6 +1208,13 @@ class CypressPlugin {
               this.activeTestSpan.setTag(TEST_MANAGEMENT_ATTEMPT_TO_FIX_PASSED, 'true')
             }
           }
+          recordAttemptToFixExecution(this.attemptToFixExecutions, {
+            testSuite,
+            testName,
+            status: testStatus,
+            isDisabled: activeSpanTags[TEST_MANAGEMENT_IS_DISABLED] === 'true',
+            isQuarantined: activeSpanTags[TEST_MANAGEMENT_IS_QUARANTINED] === 'true',
+          })
         }
         // ATR: set TEST_HAS_FAILED_ALL_RETRIES when all auto test retries were exhausted and every attempt failed
         if (this.isFlakyTestRetriesEnabled && !isAttemptToFix && !isEfdRetry &&
@@ -1207,6 +1228,9 @@ class CypressPlugin {
         if (isQuarantinedFromSupport) {
           this.activeTestSpan.setTag(TEST_MANAGEMENT_IS_QUARANTINED, 'true')
         }
+        if (isDisabledFromSupport) {
+          this.activeTestSpan.setTag(TEST_MANAGEMENT_IS_DISABLED, 'true')
+        }
 
         const finishedTest = {
           testName,
@@ -1222,13 +1246,12 @@ class CypressPlugin {
           this.finishedTestsByFile[testSuite] = [finishedTest]
         }
         // test spans are finished at after:spec
-        const activeSpanTags = this.activeTestSpan.context()._tags
         this.ciVisEvent(TELEMETRY_EVENT_FINISHED, 'test', {
           hasCodeOwners: !!activeSpanTags[TEST_CODE_OWNERS],
           isNew,
           isRum: isRUMActive,
           browserDriver: 'cypress',
-          isQuarantined: isQuarantinedFromSupport,
+          isQuarantined: activeSpanTags[TEST_MANAGEMENT_IS_QUARANTINED] === 'true',
           isModified,
           isDisabled: activeSpanTags[TEST_MANAGEMENT_IS_DISABLED] === 'true',
         })

package/packages/datadog-plugin-cypress/src/support.js

@@ -15,8 +15,8 @@ let isModifiedTest = false
 let isTestIsolationEnabled = false
 // Array of test names that have been retried and the reason
 const retryReasonsByTestName = new Map()
-// Track quarantined test errors - we catch them in Cypress.on('fail') but need to report to Datadog
-const quarantinedTestErrors = new Map()
+// Track test errors suppressed by test management so we can still report them to Datadog.
+const suppressedTestFailures = new Map()
 
 // Track the most recently loaded window in the AUT. Updated via the 'window:load'
 // event so we always get the real app window (after cy.visit()), not the
@@ -61,13 +61,12 @@ Cypress.on('fail', (err, runnable) => {
   }
 
   const testName = runnable.fullTitle()
-  const { isQuarantined, isDisabled } = getTestProperties(testName)
+  const { isAttemptToFix, isQuarantined, isDisabled } = getTestProperties(testName)
 
   // Suppress failures for quarantined or disabled tests so they don't affect the exit code.
-  // This applies regardless of attempt-to-fix status: per spec, quarantined/disabled test
-  // results are always ignored.
-  if (isQuarantined || isDisabled) {
-    quarantinedTestErrors.set(testName, err)
+  // Attempt-to-fix ignores quarantine/disabled suppression and keeps the normal framework result.
+  if (!isAttemptToFix && (isQuarantined || isDisabled)) {
+    suppressedTestFailures.set(testName, { error: err, isQuarantined, isDisabled })
     return
   }
 
@@ -245,13 +244,14 @@ afterEach(function () {
   const currentTest = Cypress.mocha.getRunner().suite.ctx.currentTest
   const testName = currentTest.fullTitle()
 
-  // Check if this was a quarantined test that we suppressed the failure for
-  const quarantinedError = quarantinedTestErrors.get(testName)
-  const isQuarantinedTestThatFailed = !!quarantinedError
+  // Check if this was a test management test that we suppressed the failure for.
+  const suppressedTestFailure = suppressedTestFailures.get(testName)
+  const suppressedError = suppressedTestFailure && suppressedTestFailure.error
+  const isTestManagementTestThatFailed = !!suppressedError
 
