fix(openfeature): harden agentless delivery boundaries

Partial HTTP responses could leave polling pending because the shared transport settled only on end. Every terminal response event now settles once, and mixed-case gzip encodings remain supported.

Cleartext non-loopback overrides could apply unauthenticated flag data after the transport stripped the API key. They are now rejected before a request, and diagnostics exclude sensitive endpoint and payload data.

Feature Flags now activate independently from APM tracing, so Remote Config cannot target the noop provider. Inactive processes still avoid loading the provider, source, and agentless header helper.

Author: BridgeAR

index.d.ts

@@ -156,12 +156,12 @@ interface Tracer extends opentracing.Tracer {
   llmobs: tracer.llmobs.LLMObs;
 
   /**
-   * OpenFeature Provider with Remote Config integration.
+   * OpenFeature Provider with agentless and Agent Remote Config delivery.
    *
-   * Extends DatadogNodeServerProvider with Remote Config integration for dynamic flag configuration.
-   * Enable with DD_EXPERIMENTAL_FLAGGING_PROVIDER_ENABLED=true.
+   * Agentless delivery is enabled by default and starts when the provider is first accessed.
    *
-   * @env DD_EXPERIMENTAL_FLAGGING_PROVIDER_ENABLED
+   * @env DD_FEATURE_FLAGS_ENABLED
+   * @env DD_FEATURE_FLAGS_CONFIGURATION_SOURCE
    * @beta This feature is in preview and not ready for production use
    */
   openfeature: tracer.OpenFeatureProvider;
@@ -799,9 +799,9 @@ declare namespace tracer {
        */
       flaggingProvider?: {
         /**
-         * Whether to enable the feature flagging provider.
-         * Requires Remote Config to be properly configured.
-         * Can be configured via DD_EXPERIMENTAL_FLAGGING_PROVIDER_ENABLED environment variable.
+         * Legacy feature flagging provider switch.
+         * When the stable Feature Flags configuration is unset, true selects Agent Remote Config and false disables
+         * the provider.
          *
          * @default false
          * @env DD_EXPERIMENTAL_FLAGGING_PROVIDER_ENABLED
@@ -1620,7 +1620,7 @@ declare namespace tracer {
   /**
    * Flagging Provider (OpenFeature-compatible).
    *
-   * Wraps @datadog/openfeature-node-server with Remote Config integration for dynamic flag configuration.
+   * Wraps @datadog/openfeature-node-server with agentless and Agent Remote Config delivery.
    * Implements the OpenFeature Provider interface for flag evaluation.
    *
    * @beta This feature is in preview and not ready for production use

index.d.v5.ts

@@ -156,12 +156,12 @@ interface Tracer extends opentracing.Tracer {
   llmobs: tracer.llmobs.LLMObs;
 
   /**
-   * OpenFeature Provider with Remote Config integration.
+   * OpenFeature Provider with agentless and Agent Remote Config delivery.
    *
-   * Extends DatadogNodeServerProvider with Remote Config integration for dynamic flag configuration.
-   * Enable with DD_EXPERIMENTAL_FLAGGING_PROVIDER_ENABLED=true.
+   * Agentless delivery is enabled by default and starts when the provider is first accessed.
    *
-   * @env DD_EXPERIMENTAL_FLAGGING_PROVIDER_ENABLED
+   * @env DD_FEATURE_FLAGS_ENABLED
+   * @env DD_FEATURE_FLAGS_CONFIGURATION_SOURCE
    * @beta This feature is in preview and not ready for production use
    */
   openfeature: tracer.OpenFeatureProvider;
@@ -869,9 +869,9 @@ declare namespace tracer {
        */
       flaggingProvider?: {
         /**
-         * Whether to enable the feature flagging provider.
-         * Requires Remote Config to be properly configured.
-         * Can be configured via DD_EXPERIMENTAL_FLAGGING_PROVIDER_ENABLED environment variable.
+         * Legacy feature flagging provider switch.
+         * When the stable Feature Flags configuration is unset, true selects Agent Remote Config and false disables
+         * the provider.
          *
          * @default false
          * @env DD_EXPERIMENTAL_FLAGGING_PROVIDER_ENABLED
@@ -1732,7 +1732,7 @@ declare namespace tracer {
   /**
    * Flagging Provider (OpenFeature-compatible).
    *
-   * Wraps @datadog/openfeature-node-server with Remote Config integration for dynamic flag configuration.
+   * Wraps @datadog/openfeature-node-server with agentless and Agent Remote Config delivery.
    * Implements the OpenFeature Provider interface for flag evaluation.
    *
    * @beta This feature is in preview and not ready for production use

