dd-trace 6.14.0 → 6.16.0

package/packages/dd-trace/src/appsec/telemetry/index.js

@@ -5,14 +5,13 @@ const {
   incrementApiSecRequestNoSchema,
   incrementApiSecRequestSchema,
 } = require('./api_security')
-const { DD_TELEMETRY_REQUEST_METRICS } = require('./common')
+const { appsecMetrics, DD_TELEMETRY_REQUEST_METRICS, getVersionsTags } = require('./common')
 const { incrementMissingUserId, incrementMissingUserLogin, incrementSdkEvent } = require('./user')
 const {
   addRaspRequestMetrics,
   trackRaspMetrics,
   trackRaspRuleMatch,
   trackRaspRuleSkipped,
-  incrementRaspDurationMetrics,
 } = require('./rasp')
 const {
   addWafRequestMetrics,
@@ -21,7 +20,6 @@ const {
   incrementWafUpdates,
   incrementWafConfigErrors,
   incrementWafRequests,
-  incrementWafDurationMetrics,
 } = require('./waf')
 
 const metricsStoreMap = new WeakMap()
@@ -150,8 +148,28 @@ function incrementRequestDurationMetrics (req) {
   const store = getStore(req)
   const requestMetrics = store[DD_TELEMETRY_REQUEST_METRICS]
 
-  incrementWafDurationMetrics(requestMetrics)
-  incrementRaspDurationMetrics(requestMetrics)
+  if (!requestMetrics.duration && !requestMetrics.durationExt &&
+      !requestMetrics.raspDuration && !requestMetrics.raspDurationExt) return
+
+  const { duration, durationExt, raspDuration, raspDurationExt, wafVersion, rulesVersion } = requestMetrics
+
+  const versionsTags = getVersionsTags(wafVersion, rulesVersion)
+
+  if (duration) {
+    appsecMetrics.distribution('waf.duration', versionsTags).track(duration)
+  }
+
+  if (durationExt) {
+    appsecMetrics.distribution('waf.duration_ext', versionsTags).track(durationExt)
+  }
+
+  if (raspDuration) {
+    appsecMetrics.distribution('rasp.duration', versionsTags).track(raspDuration)
+  }
+
+  if (raspDurationExt) {
+    appsecMetrics.distribution('rasp.duration_ext', versionsTags).track(raspDurationExt)
+  }
 }
 
 function incrementMissingUserLoginMetric (framework, eventType) {

package/packages/dd-trace/src/appsec/telemetry/rasp.js

@@ -1,9 +1,6 @@
 'use strict'
 
-const telemetryMetrics = require('../../telemetry/metrics')
-const { DD_TELEMETRY_REQUEST_METRICS, getVersionsTags } = require('./common')
-
-const appsecMetrics = telemetryMetrics.manager.namespace('appsec')
+const { appsecMetrics, DD_TELEMETRY_REQUEST_METRICS, getVersionsTags } = require('./common')
 
 const BLOCKING_STATUS = {
   FAILURE: 'failure',
@@ -77,21 +74,6 @@ function trackRaspRuleMatch (store, raspRule, blockTriggered, blocked) {
   appsecMetrics.count('rasp.rule.match', tags).inc(1)
 }
 
-function incrementRaspDurationMetrics (requestMetrics) {
-  const { raspDuration, raspDurationExt, wafVersion, rulesVersion } = requestMetrics
-  if (!raspDuration && !raspDurationExt) return
-
-  const versionsTags = getVersionsTags(wafVersion, rulesVersion)
-
-  if (raspDuration) {
-    appsecMetrics.distribution('rasp.duration', versionsTags).track(raspDuration)
-  }
-
-  if (raspDurationExt) {
-    appsecMetrics.distribution('rasp.duration_ext', versionsTags).track(raspDurationExt)
-  }
-}
-
 function trackRaspRuleSkipped (raspRule, reason) {
   const tags = { reason, rule_type: raspRule.type }
 
