dd-trace 6.0.0 → 6.1.0

package/packages/dd-trace/src/aiguard/integrations/openai.js

@@ -16,51 +16,65 @@ const chatCompletionsAfterChannel = channel('dd-trace:openai:chat.completions:af
 const responsesBeforeChannel = channel('dd-trace:openai:responses:before')
 const responsesAfterChannel = channel('dd-trace:openai:responses:after')
 
+let isEnabled = false
+let aiguard
+let opts
+
 /**
  * Subscribes AI Guard to OpenAI lifecycle channels.
  *
- * @param {object} aiguard
+ * @param {object} aiguardInstance
  * @param {boolean} block
- * @returns {() => void}
  */
-function enable (aiguard, block) {
-  const opts = { block, source: SOURCE_AUTO, integration: 'openai' }
-
-  function onChatCompletionsBefore (ctx) {
-    pushEvaluation(ctx, aiguard, getChatCompletionsInputMessages(ctx.args?.[0]), opts)
-  }
-
-  function onChatCompletionsAfter (ctx) {
-    const inputMessages = getChatCompletionsInputMessages(ctx.args?.[0])
-    if (!inputMessages?.length) return
-    for (const message of getChatCompletionsOutputMessages(ctx.body)) {
-      pushEvaluation(ctx, aiguard, [...inputMessages, message], opts)
-    }
-  }
+function enable (aiguardInstance, block) {
+  if (isEnabled) return
 
-  function onResponsesBefore (ctx) {
-    pushEvaluation(ctx, aiguard, getResponsesInputMessages(ctx.args?.[0]), opts)
-  }
-
-  function onResponsesAfter (ctx) {
-    const inputMessages = getResponsesInputMessages(ctx.args?.[0])
-    if (!inputMessages?.length) return
-    const outputMessages = getResponsesOutputMessages(ctx.body)
-    if (!outputMessages.length) return
-    pushEvaluation(ctx, aiguard, [...inputMessages, ...outputMessages], opts)
-  }
+  aiguard = aiguardInstance
+  opts = { block, source: SOURCE_AUTO, integration: 'openai' }
 
   chatCompletionsBeforeChannel.subscribe(onChatCompletionsBefore)
   chatCompletionsAfterChannel.subscribe(onChatCompletionsAfter)
   responsesBeforeChannel.subscribe(onResponsesBefore)
   responsesAfterChannel.subscribe(onResponsesAfter)
 
-  return function disable () {
-    chatCompletionsBeforeChannel.unsubscribe(onChatCompletionsBefore)
-    chatCompletionsAfterChannel.unsubscribe(onChatCompletionsAfter)
-    responsesBeforeChannel.unsubscribe(onResponsesBefore)
-    responsesAfterChannel.unsubscribe(onResponsesAfter)
+  isEnabled = true
+}
+
+function disable () {
+  if (!isEnabled) return
+
+  chatCompletionsBeforeChannel.unsubscribe(onChatCompletionsBefore)
+  chatCompletionsAfterChannel.unsubscribe(onChatCompletionsAfter)
+  responsesBeforeChannel.unsubscribe(onResponsesBefore)
+  responsesAfterChannel.unsubscribe(onResponsesAfter)
+
+  aiguard = undefined
+  opts = undefined
+  isEnabled = false
+}
+
+function onChatCompletionsBefore (ctx) {
+  pushEvaluation(ctx, aiguard, getChatCompletionsInputMessages(ctx.args?.[0]), opts)
+}
+
+function onChatCompletionsAfter (ctx) {
+  const inputMessages = getChatCompletionsInputMessages(ctx.args?.[0])
+  if (!inputMessages?.length) return
+  for (const message of getChatCompletionsOutputMessages(ctx.body)) {
+    pushEvaluation(ctx, aiguard, [...inputMessages, message], opts)
   }
 }
 
