dd-trace 6.4.0 → 6.6.0

package/ci/test-optimization-validation/init-probe.js

@@ -0,0 +1,246 @@
+'use strict'
+
+const fs = require('node:fs')
+const path = require('node:path')
+
+const {
+  mergeNodeOptions,
+  runCommand,
+} = require('./command-runner')
+const { inheritApprovedExecutable } = require('./executable-approval')
+const { sanitizeForReport } = require('./redaction')
+const { createFileSafely, ensureSafeDirectory, writeFileSafely } = require('./safe-files')
+
+const PROBE_PRELOAD = path.join(__dirname, 'init-probe-preload.js')
+const PROBE_FILE_ENV = 'DD_TEST_OPTIMIZATION_INIT_PROBE_FILE'
+const MAX_PROBE_RECORD_BYTES = 1024 * 1024
+
+/**
+ * Runs a CI-shaped command with a lightweight NODE_OPTIONS preload that records process reachability.
+ *
+ * @param {object} options probe options
+ * @param {object} options.command manifest command to run
+ * @param {object} options.framework manifest framework entry
+ * @param {string} options.outDir scenario output directory
+ * @param {object} options.options CLI options
+ * @returns {Promise<{ artifacts: object, summary: object }>} probe artifacts and summary
+ */
+async function runInitializationProbe ({ command, framework, outDir, options }) {
+  const probeOutDir = path.join(outDir, 'initialization-probe')
+  const recordsPath = path.join(probeOutDir, 'records.ndjson')
+  const rawRecordsPath = path.join(probeOutDir, '.records.raw.ndjson')
+  const probeCommand = getProbeCommand(command)
+
+  ensureSafeDirectory(outDir, probeOutDir, 'initialization probe artifact directory')
+  createFileSafely(outDir, rawRecordsPath, '', 'raw initialization probe records')
+
+  let result
+  let records
+  try {
+    result = await runCommand(probeCommand, {
+      artifactRoot: outDir,
+      env: {
+        [PROBE_FILE_ENV]: rawRecordsPath,
+        NODE_OPTIONS: mergeNodeOptions(
+          `-r ${formatNodeRequire(PROBE_PRELOAD)}`
+        ),
+      },
+      envMode: 'clean',
+      outDir: probeOutDir,
+      repositoryRoot: options.repositoryRoot,
+      requireExecutableApproval: options.requireExecutableApproval,
+      label: `${framework.id}:ci-wiring:init-probe`,
+      stopWhen: () => probeReachedFramework(rawRecordsPath, framework.framework),
+      verbose: options.verbose,
+    })
+    records = readProbeRecords(rawRecordsPath)
+    writeFileSafely(
+      outDir,
+      recordsPath,
+      records.map(record => JSON.stringify(sanitizeForReport(record))).join('\n') + '\n',
+      'initialization probe records'
+    )
+  } finally {
+    fs.rmSync(rawRecordsPath, { force: true })
+  }
+
+  return {
+    artifacts: {
+      command: result.artifacts.command,
+      records: recordsPath,
+      stderr: result.artifacts.stderr,
+      stdout: result.artifacts.stdout,
+    },
+    summary: summarizeProbeResult({ framework, result, records, recordsPath }),
+  }
+}
+
+function getProbeCommand (command) {
+  if (!command.env?.NODE_OPTIONS) return command
+
+  const env = { ...command.env }
+  const nodeOptions = removeDatadogPreloads(env.NODE_OPTIONS)
+  if (nodeOptions) {
+    env.NODE_OPTIONS = nodeOptions
+  } else {
+    delete env.NODE_OPTIONS
+  }
+
+  return inheritApprovedExecutable(command, {
+    ...command,
+    env,
+  })
+}
+
+function removeDatadogPreloads (nodeOptions) {
+  const tokens = tokenizeNodeOptions(nodeOptions)
+  const kept = []
+
+  for (let index = 0; index < tokens.length; index++) {
+    const token = tokens[index]
+    if (isSeparatedPreloadFlag(token) && isDatadogPreload(tokens[index + 1])) {
+      index++
+      continue
+    }
