dd-trace 6.3.0 → 6.5.0

package/packages/dd-trace/src/ci-visibility/test-optimization-http-cache.js

@@ -6,7 +6,10 @@ const path = require('node:path')
 const log = require('../log')
 const { getNumFromKnownTests } = require('../plugins/util/test')
 const { parseKnownTestsResponse } = require('./early-flake-detection/get-known-tests')
-const { parseSkippableSuitesResponse } = require('./intelligent-test-runner/get-skippable-suites')
+const {
+  logSkippableSuitesResponse,
+  parseSkippableSuitesResponse,
+} = require('./intelligent-test-runner/get-skippable-suites')
 const { parseLibraryConfigurationResponse } = require('./requests/get-library-configuration')
 const {
   getNumFromTestManagementTests,
@@ -45,6 +48,10 @@ const SKIPPABLE_TESTS_FILE_NAME = 'skippable_tests.json'
 const TEST_MANAGEMENT_FILE_NAME = 'test_management.json'
 
 const RUNFILES_MANIFEST_SEPARATOR = ' '
+const DEFAULT_VALIDATION_MAX_FILE_BYTES = 1024 * 1024
+const DEFAULT_VALIDATION_MAX_ENTRIES = 100_000
+const DEFAULT_VALIDATION_MAX_NESTING_DEPTH = 32
+const DEFAULT_VALIDATION_MAX_STRING_BYTES = 4096
 
 function parseManifestVersion (content) {
   // Supported just the number version or 'version=x'
@@ -54,12 +61,22 @@ function parseManifestVersion (content) {
 }
 
 class TestOptimizationHttpCache {
-  constructor ({ cwd = process.cwd(), env } = {}) {
+  constructor ({
+    cwd = process.cwd(),
+    env,
+    validationManifestPath,
+    maxFileBytes = DEFAULT_VALIDATION_MAX_FILE_BYTES,
+  } = {}) {
     this._cwd = cwd
     // This cache intentionally consumes env vars that are not tracer config keys. (??)
     // eslint-disable-next-line eslint-rules/eslint-process-env
     this._env = env ?? process.env
-    this._manifestPath = this._resolveManifestPath()
+    this._validationManifestPath = validationManifestPath
+    this._maxFileBytes = maxFileBytes
+    this._lastError = undefined
+    this._manifestPath = validationManifestPath
+      ? this._resolveValidationManifestPath(validationManifestPath)
+      : this._resolveManifestPath()
     this._testOptimizationPath = undefined
     this._httpCachePath = undefined
     this._available = false
@@ -71,6 +88,10 @@ class TestOptimizationHttpCache {
     return this._available
   }
 
+  getLastError () {
+    return this._lastError
+  }
+
   readSettings () {
     const payload = this._readFile(SETTINGS_FILE_NAME)
     if (payload === CACHE_MISS) {
@@ -79,7 +100,11 @@ class TestOptimizationHttpCache {
     }
 
     try {
-      const settings = parseLibraryConfigurationResponse(payload, undefined, { validateRequiredFields: true })
+      const settings = parseLibraryConfigurationResponse(
+        this._parsePayload(payload, SETTINGS_FILE_NAME),
+        undefined,
+        { validateRequiredFields: true, validationMode: Boolean(this._validationManifestPath) }
+      )
       incrementCountMetric(TELEMETRY_GIT_REQUESTS_SETTINGS_RESPONSE, settings)
       return settings
     } catch (err) {
@@ -94,7 +119,10 @@ class TestOptimizationHttpCache {
     if (payload === CACHE_MISS) return CACHE_MISS
 
