dd-trace 6.8.0 → 6.10.0

package/initialize.mjs

@@ -20,6 +20,7 @@ import { isMainThread } from 'worker_threads'
 
 import {
   iitmExclusionRegExp,
+  initialize as hookInitialize,
   load as hookLoad,
   resolve as hookResolve,
 } from './loader-hook.mjs?initialize'
@@ -66,7 +67,17 @@ const [NODE_MAJOR, NODE_MINOR] = process.versions.node.split('.').map(Number)
 
 const brokenLoaders = NODE_MAJOR === 18 && NODE_MINOR === 0
 
+// Node calls `initialize` only through `module.register`, never for `--loader`; without it
+// import-in-the-middle keeps its default matcher and proxies every application module. Loaders
+// before Node 18.19 share the application thread, where `loader-hook.mjs` builds no matcher.
+let needsHookInitialize = !isMainThread && !brokenLoaders
+
 export async function load (url, context, nextLoad) {
+  if (needsHookInitialize) {
+    needsHookInitialize = false
+    hookInitialize()
+  }
+
   const loadHook = (brokenLoaders || iitmExclusionRegExp.test(url)) ? nextLoad : hookLoad
   return insertInit(await loadHook(url, context, nextLoad), url, context)
 }

package/loader-hook.mjs

@@ -16,7 +16,6 @@ const require = Module.createRequire(import.meta.url)
 const isInitializeMainThread = isMainThread && import.meta.url.endsWith('?initialize')
 let syncImportInTheMiddleHook
 
-let getValueFromEnvSources
 let regexpEscape
 
 // Substrings of resolved URLs that import-in-the-middle must never wrap: re-export
@@ -32,13 +31,12 @@ const includeModuleNames = new Set()
 let moduleNameAlternation = ''
 
 if (!isInitializeMainThread) {
+  require('./packages/dd-trace/src/guardrails/apply-pm2-env.js')
   const regexpEscapeModule = require('./vendor/dist/escape-string-regexp/index.js')
   const hooks = require('./packages/datadog-instrumentations/src/helpers/hooks.js')
-  const configHelper = require('./packages/dd-trace/src/config/helper.js')
   const { isRelativeRequire } = require('./packages/datadog-instrumentations/src/helpers/shared-utils.js')
 
   regexpEscape = regexpEscapeModule.default
-  getValueFromEnvSources = configHelper.getValueFromEnvSources
 
   for (const moduleName of Object.keys(hooks)) {
     // Relative hooks resolve outside node_modules and are not instrumented here.
@@ -63,7 +61,11 @@ function prepareImportInTheMiddleOptions (data = {}) {
   // A consumer-owned shouldInclude predicate takes over the wrapping decision, so
   // iitm ignores the include/exclude arrays. Building the matcher here keeps the
   // synchronous and asynchronous loaders on one matching implementation.
-  data.shouldInclude = createShouldInclude(getValueFromEnvSources('DD_IAST_SECURITY_CONTROLS_CONFIGURATION'))
+  // Lazily required and read without its registered default so a loader worker
+  // never loads the configuration defaults table. The default is unset regardless.
+  const { getValueFromEnvSources } = require('./packages/dd-trace/src/config/helper.js')
+
+  data.shouldInclude = createShouldInclude(getValueFromEnvSources('DD_IAST_SECURITY_CONTROLS_CONFIGURATION', true))
 