+    if (isInlineDatadogPreload(token)) continue
+    kept.push(token)
+  }
+
+  return kept.join(' ')
+}
+
+function tokenizeNodeOptions (nodeOptions) {
+  return String(nodeOptions || '').match(/"[^"]*"|'[^']*'|\S+/g) || []
+}
+
+function isSeparatedPreloadFlag (token) {
+  return token === '-r' || token === '--require' || token === '--import'
+}
+
+function isInlineDatadogPreload (token) {
+  return (token.startsWith('--require=') && isDatadogPreload(token.slice('--require='.length))) ||
+    (token.startsWith('--import=') && isDatadogPreload(token.slice('--import='.length))) ||
+    (token.startsWith('-r') && token.length > 2 && isDatadogPreload(token.slice(2)))
+}
+
+function isDatadogPreload (value) {
+  const normalized = String(value || '').replaceAll(/^['"]|['"]$/g, '')
+  return normalized.includes('dd-trace/ci/init') || normalized.includes('dd-trace/register')
+}
+
+function summarizeProbeResult ({ framework, result, records, recordsPath }) {
+  const processRecords = records.filter(record => record.type === 'process-start')
+  const moduleLoadRecords = records.filter(record => record.type === 'module-load')
+  const testRunnerSignals = getToolSignals(records, 'test-runner')
+    .filter(signal => signal.name === framework.framework)
+  const wrapperSignals = getToolSignals(records, 'wrapper', { processStartsOnly: true })
+  const packageManagerSignals = getToolSignals(records, 'package-manager', { processStartsOnly: true })
+
+  return {
+    ran: true,
+    commandExitCode: result.exitCode,
+    commandTimedOut: result.timedOut,
+    processCount: processRecords.length,
+    moduleLoadCount: moduleLoadRecords.length,
+    reachedAnyNodeProcess: processRecords.length > 0,
+    reachedTestRunnerProcess: testRunnerSignals.length > 0,
+    stoppedAfterRunnerReached: result.stoppedEarly === true && testRunnerSignals.length > 0,
+    testRunnerSignals,
+    wrapperSignals,
+    packageManagerSignals,
+    recordsPath,
+  }
+}
+
+function probeReachedFramework (recordsPath, frameworkName) {
+  return readProbeRecords(recordsPath).some(record => {
+    return getRecordTools(record).some(tool => tool.kind === 'test-runner' && tool.name === frameworkName)
+  })
+}
+
+function getToolSignals (records, kind, { processStartsOnly = false } = {}) {
+  const signals = []
+  const signalsByLocation = new Map()
+
+  for (const record of records) {
+    if (processStartsOnly && record.type !== 'process-start') continue
+    for (const tool of getRecordTools(record)) {
+      if (tool.kind !== kind) continue
+
+      const key = `${tool.name}:${record.cwd}`
+      let signal = signalsByLocation.get(key)
+      if (!signal) {
+        signal = {
+          name: tool.name,
+          kind: tool.kind,
+          pid: record.pid,
+          ppid: record.ppid,
+          source: record.type,
+          argv: Array.isArray(record.argv) ? record.argv : undefined,
+          cwd: record.cwd,
+          request: record.request,
+          processCount: 0,
+          processIds: new Set(),
+        }
+        signalsByLocation.set(key, signal)
+        signals.push(signal)
+      }
+      signal.processIds.add(record.pid)
+    }
+  }
+
+  return signals.map(signal => {
+    signal.processCount = signal.processIds.size
+    delete signal.processIds
+    return signal
+  })
+}
+
+function getRecordTools (record) {
+  if (record.tool) return [record.tool]
+  if (Array.isArray(record.detectedTools)) return record.detectedTools
+  return []
+}
+
+function readProbeRecords (recordsPath) {
+  let file
+  try {