-  // For quarantined tests, convert Error to a serializable format for cy.task
-  const errorToReport = isQuarantinedTestThatFailed
-    ? { message: quarantinedError.message, stack: quarantinedError.stack }
+  // For suppressed test management tests, convert Error to a serializable format for cy.task.
+  const errorToReport = isTestManagementTestThatFailed
+    ? { message: suppressedError.message, stack: suppressedError.stack }
     : currentTest.err
 
   const testInfo = {
@@ -259,16 +259,17 @@ afterEach(function () {
     testItTitle: currentTest.title,
     testSuite: Cypress.mocha.getRootSuite().file,
     testSuiteAbsolutePath: Cypress.spec && Cypress.spec.absolute,
-    // For quarantined tests, report the actual state (failed) to Datadog, not what Cypress thinks (passed)
-    state: isQuarantinedTestThatFailed ? 'failed' : currentTest.state,
-    // For quarantined tests, include the actual error that was suppressed
+    // Report the actual failed state to Datadog, not the pass state Cypress sees after suppression.
+    state: isTestManagementTestThatFailed ? 'failed' : currentTest.state,
+    // Include the actual error that was suppressed.
     error: errorToReport,
     isNew: currentTest._ddIsNew,
     isEfdRetry: currentTest._ddIsEfdRetry,
     isAttemptToFix: currentTest._ddIsAttemptToFix,
     isModified: currentTest._ddIsModified,
-    // Mark quarantined tests that failed so the plugin knows to tag them appropriately
-    isQuarantined: isQuarantinedTestThatFailed,
+    // Mark suppressed tests so the plugin can tag them with the correct test management reason.
+    isQuarantined: isTestManagementTestThatFailed && suppressedTestFailure.isQuarantined,
+    isDisabled: isTestManagementTestThatFailed && suppressedTestFailure.isDisabled,
   }
   try {
     const invocationDetails = Cypress.mocha.getRunner().currentRunnable.invocationDetails
@@ -292,9 +293,9 @@ afterEach(function () {
     // ignore error and continue
   }
 
-  // Clean up the quarantined error tracking
-  if (isQuarantinedTestThatFailed) {
-    quarantinedTestErrors.delete(testName)
+  // Clean up the suppressed error tracking.
+  if (isTestManagementTestThatFailed) {
+    suppressedTestFailures.delete(testName)
   }
 
   cy.task('dd:afterEach', { test: testInfo, coverage })

package/packages/datadog-plugin-dd-trace-api/src/index.js

@@ -14,7 +14,7 @@ module.exports = class DdTraceApiPlugin extends Plugin {
     super(...args)
 
     const tracer = this._tracer
-    const injectionEnabledTag = `injection_enabled:${this._tracerConfig.injectionEnabled ? 'yes' : 'no'}`
+    const injectionEnabledTag = `injection_enabled:${this._tracerConfig.DD_INJECTION_ENABLED ? 'yes' : 'no'}`
 
     this.addSub('datadog-api:v1:tracerinit', ({ proxy }) => {
       const proxyVal = proxy()

package/packages/datadog-plugin-graphql/src/utils.js

@@ -26,8 +26,8 @@ function extractErrorIntoSpanEvent (config, span, exc) {
     attributes.message = exc.message
   }
 
-  if (config.graphqlErrorExtensions) {
-    for (const ext of config.graphqlErrorExtensions) {
+  if (config.DD_TRACE_GRAPHQL_ERROR_EXTENSIONS) {
+    for (const ext of config.DD_TRACE_GRAPHQL_ERROR_EXTENSIONS) {
       if (exc.extensions?.[ext]) {
         const value = exc.extensions[ext]
 

package/packages/datadog-plugin-grpc/src/client.js

@@ -64,7 +64,7 @@ class GrpcClientPlugin extends ClientPlugin {
 
   error ({ span = this.activeSpan, error }) {
     this.addCode(span, error.code)
-    if (error.code && !this._tracerConfig.grpc.client.error.statuses.includes(error.code)) {
+    if (error.code && !this._tracerConfig.DD_GRPC_CLIENT_ERROR_STATUSES.includes(error.code)) {
       return
     }
     this.addError(error, span)

