dd-trace 6.16.0 → 6.17.0

package/packages/dd-trace/src/config/supported-configurations.json

@@ -57,14 +57,16 @@
       {
         "implementation": "A",
         "type": "boolean",
+        "namespace": "aiguard",
         "default": "false",
-        "description": "Buffer Vercel AI streamed responses for After Model evaluation before replaying them."
+        "description": "Analyze streamed OpenAI and Vercel AI responses with AI Guard After Model evaluation."
       }
     ],
     "DD_AI_GUARD_BLOCK": [
       {
         "implementation": "C",
         "type": "boolean",
+        "namespace": "aiguard",
         "configurationNames": [
           "experimental.aiguard.block"
         ],
@@ -75,6 +77,7 @@
       {
         "implementation": "A",
         "type": "boolean",
+        "namespace": "aiguard",
         "configurationNames": [
           "experimental.aiguard.enabled"
         ],
@@ -85,6 +88,7 @@
       {
         "implementation": "A",
         "type": "string",
+        "namespace": "aiguard",
         "configurationNames": [
           "experimental.aiguard.endpoint"
         ],
@@ -95,6 +99,7 @@
       {
         "implementation": "A",
         "type": "int",
+        "namespace": "aiguard",
         "configurationNames": [
           "experimental.aiguard.maxContentSize"
         ],
@@ -105,6 +110,7 @@
       {
         "implementation": "A",
         "type": "int",
+        "namespace": "aiguard",
         "configurationNames": [
           "experimental.aiguard.maxMessagesLength"
         ],
@@ -115,6 +121,7 @@
       {
         "implementation": "A",
         "type": "boolean",
+        "namespace": "aiguard",
         "configurationNames": [
           "experimental.aiguard.redactionEnabled"
         ],
@@ -125,6 +132,7 @@
       {
         "implementation": "A",
         "type": "int",
+        "namespace": "aiguard",
         "configurationNames": [
           "experimental.aiguard.timeout"
         ],
@@ -247,6 +255,7 @@
       {
         "implementation": "E",
         "type": "string",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.eventTracking.mode",
           "experimental.appsec.eventTracking.mode"
@@ -261,6 +270,7 @@
       {
         "implementation": "A",
         "type": "boolean",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.extendedHeadersCollection.enabled",
           "experimental.appsec.extendedHeadersCollection.enabled"
@@ -273,6 +283,7 @@
       {
         "implementation": "C",
         "type": "boolean",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.enabled",
           "appsec",
@@ -286,6 +297,7 @@
       {
         "implementation": "A",
         "type": "string",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.blockedTemplateGraphql",
           "experimental.appsec.blockedTemplateGraphql"
@@ -298,6 +310,7 @@
       {
         "implementation": "A",
         "type": "boolean",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.extendedHeadersCollection.redaction",
           "experimental.appsec.extendedHeadersCollection.redaction"
@@ -310,6 +323,7 @@
       {
         "implementation": "B",
         "type": "string",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.blockedTemplateHtml",
           "experimental.appsec.blockedTemplateHtml"
@@ -322,6 +336,7 @@
       {
         "implementation": "B",
         "type": "string",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.blockedTemplateJson",
           "experimental.appsec.blockedTemplateJson"
@@ -334,6 +349,7 @@
       {
         "implementation": "A",
         "type": "int",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.extendedHeadersCollection.maxHeaders",
           "experimental.appsec.extendedHeadersCollection.maxHeaders"
@@ -346,6 +362,7 @@
       {
         "implementation": "A",
         "type": "int",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.stackTrace.maxStackTraces",
           "experimental.appsec.stackTrace.maxStackTraces"
@@ -360,6 +377,7 @@
       {
         "implementation": "A",
         "type": "int",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.stackTrace.maxDepth",
           "experimental.appsec.stackTrace.maxDepth"
@@ -374,6 +392,7 @@
       {
         "implementation": "B",
         "type": "string",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.obfuscatorKeyRegex",
           "experimental.appsec.obfuscatorKeyRegex"
@@ -385,6 +404,7 @@
       {
         "implementation": "G",
         "type": "string",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.obfuscatorValueRegex",
           "experimental.appsec.obfuscatorValueRegex"
@@ -396,6 +416,7 @@
       {
         "implementation": "A",
         "type": "boolean",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.rasp.bodyCollection",
           "experimental.appsec.rasp.bodyCollection"
@@ -408,6 +429,7 @@
       {
         "implementation": "A",
         "type": "boolean",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.rasp.enabled",
           "experimental.appsec.rasp.enabled"
@@ -419,6 +441,7 @@
       {
         "implementation": "B",
         "type": "string",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.rules",
           "experimental.appsec.rules"
@@ -438,6 +461,7 @@
       {
         "implementation": "A",
         "type": "boolean",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.stackTrace.enabled",
           "experimental.appsec.stackTrace.enabled"
@@ -449,6 +473,7 @@
       {
         "implementation": "A",
         "type": "int",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.rateLimit",
           "experimental.appsec.rateLimit"
@@ -460,6 +485,7 @@
       {
         "implementation": "E",
         "type": "int",
+        "namespace": "appsec",
         "configurationNames": [
           "appsec.wafTimeout",
           "experimental.appsec.wafTimeout"
@@ -531,6 +557,22 @@
         "namespace": "testOptimization"
       }
     ],
+    "DD_CIVISIBILITY_DYNAMIC_ATR_BUCKETS": [
+      {
+        "implementation": "A",
+        "type": "array",
+        "default": null,
+        "namespace": "testOptimization"
+      }
+    ],
+    "DD_CIVISIBILITY_DYNAMIC_ATR_ENABLED": [
+      {
+        "implementation": "A",
+        "type": "boolean",
+        "default": "false",
+        "namespace": "testOptimization"
+      }
+    ],
     "DD_CIVISIBILITY_EARLY_FLAKE_DETECTION_ENABLED": [
       {
         "implementation": "B",
@@ -837,6 +879,7 @@
       {
         "implementation": "B",
         "type": "boolean",
+        "namespace": "appsec",
         "default": "false",
         "configurationNames": [
           "experimental.appsec.standalone.enabled"
@@ -1123,6 +1166,7 @@
       {
         "implementation": "A",
         "type": "int",
+        "namespace": "iast",
         "configurationNames": [
           "iast.dbRowsToTaint",
           "experimental.iast.dbRowsToTaint"
@@ -1134,6 +1178,7 @@
       {
         "implementation": "A",
         "type": "boolean",
+        "namespace": "iast",
         "configurationNames": [
           "iast.deduplicationEnabled",
           "experimental.iast.deduplicationEnabled"
@@ -1145,6 +1190,7 @@
       {
         "implementation": "B",
         "type": "boolean",
+        "namespace": "iast",
         "configurationNames": [
           "iast.enabled",
           "iast",
@@ -1158,6 +1204,7 @@
       {
         "implementation": "A",
         "type": "int",
+        "namespace": "iast",
         "configurationNames": [
           "iast.maxConcurrentRequests",
           "experimental.iast.maxConcurrentRequests"
@@ -1169,6 +1216,7 @@
       {
         "implementation": "A",
         "type": "int",
+        "namespace": "iast",
         "configurationNames": [
           "iast.maxContextOperations",
           "experimental.iast.maxContextOperations"
@@ -1180,6 +1228,7 @@
       {
         "implementation": "A",
         "type": "boolean",
+        "namespace": "iast",
         "configurationNames": [
           "iast.redactionEnabled",
           "experimental.iast.redactionEnabled"
@@ -1191,6 +1240,7 @@
       {
         "implementation": "A",
         "type": "string",
+        "namespace": "iast",
         "configurationNames": [
           "iast.redactionNamePattern",
           "experimental.iast.redactionNamePattern"
@@ -1202,6 +1252,7 @@
       {
         "implementation": "A",
         "type": "string",
+        "namespace": "iast",
         "configurationNames": [
           "iast.redactionValuePattern",
           "experimental.iast.redactionValuePattern"
@@ -1213,6 +1264,7 @@
       {
         "implementation": "A",
         "type": "int",
+        "namespace": "iast",
         "configurationNames": [
           "iast.requestSampling",
           "experimental.iast.requestSampling"
@@ -1234,6 +1286,7 @@
       {
         "implementation": "B",
         "type": "boolean",
+        "namespace": "iast",
         "configurationNames": [
           "iast.stackTrace.enabled",
           "experimental.iast.stackTrace.enabled"
@@ -1245,6 +1298,7 @@
       {
         "implementation": "B",
         "type": "string",
+        "namespace": "iast",
         "configurationNames": [
           "iast.telemetryVerbosity",
           "experimental.iast.telemetryVerbosity"
@@ -1349,7 +1403,8 @@
         "configurationNames": [
           "llmobs.agentlessEnabled"
         ],
-        "default": null
+        "default": null,
+        "namespace": "llmobs"
       }
     ],
     "DD_LLMOBS_ENABLED": [
@@ -1367,7 +1422,8 @@
         "configurationNames": [
           "llmobs.mlApp"
         ],
-        "default": null
+        "default": null,
+        "namespace": "llmobs"
       }
     ],
     "DD_LLMOBS_PROJECT_NAME": [
@@ -1377,9 +1433,45 @@
         "configurationNames": [
           "llmobs.projectName"
         ],
+        "default": null,
+        "namespace": "llmobs"