+    file = fs.openSync(recordsPath, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0))
+    const stat = fs.fstatSync(file)
+    if (!stat.isFile() || stat.size > MAX_PROBE_RECORD_BYTES) return []
+    const content = fs.readFileSync(file, 'utf8')
+    return parseProbeRecords(content)
+  } catch {
+    return []
+  } finally {
+    if (file !== undefined) fs.closeSync(file)
+  }
+}
+
+function parseProbeRecords (content) {
+  const records = []
+  for (const line of content.split(/\r?\n/)) {
+    if (!line) continue
+    try {
+      const record = JSON.parse(line)
+      if (isProbeRecord(record)) records.push(sanitizeForReport(record))
+    } catch {}
+  }
+  return records
+}
+
+function isProbeRecord (record) {
+  return record && typeof record === 'object' && !Array.isArray(record) &&
+    (record.type === 'process-start' || record.type === 'module-load') &&
+    Number.isInteger(record.pid) && Number.isInteger(record.ppid) &&
+    typeof record.cwd === 'string' && Array.isArray(record.argv)
+}
+
+function formatNodeRequire (filename) {
+  if (!/\s/.test(filename)) return filename
+  return JSON.stringify(filename)
+}
+
+module.exports = {
+  runInitializationProbe,
+}

package/ci/test-optimization-validation/late-initialization.js

@@ -0,0 +1,63 @@
+'use strict'
+
+const fs = require('node:fs')
+const path = require('node:path')
+
+const MAX_FILE_BYTES = 512 * 1024
+const SCRIPT_LITERAL_PATTERN = /['"]([^'"]+\.[cm]?[jt]sx?)['"]/g
+
+/**
+ * Finds Test Optimization initialization loaded from a Vitest setup file.
+ *
+ * @param {object} manifest normalized manifest
+ * @param {object} framework manifest framework
+ * @returns {{configFile: string, setupFile: string}[]} late initialization evidence
+ */
+function findLateInitialization (manifest, framework) {
+  if (framework.framework !== 'vitest') return []
+
+  const findings = []
+  const seen = new Set()
+  for (const configFile of framework.project?.configFiles || []) {
+    const config = readSmallFile(configFile)
+    if (!config || !/\bsetupFiles\b/.test(config)) continue
+
+    if (/setupFiles[\s\S]{0,1000}?dd-trace\/ci\/init/.test(config)) {
+      addFinding(findings, seen, configFile, 'dd-trace/ci/init')
+    }
+
+    for (const match of config.matchAll(SCRIPT_LITERAL_PATTERN)) {
+      for (const candidate of getSetupFileCandidates(manifest.repository.root, configFile, match[1])) {
+        const setup = readSmallFile(candidate)
+        if (!setup || !/dd-trace\/ci\/init/.test(setup)) continue
+        addFinding(findings, seen, configFile, candidate)
+      }
+    }
+  }
+  return findings
+}
+
+function getSetupFileCandidates (repositoryRoot, configFile, filename) {
+  if (path.isAbsolute(filename)) return [filename]
+  return [
+    path.resolve(path.dirname(configFile), filename),
+    path.resolve(repositoryRoot, filename),
+  ]
+}
+
+function readSmallFile (filename) {
+  try {
+    const stat = fs.statSync(filename)
+    if (!stat.isFile() || stat.size > MAX_FILE_BYTES) return
+    return fs.readFileSync(filename, 'utf8')
+  } catch {}
+}
+
+function addFinding (findings, seen, configFile, setupFile) {
+  const key = `${configFile}:${setupFile}`
+  if (seen.has(key)) return
+  seen.add(key)
+  findings.push({ configFile, setupFile })
+}
+
+module.exports = { findLateInitialization }

package/ci/test-optimization-validation/local-command.js

@@ -0,0 +1,163 @@
+'use strict'
+
+const path = require('path')
+
+const { inheritApprovedExecutable } = require('./executable-approval')
+
+const JEST_NO_WATCHMAN_ADJUSTMENT = 'Disable Watchman for local validation to avoid home-directory writes.'