     try {
-      const knownTests = parseKnownTestsResponse(payload, { validateRequiredFields: true })
+      const knownTests = parseKnownTestsResponse(
+        this._parsePayload(payload, KNOWN_TESTS_FILE_NAME),
+        { validateRequiredFields: true, validationMode: Boolean(this._validationManifestPath) }
+      )
       distributionMetric(TELEMETRY_KNOWN_TESTS_RESPONSE_TESTS, {}, getNumFromKnownTests(knownTests))
       distributionMetric(TELEMETRY_KNOWN_TESTS_RESPONSE_BYTES, {}, payload.length)
       return knownTests
@@ -109,9 +137,15 @@ class TestOptimizationHttpCache {
     if (payload === CACHE_MISS) return CACHE_MISS
 
     try {
-      const parsedResponse = JSON.parse(payload)
-      const result = parseSkippableSuitesResponse(parsedResponse, { ...options, validateRequiredFields: true })
+      const boundedPayload = this._parsePayload(payload, SKIPPABLE_TESTS_FILE_NAME)
+      const parsedResponse = typeof boundedPayload === 'string' ? JSON.parse(boundedPayload) : boundedPayload
+      const result = parseSkippableSuitesResponse(parsedResponse, {
+        ...options,
+        validateRequiredFields: true,
+        validationMode: Boolean(this._validationManifestPath),
+      })
       const testLevel = options.testLevel || 'suite'
+      logSkippableSuitesResponse(result, testLevel)
       const skippableItems = parsedResponse.data.filter(({ type }) => type === testLevel)
       incrementCountMetric(
         testLevel === 'test'
@@ -133,7 +167,10 @@ class TestOptimizationHttpCache {
     if (payload === CACHE_MISS) return false
 
     try {
-      parseSkippableSuitesResponse(JSON.parse(payload), { ...options, validateRequiredFields: true })
+      parseSkippableSuitesResponse(
+        this._parsePayload(payload, SKIPPABLE_TESTS_FILE_NAME),
+        { ...options, validateRequiredFields: true, validationMode: Boolean(this._validationManifestPath) }
+      )
       return true
     } catch {
       return false
@@ -145,7 +182,10 @@ class TestOptimizationHttpCache {
     if (payload === CACHE_MISS) return CACHE_MISS
 
     try {
-      const testManagementTests = parseTestManagementTestsResponse(payload, { validateRequiredFields: true })
+      const testManagementTests = parseTestManagementTestsResponse(
+        this._parsePayload(payload, TEST_MANAGEMENT_FILE_NAME),
+        { validateRequiredFields: true, validationMode: Boolean(this._validationManifestPath) }
+      )
       distributionMetric(
         TELEMETRY_TEST_MANAGEMENT_TESTS_RESPONSE_TESTS,
         {},
@@ -161,12 +201,18 @@ class TestOptimizationHttpCache {
 
   _buildReader () {
     if (!this._manifestPath) {
+      if (this._validationManifestPath && !this._lastError) {
+        this._setError('Offline Test Optimization validation manifest was not found.')
+      }
       log.debug('Test Optimization HTTP cache manifest not found')
       return
     }
 
     const version = this._readManifestVersion(this._manifestPath)
     if (version !== SUPPORTED_MANIFEST_VERSION) {
+      if (this._validationManifestPath) {
+        this._setError(`Unsupported offline Test Optimization validation manifest version: ${version || 'missing'}.`)
+      }
       log.debug('Unsupported Test Optimization HTTP cache manifest version %j at %s', version, this._manifestPath)
       return
     }
@@ -180,6 +226,9 @@ class TestOptimizationHttpCache {
 
     const settingsPath = path.join(this._httpCachePath, SETTINGS_FILE_NAME)
     if (!fs.existsSync(settingsPath)) {
+      if (this._validationManifestPath) {
+        this._setError('Offline Test Optimization validation settings fixture is missing.')
+      }
       log.debug('Test Optimization HTTP cache settings file not found at %s', settingsPath)
       return
     }
@@ -203,6 +252,30 @@ class TestOptimizationHttpCache {
     }
   }
 