   return data
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dd-trace",
-  "version": "6.8.0",
+  "version": "6.10.0",
   "description": "Datadog APM tracing client for JavaScript",
   "main": "index.js",
   "typings": "index.d.ts",
@@ -15,16 +15,19 @@
     "generate:electron-package": "node scripts/generate-electron-package.js",
     "verify:config:types": "node scripts/generate-config-types.js --check",
     "verify:electron-package": "node scripts/generate-electron-package.js --check",
+    "generate:rewriter:targets": "node scripts/generate-rewriter-targets.js",
+    "verify:rewriter:targets": "node scripts/generate-rewriter-targets.js --check",
     "generate:supported-integrations": "node scripts/generate-supported-integrations.js",
     "verify:supported-integrations": "node scripts/generate-supported-integrations.js --check",
     "type:check": "tsc --noEmit -p tsconfig.dev.json",
     "type:doc:build": "cd docs && yarn && yarn build",
     "type:doc:test": "cd docs && yarn && yarn test",
-    "lint": "node scripts/check_licenses.js && node scripts/check-no-coverage-artifacts.js && node scripts/check-no-mcr-images.js && node scripts/check-docker-image-shas.js && eslint . --concurrency=auto --max-warnings 0 && npm run lint:codeowners:ci && npm run verify-exercised-tests",
+    "lint": "node scripts/check_licenses.js && node scripts/check-no-coverage-artifacts.js && node scripts/check-no-mcr-images.js && node scripts/check-docker-image-shas.js && eslint . --concurrency=auto --max-warnings 0 && npm run verify:carrier-fields && npm run lint:codeowners:ci && npm run verify-exercised-tests",
     "lint:fix": "node scripts/check_licenses.js && node scripts/check-no-coverage-artifacts.js && node scripts/check-no-mcr-images.js && node scripts/check-docker-image-shas.js && eslint . --concurrency=auto --max-warnings 0 --fix",
+    "verify:carrier-fields": "node scripts/verify-carrier-fields.mjs",
     "lint:inspect": "npx @eslint/config-inspector@latest",
     "lint:codeowners": "codeowners-audit",
-    "lint:codeowners:ci": "codeowners-audit --glob='**/*.spec.js' --glob='benchmark/sirun/**' --glob='.agents/**' --glob='.claude/**' --glob='integration-tests/**'",
+    "lint:codeowners:ci": "codeowners-audit --glob='**/*.spec.js' --glob='benchmark/sirun/**' --glob='.agents/**' --glob='.claude/**' --glob='integration-tests/**' --glob='packages/dd-trace/src/guardrails/**'",
     "lint:editorconfig": "docker build -q -t ec .github/editorconfig-checker && docker run --rm --volume=$PWD:/check ec",
     "release:proposal": "node scripts/release/proposal",
     "services": "node ./scripts/install_plugin_modules && node packages/dd-trace/test/setup/services",
@@ -37,7 +40,7 @@
     "test:appsec:plugins:ci": "yarn services && node scripts/c8-ci.js test:appsec:plugins",
     "test:debugger": "mocha \"packages/dd-trace/test/debugger/**/*.spec.js\"",
     "test:debugger:ci": "node scripts/c8-ci.js test:debugger",
-    "test:eslint-rules": "node eslint-rules/*.test.mjs",
+    "test:eslint-rules": "node scripts/run-eslint-rule-tests.mjs eslint-rules/*.test.mjs",
     "test:trace:core": "node scripts/mocha-parallel-files.js --expose-gc --timeout 30000 -- \"packages/dd-trace/test/*.spec.js\" \"packages/dd-trace/test/{agent,ci-visibility,config,crashtracking,datastreams,encode,exporters,msgpack,opentelemetry,opentracing,payload-tagging,plugins,remote_config,service-naming,standalone,telemetry,external-logger}/**/*.spec.js\"",
     "test:trace:core:ci": "node scripts/c8-ci.js test:trace:core",
     "test:trace:guardrails": "mocha \"packages/dd-trace/test/guardrails/**/*.spec.js\"",
@@ -217,7 +220,7 @@
     "eslint-plugin-n": "^18.2.1",
     "eslint-plugin-promise": "^7.3.0",
     "eslint-plugin-sonarjs": "^4.2.0",
-    "eslint-plugin-unicorn": "^72.0.0",
+    "eslint-plugin-unicorn": "^73.0.0",
     "express": "^5.1.0",
     "glob": "^10.4.5",
     "globals": "^17.7.0",

package/packages/datadog-core/src/utils/src/parse-tags.js

@@ -9,7 +9,6 @@ const digitRegex = /^\d+$/
  *   { 'a.0.b': 'value' } -> { a: [{ b: 'value' }] }
  *
  * @param {object} tags - Key/value pairs of tags
- * @returns Object - Parsed tags
  */
 module.exports = function parseTags (tags) {
   const parsedTags = {}