+const INLINE_DATADOG_ENV_PATTERN = /(?:^|[\s;&|()'"])(?:export\s+|set\s+)?["']?(?:\$env:)?DD_[A-Z0-9_]+\s*\+?=/i
+const INIT_PATH = path.resolve(__dirname, '..', 'init.js').replaceAll('\\', '/')
+const REGISTER_PATH = path.resolve(__dirname, '..', '..', 'register.js').replaceAll('\\', '/')
+
+/**
+ * Applies semantics-preserving local validation adjustments to a command.
+ *
+ * @param {object} framework manifest framework entry
+ * @param {object} command command to adjust
+ * @returns {object} adjusted command
+ */
+function getLocalValidationCommand (framework, command) {
+  if (framework.framework !== 'jest' || command.usesShell || command.argv?.includes('--no-watchman') ||
+    !isJestCommand(command.argv)) {
+    return command
+  }
+
+  const argv = [...command.argv]
+  const executable = path.basename(argv[0]).replace(/\.cmd$/i, '')
+  if (executable === 'npm' && !argv.includes('--')) argv.push('--')
+  argv.push('--no-watchman')
+
+  return inheritApprovedExecutable(command, {
+    ...command,
+    argv,
+    localAdjustments: [
+      ...(command.localAdjustments || []),
+      JEST_NO_WATCHMAN_ADJUSTMENT,
+    ],
+  })
+}
+
+/**
+ * Identifies Jest entrypoints and package scripts that can forward Jest options.
+ *
+ * @param {string[]} argv command arguments
+ * @returns {boolean} whether --no-watchman can be appended safely
+ */
+function isJestCommand (argv) {
+  if (!Array.isArray(argv) || argv.length === 0) return false
+
+  const executable = path.basename(argv[0]).replace(/\.cmd$/i, '')
+  if (['npm', 'npx', 'pnpm', 'yarn', 'yarnpkg'].includes(executable)) return true
+
+  return argv.some(argument => /(?:^|[/\\])(?:jest|jest\.js)$/.test(argument))
+}
+
+/**
+ * Removes Datadog initialization from a command before an uninstrumented preflight.
+ *
+ * @param {object} command command to sanitize
+ * @returns {object} Datadog-clean command
+ */
+function getDatadogCleanCommand (command) {
+  const inlineInitialization = getInlineDatadogInitialization(command)
+  if (inlineInitialization) {
+    throw new Error(
+      `Cannot create a Datadog-clean command because it ${inlineInitialization}. ` +
+      'Remove inline Datadog initialization from the local validation command.'
+    )
+  }
+
+  const env = {}
+  for (const [name, value] of Object.entries(command.env || {})) {
+    if (name.startsWith('DD_') || (name === 'NODE_OPTIONS' && /dd-trace/.test(value))) continue
+    env[name] = value
+  }
+
+  return inheritApprovedExecutable(command, {
+    ...command,
+    env,
+  })
+}
+
+/**
+ * Finds Datadog initialization embedded in executable arguments or shell source.
+ *
+ * @param {object} command manifest command
+ * @returns {string|undefined} customer-facing inline initialization description
+ */
+function getInlineDatadogInitialization (command) {
+  const source = command?.usesShell
+    ? String(command.shellCommand || '')
+    : (command?.argv || []).join(' ')
+  const normalized = source.replaceAll('\\', '/')
+
+  if (normalized.includes('dd-trace/ci/init') || normalized.includes('dd-trace/register.js') ||
+    normalized.includes(INIT_PATH) || normalized.includes(REGISTER_PATH)) {
+    return 'contains an inline dd-trace preload'
+  }
+  if (INLINE_DATADOG_ENV_PATTERN.test(source)) return 'contains an inline DD_* assignment'
+}
+
+/**
+ * Returns the CI wiring command with the replay shell recorded by CI discovery when available.