package/packages/datadog-plugin-grpc/src/server.js

@@ -70,7 +70,7 @@ class GrpcServerPlugin extends ServerPlugin {
     if (!span) return
 
     this.addCode(span, error.code)
-    if (error.code && !this._tracerConfig.grpc.server.error.statuses.includes(error.code)) {
+    if (error.code && !this._tracerConfig.DD_GRPC_SERVER_ERROR_STATUSES.includes(error.code)) {
       return
     }
     this.addError(error)

package/packages/datadog-plugin-memcached/src/index.js

@@ -16,7 +16,7 @@ class MemcachedPlugin extends CachePlugin {
       [CLIENT_PORT_KEY]: address[1],
     }
 
-    if (this.config.memcachedCommandEnabled) {
+    if (this.config.DD_TRACE_MEMCACHED_COMMAND_ENABLED) {
       meta['memcached.command'] = query.command
     }
 

package/packages/datadog-plugin-mongodb-core/src/index.js

@@ -160,10 +160,9 @@ function limitDepth (input) {
       input, output, depth,
     } = queue.pop()
     const nextDepth = depth + 1
-    for (const key in input) {
-      if (typeof input[key] === 'function') continue
-
+    for (const key of Object.keys(input)) {
       let child = input[key]
+      if (typeof child === 'function') continue
 
       if (isBSON(child)) {
         child = typeof child.toJSON === 'function' ? child.toJSON() : '?'

package/packages/datadog-plugin-playwright/src/index.js

@@ -39,6 +39,7 @@ const {
   TEST_SUITE,
   TEST_HAS_DYNAMIC_NAME,
   DYNAMIC_NAME_RE,
+  TEST_FINAL_STATUS,
 } = require('../../dd-trace/src/plugins/util/test')
 const { RESOURCE_NAME } = require('../../../ext/tags')
 const { COMPONENT } = require('../../dd-trace/src/constants')
@@ -319,6 +320,7 @@ class PlaywrightPlugin extends CiPlugin {
       hasFailedAttemptToFixRetries,
       isAtrRetry,
       isModified,
+      finalStatus,
       onDone,
     }) => {
       if (!span) return
@@ -379,6 +381,9 @@ class PlaywrightPlugin extends CiPlugin {
           span.setTag(TEST_RETRY_REASON, TEST_RETRY_REASON_TYPES.efd)
         }
       }
+      if (finalStatus) {
+        span.setTag(TEST_FINAL_STATUS, finalStatus)
+      }
       for (const step of steps) {
         const stepStartTime = step.startTime.getTime()
         const stepSpan = this.tracer.startSpan('playwright.step', {
@@ -451,6 +456,7 @@ class PlaywrightPlugin extends CiPlugin {
       )
 
       span.setTag(TEST_STATUS, 'skip')
+      span.setTag(TEST_FINAL_STATUS, 'skip')
 
       if (isNew) {
         span.setTag(TEST_IS_NEW, 'true')

package/packages/datadog-plugin-router/src/index.js

@@ -157,6 +157,13 @@ class RouterPlugin extends WebPlugin {
 }
 
 function isMoreSpecificThan (routeA, routeB) {
+  // Concrete paths beat catch-all wildcards (`/*splat`, `/api/*`) on the same
+  // request so that `/foo/bar` wins over `/foo/*splat` regardless of length.
+  if (routeA && routeB) {
+    const aWild = hasWildcard(routeA)
+    const bWild = hasWildcard(routeB)
+    if (aWild !== bWild) return !aWild
+  }
   if (!routeIsRegex(routeA) && routeIsRegex(routeB)) {
     return true
   }
@@ -167,4 +174,10 @@ function routeIsRegex (route) {
   return route.includes('(/')
 }
 
+function hasWildcard (route) {
+  // RegExp routes are encoded as `(/.../)` and may legitimately contain `*`,
+  // so only treat plain string patterns as wildcards.
+  return !routeIsRegex(route) && route.includes('*')
+}
+
 module.exports = RouterPlugin

package/packages/dd-trace/index.js

@@ -30,9 +30,10 @@ if (!global._ddtrace) {
     configurable: true,
     writable: true,
   })
-
-  global._ddtrace.default = global._ddtrace
-  global._ddtrace.tracer = global._ddtrace
 }
 
 module.exports = global._ddtrace
+// Static aliases so cjs-module-lexer surfaces them as ESM named exports
+// (`import { tracer } from 'dd-trace'`).
+module.exports.tracer = global._ddtrace
+module.exports.default = global._ddtrace

package/packages/dd-trace/src/aiguard/sdk.js

@@ -70,7 +70,7 @@ class AIGuard extends NoopAIGuard {
   constructor (tracer, config) {
     super()
 
-    if (!config.apiKey || !config.appKey) {
+    if (!config.apiKey || !config.DD_APP_KEY) {
       log.error('AIGuard: missing api and/or app keys, use env DD_API_KEY and DD_APP_KEY')
       this.#initialized = false
       return
@@ -78,7 +78,7 @@ class AIGuard extends NoopAIGuard {
     this.#tracer = tracer
     this.#headers = {
       'DD-API-KEY': config.apiKey,
-      'DD-APPLICATION-KEY': config.appKey,
+      'DD-APPLICATION-KEY': config.DD_APP_KEY,
       'DD-AI-GUARD-VERSION': tracerVersion,
       'DD-AI-GUARD-SOURCE': 'SDK',
       'DD-AI-GUARD-LANGUAGE': 'nodejs',

package/packages/dd-trace/src/appsec/blocking.js

@@ -1,10 +1,16 @@
 'use strict'
 
+const { LRUCache } = require('../../../../vendor/dist/lru-cache')
 const log = require('../log')
+const web = require('../plugins/util/web')
 const blockedTemplates = require('./blocked_templates')
 const { updateBlockFailureMetric } = require('./telemetry')
 
-const detectedSpecificEndpoints = {}
+// Bounded by the LRU as defense-in-depth: getSpecificKey already keys on the
+// resolved route (or the path with the query string stripped) so cardinality
+// follows the routing table, not the URL space.
+const SPECIFIC_ENDPOINT_CACHE_MAX = 16_384
+const detectedSpecificEndpoints = new LRUCache({ max: SPECIFIC_ENDPOINT_CACHE_MAX })
 
 const templateKeyword = '[security_response_id]'
 
@@ -38,12 +44,18 @@ const specificBlockingTypes = {
   GRAPHQL: 'graphqlJson',
 }
 
-function getSpecificKey (method, url) {
-  return `${method}+${url}`
+function getSpecificKey (req) {
+  const route = web.getContext(req)?.paths?.join('')
+  if (route) return `${req.method}+${route}`
+
+  // Strip the query string so unique parameters do not balloon the cache.
+  const url = req.originalUrl || req.url || ''
+  const queryStart = url.indexOf('?')
+  return `${req.method}+${queryStart === -1 ? url : url.slice(0, queryStart)}`
 }
 
-function addSpecificEndpoint (method, url, type) {
-  detectedSpecificEndpoints[getSpecificKey(method, url)] = type
+function addSpecificEndpoint (req, type) {
+  detectedSpecificEndpoints.set(getSpecificKey(req), type)
 }
 
 function getBlockWithRedirectData (actionParameters) {
@@ -65,7 +77,7 @@ function getBlockWithContentData (req, specificType, actionParameters) {
   let type
   let body
 
-  const specificBlockingType = specificType || detectedSpecificEndpoints[getSpecificKey(req.method, req.url)]
+  const specificBlockingType = specificType || detectedSpecificEndpoints.get(getSpecificKey(req))
   if (specificBlockingType) {
     const specificBlockingContent = getTemplate(specificBlockingType, actionParameters)
     type = specificBlockingContent?.type

package/packages/dd-trace/src/appsec/graphql.js

@@ -78,7 +78,7 @@ function enterInApolloRequest () {
     // Set isInGraphqlRequest=true since this function only runs for GraphQL requests
     // This works for both Apollo v4 (middleware) and v5 (HTTP server) contexts
     requestData.isInGraphqlRequest = true
-    addSpecificEndpoint(req.method, req.originalUrl || req.url, specificBlockingTypes.GRAPHQL)
+    addSpecificEndpoint(req, specificBlockingTypes.GRAPHQL)
   }
 }
 

package/packages/dd-trace/src/baggage.js

@@ -3,10 +3,9 @@
 const { storage } = require('../../datadog-core')
 
 /**
- * Spec (API semantics):
- * - OpenTelemetry Baggage API: https://opentelemetry.io/docs/specs/otel/baggage/api/
+ * In-process baggage map stored in async local storage. Frozen on every write.
  *
- * In-process baggage is a string->string map stored in async local storage.
+ * @see https://opentelemetry.io/docs/specs/otel/baggage/api/
  * @typedef {import('../../datadog-core/src/storage').Store<string>} BaggageStore
  */
 
@@ -18,6 +17,8 @@ const baggageStorage =
     /** @type {unknown} */ (storage('baggage'))
   )
 
+const EMPTY_STORE = Object.freeze(/** @type {BaggageStore} */ ({}))
+
 // TODO: Implement metadata https://opentelemetry.io/docs/specs/otel/baggage/api/#set-value
 /**
  * @param {string} key
@@ -25,12 +26,11 @@ const baggageStorage =
  * @param {object} [metadata] Not used yet
  */
 function setBaggageItem (key, value, metadata) {
+  const store = baggageStorage.getStore()
   if (typeof key !== 'string' || typeof value !== 'string' || key === '') {
-    return baggageStorage.getStore() ?? {}
+    return store ?? EMPTY_STORE
   }
-
-  const store = baggageStorage.getStore()
-  const newStore = { ...store, [key]: value }
+  const newStore = Object.freeze({ ...store, [key]: value })
   baggageStorage.enterWith(newStore)
   return newStore
 }
@@ -44,27 +44,40 @@ function getBaggageItem (key) {
 }
 
 function getAllBaggageItems () {
-  return baggageStorage.getStore() ?? {}
+  return baggageStorage.getStore() ?? EMPTY_STORE
 }
 
 /**
- * @param {string} keyToRemove
+ * @param {string} keyToRemove No-op for non-string or empty keys.
  */
 function removeBaggageItem (keyToRemove) {
-  const store = baggageStorage.getStore() ?? {}
+  const store = baggageStorage.getStore() ?? EMPTY_STORE
+  if (typeof keyToRemove !== 'string' || keyToRemove === '') {
+    return store
+  }
   const { [keyToRemove]: _, ...newBaggage } = store
+  Object.freeze(newBaggage)
   baggageStorage.enterWith(newBaggage)
   return newBaggage
 }
 
 function removeAllBaggageItems () {
-  const newContext = /** @type {BaggageStore} */ ({})
-  baggageStorage.enterWith(newContext)
-  return newContext
+  baggageStorage.enterWith(EMPTY_STORE)
+  return EMPTY_STORE
+}
+
+/**
+ * @param {BaggageStore} items Frozen in place; do not mutate after.
+ */
+function setAllBaggageItems (items) {
+  Object.freeze(items)
+  baggageStorage.enterWith(items)
+  return items
 }
 
 module.exports = {
   setBaggageItem,
+  setAllBaggageItems,
   getBaggageItem,
   getAllBaggageItems,
   removeBaggageItem,

package/packages/dd-trace/src/ci-visibility/exporters/ci-visibility-exporter.js

@@ -234,7 +234,7 @@ class CiVisibilityExporter extends BufferingExporter {
         testManagementAttemptToFixRetries ?? this._config.testManagementAttemptToFixRetries,
       isImpactedTestsEnabled: isImpactedTestsEnabled && this._config.isImpactedTestsEnabled,
       isCoverageReportUploadEnabled,
-      isKeepingCoverageConfiguration: this._config.isKeepingCoverageConfiguration,
+      DD_TEST_TIA_KEEP_COV_CONFIG: this._config.DD_TEST_TIA_KEEP_COV_CONFIG,
     }
   }