+  _resolveValidationManifestPath (manifestPath) {
+    if (!path.isAbsolute(manifestPath)) {
+      this._setError('Offline Test Optimization validation manifest path must be absolute.')
+      return
+    }
+
+    const resolvedManifestPath = path.resolve(manifestPath)
+    const testOptimizationPath = path.dirname(resolvedManifestPath)
+    const fixtureRoot = path.dirname(testOptimizationPath)
+    if (path.basename(resolvedManifestPath) !== MANIFEST_FILE_NAME ||
+      path.basename(testOptimizationPath) !== PLAN_FOLDER) {
+      this._setError('Offline Test Optimization validation manifest must use the fixed .testoptimization layout.')
+      return
+    }
+
+    try {
+      assertPathComponentsAreNotSymlinks(fixtureRoot, resolvedManifestPath)
+      assertRegularFixtureFile(resolvedManifestPath)
+      return resolvedManifestPath
+    } catch (err) {
+      this._setError(err.message)
+    }
+  }
+
   _resolveRunfilePath (manifestFile) {
     if (fs.existsSync(manifestFile)) {
       return manifestFile
@@ -253,8 +326,10 @@ class TestOptimizationHttpCache {
 
   _readManifestVersion (manifestPath) {
     try {
+      this._assertValidationFixtureFile(manifestPath)
       return parseManifestVersion(fs.readFileSync(manifestPath, 'utf8'))
     } catch (err) {
+      if (this._validationManifestPath) this._setError(err.message)
       log.debug('Failed to read Test Optimization HTTP cache manifest %s: %s', manifestPath, err.message)
     }
   }
@@ -264,24 +339,113 @@ class TestOptimizationHttpCache {
 
     const filePath = path.join(this._httpCachePath, fileName)
     try {
+      this._assertValidationFixtureFile(filePath)
       log.debug('Reading Test Optimization HTTP cache file %s', filePath)
       return fs.readFileSync(filePath, 'utf8')
     } catch (err) {
+      if (this._validationManifestPath) this._setError(err.message)
       log.debug('Test Optimization HTTP cache file %s could not be read: %s', filePath, err.message)
       return CACHE_MISS
     }
   }
 
   _logInvalidCacheFile (fileName, err) {
+    if (this._validationManifestPath) {
+      this._setError(`Invalid offline Test Optimization ${fileName} fixture: ${err.message}`)
+    }
     log.debug('Test Optimization HTTP cache file %s could not be parsed: %s', fileName, err.message)
   }
 
+  _assertValidationFixtureFile (filePath) {
+    if (!this._validationManifestPath) return
+    const fixtureRoot = path.dirname(path.dirname(this._manifestPath))
+    assertPathComponentsAreNotSymlinks(fixtureRoot, filePath)
+    const stat = assertRegularFixtureFile(filePath)
+    if (stat.size > this._maxFileBytes) {
+      throw new Error(
+        `Offline Test Optimization fixture ${path.basename(filePath)} exceeds ${this._maxFileBytes} bytes.`
+      )
+    }
+  }
+
+  _parsePayload (payload, fileName) {
+    if (!this._validationManifestPath) return payload
+
+    const parsed = JSON.parse(payload)
+    assertBoundedValidationValue(parsed, fileName)
+    return parsed
+  }
+
+  _setError (message) {
+    this._lastError = new Error(message)
+  }
+
   _disable () {
     this._available = false
   }
 }
 
