add manual datadog(handle) case where tracer isn't initialized.

Author: joeyzhao2018

integration_tests/container/cjs/http-requests-manual.js

@@ -0,0 +1,18 @@
+// Manual-wrap companion to http-requests.js, run as the manual-http-requests
+// case — the exact shape of the AWS suite's http-requests function
+// (manual datadog() wrap, no userland dd-trace init).
+//
+// With no tracer initialized, TraceListener falls back to the library's own
+// patchHttp (src/trace/patch-http.ts), which wraps http/https and logs
+// "HTTP GET <url> TraceHeaders: [...]" per request. On real Lambda the
+// injected headers come from the platform's pass-through _X_AMZN_TRACE_ID;
+// under RIE that variable cannot be emulated (the RIC owns it), so the
+// golden pins the empty-context form (TraceHeaders: []) plus the mock echo
+// of the exact header set sent. The path under test — patchHttp wiring —
+// fails this golden the moment it stops wrapping or logging; the
+// context-dependent header values are pinned by the patch-http unit tests
+// and the AWS suite.
+const { datadog } = require("datadog-lambda-js");
+const { handle } = require("./http-requests");
+
+module.exports.handle = datadog(handle);

integration_tests/container/cjs/http-requests.js

@@ -1,17 +1,19 @@
-// Ported from integration_tests/http-requests.js with two seam adaptations:
-//   1. The AWS suite hits the real ip-ranges.datadoghq.com/.eu endpoints; the
-//      local harness is hermetic, so URLs come from MOCK_HTTP_URLS (set by
-//      run.sh to the mock-http container on the case's docker network). The
-//      default keeps this file runnable outside the harness.
-//   2. The handler is left UNWRAPPED and runs through the npm redirect entry
-//      (dist/handler.handler), because the manual-wrap path never produces
-//      traces without a userland dd-trace init — true in the AWS suite too
-//      (its http-requests snapshots contain no trace JSON). Redirect mode
-//      initializes the tracer first, so the http plugin patches axios and the
-//      mock echo below shows the injected x-datadog-* headers in the golden.
+// Ported from integration_tests/http-requests.js with one seam adaptation:
+// the AWS suite hits the real ip-ranges.datadoghq.com/.eu endpoints; the
+// local harness is hermetic, so URLs come from MOCK_HTTP_URLS (set by run.sh
+// to the mock-http container on the case's docker network). The default keeps
+// this file runnable outside the harness.
+//
+// This entry point is UNWRAPPED and runs through the npm redirect entry
+// (dist/handler.handler) in the cjs-http-requests case. Redirect mode
+// initializes dd-trace first, so the tracer's http plugin patches axios and
+// the mock echo below shows the injected x-datadog-* headers in the golden.
+// The manual-wrap variant of the AWS suite's function — which exercises the
+// library's own patchHttp fallback instead — lives in http-requests-manual.js
+// and runs as the manual-http-requests case.
 //
 // The mock echoes the request headers it received, and this handler logs them,
-// so the golden shows the injected downstream trace context
+// so both goldens show the injected downstream trace context
 // (x-datadog-trace-id / x-datadog-parent-id, normalized to XXXX).
 const { sendDistributionMetric } = require("datadog-lambda-js");
 const axios = require("axios");
@@ -36,4 +38,3 @@ async function handle(event, context) {
 }
 
 module.exports.handle = handle;
-

integration_tests_local/README.md

@@ -54,7 +54,8 @@ The case names are:
 | `manual-status-500` | manual wrap with userland `dd-trace` init returning a 500 API Gateway response (`DD_TRACE_ENABLED=true`); error span tag + enhanced error metrics |
 | `manual-send-metrics` | manual wrap calling `sendDistributionMetric` inside and outside the handler; per-event return values |
 | `manual-process-input` | manual wrap with userland `dd-trace` init reading the active span; per-event return values |
-| `cjs-http-requests` | downstream HTTP calls against a hermetic mock server; asserts injected `x-datadog-*`/`traceparent` headers and log injection |
+| `cjs-http-requests` | downstream HTTP calls against a hermetic mock server in redirect mode; asserts injected `x-datadog-*`/`traceparent` headers and log injection via dd-trace's http plugin |
+| `manual-http-requests` | same handler, manual wrap without userland dd-trace init; exercises the library's own `patchHttp` fallback (request wrapping + per-request logging + exact header set via mock echo) |
 | `cjs-custom-extractor` | `DD_TRACE_EXTRACTOR=extractor.extract`; asserts `_dd.parent_source: event` on the inferred span |
 | `cjs-proactive-init` | eager-init managed-instances RIE path with a 15 s init→invoke gap; asserts proactive-initialization markers on the raw logs |
 
@@ -68,8 +69,12 @@ Unless `SKIP_PACK=true` is set, each run repacks the library under test
 like `scripts/run_integration_tests.sh` does, so the containers always test
 the working tree. The layer fixture instead assembles
 `integration_tests/container/layer/layer_pkg/` from the repo build via
-`prepare-layer.js`, mirroring the release Dockerfile's layer layout, with
-dependency versions pinned from the lockfile-resolved `node_modules` set.
+`prepare-layer.js`, mirroring the release Dockerfile's layer layout. The
+dependency manifest mirrors the release build's full dependency closure —
+production dependencies plus every package `scripts/move_ddtrace_dependency.js`
+moves (dd-trace, @datadog/native-appsec, @datadog/pprof, @opentelemetry/api,
+@opentelemetry/api-logs) — with versions pinned from the lockfile-resolved
+`node_modules` set.
 
 The harness takes no flags or positional arguments — configuration is
 environment-only, and an unexpected argument is rejected rather than ignored.
@@ -126,6 +131,9 @@ filter to absorb it would be invisible. Current overrides:
   `index.mjs` frames) to error stack traces.
 - `cjs-http-requests_node18.log`: dd-trace's `dns`/`net` plugins fire on
   Node 18 only, adding `_dd.integration` span meta lines.
+- `manual-http-requests_node18.log`: Node 18's HTTP agent sends
+  `connection: close` where 20+ send `keep-alive`; the mock echo pins the
+  difference.
 - `cjs-proactive-init_node{18,20,24,26}.log`: Node's
   `TimeoutOverflowWarning` emission (count and JSON-record wrapping) varies
   by runtime major under the managed-instances path. The case's actual
@@ -137,16 +145,22 @@ instead of overwriting it — otherwise the last runtime to run would silently
 define the expectation for all of them. To capture a genuine per-runtime
 divergence, `touch` the override file first so the write targets it.
 
-## The mock HTTP server (cjs-http-requests)
+## The mock HTTP server (cjs-http-requests, manual-http-requests)
 
-`cjs-http-requests` exercises downstream header injection without touching
+Both HTTP cases exercise downstream header injection without touching
 the network: `run.sh` creates a per-run docker network, starts a mock server
 on it (reusing the Lambda base image with `--entrypoint node`), and passes
 `MOCK_HTTP_URLS` to the fixture. The mock echoes the request headers it
 received, so the golden pins exactly which trace-propagation headers the
 library injected. Container-to-container traffic stays on the throwaway
 network; only the readiness probe goes through the host.
 
+The two cases cover the two injection paths: `cjs-http-requests` runs through
+the redirect entry (dd-trace initialized → the tracer's http plugin injects),
+while `manual-http-requests` is manual-wrapped with no tracer (TraceListener
+falls back to the library's own `patchHttp`). See "Known emulation gaps" for
+what the manual case cannot pin locally.
+
 ## Proactive initialization (cjs-proactive-init)
 
 The library stamps `initTime = Date.now()` at wrapper-module load
@@ -247,6 +261,16 @@ endpoints). Do not diff one suite's output against the other's snapshots.
   tag stable.
 - Enhanced metrics that depend on platform-provided values (e.g. real
   memory size / billed duration) may be absent or differ.
+- `_X_AMZN_TRACE_ID` cannot be emulated: the RIC owns that variable and
+  clears it per invocation, so neither a container env var, an invoke-request
+  header, nor a module-load assignment survives to extraction time. On real
+  Lambda the platform's pass-through trace header is what gives the
+  manual-wrap `patchHttp` path a context to inject; locally the
+  `manual-http-requests` golden therefore pins `TraceHeaders: []` plus the
+  mock echo of the exact header set. The wiring (patch, wrap, per-request
+  log) is fully covered — a migration that breaks it fails the golden — but
+  the injected header *values* on that path are pinned only by the
+  `patch-http` unit tests and the AWS suite.
 - The layer fixture installs into a plain `/opt/nodejs/node_modules`
   directory rather than a real published layer zip, so layer-version
   metadata (e.g. an exact layer ARN in tags) cannot be reproduced locally.

integration_tests_local/prepare-layer.js

@@ -46,9 +46,21 @@ fs.writeFileSync(
   JSON.stringify({ name: pkg.name, version: pkg.version, main: "index.js", types: "index.d.ts" }, null, 2) + "\n",
 );
 
-// 3. deps.package.json: datadog-lambda-js's production dependencies plus
-// dd-trace (which the release build moves from devDependencies), each pinned
-// to the version yarn actually installed.
+// 3. deps.package.json: datadog-lambda-js's production dependencies plus the
+// packages the release build moves from devDependencies, each pinned to the
+// version yarn actually installed. LAYER_MOVED_DEPENDENCIES must stay in sync
+// with scripts/move_ddtrace_dependency.js — the release layer's dependency
+// closure includes all of them, so the local layer image must too, otherwise
+// layer-only behavior that probes these modules (pprof, appsec, otel) is
+// tested on an absent-branch that real layer users never run.
+const LAYER_MOVED_DEPENDENCIES = [
+  "dd-trace",
+  "@datadog/native-appsec",
+  "@datadog/pprof",
+  "@opentelemetry/api",
+  "@opentelemetry/api-logs",
+];
+
 function installedVersion(name) {
   // Read the hoisted install location directly: require.resolve("<name>/package.json")
   // breaks on packages whose exports map doesn't expose ./package.json.
@@ -73,7 +85,9 @@ const dependencies = {};
 for (const name of Object.keys(pkg.dependencies || {})) {
   dependencies[name] = installedVersion(name);
 }
-dependencies["dd-trace"] = installedVersion("dd-trace");
+for (const name of LAYER_MOVED_DEPENDENCIES) {
+  dependencies[name] = installedVersion(name);
+}
 
 fs.writeFileSync(
   path.join(layerDir, "deps.package.json"),

integration_tests_local/run.sh

@@ -22,7 +22,8 @@
 # manual-status-500        | cjs   | status-code-500s.handle                  | manual wrap; API GW 500 -> span error + enhanced error metric
 # manual-send-metrics      | cjs   | send-metrics.handle                      | manual wrap; sendDistributionMetric via DD_FLUSH_TO_LOG
 # manual-process-input     | cjs   | process-input.handle                     | manual wrap; dd-trace child spans via tracer.wrap
-# cjs-http-requests       | cjs   | node_modules/datadog-lambda-js/dist/handler.handler | npm redirect; downstream HTTP header injection (hermetic mock server)
+# cjs-http-requests       | cjs   | node_modules/datadog-lambda-js/dist/handler.handler | npm redirect; downstream HTTP header injection via dd-trace's http plugin (hermetic mock server)
+# manual-http-requests    | cjs   | http-requests-manual.handle              | manual wrap; patchHttp fallback wrapping + per-request logging (hermetic mock)
 # cjs-custom-extractor     | cjs   | node_modules/datadog-lambda-js/dist/handler.handler | DD_TRACE_EXTRACTOR custom extractor + _dd.parent_source
 # cjs-proactive-init       | cjs   | node_modules/datadog-lambda-js/dist/handler.handler | proactive-initialization markers (raw-log assertions)
 #
@@ -111,6 +112,7 @@ ALL_CASES=(
     "manual-send-metrics"
     "manual-process-input"
     "cjs-http-requests"
+    "manual-http-requests"
     "cjs-custom-extractor"
     "cjs-proactive-init"
 )
@@ -183,16 +185,40 @@ function configure_case() {
             case_return_mode=per-event
             ;;
         cjs-http-requests)
-            # Redirect mode, not manual wrap: the manual-wrap path never
-            # produces traces without a userland dd-trace init (true in the
-            # AWS suite as well — its http-requests snapshots have no trace
-            # JSON), and traces are what make the injected downstream headers
-            # observable in the golden.
+            # Redirect mode, not manual wrap: redirect mode initializes
+            # dd-trace before the user handler loads, so the tracer's http
+            # plugin does the injection and the golden pins full trace JSON.
+            # The manual-wrap fallback (patchHttp) is covered separately by
+            # manual-http-requests below.
             case_image=cjs
             case_entry_handler="node_modules/datadog-lambda-js/dist/handler.handler"
             case_needs_mock=true
             case_extra_env=(-e DD_LAMBDA_HANDLER=http-requests.handle -e "MOCK_HTTP_URLS=http://mock-http:8080/ip-ranges-us,http://mock-http:8080/ip-ranges-eu")
             ;;
+        manual-http-requests)
+            # Manual wrap without a userland dd-trace init — the exact shape
+            # of the AWS suite's http-requests function. TraceListener falls
+            # back to the library's own patchHttp (src/trace/patch-http.ts),
+            # which injects the x-datadog-* headers and logs
+            # "GET <url> TraceHeaders: [...]" per request; the mock echo pins
+            # the same headers a second way. No trace JSON on this path (true
+            # in the AWS suite as well).
+            #
+            # patchHttp needs an extracted trace context to inject headers.
+            # On real Lambda that context is the platform's pass-through
+            # _X_AMZN_TRACE_ID; under RIE it cannot be emulated (the RIC owns
+            # the variable, and event-based extraction needs a tracer, which
+            # this path deliberately lacks). The golden therefore pins what
+            # is observable here: patchHttp wraps and logs every request
+            # ("HTTP GET ... TraceHeaders: []"), the mock echo pins the exact
+            # header set sent, and any change to either fails the case. The
+            # context-dependent header values are pinned by the patch-http
+            # unit tests and the AWS suite; see README "Known emulation gaps".
+            case_image=cjs
+            case_entry_handler="http-requests-manual.handle"
+            case_needs_mock=true
+            case_extra_env=(-e "MOCK_HTTP_URLS=http://mock-http:8080/ip-ranges-us,http://mock-http:8080/ip-ranges-eu")
+            ;;
         cjs-custom-extractor)
             case_image=cjs
             case_entry_handler="node_modules/datadog-lambda-js/dist/handler.handler"