+      }
+    ],
+    "DD_LLMOBS_PROMPTS_CACHE_DIR": [
+      {
+        "implementation": "A",
+        "type": "string",
         "default": null
       }
     ],
+    "DD_LLMOBS_PROMPTS_CACHE_TTL": [
+      {
+        "implementation": "B",
+        "type": "decimal",
+        "default": "60",
+        "aliases": [
+          "DD_LLMOBS_PROMPTS_CACHE_TTL_SECONDS"
+        ]
+      }
+    ],
+    "DD_LLMOBS_PROMPTS_FILE_CACHE_ENABLED": [
+      {
+        "implementation": "A",
+        "type": "boolean",
+        "default": "false"
+      }
+    ],
+    "DD_LLMOBS_PROMPTS_TIMEOUT": [
+      {
+        "implementation": "B",
+        "type": "decimal",
+        "default": "5.0",
+        "allowed": "\\d+(\\.\\d+)?",
+        "aliases": [
+          "DD_LLMOBS_PROMPTS_TIMEOUT_SECONDS"
+        ]
+      }
+    ],
     "DD_LLMOBS_SAMPLE_RATE": [
       {
         "implementation": "A",
@@ -1387,7 +1479,8 @@
         "configurationNames": [
           "llmobs.sampleRate"
         ],
-        "default": "1.0"
+        "default": "1.0",
+        "namespace": "llmobs"
       }
     ],
     "DD_LOGS_INJECTION": [
@@ -1454,12 +1547,21 @@
       {
         "implementation": "A",
         "type": "boolean",
+        "namespace": "openai",
         "default": "false",
         "configurationNames": [
           "openAiLogsEnabled"
         ]
       }
     ],
+    "DD_OPENAI_REALTIME_ENABLED": [
+      {
+        "implementation": "A",
+        "type": "boolean",
+        "default": "true",
+        "namespace": "openai"
+      }
+    ],
     "DD_OPENAI_SPAN_CHAR_LIMIT": [
       {
         "implementation": "A",
@@ -1484,9 +1586,9 @@
     ],
     "DD_PROFILING_ALLOCATION_ENABLED": [
       {
-        "implementation": "A",
+        "implementation": "B",
         "type": "boolean",
-        "default": "false"
+        "default": "true"
       }
     ],
     "DD_PROFILING_ASYNC_CONTEXT_FRAME_ENABLED": [
@@ -1601,9 +1703,10 @@
     ],
     "DD_PROFILING_EXPERIMENTAL_OOM_HEAP_LIMIT_EXTENSION_SIZE": [
       {
-        "implementation": "A",
-        "type": "int",
-        "default": "0"
+        "implementation": "B",
+        "type": "string",
+        "transform": "normalizeProfilingHeapLimitExtensionSize",
+        "default": "auto"
       }
     ],
     "DD_PROFILING_EXPERIMENTAL_OOM_MAX_HEAP_EXTENSION_COUNT": [
@@ -1843,6 +1946,7 @@
         "implementation": "C",
         "type": "string",
         "default": "datadoghq.com",
+        "transform": "toLowerCase",
         "configurationNames": [
           "site"
         ]
@@ -3701,6 +3805,13 @@
         "default": "true"
       }
     ],
+    "DD_TRACE_POSTGRES_ENABLED": [
+      {
+        "implementation": "A",
+        "type": "boolean",
+        "default": "true"
+      }
+    ],
     "DD_TRACE_PRISMA_ENABLED": [
       {
         "implementation": "A",
@@ -4018,6 +4129,13 @@
         "default": "true"
       }
     ],
+    "DD_TRACE_SUPABASE_ENABLED": [
+      {
+        "implementation": "A",
+        "type": "boolean",
+        "default": "true"
+      }
+    ],
     "DD_TRACE_TAGS": [
       {
         "implementation": "B",
@@ -4196,6 +4314,7 @@
       {
         "implementation": "A",
         "type": "string",
+        "transform": "validateHttpUrl",
         "default": null
       }
     ],
@@ -4211,6 +4330,7 @@
       {
         "implementation": "A",
         "type": "string",
+        "transform": "validateHttpUrl",
         "default": null
       }
     ],
@@ -4231,6 +4351,7 @@
         "type": "string",
         "default": "http/json",
         "allowed": "http/json",
+        "transform": "toLowerCase",
         "aliases": [
           "OTEL_EXPORTER_OTLP_PROTOCOL"
         ]
@@ -4250,6 +4371,7 @@
       {
         "implementation": "A",
         "type": "string",
+        "transform": "validateHttpUrl",
         "default": null
       }
     ],
@@ -4269,6 +4391,8 @@
         "implementation": "D",
         "type": "string",
         "default": "http/protobuf",
+        "allowed": "grpc|http/json|http/protobuf",
+        "transform": "toLowerCase",
         "aliases": [
           "OTEL_EXPORTER_OTLP_PROTOCOL"
         ]
@@ -4289,6 +4413,7 @@
       {
         "implementation": "A",
         "type": "string",
+        "transform": "validateHttpUrl",
         "default": null
       }
     ],
@@ -4308,6 +4433,8 @@
         "implementation": "B",
         "type": "string",
         "default": "http/protobuf",
+        "allowed": "grpc|http/json|http/protobuf",
+        "transform": "toLowerCase",
         "aliases": [
           "OTEL_EXPORTER_OTLP_PROTOCOL"
         ]
@@ -4337,7 +4464,9 @@
       {
         "implementation": "A",
         "type": "string",
-        "default": "http/protobuf"
+        "default": "http/protobuf",
+        "allowed": "grpc|http/json|http/protobuf",
+        "transform": "toLowerCase"
       }
     ],
     "OTEL_EXPORTER_OTLP_TIMEOUT": [

package/packages/dd-trace/src/datastreams/encoding.js

@@ -26,7 +26,6 @@ function encodeVarint (v) {
  * @param {Uint8Array | Buffer} target
  * @param {number} offset
  * @param {number} value
- * @returns {number}
  */
 function encodeVarintInto (target, offset, value) {
   const sign = value >= 0 ? 0 : 1

package/packages/dd-trace/src/datastreams/pathway.js

@@ -86,7 +86,6 @@ function encodePathwayContext (dataStreamsContext) {
  * @param {Buffer} dataStreamsContext.hash
  * @param {number} dataStreamsContext.pathwayStartNs
  * @param {number} dataStreamsContext.edgeStartNs
- * @returns {string}
  */
 function encodePathwayContextBase64 (dataStreamsContext) {
   const encodedPathway = encodePathwayContext(dataStreamsContext)

package/packages/dd-trace/src/debugger/constants.js

@@ -1,9 +1,19 @@
 'use strict'
 
 module.exports = {
+  DEFAULT_QUEUE_MAX_BYTES: 10 * 1024 * 1024,
+  DIAGNOSTICS_QUEUE_MAX_BYTES: 1024 * 1024,
+  MAX_MESSAGE_LENGTH: 8 * 1024,
+
   DEBUGGER_INPUT_DIRECT: '/api/v2/debugger',
   DEBUGGER_DIAGNOSTICS_V1: '/debugger/v1/diagnostics',
   DEBUGGER_INPUT_V1: '/debugger/v1/input',
   DEBUGGER_INPUT_V2: '/debugger/v2/input',
+
+  // Guardrail counters are aggregated in shared memory and only converted into telemetry metrics at this interval, so
+  // the interval bounds the delay before a guardrail hit becomes visible, not the cost of recording it. Tests wait on
+  // it, so it is shared rather than duplicated.
+  GUARDRAIL_METRICS_FLUSH_INTERVAL_MS: 10_000,
+
   INSPECT_SEGMENT_GLOBAL_PROPERTY: 'debuggerInspectSegment',
 }

package/packages/dd-trace/src/debugger/devtools_client/breakpoints.js

@@ -57,6 +57,7 @@ module.exports = {
   addBreakpoint: lock(addBreakpoint),
   removeBreakpoint: lock(removeBreakpoint),
   modifyBreakpoint: lock(modifyBreakpoint),
+  refreshBreakpoints: lock(refreshBreakpoints),
 }
 
 async function addBreakpoint (probe) {
@@ -241,23 +242,77 @@ async function modifyBreakpoint (probe) {
   await addBreakpoint(probe)
 }
 