package/packages/datadog-esbuild/src/utils.js

@@ -85,10 +85,25 @@ function getSource (url, { format }) {
   }
 }
 
+/**
+ * @typedef {[typeof LOAD_OPERATION, URL, object] | [typeof RESOLVE_OPERATION, string, object]} GetExportsOperation
+ */
+
+/**
+ * @typedef {{ done: false, value: GetExportsOperation } | { done: true, value: Set<string> }} GetExportsResult
+ */
+
+/**
+ * @typedef {{
+ *   next: (value?: unknown) => GetExportsResult,
+ *   throw: (error?: unknown) => GetExportsResult,
+ * }} GetExportsGenerator
+ */
+
 /**
  * Drives the generator returned by import-in-the-middle >=3.1.0 export discovery.
  *
- * @param {Generator<Array, Set<string>>} exportsGenerator Generator returned by getExports
+ * @param {GetExportsGenerator} exportsGenerator Generator returned by getExports
  * @param {(url: URL, context: object) => { source: string, format: string }} getSource
  * Function that loads module source
  * @returns {Set<string>}

package/packages/datadog-instrumentations/src/ai.js

@@ -116,6 +116,66 @@ function wrapModelWithLifecycle (model) {
   }
 }
 
+/**
+ * Wraps an OTel span without changing its method receivers.
+ *
+ * OTel spans may use private fields, so methods must run against the original
+ * span. A per-invocation wrapper also preserves `ctx` without mutating the AI
+ * SDK's shared no-op span.
+ *
+ * @param {import('@opentelemetry/api').Span} span
+ * @param {object} ctx
+ * @returns {import('@opentelemetry/api').Span}
+ */
+function createDelegatingSpan (span, ctx) {
+  return {
+    spanContext () {
+      return span.spanContext.apply(span, arguments)
+    },
+    setAttribute () {
+      span.setAttribute.apply(span, arguments)
+      return this
+    },
+    setAttributes (attributes) {
+      vercelAiSpanSetAttributesChannel.publish({ ctx, attributes })
+      span.setAttributes.apply(span, arguments)
+      return this
+    },
+    addEvent () {
+      span.addEvent.apply(span, arguments)
+      return this
+    },
+    addLink () {
+      span.addLink.apply(span, arguments)
+      return this
+    },
+    addLinks () {
+      span.addLinks.apply(span, arguments)
+      return this
+    },
+    setStatus () {
+      span.setStatus.apply(span, arguments)
+      return this
+    },
+    updateName () {
+      span.updateName.apply(span, arguments)
+      return this
+    },
+    isRecording () {
+      return span.isRecording.apply(span, arguments)
+    },
+    recordException (exception) {
+      ctx.error = exception
+      vercelAiTracingChannel.error.publish(ctx)
+      return span.recordException.apply(span, arguments)
+    },
+    end () {
+      vercelAiTracingChannel.asyncEnd.publish(ctx)
+      return span.end.apply(span, arguments)
+    },
+  }
+}
+
 function wrapTracer (tracer) {
   if (tracers.has(tracer)) {
     return
@@ -136,40 +196,7 @@ function wrapTracer (tracer) {
 