+ *
+ * @param {object} framework manifest framework entry
+ * @returns {object|undefined} command to run
+ */
+function getCiWiringCommand (framework) {
+  const command = framework.ciWiringCommand
+  if (!command || !command.usesShell || command.shell || !framework.ciWiring?.shell) return command
+
+  const replayCommand = getShellReplayCommand(command, framework.ciWiring.shell)
+  if (replayCommand) return inheritApprovedExecutable(command, replayCommand)
+
+  const shell = getReplayShell(framework.ciWiring.shell)
+  if (!shell) return command
+
+  return inheritApprovedExecutable(command, {
+    ...command,
+    shell,
+  })
+}
+
+function getShellReplayCommand (command, shell) {
+  const tokens = tokenizeShellTemplate(shell)
+  const hasTemplate = tokens.includes('{0}')
+  if (tokens.length <= 1 && !hasTemplate) return
+
+  const argv = hasTemplate ? tokens.filter(token => token !== '{0}') : tokens
+  if (!isBourneShell(argv[0])) return
+
+  return {
+    ...command,
+    argv: [...argv, '-c', command.shellCommand],
+    shell: undefined,
+    shellCommand: undefined,
+    usesShell: false,
+  }
+}
+
+function getReplayShell (shell) {
+  const value = String(shell || '').trim()
+  if (!value) return
+
+  const firstToken = value.split(/\s+/)[0]
+  if (firstToken && value.includes('{0}')) return firstToken
+  if (!/\s/.test(value)) return value
+}
+
+function tokenizeShellTemplate (shell) {
+  return String(shell || '').trim().split(/\s+/).filter(Boolean)
+}
+
+function isBourneShell (executable) {
+  const basename = path.basename(String(executable || ''))
+  return basename === 'bash' || basename === 'sh' || basename === 'zsh'
+}
+
+module.exports = {
+  getCiWiringCommand,
+  getDatadogCleanCommand,
+  getInlineDatadogInitialization,
+  getLocalValidationCommand,
+}

package/ci/test-optimization-validation/manifest-loader.js

@@ -0,0 +1,133 @@
+'use strict'
+
+const crypto = require('node:crypto')
+const fs = require('node:fs')
+const path = require('node:path')
+
+const { parseBoundedJson } = require('./bounded-json')
+const { validateManifest } = require('./manifest-schema')
+
+const MAX_MANIFEST_BYTES = 5 * 1024 * 1024
+const MAX_MANIFEST_COLLECTION_ENTRIES = 50_000
+const MAX_MANIFEST_ERROR_BYTES = 16 * 1024
+const MAX_MANIFEST_NESTING_DEPTH = 64
+const MAX_MANIFEST_STRING_BYTES = 256 * 1024
+
+function loadManifest (manifestPath) {
+  const resolvedPath = path.resolve(manifestPath)
+  const stat = fs.lstatSync(resolvedPath)
+  if (stat.isSymbolicLink() || !stat.isFile()) {
+    throw new Error(`Validation manifest must be a regular file, not a symbolic link: ${resolvedPath}`)
+  }
+  if (stat.size > MAX_MANIFEST_BYTES) {
+    throw new Error(`Validation manifest exceeds the ${MAX_MANIFEST_BYTES}-byte size limit: ${resolvedPath}`)
+  }
+  const raw = fs.readFileSync(resolvedPath)
+  const manifest = parseBoundedJson(raw, {
+    label: 'Validation manifest JSON',
+    maxCollectionEntries: MAX_MANIFEST_COLLECTION_ENTRIES,
+    maxNestingDepth: MAX_MANIFEST_NESTING_DEPTH,
+    maxStringBytes: MAX_MANIFEST_STRING_BYTES,
+  }).value
+
+  const errors = validateManifest(manifest)
+  if (errors.length > 0) {
+    throw new Error(`Invalid validation manifest:\n- ${renderErrors(errors)}`)
+  }
+  manifest.__path = resolvedPath
+  Object.defineProperty(manifest, '__sourceSha256', {
+    configurable: false,
+    enumerable: false,
+    value: crypto.createHash('sha256').update(raw).digest('hex'),
+    writable: false,
+  })
+  if (path.dirname(resolvedPath) !== path.resolve(manifest.repository.root)) {
+    throw new Error(`Validation manifest must be stored directly in repository.root: ${resolvedPath}`)
+  }
