dd-trace 6.9.0 → 6.11.0

package/packages/datadog-esbuild/index.js

@@ -8,11 +8,6 @@ const { pathToFileURL, fileURLToPath } = require('node:url')
 const instrumentations = require('../datadog-instrumentations/src/helpers/instrumentations')
 const extractPackageAndModulePath = require('../datadog-instrumentations/src/helpers/extract-package-and-module-path')
 const hooks = require('../datadog-instrumentations/src/helpers/hooks')
-const {
-  OPTIONAL_PEER_FILTER,
-  matchesOptionalPeerFile,
-  rewriteOptionalPeerLoads,
-} = require('../datadog-instrumentations/src/helpers/optional-peer-bundler')
 const { processModule, isESMFile } = require('./src/utils')
 const log = require('./src/log')
 
@@ -133,19 +128,6 @@ module.exports.setup = function (build) {
 ${build.initialOptions.banner.js}`
   }
 
-  // Keep the build from failing on the optional `@openfeature/core` peer of
-  // `@openfeature/server-sdk` when it is not installed (#8635). esbuild follows the chain
-  // whenever `@openfeature/server-sdk` is reachable -- the app importing it directly, or the
-  // bundled provider when the optional peer is present -- so mark `@openfeature/core` external
-  // when it is absent rather than erroring at bundle time.
-  try {
-    // eslint-disable-next-line n/no-unpublished-require
-    require.resolve('@openfeature/core')
-  } catch {
-    build.initialOptions.external ??= []
-    build.initialOptions.external.push('@openfeature/core')
-  }
-
   const esmBuild = isESMBuild(build)
   if (
     esmBuild &&
@@ -182,22 +164,6 @@ ${build.initialOptions.banner.js}`
     log.warn('No git metadata available - skipping injection')
   }
 
-  // Rewrite optional-peer loads so installed peers get bundled and survive the bundle being
-  // relocated without them on disk (#8980). Registered before the generic onLoad so it wins for
-  // these files. Absent peers stay opaque, so a build that does not opt into the feature does not
-  // follow their dependency chain (#8635).
-  build.onLoad({ filter: OPTIONAL_PEER_FILTER }, args => {
-    const normalizedPath = args.path.replaceAll('\\', '/')
-    if (!matchesOptionalPeerFile(normalizedPath)) return
-
-    log.debug('INLINE: optional-peer loader applied to %s', normalizedPath)
-    return {
-      contents: rewriteOptionalPeerLoads(fs.readFileSync(args.path, 'utf8'), path.dirname(args.path)),
-      loader: 'js',
-      resolveDir: path.dirname(args.path),
-    }
-  })
-
   // first time is intercepted, proxy should be created, next time the original should be loaded
   const interceptedESMModules = new Set()
 

package/packages/datadog-instrumentations/src/anthropic.js

@@ -6,6 +6,144 @@ const { addHook } = require('./helpers/instrument')
 