+function assertPathComponentsAreNotSymlinks (root, filename) {
+  const resolvedRoot = path.resolve(root)
+  const resolvedFilename = path.resolve(filename)
+  const rootStat = fs.lstatSync(resolvedRoot)
+  if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) {
+    throw new Error(`Offline Test Optimization fixture root must be a regular directory: ${resolvedRoot}`)
+  }
+  const relative = path.relative(resolvedRoot, resolvedFilename)
+  if (relative.startsWith('..') || path.isAbsolute(relative)) {
+    throw new Error('Offline Test Optimization fixture path escapes its validation root.')
+  }
+
+  let current = resolvedRoot
+  for (const segment of relative ? relative.split(path.sep) : []) {
+    current = path.join(current, segment)
+    const stat = fs.lstatSync(current)
+    if (stat.isSymbolicLink()) {
+      throw new Error(`Offline Test Optimization fixture path contains a symbolic link: ${current}`)
+    }
+  }
+}
+
+function assertRegularFixtureFile (filename) {
+  const stat = fs.lstatSync(filename)
+  if (!stat.isFile()) {
+    throw new Error(`Offline Test Optimization fixture is not a regular file: ${filename}`)
+  }
+  if (stat.nlink > 1) {
+    throw new Error(`Offline Test Optimization fixture must not be hard-linked: ${filename}`)
+  }
+  return stat
+}
+
+function assertBoundedValidationValue (value, fileName) {
+  const pending = [{ depth: 0, value }]
+  let entries = 0
+
+  while (pending.length > 0) {
+    const current = pending.pop()
+    if (current.depth > DEFAULT_VALIDATION_MAX_NESTING_DEPTH) {
+      throw new Error(`${fileName} exceeds the validation nesting limit.`)
+    }
+    if (typeof current.value === 'string' &&
+      Buffer.byteLength(current.value) > DEFAULT_VALIDATION_MAX_STRING_BYTES) {
+      throw new Error(`${fileName} contains a string that exceeds the validation limit.`)
+    }
+    if (!current.value || typeof current.value !== 'object') continue
+
+    const values = Array.isArray(current.value) ? current.value : Object.values(current.value)
+    entries += values.length
+    if (entries > DEFAULT_VALIDATION_MAX_ENTRIES) {
+      throw new Error(`${fileName} exceeds the validation collection-entry limit.`)
+    }
+    for (const nestedValue of values) {
+      pending.push({ depth: current.depth + 1, value: nestedValue })
+    }
+  }
+}
+
 module.exports = {
   CACHE_MISS,
+  DEFAULT_VALIDATION_MAX_FILE_BYTES,
   TestOptimizationHttpCache,
 }

package/packages/dd-trace/src/ci-visibility/test-screenshot.js

@@ -0,0 +1,90 @@
+'use strict'
+
+const { statSync } = require('node:fs')
+
+const {
+  TEST_FAILURE_SCREENSHOT_UPLOADED,
+  TEST_FAILURE_SCREENSHOT_UPLOAD_ERROR,
+} = require('../plugins/util/test')
+
+const dateNow = Date.now
+
+const SCREENSHOT_UPLOAD_RESULT_UPLOADED = 'uploaded'
+const SCREENSHOT_UPLOAD_RESULT_ERROR = 'error'
+
+/**
+ * Resolves a screenshot's capture time in epoch milliseconds.
+ *
+ * @param {object|string} screenshot - Framework screenshot metadata or its file path
+ * @param {string} filePath - Resolved screenshot file path
+ * @returns {number} Capture time in epoch milliseconds
+ */
+function getScreenshotCapturedAtMs (screenshot, filePath) {
+  const takenAt = screenshot !== null && typeof screenshot === 'object' ? screenshot.takenAt : undefined
+  if (takenAt) {
+    const parsedMs = new Date(takenAt).getTime()
+    if (Number.isInteger(parsedMs) && parsedMs > 0) {
+      return parsedMs
+    }
+  }
+  try {
+    return Math.floor(statSync(filePath).mtimeMs)
+  } catch {
+    return dateNow()
+  }
+}
+
+/**
+ * Combines screenshot upload results, giving errors precedence over successes.
+ *
+ * @param {Array<string|undefined>} uploadResults - Per-screenshot upload results
+ * @returns {string|undefined} Combined upload result
+ */
+function getScreenshotUploadResult (uploadResults) {
+  let hasUploaded = false
+  for (const uploadResult of uploadResults) {
+    if (uploadResult === SCREENSHOT_UPLOAD_RESULT_ERROR) {
+      return SCREENSHOT_UPLOAD_RESULT_ERROR
+    }
+    if (uploadResult === SCREENSHOT_UPLOAD_RESULT_UPLOADED) {
+      hasUploaded = true
+    }
+  }
+  return hasUploaded ? SCREENSHOT_UPLOAD_RESULT_UPLOADED : undefined
+}
+
+/**
+ * Returns the test tag that represents an aggregate screenshot upload outcome.
+ *
+ * @param {string|undefined} uploadResult - Aggregate screenshot upload result
+ * @returns {string|undefined} Screenshot upload result tag
+ */
+function getScreenshotUploadTag (uploadResult) {
+  if (uploadResult === SCREENSHOT_UPLOAD_RESULT_ERROR) {
+    return TEST_FAILURE_SCREENSHOT_UPLOAD_ERROR
+  }
+  if (uploadResult === SCREENSHOT_UPLOAD_RESULT_UPLOADED) {
+    return TEST_FAILURE_SCREENSHOT_UPLOADED
+  }
+}
+
+/**
+ * Tags a test span with the aggregate screenshot upload outcome.
+ *
+ * @param {object} testSpan - Test span to tag
+ * @param {string|undefined} uploadResult - Aggregate screenshot upload result
+ * @returns {void}
+ */
+function setScreenshotUploadTags (testSpan, uploadResult) {
+  const uploadTag = getScreenshotUploadTag(uploadResult)
+  if (uploadTag) testSpan.setTag(uploadTag, 'true')
+}
+
+module.exports = {
+  SCREENSHOT_UPLOAD_RESULT_ERROR,
+  SCREENSHOT_UPLOAD_RESULT_UPLOADED,
+  getScreenshotCapturedAtMs,
+  getScreenshotUploadResult,
+  getScreenshotUploadTag,
+  setScreenshotUploadTags,
+}