+  validatePhysicalManifestPaths(manifest)
+
+  return manifest
+}
+
+function renderErrors (errors) {
+  const rendered = errors.join('\n- ')
+  if (Buffer.byteLength(rendered) <= MAX_MANIFEST_ERROR_BYTES) return rendered
+  return `${Buffer.from(rendered).subarray(0, MAX_MANIFEST_ERROR_BYTES).toString('utf8')}\n- Additional errors omitted.`
+}
+
+function validatePhysicalManifestPaths (manifest) {
+  const root = fs.realpathSync(manifest.repository.root)
+
+  for (const [label, candidate] of getManifestPaths(manifest)) {
+    if (typeof candidate !== 'string' || !path.isAbsolute(candidate)) continue
+    let existing = candidate
+    while (!fs.existsSync(existing) && path.dirname(existing) !== existing) existing = path.dirname(existing)
+    const physical = fs.realpathSync(existing)
+    if (!isPathInside(root, physical)) {
+      throw new Error(`Validation manifest ${label} resolves outside repository.root: ${candidate}`)
+    }
+  }
+}
+
+function getManifestPaths (manifest) {
+  const paths = []
+  for (const [frameworkIndex, framework] of (manifest.frameworks || []).entries()) {
+    const prefix = `frameworks[${frameworkIndex}]`
+    paths.push(
+      [`${prefix}.project.root`, framework.project?.root],
+      [`${prefix}.project.packageJson`, framework.project?.packageJson],
+      [`${prefix}.ciWiring.configFile`, framework.ciWiring?.configFile],
+      [`${prefix}.ciWiring.workingDirectory`, framework.ciWiring?.workingDirectory]
+    )
+    for (const [index, configFile] of (framework.project?.configFiles || []).entries()) {
+      paths.push([`${prefix}.project.configFiles[${index}]`, configFile])
+    }
+    for (const [name, command] of getCommands(framework)) {
+      paths.push([`${prefix}.${name}.cwd`, command.cwd])
+      for (const [outputIndex, outputPath] of (command.outputPaths || []).entries()) {
+        paths.push([`${prefix}.${name}.outputPaths[${outputIndex}]`, outputPath])
+      }
+    }
+
+    const strategy = framework.generatedTestStrategy
+    paths.push([`${prefix}.generatedTestStrategy.testDirectory`, strategy?.testDirectory])
+    for (const [index, file] of (strategy?.files || []).entries()) {
+      paths.push([`${prefix}.generatedTestStrategy.files[${index}].path`, file.path])
+    }
+    for (const [index, cleanupPath] of (strategy?.cleanupPaths || []).entries()) {
+      paths.push([`${prefix}.generatedTestStrategy.cleanupPaths[${index}]`, cleanupPath])
+    }
+    for (const [scenarioIndex, scenario] of (strategy?.scenarios || []).entries()) {
+      for (const [identityIndex, identity] of (scenario?.testIdentities || []).entries()) {
+        paths.push([
+          `${prefix}.generatedTestStrategy.scenarios[${scenarioIndex}].testIdentities[${identityIndex}].file`,
+          identity.file,
+        ])
+      }
+    }
+  }
+  return paths
+}
+
+function getCommands (framework) {
+  const commands = []
+  for (const name of ['existingTestCommand', 'ciWiringCommand']) {
+    if (framework[name]) commands.push([name, framework[name]])
+  }
+  for (const [index, command] of (framework.setup?.commands || []).entries()) {
+    commands.push([`setup.commands[${index}]`, command])
+  }
+  for (const [index, scenario] of (framework.generatedTestStrategy?.scenarios || []).entries()) {
+    if (scenario?.runCommand) {
+      commands.push([`generatedTestStrategy.scenarios[${index}].runCommand`, scenario.runCommand])
+    }
+  }
+  return commands
+}
+
+function isPathInside (root, filename) {
+  const relative = path.relative(root, filename)
+  return relative === '' || (relative && !relative.startsWith('..') && !path.isAbsolute(relative))
+}
+
+module.exports = { loadManifest }