-module.exports = { enable }
+function onResponsesBefore (ctx) {
+  pushEvaluation(ctx, aiguard, getResponsesInputMessages(ctx.args?.[0]), opts)
+}
+
+function onResponsesAfter (ctx) {
+  const inputMessages = getResponsesInputMessages(ctx.args?.[0])
+  if (!inputMessages?.length) return
+  const outputMessages = getResponsesOutputMessages(ctx.body)
+  if (!outputMessages.length) return
+  pushEvaluation(ctx, aiguard, [...inputMessages, ...outputMessages], opts)
+}
+
+module.exports = { enable, disable }

package/packages/dd-trace/src/aiguard/integrations/vercel-ai.js

@@ -11,45 +11,59 @@ const doGenerateAfterChannel = channel('dd-trace:vercel-ai:doGenerate:after')
 const doStreamBeforeChannel = channel('dd-trace:vercel-ai:doStream:before')
 const doStreamAfterChannel = channel('dd-trace:vercel-ai:doStream:after')
 
+let isEnabled = false
+let aiguard
+let opts
+
 /**
  * Subscribes AI Guard to Vercel AI lifecycle channels.
  *
- * @param {object} aiguard
+ * @param {object} aiguardInstance
  * @param {boolean} block
- * @returns {() => void}
  */
-function enable (aiguard, block) {
-  const opts = { block, source: SOURCE_AUTO, integration: 'ai' }
-
-  function onBefore (ctx) {
-    pushEvaluation(ctx, aiguard, convertVercelPromptToMessages(ctx.prompt), opts)
-  }
-
-  function onGenerateAfter (ctx) {
-    const inputMessages = convertVercelPromptToMessages(ctx.prompt)
-    if (!inputMessages.length || !ctx.result?.content?.length) return
-
-    pushEvaluation(ctx, aiguard, buildOutputMessages(inputMessages, ctx.result.content), opts)
-  }
+function enable (aiguardInstance, block) {
+  if (isEnabled) return
 
-  function onStreamAfter (ctx) {
-    const inputMessages = convertVercelPromptToMessages(ctx.prompt)
-    if (!inputMessages.length || !ctx.chunks?.length) return
-
-    pushEvaluation(ctx, aiguard, buildOutputMessages(inputMessages, getStreamContent(ctx.chunks)), opts)
-  }
+  aiguard = aiguardInstance
+  opts = { block, source: SOURCE_AUTO, integration: 'ai' }
 
   doGenerateBeforeChannel.subscribe(onBefore)
   doGenerateAfterChannel.subscribe(onGenerateAfter)
   doStreamBeforeChannel.subscribe(onBefore)
   doStreamAfterChannel.subscribe(onStreamAfter)
 
-  return function disable () {
-    doGenerateBeforeChannel.unsubscribe(onBefore)
-    doGenerateAfterChannel.unsubscribe(onGenerateAfter)
-    doStreamBeforeChannel.unsubscribe(onBefore)
-    doStreamAfterChannel.unsubscribe(onStreamAfter)
-  }
+  isEnabled = true
+}
+
+function disable () {
+  if (!isEnabled) return
+
+  doGenerateBeforeChannel.unsubscribe(onBefore)
+  doGenerateAfterChannel.unsubscribe(onGenerateAfter)
+  doStreamBeforeChannel.unsubscribe(onBefore)
+  doStreamAfterChannel.unsubscribe(onStreamAfter)
+
+  aiguard = undefined
+  opts = undefined
+  isEnabled = false
+}
+
+function onBefore (ctx) {
+  pushEvaluation(ctx, aiguard, convertVercelPromptToMessages(ctx.prompt), opts)
+}
+
+function onGenerateAfter (ctx) {
+  const inputMessages = convertVercelPromptToMessages(ctx.prompt)
+  if (!inputMessages.length || !ctx.result?.content?.length) return
+
+  pushEvaluation(ctx, aiguard, buildOutputMessages(inputMessages, ctx.result.content), opts)
+}
+
+function onStreamAfter (ctx) {
+  const inputMessages = convertVercelPromptToMessages(ctx.prompt)
+  if (!inputMessages.length || !ctx.chunks?.length) return
+
+  pushEvaluation(ctx, aiguard, buildOutputMessages(inputMessages, getStreamContent(ctx.chunks)), opts)
 }
 
 /**
@@ -75,4 +89,4 @@ function getStreamContent (chunks) {
   return text ? [{ type: 'text', text }] : []
 }
 
-module.exports = { enable }
+module.exports = { enable, disable }

package/packages/dd-trace/src/appsec/graphql.js

@@ -72,14 +72,17 @@ function enterInApolloServerCoreRequest () {
 
 function enterInApolloRequest () {
   const req = getActiveRequest()
+  if (!req) return
 