       args[args.length - 1] = shimmer.wrapFunction(cb, function (originalCb) {
         return function (span) {
-          // A plain delegating wrapper is used instead of Object.create(span) because
-          // Object.create (and Proxy) cannot cross private-field brand checks — any span
-          // method that reads a private field (e.g. BridgeSpanBase#statusCode) would throw
-          // "Cannot read private member" on a prototype clone. Every method here calls
-          // through to the real span instance so private fields always resolve correctly.
-          const freshSpan = {
-            spanContext () { return span.spanContext() },
-            setAttribute (key, value) { span.setAttribute(key, value); return freshSpan },
-            setAttributes (attributes) {
-              vercelAiSpanSetAttributesChannel.publish({ ctx, attributes })
-              span.setAttributes(attributes)
-              return freshSpan
-            },
-            addEvent (name, attributesOrStartTime, startTime) {
-              span.addEvent(name, attributesOrStartTime, startTime)
-              return freshSpan
-            },
-            addLink (link, attrs) { span.addLink(link, attrs); return freshSpan },
-            addLinks (links) { span.addLinks(links); return freshSpan },
-            setStatus (status) { span.setStatus(status); return freshSpan },
-            updateName (spanName) { span.updateName(spanName); return freshSpan },
-            isRecording () { return span.isRecording() },
-            recordException (exception, timeInput) {
-              ctx.error = exception
-              vercelAiTracingChannel.error.publish(ctx)
-              span.recordException(exception, timeInput)
-            },
-            end (...endArgs) {
-              vercelAiTracingChannel.asyncEnd.publish(ctx)
-              span.end(...endArgs)
-            },
-          }
-
-          return originalCb.call(this, freshSpan)
+          return originalCb.call(this, createDelegatingSpan(span, ctx))
         }
       })
 

package/packages/datadog-instrumentations/src/bluebird.js

@@ -15,12 +15,12 @@ function createGetNewLibraryCopyWrap (originalLib) {
   }
 }
 
-addHook({ name: 'bluebird', versions: ['>=2.0.2'] }, Promise => {
-  shimmer.wrap(Promise.prototype, '_then', wrapThen)
-  return Promise
+addHook({ name: 'bluebird', versions: ['>=2.0.2'] }, LibraryPromise => {
+  shimmer.wrap(LibraryPromise.prototype, '_then', wrapThen)
+  return LibraryPromise
 })
 
-addHook({ name: 'bluebird', versions: ['^2.11.0', '^3.4.1'] }, Promise => {
-  shimmer.wrap(Promise, 'getNewLibraryCopy', createGetNewLibraryCopyWrap(Promise))
-  return Promise
+addHook({ name: 'bluebird', versions: ['^2.11.0', '^3.4.1'] }, LibraryPromise => {
+  shimmer.wrap(LibraryPromise, 'getNewLibraryCopy', createGetNewLibraryCopyWrap(LibraryPromise))
+  return LibraryPromise
 })

package/packages/datadog-instrumentations/src/claude-agent-sdk.js

@@ -13,6 +13,66 @@ const LOCAL_LIFECYCLE_LOOKAHEAD = 4
 
 const chunkEmitTimes = new WeakMap()
 
+/**
+ * @typedef {{ session_id?: string } & Record<string, unknown>} Chunk
+ */
+
+/**
+ * @typedef {{
+ *   id: string,
+ *   name?: string,
+ *   input?: unknown,
+ *   output?: unknown,
+ *   error?: unknown,
+ *   isInterrupt?: boolean,
+ *   sessionId?: string,
+ *   hookStartTime?: number,
+ *   hookFinishTime?: number,
+ * }} ToolState
+ */
+
+/**
+ * @typedef {{ taskStartedChunk?: Chunk, toolResultIndex?: number }} ToolLifecycle
+ */
+
+/**
+ * @typedef {(startIndex: number, toolUseId: string) => ToolLifecycle} GetLifecycle
+ */
+
+/**
+ * @typedef {{
+ *   tools: Map<string, ToolState>,
+ *   subagents: Map<string, Record<string, unknown>>,
+ *   prompt?: string,
+ *   model?: string,
+ *   resume?: string,
+ *   maxTurns?: number,
+ *   permissionMode?: string,
+ *   sessionId?: string,
+ *   source?: string,
+ *   cwd?: string,
+ *   transcriptPath?: string,
+ *   agentType?: string,
+ *   endReason?: string,
+ *   stopReason?: string,
+ *   lastAssistantMessage?: string,
+ * }} SessionContext
+ */
+
+/**
+ * @typedef {{
+ *   stepIndex: number,
+ *   startTime?: number,
+ *   finishTime?: number,
+ *   parentToolUseId?: string,
+ *   sessionId?: string,
+ *   chunks?: Chunk[],
+ *   llmStartIdx?: number,
+ *   llmEndIdx?: number,
+ *   toolOutputs?: unknown[],
+ * }} StepContext
+ */
+
 function hasDownstreamSubscribers () {
   return queryChannel.asyncEnd.hasSubscribers ||
     queryChannel.error.hasSubscribers ||
@@ -287,10 +347,12 @@ function getToolResultContent (chunk, toolUseId) {
 }
 