+/**
+ * Rebuild the breakpoint conditions at the locations of the given probes from the current state of the probes
+ * attached to them.
+ *
+ * A breakpoint condition bakes in whether each probe produces snapshots, which decides if a hit counts against the
+ * global snapshot rate limit and how a skipped hit is classified. That changes when the pause handler permanently
+ * disables capture for a probe after a fatal capture error, so the conditions have to be recompiled.
+ *
+ * Probes sharing a location share a breakpoint, so each location is only refreshed once. A probe that has been removed
+ * in the meantime is ignored: its location no longer needs the update.
+ *
+ * The locations are independent, so one that fails does not stop the others from being refreshed. Any failure is
+ * thrown once every location has been attempted.
+ *
+ * @param {{ id: string }[]} probes - Probes attached to the breakpoints to refresh.
+ * @returns {Promise<void>}
+ */
+async function refreshBreakpoints (probes) {
+  if (!sessionStarted) return
+
+  // Breakpoints set next to each other can snap to the same logical location and be hit at the same time, so the
+  // probes can be spread over more than one breakpoint.
+  const locationKeys = new Set()
+  for (const { id } of probes) {
+    const locationKey = probeToLocation.get(id)
+    if (locationKey !== undefined) locationKeys.add(locationKey)
+  }
+
+  /** @type {Error[] | undefined} */
+  let errors
+  for (const locationKey of locationKeys) {
+    try {
+      // eslint-disable-next-line no-await-in-loop
+      await updateBreakpointInternal(locationToBreakpoint.get(locationKey))
+    } catch (err) {
+      // Keep going: the remaining locations would otherwise hold on to the condition this refresh exists to replace
+      errors ??= []
+      errors.push(err)
+    }
+  }
+
+  if (errors !== undefined) {
+    throw errors.length === 1 ? errors[0] : new AggregateError(errors, 'Error refreshing breakpoints')
+  }
+}
+
+/**
+ * Replace the breakpoint at a location with one whose condition matches the probes currently attached to it.
+ *
+ * @param {{ id: string, location: object, locationKey: string }} breakpoint - The breakpoint to replace.
+ * @param {object} [probe] - A probe to attach to the breakpoint first, when one is being added.
+ * @returns {Promise<void>}
+ */
 async function updateBreakpointInternal (breakpoint, probe) {
   const probesAtLocation = breakpointToProbes.get(breakpoint.id)
 
-  // If a probe is provided, add it to the breakpoint. If not, it's because we're removing a probe. In both cases the
-  // breakpoint condition must be rebuilt to match the remaining probes at the location.
+  // If a probe is provided, add it to the breakpoint. If not, it's because we're removing a probe or the probes at the
+  // location changed. In all cases the breakpoint condition must be rebuilt to match the probes at the location.
+  let context // identifies the update in the error messages below
   if (probe) {
     probesAtLocation.set(probe.id, probe)
     probeToLocation.set(probe.id, breakpoint.locationKey)
+    context = `while adding probe ${probe.id} (version: ${probe.version})`
+  } else {
+    context = `at ${breakpoint.locationKey}`
   }
 
   try {
     await session.post('Debugger.removeBreakpoint', { breakpointId: breakpoint.id })
   } catch (err) {
-    const message = probe
-      ? `Error replacing breakpoint while adding probe ${probe.id} (version: ${probe.version})`
-      : `Error replacing breakpoint after removing probe from ${breakpoint.locationKey}`
-    throw new Error(message, { cause: err })
+    throw new Error(`Error replacing breakpoint ${context}`, { cause: err })
   }
   breakpointToProbes.delete(breakpoint.id)
   let result
@@ -267,10 +322,7 @@ async function updateBreakpointInternal (breakpoint, probe) {
       condition: compileBreakpointCondition([...probesAtLocation.values()]),
     }))
   } catch (err) {
-    const message = probe
-      ? `Error setting breakpoint while adding probe ${probe.id} (version: ${probe.version})`
-      : `Error setting breakpoint after removing probe from ${breakpoint.locationKey}`
-    throw new Error(message, { cause: err })
+    throw new Error(`Error setting breakpoint ${context}`, { cause: err })
   }
   breakpoint.id = result.breakpointId
   breakpointToProbes.set(result.breakpointId, probesAtLocation)

package/packages/dd-trace/src/debugger/devtools_client/config.js

@@ -2,6 +2,7 @@
 
 const { workerData: { config: parentConfig, parentThreadId, configPort } } = require('node:worker_threads')
 const processTags = require('../../process-tags')
+const { DEFAULT_QUEUE_MAX_BYTES } = require('../constants')
 const log = require('./log')
 
 processTags.initialize()
@@ -10,6 +11,7 @@ const config = module.exports = {
   ...parentConfig,
   parentThreadId,
   maxTotalPayloadSize: 5 * 1024 * 1024, // 5MB
+  queueMaxBytes: DEFAULT_QUEUE_MAX_BYTES,
 }
 
 updateConfig(parentConfig)