-  const requestData = graphqlRequestData.get(req)
-  if (requestData) {
-    // Set isInGraphqlRequest=true since this function only runs for GraphQL requests
-    // This works for both Apollo v4 (middleware) and v5 (HTTP server) contexts
-    requestData.isInGraphqlRequest = true
-    addSpecificEndpoint(req, specificBlockingTypes.GRAPHQL)
+  let requestData = graphqlRequestData.get(req)
+  if (!requestData) {
+    // executeHTTPGraphQLRequest is the GraphQL request boundary, so seed here
+    // when no upstream hook (express4 middleware, drainHttpServer) has run.
+    requestData = { blocked: false }
+    graphqlRequestData.set(req, requestData)
   }
+  requestData.isInGraphqlRequest = true
+  addSpecificEndpoint(req, specificBlockingTypes.GRAPHQL)
 }
 
 function beforeWriteApolloGraphqlResponse ({ abortController, abortData }) {

package/packages/dd-trace/src/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.js

@@ -46,15 +46,6 @@ class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
           this.analyze({ filter }, store)
         }
       }
-
-      return store
-    }
-
-    // mquery analyzes and marks on the same channel: its tracing start both reaches
-    // the driver scope and is the first place the filters are available.
-    const onStartAndBind = (message) => {
-      onStart(message)
-      return markExecStore()
     }
 
     this.addSub('datadog:mongodb:collection:filter:start', onStart)
@@ -65,8 +56,10 @@ class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
     this.addSub('datadog:mongoose:model:filter:start', onStart)
     this.addBind('datadog:mongoose:model:filter:exec', markExecStore)
 
+    // mquery analyzes filters at the prepare step and marks the execution scope at
+    // tracing start, where the deferred driver call runs under the marked store.
     this.addSub('datadog:mquery:filter:prepare', onStart)
-    this.addBind('tracing:datadog:mquery:filter:start', onStartAndBind)
+    this.addBind('tracing:datadog:mquery:filter:start', markExecStore)
   }
 
   configureSanitizers () {

package/packages/dd-trace/src/ci-visibility/dynamic-instrumentation/index.js

@@ -9,6 +9,7 @@ const getDebuggerConfig = require('../../debugger/config')
 
 const probeIdToResolveBreakpointSet = new Map()
 const probeIdToResolveBreakpointRemove = new Map()
+const drainRequestIdToResolveBreakpointHit = new Map()
 
 class TestVisDynamicInstrumentation {
   /**
@@ -57,6 +58,21 @@ class TestVisDynamicInstrumentation {
     ]
   }
 
+  /**
+   * Waits until all breakpoint hits already being handled by the DI worker have been posted back.
+   *
+   * @returns {Promise<void>}
+   */
+  waitForInFlightBreakpointHits () {
+    if (!this.worker) return Promise.resolve()
+
+    const requestId = randomUUID()
+    return new Promise(resolve => {
+      drainRequestIdToResolveBreakpointHit.set(requestId, resolve)
+      this.breakpointHitChannel.port2.postMessage({ drainRequestId: requestId })
+    })
+  }
+
   isReady () {
     return this._readyPromise
   }
@@ -130,7 +146,16 @@ class TestVisDynamicInstrumentation {
       }
     }).unref?.()
 
-    this.breakpointHitChannel.port2.on('message', ({ snapshot }) => {
+    this.breakpointHitChannel.port2.on('message', ({ snapshot, drainRequestId }) => {
+      if (drainRequestId) {
+        const resolve = drainRequestIdToResolveBreakpointHit.get(drainRequestId)
+        if (resolve) {
+          resolve()
+          drainRequestIdToResolveBreakpointHit.delete(drainRequestId)
+        }
+        return
+      }
+
       const { probe: { id: probeId } } = snapshot
       const onHit = this.onHitBreakpointByProbeId.get(probeId)
       if (onHit) {

package/packages/dd-trace/src/ci-visibility/dynamic-instrumentation/worker/index.js