 /**
- *
- * @param {Array<Record<string, unknown>>} chunks
+ * @param {Chunk[]} chunks
  * @param {number} startIndex
  * @param {string} toolUseId
+ * @param {SessionContext | null | undefined} sessionCtx
+ * @param {GetLifecycle} getLifecycle
+ * @param {ToolLifecycle} lifecycle
  * @returns {number} index in chunks where the next step should start iteration
  */
 function processTool (chunks, startIndex, toolUseId, sessionCtx, getLifecycle, lifecycle) {
@@ -342,9 +404,14 @@ function processTool (chunks, startIndex, toolUseId, sessionCtx, getLifecycle, l
 }
 
 /**
- *
- * @param {Array<Record<string, unknown>>} chunks
+ * @param {Chunk[]} chunks
  * @param {number} startIndex
+ * @param {number | undefined} stepStartTime
+ * @param {string | null | undefined} parentToolUseId
+ * @param {string | undefined} initialPrompt
+ * @param {StepContext | null | undefined} stepCtx
+ * @param {SessionContext | null | undefined} sessionCtx
+ * @param {GetLifecycle} getLifecycle
  * @returns {number} index in chunks where the next step should start iteration
  */
 function processStep (
@@ -447,7 +514,16 @@ function processStep (
 }
 
 /**
- * @param {Array<Record<string, unknown>>} chunks
+ * @param {Chunk[]} chunks
+ * @param {{
+ *   sessionCtx?: SessionContext,
+ *   session_id?: string,
+ *   cwd?: string,
+ *   permissionMode?: string,
+ *   output?: unknown,
+ *   arguments?: Array<{ prompt?: string }>,
+ *   runInContext?: (fn: () => number) => number,
+ * }} agentCtx
  */
 function processChunks (chunks, agentCtx) {
   let chunkIndex = 0

package/packages/datadog-instrumentations/src/confluentinc-kafka-javascript.js

@@ -29,6 +29,17 @@ const channels = {
 
 const disabledHeaderWeakSet = new WeakSet()
 
+const EMPTY_CARRIER = Object.create(null)
+/** @type {string[]} */
+const NO_MERGEABLE_KEYS = []
+
+/** @typedef {string | Buffer} NativeHeaderValue */
+/** @typedef {Array<Record<string, NativeHeaderValue>>} NativeHeaders */
+/** @typedef {Record<string, NativeHeaderValue | NativeHeaderValue[]>} NativeHeaderCarrier */
+
+/** @type {NativeHeaders} */
+const EMPTY_NATIVE_HEADERS = []
+
 // we need to store the offset per partition per topic for the consumer to track offsets for DSM
 const latestConsumerOffsets = new Map()
 
@@ -60,17 +71,47 @@ function instrumentBaseModule (module) {
               }
 
               const brokers = this.globalConfig?.['bootstrap.servers']
+              const nativeHeaders = Array.isArray(headers) ? headers : EMPTY_NATIVE_HEADERS
+
+              let carrier
+              let forwardCallerHeaders = false
+              let applicationValues = EMPTY_CARRIER
+              let headerKeys = NO_MERGEABLE_KEYS
+              if (nativeHeaders.length !== 0) {
+                // `__proto__` is a legal Kafka header key and propagation never
+                // writes it, so only the seeded carrier needs a null prototype.
+                const candidateCarrier = Object.create(null)
+                const candidateValues = Object.create(null)
+                const candidateKeys = seedNativeHeaderCarrier(nativeHeaders, candidateCarrier, candidateValues)
+                if (candidateKeys === undefined) {
+                  forwardCallerHeaders = true
+                } else if (candidateKeys.length !== 0) {
+                  carrier = candidateCarrier
+                  applicationValues = candidateValues
+                  headerKeys = candidateKeys
+                }
+              }
 