packages/dd-trace/src/exporters/common/request.js

@@ -6,12 +6,11 @@
 const { Readable } = require('stream')
 const http = require('http')
 const https = require('https')
-const net = require('node:net')
 const zlib = require('zlib')
 
 const { storage } = require('../../../../datadog-core')
 const log = require('../../log')
-const { parseUrl } = require('./url')
+const { isLoopbackHost, parseUrl } = require('./url')
 const docker = require('./docker')
 const { httpAgent, httpsAgent } = require('./agents')
 const {
@@ -27,18 +26,6 @@ const maxActiveBufferSize = 1024 * 1024 * 64
 
 let activeBufferSize = 0
 
-/**
- * @param {string} hostname Host as resolved by {@link parseUrl}; IPv6 is unbracketed (`::1`).
- * @returns {boolean}
- */
-function isLoopbackHost (hostname) {
-  // The 127.0.0.0/8 block is loopback, but only when the host is an actual IPv4 literal: a
-  // hostname like `127.evil.com` shares the prefix yet resolves anywhere, so net.isIPv4 gates it.
-  return hostname === 'localhost' ||
-    hostname === '::1' ||
-    (hostname.startsWith('127.') && net.isIPv4(hostname))
-}
-
 /**
  * @param {Buffer|string|Readable|Array<Buffer|string>} data
  * @param {object} options
@@ -110,36 +97,48 @@ function request (data, options, callback) {
 
   /**
    * @param {import('node:http').IncomingMessage} res
-   * @param {() => void} finalize
+   * @param {(error: Error|null, result?: string|null, statusCode?: number,
+   *   headers?: import('node:http').IncomingHttpHeaders) => void} complete
+   * @param {(error: Error) => void} handleError
    */
-  const onResponse = (res, finalize) => {
+  const onResponse = (res, complete, handleError) => {
     markEndpointReached(options)
 
     const chunks = []
 
     res.setTimeout(timeout)
 
+    res.once('aborted', () => {
+      handleError(Object.assign(new Error('Response aborted'), { code: 'ECONNRESET' }))
+    })
+    res.once('error', handleError)
+    res.once('timeout', () => {
+      const error = Object.assign(new Error('Response timed out'), { code: 'ETIMEDOUT' })
+      res.destroy(error)
+      handleError(error)
+    })
+
     res.on('data', chunk => {
       chunks.push(chunk)
     })
 
     res.once('end', () => {
-      finalize()
       const buffer = Buffer.concat(chunks)
 
       if (res.statusCode >= 200 && res.statusCode <= 299) {
-        const isGzip = res.headers['content-encoding'] === 'gzip'
+        const contentEncoding = res.headers['content-encoding']
+        const isGzip = typeof contentEncoding === 'string' && contentEncoding.toLowerCase() === 'gzip'
         if (isGzip) {
           zlib.gunzip(buffer, (err, result) => {
             if (err) {
               log.error('Could not gunzip response: %s', err.message)
-              callback(null, '', res.statusCode, res.headers)
+              complete(null, '', res.statusCode, res.headers)
             } else {
-              callback(null, result.toString(), res.statusCode, res.headers)
+              complete(null, result.toString(), res.statusCode, res.headers)
             }
           })
         } else {
-          callback(null, buffer.toString(), res.statusCode, res.headers)
+          complete(null, buffer.toString(), res.statusCode, res.headers)
         }
       } else {
         let errorMessage = ''
@@ -160,7 +159,7 @@ function request (data, options, callback) {
         const error = new log.NoTransmitError(errorMessage)
         error.status = res.statusCode
 