@@ -115,5 +97,4 @@ module.exports = {
   trackRaspMetrics,
   trackRaspRuleMatch,
   trackRaspRuleSkipped,
-  incrementRaspDurationMetrics,
 }

package/packages/dd-trace/src/appsec/telemetry/user.js

@@ -1,8 +1,6 @@
 'use strict'
 
-const telemetryMetrics = require('../../telemetry/metrics')
-
-const appsecMetrics = telemetryMetrics.manager.namespace('appsec')
+const { appsecMetrics } = require('./common')
 
 function incrementMissingUserLogin (framework, eventType) {
   appsecMetrics.count('instrum.user_auth.missing_user_login', {

package/packages/dd-trace/src/appsec/telemetry/waf.js

@@ -1,9 +1,6 @@
 'use strict'
 
-const telemetryMetrics = require('../../telemetry/metrics')
-const { tags, getVersionsTags, DD_TELEMETRY_REQUEST_METRICS } = require('./common')
-
-const appsecMetrics = telemetryMetrics.manager.namespace('appsec')
+const { appsecMetrics, tags, getVersionsTags, DD_TELEMETRY_REQUEST_METRICS } = require('./common')
 
 const DD_TELEMETRY_WAF_RESULT_TAGS = Symbol('_dd.appsec.telemetry.waf.result.tags')
 
@@ -126,21 +123,6 @@ function incrementWafRequests (store) {
   }
 }
 
-function incrementWafDurationMetrics (requestMetrics) {
-  const { duration, durationExt, wafVersion, rulesVersion } = requestMetrics
-  if (!duration && !durationExt) return
-
-  const versionsTags = getVersionsTags(wafVersion, rulesVersion)
-
-  if (duration) {
-    appsecMetrics.distribution('waf.duration', versionsTags).track(duration)
-  }
-
-  if (durationExt) {
-    appsecMetrics.distribution('waf.duration_ext', versionsTags).track(durationExt)
-  }
-}
-
 function incrementTruncatedMetrics (metrics, truncationReason) {
   const truncationTags = { truncation_reason: truncationReason }
   appsecMetrics.count('waf.input_truncated', truncationTags).inc(1)
@@ -163,5 +145,4 @@ module.exports = {
   incrementWafUpdates,
   incrementWafConfigErrors,
   incrementWafRequests,
-  incrementWafDurationMetrics,
 }

package/packages/dd-trace/src/ci-visibility/requests/request.js

@@ -13,6 +13,7 @@ const {
   singleJitteredDelay,
 } = require('../../exporters/common/retry')
 const { parseUrl } = require('../../exporters/common/url')
+const { getHttpsProxyAgent } = require('../../exporters/common/proxy')
 const { getRateLimitResetDelay } = require('./rate-limit')
 
 const legacyStorage = storage('legacy')
@@ -58,6 +59,16 @@ function request (data, options, callback) {
     opts.agent = isSecure ? httpsAgent : httpAgent
   }
 
+  const hasApiKey = headers['dd-api-key'] !== undefined || headers['DD-API-KEY'] !== undefined
+  if (hasApiKey && isSecure) {
+    try {
+      opts.agent = getHttpsProxyAgent(opts, opts.agent)
+    } catch (error) {
+      callback(error)
+      return
+    }
+  }
+
   let hasRetried = false
   let firstStatusCode = null
 

package/packages/dd-trace/src/ci-visibility/requests/video-request.js

@@ -6,6 +6,7 @@ const https = require('node:https')
 const { storage } = require('../../../../datadog-core')
 const log = require('../../log')
 const { markEndpointReached } = require('../../exporters/common/retry')
+const { getHttpsProxyAgent } = require('../../exporters/common/proxy')
 const { isLoopbackHost, parseUrl } = require('../../exporters/common/url')
 