package/packages/dd-trace/src/config/generated-config-types.d.ts

@@ -16,6 +16,7 @@ export interface GeneratedConfig {
     DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES: number;
     DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS: number;
     DD_API_SECURITY_SAMPLE_DELAY: number;
+    DD_APPSEC_AGENTIC_ONBOARDING: string;
     DD_APPSEC_SCA_ENABLED: boolean | undefined;
     enabled: boolean | undefined;
     eventTracking: {
@@ -431,6 +432,13 @@ export interface GeneratedConfig {
       };
     };
   };
+  featureFlags: {
+    DD_FEATURE_FLAGS_CONFIGURATION_SOURCE: "agentless" | "remote_config";
+    DD_FEATURE_FLAGS_CONFIGURATION_SOURCE_AGENTLESS_BASE_URL: string | undefined;
+    DD_FEATURE_FLAGS_CONFIGURATION_SOURCE_AGENTLESS_POLL_INTERVAL_SECONDS: number;
+    DD_FEATURE_FLAGS_CONFIGURATION_SOURCE_AGENTLESS_REQUEST_TIMEOUT_SECONDS: number;
+    DD_FEATURE_FLAGS_ENABLED: boolean;
+  };
   flushInterval: number;
   flushMinSpans: number;
   headerTags: string[];
@@ -546,6 +554,7 @@ export interface GeneratedConfig {
     DD_CIVISIBILITY_AGENTLESS_ENABLED: boolean;
     DD_CIVISIBILITY_AGENTLESS_URL: URL | undefined;
     DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER: string | undefined;
+    DD_CIVISIBILITY_CODE_COVERAGE_REPORT_UPLOAD_ENABLED: boolean;
     DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE: boolean;
     DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING: boolean;
     DD_CIVISIBILITY_EARLY_FLAKE_DETECTION_ENABLED: boolean;
@@ -561,6 +570,8 @@ export interface GeneratedConfig {
     DD_CIVISIBILITY_TEST_COMMAND: string | undefined;
     DD_CIVISIBILITY_TEST_MODULE_ID: string | undefined;
     DD_CIVISIBILITY_TEST_SESSION_ID: string | undefined;
+    DD_CODE_COVERAGE_FLAGS: string | undefined;
+    DD_TEST_EARLY_FLAKE_DETECTION_RETRY_COUNT: number | undefined;
     DD_TEST_FAILED_TEST_REPLAY_ENABLED: boolean;
     DD_TEST_FAILURE_SCREENSHOTS_ENABLED: boolean | undefined;
     DD_TEST_FLEET_CONFIG_PATH: string | undefined;
@@ -610,6 +621,7 @@ export interface GeneratedEnvVarConfig {
   DD_APM_FLUSH_DEADLINE_MILLISECONDS: number;
   DD_APM_TRACING_ENABLED: boolean;
   DD_APP_KEY: string | undefined;
+  DD_APPSEC_AGENTIC_ONBOARDING: string;
   DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE: string;
   DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING: string;
   DD_APPSEC_COLLECT_ALL_HEADERS: boolean;
@@ -636,6 +648,7 @@ export interface GeneratedEnvVarConfig {
   DD_CIVISIBILITY_AGENTLESS_ENABLED: boolean;