@@ -28,12 +28,20 @@ const {
   getStackFromCallFrames,
 } = require('../../../debugger/devtools_client/state')
 const log = require('../../../log')
-const processTags = require('../../../process-tags')
+
+let processTags
+if (config.propagateProcessTags?.enabled) {
+  processTags = require('../../../process-tags')
+  processTags.initialize()
+}
 
 let sessionStarted = false
+let inFlightBreakpointHits = 0
+let isBreakpointHitDrainScheduled = false
 
 const breakpointIdToProbe = new Map()
 const probeIdToBreakpointId = new Map()
+const breakpointHitDrainRequests = []
 
 const limits = {
   maxReferenceDepth: DEFAULT_MAX_REFERENCE_DEPTH,
@@ -42,6 +50,55 @@ const limits = {
   maxLength: DEFAULT_MAX_LENGTH,
 }
 
+/**
+ * Remove empty collection arrays before sending snapshots through the Test Optimization logs path.
+ *
+ * @param {object} value - Snapshot object or sub-object.
+ * @returns {void}
+ */
+function removeEmptyCollectionProperties (value) {
+  const stack = [value]
+
+  while (stack.length > 0) {
+    const current = stack.pop()
+    if (!current || typeof current !== 'object') continue
+
+    if (Array.isArray(current)) {
+      for (const item of current) {
+        if (item && typeof item === 'object') {
+          stack.push(item)
+        }
+      }
+      continue
+    }
+
+    if (Array.isArray(current.elements)) {
+      if (current.elements.length === 0) {
+        delete current.elements
+      } else {
+        stack.push(current.elements)
+      }
+    }
+
+    if (Array.isArray(current.entries)) {
+      if (current.entries.length === 0) {
+        delete current.entries
+      } else {
+        stack.push(current.entries)
+      }
+    }
+
+    for (const key of Object.keys(current)) {
+      if (key === 'elements' || key === 'entries') continue
+
+      const child = current[key]
+      if (child && typeof child === 'object') {
+        stack.push(child)
+      }
+    }
+  }
+}
+
 session.on('Debugger.paused', async ({ params: { hitBreakpoints: [hitBreakpoint], callFrames } }) => {
   const probe = breakpointIdToProbe.get(hitBreakpoint)
   if (!probe) {
@@ -49,32 +106,47 @@ session.on('Debugger.paused', async ({ params: { hitBreakpoints: [hitBreakpoint]
     return session.post('Debugger.resume')
   }
 
-  const stack = await getStackFromCallFrames(callFrames)
-
-  const { processLocalState } = await getLocalStateForCallFrame(callFrames[0], limits)
-
-  await session.post('Debugger.resume')
-
-  const snapshot = {
-    id: randomUUID(),
-    timestamp: Date.now(),
-    probe: {
-      id: probe.id,
-      version: '0',
-      location: probe.location,
-    },
-    captures: {
-      lines: { [probe.location.lines[0]]: { locals: processLocalState() } },
-    },
-    stack,
-    language: 'javascript',
-  }
+  inFlightBreakpointHits++
+  try {
+    const stack = await getStackFromCallFrames(callFrames)
+
+    const { processLocalState } = await getLocalStateForCallFrame(callFrames[0], limits)
+
+    await session.post('Debugger.resume')
 
-  if (config.propagateProcessTags?.enabled) {
-    snapshot[processTags.DYNAMIC_INSTRUMENTATION_FIELD_NAME] = processTags.tagsObject
+    const snapshot = {
+      id: randomUUID(),
+      timestamp: Date.now(),
+      probe: {
+        id: probe.id,
+        version: 0,
+        location: probe.location,
+      },
+      captures: {
+        lines: { [probe.location.lines[0]]: { locals: processLocalState() } },
+      },
+      stack,
+      language: 'javascript',
+    }
+
+    removeEmptyCollectionProperties(snapshot.captures)
+
+    if (processTags) {
+      snapshot[processTags.DYNAMIC_INSTRUMENTATION_FIELD_NAME] = processTags.tagsObject
+    }
+
+    breakpointHitChannel.postMessage({ snapshot })
+  } finally {
+    inFlightBreakpointHits--
+    scheduleBreakpointHitDrain()
   }
+})
 