-        callback(error, null, res.statusCode, res.headers)
+        complete(error, null, res.statusCode, res.headers)
       }
     })
   }
@@ -179,30 +178,51 @@ function request (data, options, callback) {
 
     legacyStorage.run({ noop: true }, () => {
       let finished = false
+      let settled = false
       const finalize = () => {
         if (finished) return
         finished = true
         activeBufferSize -= options.headers['Content-Length'] ?? 0
       }
 
-      const req = client.request(options, (res) => onResponse(res, finalize))
+      /**
+       * @param {Error | null} error
+       * @param {string | null} [result]
+       * @param {number} [statusCode]
+       * @param {import('node:http').IncomingHttpHeaders} [headers]
+       */
+      const complete = (error, result, statusCode, headers) => {
+        if (settled) return
+        settled = true
+        finalize()
+        callback(error, result, statusCode, headers)
+      }
 
-      req.once('close', finalize)
-      req.once('timeout', finalize)
+      /**
+       * @param {Error} error
+       */
+      const handleError = (error) => {
+        if (settled) return
 
-      req.once('error', error => {
-        finalize()
         if (options.retry !== false &&
             attemptIndex < getMaxAttempts(options) &&
             isRetriableNetworkError(error)) {
+          settled = true
+          finalize()
           // Unref so a pending retry never keeps the host process alive past
           // its natural exit point; long-running apps still retry because the
           // event loop is held open by their own work.
           setTimeout(attempt, getRetryDelay(options, attemptIndex), attemptIndex + 1).unref?.()
         } else {
-          callback(error)
+          complete(error)
         }
-      })
+      }
+
+      const req = client.request(options, (res) => onResponse(res, complete, handleError))
+
+      req.once('close', finalize)
+      req.once('timeout', finalize)
+      req.once('error', handleError)
 
       req.setTimeout(timeout, () => {
         try {

packages/dd-trace/src/exporters/common/url.js

@@ -1,7 +1,21 @@
 'use strict'
 
+const net = require('node:net')
+
 const { urlToHttpOptions } = require('./url-to-http-options-polyfill')
 
+/**
+ * @param {string} hostname
+ * @returns {boolean}
+ */
+function isLoopbackHost (hostname) {
+  // Gate the 127/8 prefix on an IPv4 literal so names such as 127.example.com cannot pass.
+  return hostname === 'localhost' ||
+    hostname === '::1' ||
+    hostname === '[::1]' ||
+    (hostname.startsWith('127.') && net.isIPv4(hostname))
+}
+
 /**
  * Convert an agent/intake URL into Node http(s) request options.
  *
@@ -31,4 +45,4 @@ function parseUrl (urlObjOrString) {
   return url
 }
 
-module.exports = { parseUrl }
+module.exports = { isLoopbackHost, parseUrl }

packages/dd-trace/src/feature-registry.js

@@ -1,13 +1,19 @@
 'use strict'
 
+/**
+ * @typedef {{ enable: (config: import('./config/config-base')) => void, disable: () => void }} FeatureModule
+ * @typedef {new (tracer: import('./tracer'), config: import('./config/config-base')) => object} FeatureProvider
+ */
+
 /**
  * @typedef {object} Feature
  * @property {string} name
  * @property {object} noop
- * @property {() => object} factory
+ * @property {() => FeatureModule} factory
  * @property {(config: import('./config/config-base')) => boolean} isEnabled
- * @property {() => Function} provider
- * @property {Function} [remoteConfig]
+ * @property {() => FeatureProvider} provider
+ * @property {(rc: import('./remote_config'), config: import('./config/config-base'),
+ *   proxy: import('./proxy')) => void} [remoteConfig]
  */
 
 /** @type {{ [name: string]: Feature }} */

packages/dd-trace/src/openfeature/agentless_configuration_source.js

@@ -3,7 +3,6 @@
 /* eslint-disable no-await-in-loop -- Polls and retries must remain sequential. */
 
 const { setTimeout: sleep } = require('node:timers/promises')
-const { inspect } = require('node:util')
 
 const request = require('../exporters/common/request')
 const { getClientLibraryHeaders } = require('../exporters/common/client-library-headers')
@@ -51,9 +50,10 @@ class AgentlessConfigurationSource {
   /** @type {string | undefined} */
   #etag
 
-  #malformedPayloadLogged = false
+  /** @type {Set<string>} */
+  #failureWarnings = new Set()
 
-  #pollFailureLogged = false
+  #malformedPayloadLogged = false
 
   /**
    * @param {AgentlessSourceConfig} config
@@ -117,7 +117,7 @@ class AgentlessConfigurationSource {
 
       const retryable = response.statusCode === undefined || isRetryableStatus(response.statusCode)
       if (!retryable) {
-        this.#apply(abortController, response)
+        this.#apply(response)
         return
       }
 
@@ -174,11 +174,10 @@ class AgentlessConfigurationSource {
   }
 
   /**
-   * @param {AbortController} abortController
    * @param {PollResponse} response
    * @returns {void}
    */
-  #apply (abortController, response) {
+  #apply (response) {
     const statusCode = response.statusCode
     if (statusCode === 304) return
 
@@ -192,10 +191,10 @@ class AgentlessConfigurationSource {
     let configuration
     try {
       configuration = parseConfiguration(response.body)
-    } catch (error) {
+    } catch {
       if (!this.#malformedPayloadLogged) {
         this.#malformedPayloadLogged = true
-        log.error('Feature Flagging agentless endpoint returned malformed UFC payload: %s', errorMessage(error))
+        log.error('Feature Flagging agentless endpoint returned malformed UFC payload')
       }
       return
     }
@@ -222,8 +221,11 @@ class AgentlessConfigurationSource {
    * @returns {void}
    */
   #warnFailure (statusCode, error, attempts) {
-    if (this.#pollFailureLogged) return
-    this.#pollFailureLogged = true
+    const category = statusCode === 401 || statusCode === 403
+      ? 'authentication'
+      : statusCode ? 'http' : 'request'
+    if (this.#failureWarnings.has(category)) return
+    this.#failureWarnings.add(category)
 
     if (statusCode === 401 || statusCode === 403) {
       log.warn(
@@ -272,11 +274,7 @@ function parseConfiguration (body) {
       !attributes.flags ||
       typeof attributes.flags !== 'object' ||
       Array.isArray(attributes.flags)) {
-    throw new Error(
-      `Expected a Universal Flag Configuration v1 object; received ${
-        inspect(attributes, { depth: 0, maxStringLength: 0 })
-      }`
-    )
+    throw new Error('Expected a Universal Flag Configuration v1 object')
   }
 
   return attributes

packages/dd-trace/src/openfeature/configuration_source.js

@@ -1,5 +1,6 @@
 'use strict'
 
+const { isLoopbackHost } = require('../exporters/common/url')
 const log = require('../log')
 
 const DEFAULT_AGENTLESS_PATH = '/api/v2/feature-flagging/config/rules-based/server'
@@ -66,13 +67,16 @@ function endpoint (config, configuredBaseUrl) {
   let url
   try {
     url = new URL(configured)
-  } catch (error) {
-    throw new Error(`Invalid Feature Flagging agentless URL: ${configured}`, { cause: error })
+  } catch {
+    throw new Error('Invalid Feature Flagging agentless URL')
   }
 
   if (url.protocol !== 'https:' && url.protocol !== 'http:') {
     throw new Error('Feature Flagging agentless URL must use HTTP or HTTPS')
   }
+  if (url.protocol === 'http:' && !isLoopbackHost(url.hostname)) {
+    throw new Error('Feature Flagging agentless URL must use HTTPS unless it targets loopback')
+  }
 
   if (url.pathname === '' || url.pathname === '/') {
     url.pathname = DEFAULT_AGENTLESS_PATH