 const anthropicTracingChannel = tracingChannel('apm:anthropic:request')
 const onStreamedChunkCh = channel('apm:anthropic:request:chunk')
+const messagesBeforeChannel = channel('dd-trace:anthropic:messages:before')
+const messagesAfterChannel = channel('dd-trace:anthropic:messages:after')
+
+/**
+ * Publishes a provider-native lifecycle payload to a cancelable lifecycle channel.
+ *
+ * Subscribers push async work into `pending` synchronously during publication and
+ * abort `abortController` with an error before the pushed promise resolves to block.
+ *
+ * @param {object} channel
+ * @param {object} payload
+ * @returns {Promise<void>}
+ */
+function publishLifecycle (channel, payload) {
+  const abortController = new AbortController()
+  const ctx = { ...payload, abortController, pending: [] }
+
+  channel.publish(ctx)
+
+  return Promise.all(ctx.pending).then(() => {
+    if (abortController.signal.aborted) {
+      throw abortController.signal.reason
+    }
+  })
+}
+
+/**
+ * @template T
+ * @param {Promise<T>} promise
+ * @param {Promise<void>|undefined} verdict
+ * @returns {Promise<T>}
+ */
+function waitForVerdict (promise, verdict) {
+  if (!verdict) return promise
+
+  // The lifecycle verdict takes precedence over an earlier SDK rejection.
+  promise.catch(() => {})
+  return verdict.then(() => promise)
+}
+
+/**
+ * @param {Array<unknown>} args
+ * @returns {Array<unknown>|undefined}
+ */
+function snapshotLifecycleArgs (args) {
+  const options = args[0]
+  if (!options || typeof options !== 'object') return
+
+  const input = { messages: options.messages }
+  if (options.system !== undefined) input.system = options.system
+
+  // Snapshot via JSON so AI Guard evaluates exactly what the SDK serializes and sends, immune to
+  // later caller mutation. If it can't serialize (e.g. circular), the SDK's own serialization would
+  // fail too, so skipping evaluation is safe — nothing reaches the model.
+  try {
+    const snapshot = [...args]
+    // eslint-disable-next-line unicorn/prefer-structured-clone
+    snapshot[0] = { ...options, ...JSON.parse(JSON.stringify(input)) }
+    return snapshot
+  } catch {
+    // Unserializable input — leave AI Guard inactive for this call (the SDK send would fail too).
+  }
+}
+
+/**
+ * Finishes after output evaluation so a block propagates to the caller and span.
+ *
+ * @param {object} ctx
+ * @param {object} result
+ * @param {(body: object) => Promise<void>|undefined} getVerdict
+ * @param {object|string} [returnedResult]
+ * @returns {object|string|Promise<object|string>}
+ */
+function finishResult (ctx, result, getVerdict, returnedResult = result) {
+  const verdict = getVerdict(result)
+  if (!verdict) {
+    finish(ctx, result)
+    return returnedResult
+  }
+
+  return verdict.then(() => {
+    finish(ctx, result)
+    return returnedResult
+  })
+}
+
+/**
+ * @param {object} ctx
+ * @param {Error} error
+ * @throws {Error} Always rethrows the supplied error.
+ */
+function finishAndThrow (ctx, error) {
+  finish(ctx, null, error)
+  throw error
+}
+
+/**
+ * @param {object} response
+ * @param {'json'|'text'} method
+ * @param {object} ctx
+ * @param {(body: object) => Promise<void>|undefined} getVerdict
+ */
+function wrapResponseReader (response, method, ctx, getVerdict) {
+  if (typeof response[method] !== 'function') return
+
+  shimmer.wrap(response, method, original => function (...args) {
+    return original.apply(this, args)
+      .then(body => {
+        if (method === 'json') return finishResult(ctx, body, getVerdict)
+
+        try {
+          return finishResult(ctx, JSON.parse(body), getVerdict, body)
+        } catch {
+          finish(ctx)
+          return body
+        }
+      })
+      .catch(error => finishAndThrow(ctx, error))
+  })
+}
+
+/**
+ * @param {object} response
+ * @param {object} ctx
+ * @param {(body: object) => Promise<void>|undefined} getVerdict
+ */
+function wrapRawResponse (response, ctx, getVerdict) {
+  wrapResponseReader(response, 'json', ctx, getVerdict)
+  wrapResponseReader(response, 'text', ctx, getVerdict)
+
+  if (typeof response.clone !== 'function') return
+
+  shimmer.wrap(response, 'clone', clone => function (...args) {
+    const clonedResponse = clone.apply(this, args)
+    wrapRawResponse(clonedResponse, ctx, getVerdict)
+    return clonedResponse
+  })
+}
 
 function wrapStreamIterator (iterator, ctx) {
   return function (...args) {
@@ -34,40 +172,94 @@ function wrapStreamIterator (iterator, ctx) {
 
 function wrapCreate (create) {
   return function (...args) {
-    if (!anthropicTracingChannel.start.hasSubscribers) {
+    const options = args[0]
+    const stream = options?.stream
+
+    // Streaming is out of scope for lifecycle evaluation.
+    const lifecycleArgs = !stream &&
+      (messagesBeforeChannel.hasSubscribers || messagesAfterChannel.hasSubscribers)
+      ? snapshotLifecycleArgs(args)
+      : undefined
+
+    if (!anthropicTracingChannel.start.hasSubscribers && !lifecycleArgs) {
       return create.apply(this, args)
     }
 
-    const options = args[0]
-    const stream = options.stream
-
-    const ctx = { options, resource: 'create', baseUrl: this._client?.baseURL }
+    const ctx = { options: lifecycleArgs?.[0] ?? options, resource: 'create', baseUrl: this._client?.baseURL }
 
     return anthropicTracingChannel.start.runStores(ctx, () => {
+      const parentSpan = lifecycleArgs ? ctx.currentStore?.span : undefined
+
       let apiPromise
       try {
-        apiPromise = create.apply(this, args)
+        // Anthropic starts the request eagerly; the input verdict only gates result delivery.
+        apiPromise = create.apply(this, lifecycleArgs ?? args)
       } catch (error) {
         finish(ctx, null, error)
         throw error
       }
 
-      shimmer.wrap(apiPromise, 'parse', parse => function (...args) {
-        return parse.apply(this, args)
+      let beforeVerdict
+      let afterVerdict
+      let parseResult
+      let wrappedResponse
+
+      function getBeforeVerdict () {
+        if (!lifecycleArgs || beforeVerdict) return beforeVerdict
+        if (!messagesBeforeChannel.hasSubscribers) return
+
+        beforeVerdict = publishLifecycle(messagesBeforeChannel, { args: lifecycleArgs, parentSpan })
+        return beforeVerdict
+      }
+
+      /**
+       * @param {object|string} body
+       */
+      function getAfterVerdict (body) {
+        if (!lifecycleArgs || afterVerdict) return afterVerdict
+        if (!messagesAfterChannel.hasSubscribers) return
+
+        afterVerdict = publishLifecycle(messagesAfterChannel, { args: lifecycleArgs, body, parentSpan })
+        return afterVerdict
+      }
+
+      shimmer.wrap(apiPromise, 'parse', parse => function (...parseArgs) {
+        if (parseResult) return parseResult
+
+        const parsed = parse.apply(this, parseArgs)
+        parseResult = waitForVerdict(parsed, getBeforeVerdict())
           .then(response => {
             if (stream) {
               shimmer.wrap(response, Symbol.asyncIterator, iterator => wrapStreamIterator(iterator, ctx))
-            } else {
-              finish(ctx, response, null)
+              return response
             }
-
-            return response
-          }).catch(error => {
-            finish(ctx, null, error)
-            throw error
+            return finishResult(ctx, response, getAfterVerdict)
           })
+          .catch(error => finishAndThrow(ctx, error))
+
+        return parseResult
       })
 
+      if (typeof apiPromise.asResponse === 'function') {
+        shimmer.wrap(apiPromise, 'asResponse', origAsResponse => function (...asResponseArgs) {
+          return waitForVerdict(origAsResponse.apply(this, asResponseArgs), getBeforeVerdict())
+            .then(response => {
+              // Wrap the raw response's json()/text()/clone() readers to evaluate output on read,
+              // but only while someone still consumes the result and not twice for the same response.
+              const outputObserved = anthropicTracingChannel.start.hasSubscribers ||
+                afterVerdict || messagesAfterChannel.hasSubscribers
+              if (!stream && outputObserved && wrappedResponse !== response) {
+                wrappedResponse = response
+                wrapRawResponse(response, ctx, getAfterVerdict)
+              }
+
+              if (afterVerdict) return afterVerdict.then(() => response)
+              return response
+            })
+            .catch(error => finishAndThrow(ctx, error))
+        })
+      }
+
       anthropicTracingChannel.end.publish(ctx)
 
       return apiPromise
@@ -76,6 +268,8 @@ function wrapCreate (create) {
 }
 
 function finish (ctx, result, error) {
+  if (ctx.finished) return
+
   if (error) {
     ctx.error = error
     anthropicTracingChannel.error.publish(ctx)
@@ -83,6 +277,7 @@ function finish (ctx, result, error) {
 
   // streamed responses are handled and set separately
   ctx.result ??= result
+  ctx.finished = true
 
   anthropicTracingChannel.asyncEnd.publish(ctx)
 }

package/packages/datadog-instrumentations/src/aws-sdk.js

@@ -25,6 +25,13 @@ const KNOWN_CHANNEL_SUFFIXES = new Set([
   'bedrockruntime',
 ])
 
+// Older SDK clients report EventBridge under its CloudWatch Events name or its `events` endpoint
+// prefix; both share the EventBridge channels.
+const CHANNEL_SUFFIX_ALIASES = new Map([
+  ['cloudwatchevents', 'eventbridge'],
+  ['events', 'eventbridge'],
+])
+
 /**
  * @typedef {object} ChannelBag
  * @property {ReturnType<typeof channel>} start
@@ -314,7 +321,8 @@ function addResponse (ctx, error, result) {
 function getChannelSuffix (name) {
   // some resource identifiers have spaces between ex: bedrock runtime
   name = String(name).replaceAll(' ', '')
-  return KNOWN_CHANNEL_SUFFIXES.has(name) ? name : 'default'
+  if (KNOWN_CHANNEL_SUFFIXES.has(name)) return name
+  return CHANNEL_SUFFIX_ALIASES.get(name) ?? 'default'
 }
 
 addHook({ name: '@smithy/smithy-client', versions: ['>=1.0.3'] }, smithy => {

package/packages/datadog-instrumentations/src/browser-bunyan.js

@@ -0,0 +1,11 @@
+'use strict'
+
+const wrapLogger = require('./helpers/bunyan')
+const { addHook } = require('./helpers/instrument')
+
+addHook({ name: 'browser-bunyan', versions: ['>=1'] }, browserBunyan => {
+  // Published versions generate `_emit` through different bundle shapes,
+  // so Orchestrion has no stable function to match.
+  wrapLogger(browserBunyan.Logger, 'browser-bunyan')
+  return browserBunyan
+})

package/packages/datadog-instrumentations/src/bunyan.js

@@ -1,22 +1,9 @@
 'use strict'
 
-const shimmer = require('../../datadog-shimmer')
-const {
-  channel,
-  addHook,
-} = require('./helpers/instrument')
+const wrapLogger = require('./helpers/bunyan')
+const { addHook } = require('./helpers/instrument')
 
 addHook({ name: 'bunyan', versions: ['>=1'] }, Logger => {
-  const logCh = channel('apm:bunyan:log')
-  shimmer.wrap(Logger.prototype, '_emit', emit => {
-    return function wrappedEmit (rec) {
-      if (logCh.hasSubscribers) {
-        const payload = { message: rec }
-        logCh.publish(payload)
-        arguments[0] = payload.message
-      }
-      return emit.apply(this, arguments)
-    }
-  })
+  wrapLogger(Logger, 'bunyan')
   return Logger
 })

package/packages/datadog-instrumentations/src/confluentinc-kafka-javascript.js

@@ -29,6 +29,17 @@ const channels = {
 
 const disabledHeaderWeakSet = new WeakSet()
 
+const EMPTY_CARRIER = Object.create(null)
+/** @type {string[]} */
+const NO_MERGEABLE_KEYS = []
+
+/** @typedef {string | Buffer} NativeHeaderValue */
+/** @typedef {Array<Record<string, NativeHeaderValue>>} NativeHeaders */
+/** @typedef {Record<string, NativeHeaderValue | NativeHeaderValue[]>} NativeHeaderCarrier */
+
+/** @type {NativeHeaders} */
+const EMPTY_NATIVE_HEADERS = []
+
 // we need to store the offset per partition per topic for the consumer to track offsets for DSM
 const latestConsumerOffsets = new Map()
 