-  breakpointHitChannel.postMessage({ snapshot })
+breakpointHitChannel.on('message', ({ drainRequestId }) => {
+  if (!drainRequestId) return
+
+  breakpointHitDrainRequests.push(drainRequestId)
+  scheduleBreakpointHitDrain()
 })
 
 breakpointRemoveChannel.on('message', async (probeId) => {
@@ -154,3 +226,22 @@ function start () {
   sessionStarted = true
   return session.post('Debugger.enable') // return instead of await to reduce number of promises created
 }
+
+function drainBreakpointHitRequests () {
+  if (inFlightBreakpointHits !== 0) return
+
+  for (const drainRequestId of breakpointHitDrainRequests) {
+    breakpointHitChannel.postMessage({ drainRequestId })
+  }
+  breakpointHitDrainRequests.length = 0
+}
+
+function scheduleBreakpointHitDrain () {
+  if (isBreakpointHitDrainScheduled) return
+
+  isBreakpointHitDrainScheduled = true
+  setImmediate(() => {
+    isBreakpointHitDrainScheduled = false
+    drainBreakpointHitRequests()
+  })
+}

package/packages/dd-trace/src/ci-visibility/exporters/agent-proxy/index.js

@@ -68,6 +68,9 @@ class AgentProxyCiVisibilityExporter extends CiVisibilityExporter {
           evpProxyPrefix,
         })
         this._codeCoverageReportUrl = this._url
+        // Screenshot media uploads go through the Agent's evp_proxy: the uploader prefixes the
+        // path with evpProxyPrefix and sets X-Datadog-EVP-Subdomain: api (see uploadTestScreenshot).
+        this._testScreenshotUploadUrl = this._url
         if (testOptimization.DD_TEST_FAILED_TEST_REPLAY_ENABLED) {
           const canFowardLogs = getCanForwardDebuggerLogs(err, agentInfo)
           if (canFowardLogs) {

package/packages/dd-trace/src/ci-visibility/exporters/agentless/index.js

@@ -31,6 +31,8 @@ class AgentlessCiVisibilityExporter extends CiVisibilityExporter {
     }
 
     this._apiUrl = url || new URL(`https://api.${site}`)
+    // Media uploads (raw bytes + DD-API-KEY) go to the same api.<site> host as the rest of the API.
+    this._testScreenshotUploadUrl = this._apiUrl
     // Agentless is always gzip compatible
     this._isGzipCompatible = true
   }
@@ -40,6 +42,7 @@ class AgentlessCiVisibilityExporter extends CiVisibilityExporter {
     try {
       apiUrl = new URL(apiUrl)
       this._apiUrl = apiUrl
+      this._testScreenshotUploadUrl = apiUrl
     } catch (e) {
       log.error('Error setting CI exporter api url', e)
     }

package/packages/dd-trace/src/ci-visibility/exporters/ci-visibility-exporter.js

@@ -1,7 +1,9 @@
 'use strict'
 
+const { hostname: getHostname } = require('node:os')
 const URL = require('url').URL
 
+const { version: tracerVersion } = require('../../../../../package.json')
 const { getLibraryConfiguration: getLibraryConfigurationRequest } = require('../requests/get-library-configuration')
 const { getSkippableSuites: getSkippableSuitesRequest } = require('../intelligent-test-runner/get-skippable-suites')
 const { getKnownTests: getKnownTestsRequest } = require('../early-flake-detection/get-known-tests')
@@ -10,11 +12,14 @@ const { getTestManagementTests: getTestManagementTestsRequest } =
 const { writeSettingsToCache } = require('../test-optimization-cache')
 const { CACHE_MISS, TestOptimizationHttpCache } = require('../test-optimization-http-cache')
 const { uploadCoverageReport: uploadCoverageReportRequest } = require('../requests/upload-coverage-report')
+const { uploadTestScreenshot: uploadTestScreenshotRequest } = require('../requests/upload-test-screenshot')
 const log = require('../../log')
 const BufferingExporter = require('../../exporters/common/buffering-exporter')
 const { GIT_REPOSITORY_URL, GIT_COMMIT_SHA } = require('../../plugins/util/tags')
 const { sendGitMetadata: sendGitMetadataRequest } = require('./git/git_metadata')
 
+const hostname = getHostname()
+
 function getTestConfigurationTags (tags) {
   if (!tags) {
     return {}
@@ -37,6 +42,34 @@ function getIsTestSessionTrace (trace) {
 const GIT_UPLOAD_TIMEOUT = 60_000 // 60 seconds
 const CAN_USE_CI_VIS_PROTOCOL_TIMEOUT = GIT_UPLOAD_TIMEOUT
 
+function appendLogTag (tags, key, value) {
+  if (value !== undefined) {
+    tags.push(`${key}:${value}`)
+  }
+}
+
+function getLogTags (logMessage, { env, version }, gitRepositoryUrl, gitCommitSha) {
+  const tags = []
+  if (Array.isArray(logMessage.ddtags)) {
+    for (const tag of logMessage.ddtags) {
+      tags.push(tag)
+    }
+  } else if (logMessage.ddtags) {
+    for (const tag of logMessage.ddtags.split(',')) {
+      tags.push(tag)
+    }
+  }
+
+  appendLogTag(tags, 'env', env)
+  appendLogTag(tags, 'version', version)
+  appendLogTag(tags, 'debugger_version', tracerVersion)
+  appendLogTag(tags, 'host_name', hostname)
+  appendLogTag(tags, GIT_COMMIT_SHA, gitCommitSha)
+  appendLogTag(tags, GIT_REPOSITORY_URL, gitRepositoryUrl)
+
+  return tags.join(',')
+}
+
 class CiVisibilityExporter extends BufferingExporter {
   constructor (config) {
     super(config)
@@ -49,6 +82,9 @@ class CiVisibilityExporter extends BufferingExporter {
     // AKA CI Vis Protocol
     this._canUseCiVisProtocol = false
 
+    this._isTestFailureScreenshotsEnabled =
+      Boolean(config?.testOptimization?.DD_TEST_FAILURE_SCREENSHOTS_ENABLED)
+
     const gitUploadTimeoutId = setTimeout(() => {
       this._resolveGit(new Error('Timeout while uploading git metadata'))
     }, GIT_UPLOAD_TIMEOUT)
@@ -338,21 +374,18 @@ class CiVisibilityExporter extends BufferingExporter {
     const { service, env, version } = this._config
 
     return {
-      ddtags: [
-        ...(logMessage.ddtags || []),
-        `${GIT_REPOSITORY_URL}:${gitRepositoryUrl}`,
-        `${GIT_COMMIT_SHA}:${gitCommitSha}`,
-      ].join(','),
+      ...logMessage,
+      ddtags: getLogTags(logMessage, { env, version }, gitRepositoryUrl, gitCommitSha),
       level: 'error',
       service,
+      hostname,
       dd: {
-        ...(logMessage.dd || []),
+        ...logMessage.dd,
         service,
         env,
         version,
       },
       ddsource: 'dd_debugger',
-      ...logMessage,
     }
   }
 
@@ -458,6 +491,41 @@ class CiVisibilityExporter extends BufferingExporter {
       evpProxyPrefix: this.evpProxyPrefix,
     }, callback)
   }
+
+  /**
+   * Returns whether the exporter can upload test failure screenshots.
+   *
+   * @returns {boolean}
+   */
+  canUploadTestScreenshots () {
+    return Boolean(this._testScreenshotUploadUrl) && this._isTestFailureScreenshotsEnabled
+  }
+
+  /**
+   * Uploads a single test screenshot to the Test Optimization media intake.
+   *
+   * @param {object} options - Upload options
+   * @param {string} options.filePath - Path to the screenshot file
+   * @param {string} options.traceId - Test trace id used as the screenshot key
+   * @param {string} options.idempotencyKey - Stable per-artifact key, reused on retry
+   * @param {number} options.capturedAtMs - Capture time in epoch milliseconds
+   * @param {Function} callback - Callback function (err)
+   */
+  uploadTestScreenshot ({ filePath, traceId, idempotencyKey, capturedAtMs }, callback) {
+    if (!this._testScreenshotUploadUrl) {
+      return callback(new Error('Test screenshot upload URL not configured'))
+    }
+
+    uploadTestScreenshotRequest({
+      filePath,
+      traceId,
+      idempotencyKey,
+      capturedAtMs,
+      url: this._testScreenshotUploadUrl,
+      isEvpProxy: !!this._isUsingEvpProxy,
+      evpProxyPrefix: this.evpProxyPrefix,
+    }, callback)
+  }
 }
 
 module.exports = CiVisibilityExporter