   DD_CIVISIBILITY_AGENTLESS_URL: URL | undefined;
   DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER: string | undefined;
+  DD_CIVISIBILITY_CODE_COVERAGE_REPORT_UPLOAD_ENABLED: boolean;
   DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE: boolean;
   DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING: boolean;
   DD_CIVISIBILITY_EARLY_FLAKE_DETECTION_ENABLED: boolean;
@@ -651,6 +664,7 @@ export interface GeneratedEnvVarConfig {
   DD_CIVISIBILITY_TEST_COMMAND: string | undefined;
   DD_CIVISIBILITY_TEST_MODULE_ID: string | undefined;
   DD_CIVISIBILITY_TEST_SESSION_ID: string | undefined;
+  DD_CODE_COVERAGE_FLAGS: string | undefined;
   DD_CODE_ORIGIN_FOR_SPANS_ENABLED: boolean;
   DD_CODE_ORIGIN_FOR_SPANS_EXPERIMENTAL_EXIT_SPANS_ENABLED: boolean;
   DD_CRASHTRACKING_ENABLED: boolean;
@@ -685,6 +699,11 @@ export interface GeneratedEnvVarConfig {
   DD_EXPERIMENTAL_TEST_OPT_VITEST_NO_WORKER_INIT: boolean | undefined;
   DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE: boolean;
   DD_EXTERNAL_ENV: string | undefined;
+  DD_FEATURE_FLAGS_CONFIGURATION_SOURCE: "agentless" | "remote_config";
+  DD_FEATURE_FLAGS_CONFIGURATION_SOURCE_AGENTLESS_BASE_URL: string | undefined;
+  DD_FEATURE_FLAGS_CONFIGURATION_SOURCE_AGENTLESS_POLL_INTERVAL_SECONDS: number;
+  DD_FEATURE_FLAGS_CONFIGURATION_SOURCE_AGENTLESS_REQUEST_TIMEOUT_SECONDS: number;
+  DD_FEATURE_FLAGS_ENABLED: boolean;
   DD_GIT_BRANCH: string | undefined;
   DD_GIT_COMMIT_AUTHOR_DATE: string | undefined;
   DD_GIT_COMMIT_AUTHOR_EMAIL: string | undefined;
@@ -794,6 +813,7 @@ export interface GeneratedEnvVarConfig {
   DD_TELEMETRY_HEARTBEAT_INTERVAL: number;
   DD_TELEMETRY_LOG_COLLECTION_ENABLED: boolean;
   DD_TELEMETRY_METRICS_ENABLED: boolean;
+  DD_TEST_EARLY_FLAKE_DETECTION_RETRY_COUNT: number | undefined;
   DD_TEST_FAILED_TEST_REPLAY_ENABLED: boolean;
   DD_TEST_FAILURE_SCREENSHOTS_ENABLED: boolean | undefined;
   DD_TEST_FLEET_CONFIG_PATH: string | undefined;

package/packages/dd-trace/src/config/helper.js

@@ -13,6 +13,7 @@
  * @property {string} [namespace] Nests the canonical env name under this property path (e.g. `telemetry`).
  * @property {string} [transform]
  * @property {string} [allowed]
+ * @property {string} [description]
  * @property {string|boolean} [deprecated]
  * @property {boolean} [sensitive] Excludes the configuration value from configuration telemetry.
  */

package/packages/dd-trace/src/config/index.js

@@ -333,6 +333,16 @@ class Config extends ConfigBase {
   #applyCalculated () {
     undo(this, 'calculated')
 