               const ctx = {
                 topic,
-                messages: [{ key, value: message }],
+                messages: [{
+                  key,
+                  value: message,
+                  headers: carrier,
+                }],
                 bootstrapServers: brokers,
               }
 
               return channels.producerStart.runStores(ctx, () => {
                 try {
-                  const headers = convertHeaders(ctx.messages[0].headers)
-                  const result = produce.apply(this, [topic, partition, message, key, timestamp, opaque, headers])
+                  const producedHeaders = forwardCallerHeaders
+                    ? nativeHeaders
+                    : mergeNativeHeaders(
+                      nativeHeaders, headerKeys, applicationValues, ctx.messages[0].headers ?? EMPTY_CARRIER
+                    )
+                  const result = produce.apply(this, [
+                    topic, partition, message, key, timestamp, opaque, producedHeaders,
+                  ])
 
                   ctx.result = result
                   channels.producerCommit.publish(ctx)
@@ -432,7 +473,71 @@ function getLatestOffsets () {
   return [...latestConsumerOffsets.values()]
 }
 
-function convertHeaders (headers) {
-  // convert headers from object to array of objects with 1 key and value per array entry
-  return Object.entries(headers).map(([key, value]) => ({ [key.toString()]: value.toString() }))
+/**
+ * `Producer::NodeProduce` reads the first *enumerable* own key of each entry and
+ * validates the value itself. A `null` or `undefined` entry aborts the process
+ * there, so those are the only entries we refuse to hand back to it.
+ *
+ * @param {NativeHeaders} headers Caller-owned.
+ * @param {NativeHeaderCarrier} carrier
+ * @param {NativeHeaderCarrier} applicationValues
+ * @returns {string[] | undefined} `undefined` when the binding has to reject the
+ *   array itself; empty when it cannot consume the array at all.
+ * @see https://github.com/confluentinc/confluent-kafka-javascript/blob/v1.9.1/src/producer.cc
+ */
+function seedNativeHeaderCarrier (headers, carrier, applicationValues) {
+  const keys = new Array(headers.length)
+  for (let i = 0; i < headers.length; i++) {
+    const header = headers[i]
+    if (header === null || header === undefined) return NO_MERGEABLE_KEYS
+
+    const key = Object.keys(header)[0]
+    if (key === undefined) return
+
+    keys[i] = key
+    const value = header[key]
+    if (typeof value !== 'string' && !Buffer.isBuffer(value)) return
+
+    if (i === 0) {
+      carrier[key] = value
+      applicationValues[key] = value
+      continue
+    }
+
+    const previousValue = carrier[key]
+    if (previousValue === undefined) {
+      carrier[key] = value
+    } else if (Array.isArray(previousValue)) {
+      previousValue.push(value)
+    } else {
+      carrier[key] = [previousValue, value]
+    }
+    applicationValues[key] = carrier[key]
+  }
+  return keys
+}
+
+/**
+ * @param {NativeHeaders} headers Caller-owned; surviving entries are forwarded
+ *   by reference, never copied or mutated.
+ * @param {string[]} headerKeys Parallel to `headers`.
+ * @param {NativeHeaderCarrier} applicationValues Carrier contents before
+ *   propagation ran.
+ * @param {NativeHeaderCarrier} carrier
+ */
+function mergeNativeHeaders (headers, headerKeys, applicationValues, carrier) {
+  const merged = []
+  for (let i = 0; i < headerKeys.length; i++) {
+    const key = headerKeys[i]
+    if (carrier[key] === applicationValues[key]) {
+      merged.push(headers[i])
+    }
+  }
+
+  for (const key of Object.keys(carrier)) {
+    if (carrier[key] !== applicationValues[key]) {
+      merged.push({ [key]: carrier[key] })
+    }
+  }
+  return merged
 }