 const legacyStorage = storage('legacy')
@@ -129,6 +130,9 @@ function getRequestOptions (options) {
     delete requestOptions.headers['dd-api-key']
     delete requestOptions.headers['DD-API-KEY']
   }
+  if (hasApiKey && requestOptions.protocol === 'https:') {
+    requestOptions.agent = getHttpsProxyAgent(requestOptions, requestOptions.agent)
+  }
 
   delete requestOptions.deadline
   delete requestOptions.retry

package/packages/dd-trace/src/config/generated-config-types.d.ts

@@ -68,6 +68,7 @@ export interface GeneratedConfig {
   DD_AGENTLESS_ENABLED: boolean;
   DD_AGENTLESS_LOG_SUBMISSION_ENABLED: boolean;
   DD_AGENTLESS_LOG_SUBMISSION_URL: string | undefined;
+  DD_AI_GUARD_ANALYZE_STREAM_RESPONSES_ENABLED: boolean;
   DD_API_KEY: string | undefined;
   DD_APM_FLUSH_DEADLINE_MILLISECONDS: number;
   DD_APP_KEY: string | undefined;
@@ -615,6 +616,7 @@ export interface GeneratedEnvVarConfig {
   DD_AGENTLESS_ENABLED: boolean;
   DD_AGENTLESS_LOG_SUBMISSION_ENABLED: boolean;
   DD_AGENTLESS_LOG_SUBMISSION_URL: string | undefined;
+  DD_AI_GUARD_ANALYZE_STREAM_RESPONSES_ENABLED: boolean;
   DD_AI_GUARD_BLOCK: boolean;
   DD_AI_GUARD_ENABLED: boolean;
   DD_AI_GUARD_ENDPOINT: string | undefined;

package/packages/dd-trace/src/config/helper.js

@@ -143,10 +143,17 @@ function getEnvNameFromSource (name, source) {
   }
 }
 
+/**
+ * @param {string} name
+ * @returns {boolean}
+ */
+function isSupportedConfiguration (name) {
+  return supportedConfigurations[name] !== undefined || aliasToCanonical[name] !== undefined
+}
+
 function validateAccess (name) {
   if ((name.startsWith('DD_') || name.startsWith('OTEL_')) &&
-    !supportedConfigurations[name] &&
-    !aliasToCanonical[name]) {
+    !isSupportedConfiguration(name)) {
     throw new Error(`Missing ${name} env/configuration in "supported-configurations.json" file.`)
   }
 }
@@ -284,6 +291,7 @@ function getValueFromEnvSources (name, skipDefault) {
 
 module.exports = {
   getValueFromEnvSources,
+  isSupportedConfiguration,
 
   /**
    * Expose raw stable config maps and warnings for consumers that need

package/packages/dd-trace/src/config/index.js

@@ -24,6 +24,7 @@ const {
 } = require('../serverless')
 const { ORIGIN_KEY, DATADOG_MINI_AGENT_PATH } = require('../constants')
 const { appendRules } = require('../payload-tagging/config')
+const { createSiteUrl } = require('../exporters/common/url')
 const ConfigBase = require('./config-base')
 const {
   getEnvironmentVariable,
@@ -495,9 +496,6 @@ class Config extends ConfigBase {
 
     const agentlessTracingEnabled = this.DD_AGENTLESS_ENABLED ||
       isTrue(getEnvironmentVariable('_DD_APM_TRACING_AGENTLESS_ENABLED'))
-    if (agentlessTracingEnabled && !this.isCiVisibility) {
-      setAndTrack(this, 'OTEL_TRACES_EXPORTER', 'none')
-    }
 
     // Apply the OTel sampler when the user opted into OTel traces or explicitly set the sampler.
     // OTEL_TRACES_SAMPLER has `default: parentbased_always_on` (per OTel spec), so opt-in users
@@ -699,16 +697,33 @@ class Config extends ConfigBase {
 
     // TODO: This could likely be moved to the base class and allow easier GRPC handling
     // Default OTLP endpoints follow the configured agent host so users who point DD at a custom
-    // agent (DD_AGENT_HOST / DD_TRACE_AGENT_URL) also reach OTLP on that host.
-    const defaultOtlpBase = this.OTEL_EXPORTER_OTLP_ENDPOINT?.replace(/\/$/, '') ?? `http://${agentHostname}:4318`
+    // agent (DD_AGENT_HOST / DD_TRACE_AGENT_URL) also reach OTLP on that host. In agentless mode
+    // there is no agent to relay through, so OTLP goes straight to the per-site intake instead.
+    const otlpAgentlessOrigin = agentlessTracingEnabled && !this.OTEL_EXPORTER_OTLP_ENDPOINT
+      ? createSiteUrl(this.site, 'otlp')?.origin
+      : undefined
+    const defaultOtlpBase = otlpAgentlessOrigin ??
+      this.OTEL_EXPORTER_OTLP_ENDPOINT?.replace(/\/$/, '') ?? `http://${agentHostname}:4318`
+
+    const assignOtlpHeaderApiKey = (configName) => {
+      if (otlpAgentlessOrigin) {
+        this[configName] ??= { ...this.OTEL_EXPORTER_OTLP_HEADERS }
+        this[configName]['dd-api-key'] = this.DD_API_KEY
+        setAndTrack(this, configName, this[configName])
+      }
+    }
+
     if (!this.OTEL_EXPORTER_OTLP_LOGS_ENDPOINT) {
       setAndTrack(this, 'OTEL_EXPORTER_OTLP_LOGS_ENDPOINT', `${defaultOtlpBase}/v1/logs`)
+      assignOtlpHeaderApiKey('OTEL_EXPORTER_OTLP_LOGS_HEADERS')
     }
     if (!this.OTEL_EXPORTER_OTLP_METRICS_ENDPOINT) {
       setAndTrack(this, 'OTEL_EXPORTER_OTLP_METRICS_ENDPOINT', `${defaultOtlpBase}/v1/metrics`)
+      assignOtlpHeaderApiKey('OTEL_EXPORTER_OTLP_METRICS_HEADERS')
     }
     if (!this.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT) {
       setAndTrack(this, 'OTEL_EXPORTER_OTLP_TRACES_ENDPOINT', `${defaultOtlpBase}/v1/traces`)
+      assignOtlpHeaderApiKey('OTEL_EXPORTER_OTLP_TRACES_HEADERS')
     }
 
     const autoTraceMetrics = this.OTEL_TRACES_EXPORTER === 'otlp' && this.DD_METRICS_OTEL_ENABLED === true

package/packages/dd-trace/src/config/supported-configurations.json

@@ -53,6 +53,14 @@
         ]
       }
     ],
+    "DD_AI_GUARD_ANALYZE_STREAM_RESPONSES_ENABLED": [
+      {
+        "implementation": "A",
+        "type": "boolean",
+        "default": "false",
+        "description": "Buffer Vercel AI streamed responses for After Model evaluation before replaying them."
+      }
+    ],
     "DD_AI_GUARD_BLOCK": [
       {
         "implementation": "C",
@@ -744,6 +752,7 @@
         "configurationNames": [
           "dogstatsd.port"
         ],
+        "allowed": "[1-9]\\d{0,3}|[1-5]\\d{4}|6[0-4]\\d{3}|65[0-4]\\d{2}|655[0-2]\\d|6553[0-5]",
         "default": "8125"
       }
     ],
@@ -2028,6 +2037,7 @@
         "configurationNames": [
           "port"
         ],
+        "allowed": "[1-9]\\d{0,3}|[1-5]\\d{4}|6[0-4]\\d{3}|65[0-4]\\d{2}|655[0-2]\\d|6553[0-5]",
         "default": "8126"
       }
     ],

package/packages/dd-trace/src/debugger/devtools_client/breakpoints.js

@@ -6,7 +6,11 @@ const { getGeneratedPosition } = require('./source-maps')
 const session = require('./session')
 const { compile, compileSegments, templateRequiresEvaluation } = require('./condition')
 const { MAX_SNAPSHOTS_PER_SECOND_PER_PROBE, MAX_NON_SNAPSHOTS_PER_SECOND_PER_PROBE } = require('./defaults')
-const { compileBreakpointCondition, getRemoveProbeExpression } = require('./probe_sampler')
+const {
+  compileBreakpointCondition,
+  getRemoveProbeExpression,
+  isSnapshotProducingProbe,
+} = require('./probe_sampler')
 const {
   DEFAULT_MAX_REFERENCE_DEPTH,
   DEFAULT_MAX_COLLECTION_SIZE,
@@ -76,12 +80,6 @@ async function addBreakpoint (probe) {
   }
   delete probe.segments
 
-  // Optimize for fast calculations when probe is hit
-  const snapshotsPerSecond = probe.sampling?.snapshotsPerSecond ?? (probe.captureSnapshot
-    ? MAX_SNAPSHOTS_PER_SECOND_PER_PROBE
-    : MAX_NON_SNAPSHOTS_PER_SECOND_PER_PROBE)
-  probe.nsBetweenSampling = BigInt(Math.trunc(1 / snapshotsPerSecond * 1e9))
-
   // Warning: The code below relies on undocumented behavior of the inspector!
   // It expects that `await session.post('Debugger.enable')` will wait for all loaded scripts to be emitted as
   // `Debugger.scriptParsed` events. If this ever changes, we will have a race condition!
@@ -156,6 +154,15 @@ async function addBreakpoint (probe) {
     }
   }
 
+  // Must be calculated after `compiledCaptureExpressions` has been resolved, since capture-expression probes produce
+  // snapshots and therefore default to the snapshot rate.
+  //
+  // Optimize for fast calculations when probe is hit
+  const snapshotsPerSecond = probe.sampling?.snapshotsPerSecond ?? (isSnapshotProducingProbe(probe)
+    ? MAX_SNAPSHOTS_PER_SECOND_PER_PROBE
+    : MAX_NON_SNAPSHOTS_PER_SECOND_PER_PROBE)
+  probe.nsBetweenSampling = BigInt(Math.trunc(1 / snapshotsPerSecond * 1e9))
+
   const locationKey = generateLocationKey(scriptId, lineNumber, columnNumber)
   const breakpoint = locationToBreakpoint.get(locationKey)
 

package/packages/dd-trace/src/debugger/devtools_client/probe_sampler.js

@@ -8,6 +8,19 @@ const SAMPLER_EXPRESSION = `globalThis[Symbol.for(${JSON.stringify(DD_TRACE_SYMB
 module.exports = {
   compileBreakpointCondition,
   getRemoveProbeExpression,
+  isSnapshotProducingProbe,
+}
+
+/**
+ * Determine whether a probe produces snapshots. Probes that capture the full local state and probes that only capture
+ * specific expressions both emit snapshot payloads, so they share the snapshot sampling defaults and count towards the
+ * global snapshot rate limit.
+ *
+ * @param {{ captureSnapshot?: boolean, compiledCaptureExpressions?: object[] }} probe - The probe to inspect.
+ * @returns {boolean}
+ */
+function isSnapshotProducingProbe (probe) {
+  return probe.captureSnapshot === true || probe.compiledCaptureExpressions !== undefined
 }
 
 /**
@@ -66,7 +79,7 @@ function compileBreakpointCondition (probes) {
  */
 function compileProbeCondition (probe) {
   const sample = `$dd_sampler.makeSampleDecision(${probe.samplingIndex}, ${JSON.stringify(probe.id)}, ` +
-    `${probe.nsBetweenSampling}n, ${probe.captureSnapshot === true || probe.compiledCaptureExpressions !== undefined})`
+    `${probe.nsBetweenSampling}n, ${isSnapshotProducingProbe(probe)})`
 
   if (probe.condition === undefined) {
     return `$dd_sampled = ${sample} || $dd_sampled`

package/packages/dd-trace/src/debugger/devtools_client/request-options.js

@@ -1,7 +1,5 @@
 'use strict'
 
-const { getHttpsProxyAgent } = require('../../evp_proxy/direct')
-
 /**
  * @param {ReturnType<import('../config')>} config - Debugger configuration
  * @param {string} path - Request path
@@ -10,8 +8,7 @@ const { getHttpsProxyAgent } = require('../../evp_proxy/direct')
  *   method: 'POST',
  *   url: string | URL,
  *   path: string,
- *   headers: Record<string, string>,
- *   agent?: import('node:https').Agent
+ *   headers: Record<string, string>
  * }}
  */
 module.exports = function getRequestOptions (config, path, headers) {
@@ -25,8 +22,6 @@ module.exports = function getRequestOptions (config, path, headers) {
   if (config.agentless) {
     if (config.apiKey !== undefined) headers['DD-API-KEY'] = config.apiKey
     headers['DD-EVP-ORIGIN'] = 'agent-debugger'
-    const agent = getHttpsProxyAgent(config.url.href)
-    if (agent !== undefined) options.agent = agent
   }
 
   return options

package/packages/dd-trace/src/evp_proxy/direct.js

@@ -1,19 +1,13 @@
 'use strict'
 
-const { HttpsProxyAgent } = require('../../../../vendor/dist/https-proxy-agent')
-const { getProxyForUrl } = require('../../../../vendor/dist/proxy-from-env')
 const { createSiteUrl } = require('../exporters/common/url')
 const log = require('../log')
 
-/** @type {Map<string, import('node:https').Agent>} */
-const proxyAgents = new Map()
-
 /**
  * @typedef {object} DirectEVPRoute
  * @property {URL} url - Direct intake URL
  * @property {string} basePath - Direct intake base path
  * @property {object} headers - Direct intake authentication headers
- * @property {import('node:https').Agent} [agent] - Optional HTTPS proxy agent
  */
 
 /**
@@ -33,36 +27,16 @@ function createDirectEVPRoute (config, intake) {
     const url = createSiteUrl(config.site, intake)
     if (url === undefined) throw new Error('Invalid direct EVP intake URL')
 
-    const agent = getHttpsProxyAgent(url.href)
-
-    const route = {
+    return {
       url,
       basePath: '',
       headers: {
         'DD-API-KEY': apiKey,
       },
     }
-    if (agent) route.agent = agent
-    return route
   } catch (error) {
     log.debug('Unable to configure direct EVP intake: %s', error.message)
   }
 }
 
-/**
- * @param {string} url
- * @returns {import('node:https').Agent|undefined}
- */
-function getHttpsProxyAgent (url) {
-  const proxyUrl = getProxyForUrl(url)
-  if (!proxyUrl) return
-
-  let agent = proxyAgents.get(proxyUrl)
-  if (agent === undefined) {
-    agent = new HttpsProxyAgent(proxyUrl)
-    proxyAgents.set(proxyUrl, agent)
-  }
-  return agent
-}
-
-module.exports = { createDirectEVPRoute, getHttpsProxyAgent }
+module.exports = { createDirectEVPRoute }

package/packages/dd-trace/src/evp_proxy/discovery.js

@@ -2,8 +2,7 @@
 
 const { fetchAgentInfo } = require('../agent/info')
 const log = require('../log')
-
-const TRAILING_SLASHES = /\/+$/
+const { stripTrailingSlashes } = require('./path')
 
 /**
  * Receiver discovery contract
@@ -81,14 +80,14 @@ function selectEVPProxyPath (agentInfo, { supportedPaths, requiredHeaders = [] }
   const advertisedPaths = new Set()
   for (const endpoint of agentInfo.endpoints) {
     if (typeof endpoint === 'string') {
-      advertisedPaths.add(endpoint.replace(TRAILING_SLASHES, ''))
+      advertisedPaths.add(stripTrailingSlashes(endpoint))
     }
   }
 
   for (const supportedPath of supportedPaths) {
     if (typeof supportedPath !== 'string') continue
 
-    const normalizedPath = supportedPath.replace(TRAILING_SLASHES, '')
+    const normalizedPath = stripTrailingSlashes(supportedPath)
     if (advertisedPaths.has(normalizedPath)) {
       return normalizedPath
     }

package/packages/dd-trace/src/evp_proxy/path.js

@@ -1,7 +1,16 @@
 'use strict'
 
 const LEADING_SLASHES = /^\/+/
-const TRAILING_SLASHES = /\/+$/
+
+/**
+ * @param {string} value
+ * @returns {string}
+ */
+function stripTrailingSlashes (value) {
+  let end = value.length
+  while (end > 0 && value[end - 1] === '/') end--
+  return end === value.length ? value : value.slice(0, end)
+}
 
 /**
  * Joins a caller-supplied EVP proxy path and product endpoint.
@@ -13,10 +22,10 @@ const TRAILING_SLASHES = /\/+$/
  * @returns {string} Joined request path
  */
 function joinEVPProxyPath (basePath, endpoint) {
-  const normalizedBasePath = basePath.replace(TRAILING_SLASHES, '')
+  const normalizedBasePath = stripTrailingSlashes(basePath)
   const normalizedEndpoint = endpoint.replace(LEADING_SLASHES, '')
 
   return `${normalizedBasePath}/${normalizedEndpoint}`
 }
 
-module.exports = { joinEVPProxyPath }
+module.exports = { joinEVPProxyPath, stripTrailingSlashes }

package/packages/dd-trace/src/exporters/agentless/writer.js

@@ -8,6 +8,7 @@ const log = require('../../log')
 const tracerVersion = require('../../../../../package.json').version
 
 const { canSendApiKey } = require('../common/url')
+const { getHttpsProxyAgent } = require('../common/proxy')
 const BaseWriter = require('../common/writer')
 const { AgentEncoder } = require('../../encode/0.4')
 const { computeIntakeUrl, INTAKE_PATH } = require('./intake')
@@ -153,6 +154,7 @@ class AgentlessWriter extends BaseWriter {
 
     this.#closeExporter()
     const config = getConfig()
+    const agent = this._url.protocol === 'https:' ? getHttpsProxyAgent(this._url) : undefined
     this.#exporter = createAgentlessExporter({
       endpoint: this.#endpoint(),
       apiKey,
@@ -165,7 +167,7 @@ class AgentlessWriter extends BaseWriter {
       tracerVersion,
       languageVersion: process.version,
       languageInterpreter: process.versions.bun ? 'JavaScriptCore' : 'v8',
-    })
+    }, { agent })
     this.#exporterApiKey = apiKey
     this.#exporterEnv = env
     this.#exporterRuntimeId = runtimeID

package/packages/dd-trace/src/exporters/common/docker.js

@@ -12,7 +12,10 @@ const uuidSource =
 const containerSource = '[0-9a-f]{64}'
 const taskSource = String.raw`[0-9a-f]{32}-\d+`
 const lineReg = /^(\d+):([^:]*):(.+)$/m
-const entityReg = new RegExp(String.raw`.*(${uuidSource}|${containerSource}|${taskSource})(?:\.scope)?$`, 'm')
+const entityReg = new RegExp(
+  String.raw`(?:^|/)[^/\r\n\u2028\u2029]*?(${uuidSource}|${containerSource}|${taskSource})(?:\.scope)?$`,
+  'm'
+)
 
 let inode = 0
 let cgroup = ''