+    if (this.featureFlags.DD_FEATURE_FLAGS_ENABLED &&
+        !trackedConfigOrigins.has('featureFlags.DD_FEATURE_FLAGS_CONFIGURATION_SOURCE') &&
+        trackedConfigOrigins.has('experimental.flaggingProvider.enabled')) {
+      if (this.experimental.flaggingProvider.enabled) {
+        setAndTrack(this, 'featureFlags.DD_FEATURE_FLAGS_CONFIGURATION_SOURCE', 'remote_config')
+      } else {
+        setAndTrack(this, 'featureFlags.DD_FEATURE_FLAGS_ENABLED', false)
+      }
+    }
+
     if (this.url ||
         os.type() !== 'Windows_NT' &&
         !trackedConfigOrigins.has('hostname') &&

package/packages/dd-trace/src/config/supported-configurations.json

@@ -206,6 +206,15 @@
         ]
       }
     ],
+    "DD_APPSEC_AGENTIC_ONBOARDING": [
+      {
+        "implementation": "A",
+        "type": "string",
+        "default": "",
+        "namespace": "appsec",
+        "description": "Set automatically by Datadog's agentic onboarding solution when it configures App & API Protection for a service. Reported verbatim in configuration telemetry only; it has no effect on tracer behavior."
+      }
+    ],
     "DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE": [
       {
         "implementation": "E",
@@ -470,6 +479,14 @@
         "namespace": "testOptimization"
       }
     ],
+    "DD_CIVISIBILITY_CODE_COVERAGE_REPORT_UPLOAD_ENABLED": [
+      {
+        "implementation": "A",
+        "type": "boolean",
+        "default": "true",
+        "namespace": "testOptimization"
+      }
+    ],
     "DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE": [
       {
         "implementation": "A",
@@ -494,6 +511,15 @@
         "namespace": "testOptimization"
       }
     ],
+    "DD_TEST_EARLY_FLAKE_DETECTION_RETRY_COUNT": [
+      {
+        "implementation": "A",
+        "type": "int",
+        "allowed": "0|[1-9][0-9]*",
+        "default": null,
+        "namespace": "testOptimization"
+      }
+    ],
     "DD_CIVISIBILITY_ENABLED": [
       {
         "implementation": "A",
@@ -597,6 +623,14 @@
         "namespace": "testOptimization"
       }
     ],
+    "DD_CODE_COVERAGE_FLAGS": [
+      {
+        "implementation": "A",
+        "type": "string",
+        "default": null,
+        "namespace": "testOptimization"
+      }
+    ],
     "DD_CODE_ORIGIN_FOR_SPANS_ENABLED": [
       {
         "implementation": "A",
@@ -810,6 +844,55 @@
         "default": "false"
       }
     ],
+    "DD_FEATURE_FLAGS_CONFIGURATION_SOURCE": [
+      {
+        "implementation": "A",
+        "type": "string",
+        "default": "agentless",
+        "allowed": "agentless|remote_config",
+        "description": "Experimental: Select where Feature Flagging loads Universal Flag Configuration. Supported values are agentless and remote_config.",
+        "namespace": "featureFlags",
+        "transform": "toLowerCase"
+      }
+    ],
+    "DD_FEATURE_FLAGS_CONFIGURATION_SOURCE_AGENTLESS_BASE_URL": [
+      {
+        "implementation": "A",
+        "type": "string",
+        "default": null,
+        "description": "Experimental: Override the agentless Feature Flagging UFC endpoint or base URL.",
+        "namespace": "featureFlags",
+        "sensitive": true
+      }
+    ],
+    "DD_FEATURE_FLAGS_CONFIGURATION_SOURCE_AGENTLESS_POLL_INTERVAL_SECONDS": [
+      {
+        "implementation": "A",
+        "type": "int",
+        "default": "30",
+        "description": "Experimental: Set the agentless Feature Flagging UFC polling interval in seconds, capped at one hour.",
+        "allowed": "[1-9]\\d*",
+        "namespace": "featureFlags"
+      }
+    ],
+    "DD_FEATURE_FLAGS_CONFIGURATION_SOURCE_AGENTLESS_REQUEST_TIMEOUT_SECONDS": [
+      {
+        "implementation": "A",
+        "type": "int",
+        "default": "5",
+        "description": "Experimental: Set the agentless Feature Flagging UFC request timeout in seconds.",
+        "allowed": "[1-9]\\d*",
+        "namespace": "featureFlags"
+      }
+    ],
+    "DD_FEATURE_FLAGS_ENABLED": [
+      {
+        "implementation": "A",
+        "type": "boolean",
+        "default": "true",
+        "namespace": "featureFlags"
+      }
+    ],
     "DD_EXPERIMENTAL_PROPAGATE_PROCESS_TAGS_ENABLED": [
       {
         "implementation": "B",