@@ -60,17 +71,47 @@ function instrumentBaseModule (module) {
               }
 
               const brokers = this.globalConfig?.['bootstrap.servers']
+              const nativeHeaders = Array.isArray(headers) ? headers : EMPTY_NATIVE_HEADERS
+
+              let carrier
+              let forwardCallerHeaders = false
+              let applicationValues = EMPTY_CARRIER
+              let headerKeys = NO_MERGEABLE_KEYS
+              if (nativeHeaders.length !== 0) {
+                // `__proto__` is a legal Kafka header key and propagation never
+                // writes it, so only the seeded carrier needs a null prototype.
+                const candidateCarrier = Object.create(null)
+                const candidateValues = Object.create(null)
+                const candidateKeys = seedNativeHeaderCarrier(nativeHeaders, candidateCarrier, candidateValues)
+                if (candidateKeys === undefined) {
+                  forwardCallerHeaders = true
+                } else if (candidateKeys.length !== 0) {
+                  carrier = candidateCarrier
+                  applicationValues = candidateValues
+                  headerKeys = candidateKeys
+                }
+              }
 
               const ctx = {
                 topic,
-                messages: [{ key, value: message }],
+                messages: [{
+                  key,
+                  value: message,
+                  headers: carrier,
+                }],
                 bootstrapServers: brokers,
               }
 
               return channels.producerStart.runStores(ctx, () => {
                 try {
-                  const headers = convertHeaders(ctx.messages[0].headers)
-                  const result = produce.apply(this, [topic, partition, message, key, timestamp, opaque, headers])
+                  const producedHeaders = forwardCallerHeaders
+                    ? nativeHeaders
+                    : mergeNativeHeaders(
+                      nativeHeaders, headerKeys, applicationValues, ctx.messages[0].headers ?? EMPTY_CARRIER
+                    )
+                  const result = produce.apply(this, [
+                    topic, partition, message, key, timestamp, opaque, producedHeaders,
+                  ])
 
                   ctx.result = result
                   channels.producerCommit.publish(ctx)
@@ -432,7 +473,71 @@ function getLatestOffsets () {
   return [...latestConsumerOffsets.values()]
 }
 
-function convertHeaders (headers) {
-  // convert headers from object to array of objects with 1 key and value per array entry
-  return Object.entries(headers).map(([key, value]) => ({ [key.toString()]: value.toString() }))
+/**
+ * `Producer::NodeProduce` reads the first *enumerable* own key of each entry and
+ * validates the value itself. A `null` or `undefined` entry aborts the process
+ * there, so those are the only entries we refuse to hand back to it.
+ *
+ * @param {NativeHeaders} headers Caller-owned.
+ * @param {NativeHeaderCarrier} carrier
+ * @param {NativeHeaderCarrier} applicationValues
+ * @returns {string[] | undefined} `undefined` when the binding has to reject the
+ *   array itself; empty when it cannot consume the array at all.
+ * @see https://github.com/confluentinc/confluent-kafka-javascript/blob/v1.9.1/src/producer.cc
+ */
+function seedNativeHeaderCarrier (headers, carrier, applicationValues) {
+  const keys = new Array(headers.length)
+  for (let i = 0; i < headers.length; i++) {
+    const header = headers[i]
+    if (header === null || header === undefined) return NO_MERGEABLE_KEYS
+
+    const key = Object.keys(header)[0]
+    if (key === undefined) return
+
+    keys[i] = key
+    const value = header[key]
+    if (typeof value !== 'string' && !Buffer.isBuffer(value)) return
+
+    if (i === 0) {
+      carrier[key] = value
+      applicationValues[key] = value
+      continue
+    }
+
+    const previousValue = carrier[key]
+    if (previousValue === undefined) {
+      carrier[key] = value
+    } else if (Array.isArray(previousValue)) {
+      previousValue.push(value)
+    } else {
+      carrier[key] = [previousValue, value]
+    }
+    applicationValues[key] = carrier[key]
+  }
+  return keys
+}
+
+/**
+ * @param {NativeHeaders} headers Caller-owned; surviving entries are forwarded
+ *   by reference, never copied or mutated.
+ * @param {string[]} headerKeys Parallel to `headers`.
+ * @param {NativeHeaderCarrier} applicationValues Carrier contents before
+ *   propagation ran.
+ * @param {NativeHeaderCarrier} carrier
+ */
+function mergeNativeHeaders (headers, headerKeys, applicationValues, carrier) {
+  const merged = []
+  for (let i = 0; i < headerKeys.length; i++) {
+    const key = headerKeys[i]
+    if (carrier[key] === applicationValues[key]) {
+      merged.push(headers[i])
+    }
+  }
+
+  for (const key of Object.keys(carrier)) {
+    if (carrier[key] !== applicationValues[key]) {
+      merged.push({ [key]: carrier[key] })
+    }
+  }
+  return merged
 }

package/packages/datadog-instrumentations/src/cucumber.js

@@ -116,7 +116,7 @@ let pickleByFile = {}
 const pickleResultByFile = {}
 
 let skippableSuites = []
-let skippableSuitesCoverage = {}
+let skippableSuitesCoverage
 let skippedSuitesCoverage = {}
 let itrCorrelationId = ''
 let isForcedToRun = false
@@ -153,12 +153,6 @@ function isValidKnownTests (receivedKnownTests) {
   return !!receivedKnownTests.cucumber
 }
 
-function hasSkippableSuitesCoverage () {
-  return skippableSuitesCoverage &&
-    typeof skippableSuitesCoverage === 'object' &&
-    Object.keys(skippableSuitesCoverage).length > 0
-}
-
 function isTiaCoverageBackfillEnabled () {
   return isItrEnabled && isCoverageReportUploadEnabled
 }
@@ -172,7 +166,7 @@ function shouldReportCodeCoverageLinesPct (hasBackfilledCoverage) {
 }
 
 function getSkippedSuitesCoverageForRun () {
-  return isSuitesSkipped && isTiaCoverageBackfillEnabled() && hasSkippableSuitesCoverage()
+  return isSuitesSkipped && isTiaCoverageBackfillEnabled() && skippableSuitesCoverage !== undefined
     ? skippableSuitesCoverage
     : {}
 }
@@ -188,7 +182,7 @@ function getCucumberTestSessionCoverageFiles () {
 
 function resetSuiteSkippingRunState () {
   skippableSuites = []
-  skippableSuitesCoverage = {}
+  skippableSuitesCoverage = undefined
   skippedSuitesCoverage = {}
   skippedSuites = []
   isSuitesSkipped = false
@@ -1143,7 +1137,7 @@ function getWrappedStart (start, frameworkVersion, isParallel = false, isCoordin
 
       errorSkippableRequest = skippableResponse.err
       skippableSuites = skippableResponse.skippableSuites ?? []
-      skippableSuitesCoverage = skippableResponse.skippableSuitesCoverage ?? {}
+      skippableSuitesCoverage = skippableResponse.skippableSuitesCoverage
 
       if (!errorSkippableRequest) {
         const filteredPickles = isCoordinator
@@ -1222,7 +1216,28 @@ function getWrappedStart (start, frameworkVersion, isParallel = false, isCoordin
       itrSkippedSuitesCh.publish({ skippedSuites, frameworkVersion })
     }
 
-    const result = await start.apply(this, arguments)
+    let result
+    try {
+      result = await start.apply(this, arguments)
+    } catch (error) {
+      try {
+        await getChannelPromise(sessionFinishCh, {
+          status: 'fail',
+          error,
+          isSuitesSkipped,
+          numSkippedSuites: skippedSuites.length,
+          hasUnskippableSuites: isUnskippable,
+          hasForcedToRunSuites: isForcedToRun,
+          isEarlyFlakeDetectionEnabled,
+          isEarlyFlakeDetectionFaulty,
+          isTestManagementTestsEnabled,
+          isParallel,
+        })
+      } catch (finalizationError) {
+        log.error('Cucumber test session finalization error: %s', finalizationError)
+      }
+      throw error
+    }
     const success = satisfies(frameworkVersion, '>=13.1.0') ? result.success : result
 
     let untestedCoverage