package/packages/dd-trace/src/exporters/common/proxy.js

@@ -0,0 +1,55 @@
+'use strict'
+
+const { isIPv6 } = require('node:net')
+
+let defaultAgentKey
+let getProxyForUrl
+let proxyAgents
+
+/**
+ * Selects a proxy agent for an HTTPS target while preserving the direct agent's pool boundaries.
+ *
+ * @param {string|URL|object} url
+ * @param {import('node:http').Agent|false} [directAgent]
+ * @returns {import('node:http').Agent|false|undefined}
+ */
+function getHttpsProxyAgent (url, directAgent) {
+  getProxyForUrl ??= require('../../../../../vendor/dist/proxy-from-env').getProxyForUrl
+
+  const host = typeof url === 'string' ? undefined : url.host ?? url.hostname
+  const isUnbracketedIPv6 = typeof host === 'string' && host.includes(':') && isIPv6(host)
+  const target = typeof url === 'string'
+    ? url
+    : { protocol: url.protocol, host: isUnbracketedIPv6 ? `[${host}]` : host, port: url.port }
+  const proxyUrl = getProxyForUrl(target)
+  if (!proxyUrl) return directAgent
+
+  directAgent ??= require('node:https').globalAgent
+
+  if (proxyAgents === undefined) {
+    defaultAgentKey = {}
+    proxyAgents = new WeakMap()
+  }
+  const cacheKey = directAgent || defaultAgentKey
+  let agents = proxyAgents.get(cacheKey)
+  if (agents === undefined) {
+    agents = new Map()
+    proxyAgents.set(cacheKey, agents)
+  }
+
+  let agent = agents.get(proxyUrl)
+  if (agent === undefined) {
+    const { HttpsProxyAgent } = require('../../../../../vendor/dist/https-proxy-agent')
+    const options = directAgent
+      ? { keepAlive: directAgent.keepAlive, maxSockets: directAgent.maxSockets }
+      : undefined
+    agent = new HttpsProxyAgent(proxyUrl, options)
+    // AgentBase normally infers this from the node:https call stack. Interceptors such as MSW
+    // construct http.ClientRequest directly, so identify the target protocol explicitly.
+    agent.protocol = 'https:'
+    agents.set(proxyUrl, agent)
+  }
+  return agent
+}
+
+module.exports = { getHttpsProxyAgent }

package/packages/dd-trace/src/exporters/common/request.js

@@ -13,6 +13,7 @@ const log = require('../../log')
 const { canSendApiKey, parseUrl } = require('./url')
 const docker = require('./docker')
 const { httpAgent, httpsAgent } = require('./agents')
+const { getHttpsProxyAgent } = require('./proxy')
 const {
   getMaxAttempts,
   getRetryDelay,
@@ -94,11 +95,18 @@ function request (data, options, callback) {
 
   docker.inject(options.headers)
 
-  const connectionOptions = {
-    ...options,
-    agent: options.agent ?? (isSecure ? httpsAgent : httpAgent),
+  let agent = options.agent ?? (isSecure ? httpsAgent : httpAgent)
+  if (hasApiKey && isSecure) {
+    try {
+      agent = getHttpsProxyAgent(options, agent)
+    } catch (error) {
+      callback(error)
+      return
+    }
   }
 
+  const connectionOptions = { ...options, agent }
+
   /**
    * @param {import('node:http').IncomingMessage} res
    * @param {(error: Error|null, result?: string|null, statusCode?: number,

package/packages/dd-trace/src/opentelemetry/metrics/index.js

@@ -66,7 +66,7 @@ function initializeOpenTelemetryMetrics (config) {
   metrics.setGlobalMeterProvider(meterProvider)
 
   // Include the final metric collection and export in lifecycle retention.
-  registerTelemetryFlusher(done => meterProvider.forceFlush(done))
+  registerTelemetryFlusher(done => reader.forceFlush(done))
 
   registerResourceAttributeRefresh(exporter, () => buildGeneralResourceAttributes(config))
 }