package/packages/dd-trace/src/constants.js

@@ -31,6 +31,13 @@ module.exports = {
   ERROR_MESSAGE: 'error.message',
   ERROR_STACK: 'error.stack',
   IGNORE_OTEL_ERROR: Symbol('ignore.otel.error'),
+  // Marks an `Http2Server` that another instrumentation (currently @grpc/grpc-js)
+  // owns and traces through its own span lifecycle over the raw HTTP/2 stream
+  // API. The http2 server instrumentation reads this to leave such servers
+  // untraced, so a gRPC call keeps a single span with gRPC as the top frame
+  // instead of gaining an extra web.request span. A module-local Symbol keeps
+  // the mark private to dd-trace and unforgeable from user code.
+  FOREIGN_HTTP2_SERVER: Symbol('foreign.http2.server'),
   COMPONENT: 'component',
   CLIENT_PORT_KEY: 'network.destination.port',
   PEER_SERVICE_KEY: 'peer.service',

package/packages/dd-trace/src/datastreams/pathway.js

@@ -136,16 +136,18 @@ const DsmPathwayCodec = {
    * @param {Buffer} dataStreamsContext.hash
    * @param {number} dataStreamsContext.pathwayStartNs
    * @param {number} dataStreamsContext.edgeStartNs
-   * @param {object} carrier
+   * @param {object} [carrier]
+   * @returns {object | undefined}
    */
   encode (dataStreamsContext, carrier) {
-    if (!dataStreamsContext || !dataStreamsContext.hash) {
-      return
-    }
+    if (!dataStreamsContext || !dataStreamsContext.hash) return
+    carrier ??= {}
     carrier[CONTEXT_PROPAGATION_KEY_BASE64] = encodePathwayContextBase64(dataStreamsContext)
 
     // eslint-disable-next-line eslint-rules/eslint-log-printf-style
     log.debug(() => `Injected into DSM carrier: ${JSON.stringify(pick(carrier, logKeys))}.`)
+
+    return carrier
   },
 
   /**

package/packages/dd-trace/src/exporter.js

@@ -19,6 +19,8 @@ module.exports = function getExporter (name) {
       return require('./ci-visibility/exporters/agentless')
     case exporters.AGENT_PROXY:
       return require('./ci-visibility/exporters/agent-proxy')
+    case exporters.CI_VALIDATION:
+      return require('./ci-visibility/exporters/ci-validation')
     case exporters.JEST_WORKER:
     case exporters.CUCUMBER_WORKER:
     case exporters.MOCHA_WORKER: