From 862ddfcb4329bd65385e5c68186da31e8da0531c Mon Sep 17 00:00:00 2001 From: Christophe Papazian Date: Wed, 22 Jul 2026 14:34:38 +0200 Subject: [PATCH 1/2] feat(appsec): report DD_APPSEC_AGENTIC_ONBOARDING in config telemetry Register DD_APPSEC_AGENTIC_ONBOARDING as a string configuration reported verbatim in configuration telemetry (RFC-1113). Always emitted: empty value with origin=default when unset. No derived boolean, no AppSec-state logic. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../src/config/generated-config-types.d.ts | 2 ++ .../src/config/supported-configurations.json | 11 ++++++ packages/dd-trace/test/config/index.spec.js | 35 +++++++++++++++++++ 3 files changed, 48 insertions(+) diff --git a/packages/dd-trace/src/config/generated-config-types.d.ts b/packages/dd-trace/src/config/generated-config-types.d.ts index 9dec6c4d28..d039dbf5d1 100644 --- a/packages/dd-trace/src/config/generated-config-types.d.ts +++ b/packages/dd-trace/src/config/generated-config-types.d.ts @@ -6,6 +6,7 @@ export interface GeneratedConfig { _DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL: number; apmTracingEnabled: boolean; appsec: { + agenticOnboarding: string; blockedTemplateGraphql: string | undefined; blockedTemplateHtml: string | undefined; blockedTemplateJson: string | undefined; @@ -620,6 +621,7 @@ export interface GeneratedEnvVarConfig { DD_APM_FLUSH_DEADLINE_MILLISECONDS: number; DD_APM_TRACING_ENABLED: boolean; DD_APP_KEY: string | undefined; + DD_APPSEC_AGENTIC_ONBOARDING: string; DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE: string; DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING: string; DD_APPSEC_COLLECT_ALL_HEADERS: boolean; diff --git a/packages/dd-trace/src/config/supported-configurations.json b/packages/dd-trace/src/config/supported-configurations.json index bb8fbb2d4c..dcd350c90b 100644 --- a/packages/dd-trace/src/config/supported-configurations.json +++ b/packages/dd-trace/src/config/supported-configurations.json @@ -206,6 +206,17 @@ ] } ], + "DD_APPSEC_AGENTIC_ONBOARDING": [ + { + "implementation": "A", + "type": "string", + "configurationNames": [ + "appsec.agenticOnboarding" + ], + "default": "", + "description": "Set automatically by Datadog's agentic onboarding solution when it configures App & API Protection for a service. Reported verbatim in configuration telemetry only; it has no effect on tracer behavior." + } + ], "DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE": [ { "implementation": "E", diff --git a/packages/dd-trace/test/config/index.spec.js b/packages/dd-trace/test/config/index.spec.js index 1c3bdcb307..583dab2094 100644 --- a/packages/dd-trace/test/config/index.spec.js +++ b/packages/dd-trace/test/config/index.spec.js @@ -615,6 +615,41 @@ describe('Config', () => { }) }) + describe('DD_APPSEC_AGENTIC_ONBOARDING', () => { + // RFC-1113: reported verbatim in configuration telemetry, always emitted + // (empty value with origin=default when unset). No effect on tracer behavior. + it('should default to an empty string and report it with origin=default when unset', () => { + const config = getConfig() + + assert.strictEqual(config.appsec.agenticOnboarding, '') + assertConfigUpdateContains(updateConfig.getCall(0).args[0], [ + { name: 'DD_APPSEC_AGENTIC_ONBOARDING', value: '', origin: 'default' }, + ]) + }) + + it('should report the value verbatim with origin=env_var when set to true', () => { + process.env.DD_APPSEC_AGENTIC_ONBOARDING = 'true' + + const config = getConfig() + + assert.strictEqual(config.appsec.agenticOnboarding, 'true') + assertConfigUpdateContains(updateConfig.getCall(0).args[0], [ + { name: 'DD_APPSEC_AGENTIC_ONBOARDING', value: 'true', origin: 'env_var' }, + ]) + }) + + it('should report an arbitrary value verbatim rather than collapsing to a boolean', () => { + process.env.DD_APPSEC_AGENTIC_ONBOARDING = 'false' + + const config = getConfig() + + assert.strictEqual(config.appsec.agenticOnboarding, 'false') + assertConfigUpdateContains(updateConfig.getCall(0).args[0], [ + { name: 'DD_APPSEC_AGENTIC_ONBOARDING', value: 'false', origin: 'env_var' }, + ]) + }) + }) + it('should correctly map OTEL_RESOURCE_ATTRIBUTES', () => { process.env.OTEL_RESOURCE_ATTRIBUTES = 'deployment.environment=test1,service.name=test2,service.version=5,foo=bar1,baz=qux1' From 92a025532953673856d1a97a1ba8ec44fa01294e Mon Sep 17 00:00:00 2001 From: Christophe Papazian Date: Wed, 22 Jul 2026 15:17:29 +0200 Subject: [PATCH 2/2] fix(appsec): keep agentic-onboarding config out of public options Use the `appsec` namespace instead of `configurationNames` so DD_APPSEC_AGENTIC_ONBOARDING stays a telemetry-only config (like DD_APPSEC_SCA_ENABLED) and is not required in index.d.ts, fixing the eslint-config-names-sync lint failure. Co-Authored-By: Claude Opus 4.8 (1M context) --- packages/dd-trace/src/config/generated-config-types.d.ts | 2 +- packages/dd-trace/src/config/supported-configurations.json | 4 +--- packages/dd-trace/test/config/index.spec.js | 6 +++--- 3 files changed, 5 insertions(+), 7 deletions(-) diff --git a/packages/dd-trace/src/config/generated-config-types.d.ts b/packages/dd-trace/src/config/generated-config-types.d.ts index d039dbf5d1..ef991ae73e 100644 --- a/packages/dd-trace/src/config/generated-config-types.d.ts +++ b/packages/dd-trace/src/config/generated-config-types.d.ts @@ -6,7 +6,6 @@ export interface GeneratedConfig { _DD_TRACE_METRICS_OTEL_FLUSH_INTERVAL: number; apmTracingEnabled: boolean; appsec: { - agenticOnboarding: string; blockedTemplateGraphql: string | undefined; blockedTemplateHtml: string | undefined; blockedTemplateJson: string | undefined; @@ -17,6 +16,7 @@ export interface GeneratedConfig { DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES: number; DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS: number; DD_API_SECURITY_SAMPLE_DELAY: number; + DD_APPSEC_AGENTIC_ONBOARDING: string; DD_APPSEC_SCA_ENABLED: boolean | undefined; enabled: boolean | undefined; eventTracking: { diff --git a/packages/dd-trace/src/config/supported-configurations.json b/packages/dd-trace/src/config/supported-configurations.json index dcd350c90b..30d6866b1d 100644 --- a/packages/dd-trace/src/config/supported-configurations.json +++ b/packages/dd-trace/src/config/supported-configurations.json @@ -210,10 +210,8 @@ { "implementation": "A", "type": "string", - "configurationNames": [ - "appsec.agenticOnboarding" - ], "default": "", + "namespace": "appsec", "description": "Set automatically by Datadog's agentic onboarding solution when it configures App & API Protection for a service. Reported verbatim in configuration telemetry only; it has no effect on tracer behavior." } ], diff --git a/packages/dd-trace/test/config/index.spec.js b/packages/dd-trace/test/config/index.spec.js index 583dab2094..935f2d847f 100644 --- a/packages/dd-trace/test/config/index.spec.js +++ b/packages/dd-trace/test/config/index.spec.js @@ -621,7 +621,7 @@ describe('Config', () => { it('should default to an empty string and report it with origin=default when unset', () => { const config = getConfig() - assert.strictEqual(config.appsec.agenticOnboarding, '') + assert.strictEqual(config.appsec.DD_APPSEC_AGENTIC_ONBOARDING, '') assertConfigUpdateContains(updateConfig.getCall(0).args[0], [ { name: 'DD_APPSEC_AGENTIC_ONBOARDING', value: '', origin: 'default' }, ]) @@ -632,7 +632,7 @@ describe('Config', () => { const config = getConfig() - assert.strictEqual(config.appsec.agenticOnboarding, 'true') + assert.strictEqual(config.appsec.DD_APPSEC_AGENTIC_ONBOARDING, 'true') assertConfigUpdateContains(updateConfig.getCall(0).args[0], [ { name: 'DD_APPSEC_AGENTIC_ONBOARDING', value: 'true', origin: 'env_var' }, ]) @@ -643,7 +643,7 @@ describe('Config', () => { const config = getConfig() - assert.strictEqual(config.appsec.agenticOnboarding, 'false') + assert.strictEqual(config.appsec.DD_APPSEC_AGENTIC_ONBOARDING, 'false') assertConfigUpdateContains(updateConfig.getCall(0).args[0], [ { name: 'DD_APPSEC_AGENTIC_ONBOARDING', value: 'false', origin: 'env_var' }, ])