chore(scripts): flag unquoted ** globs in npm scripts (#8061)

* chore(scripts): flag unquoted `**` globs in npm scripts

POSIX sh — which is what both `npm run` and `yarn run` ultimately
invoke — does not support globstar. An unquoted `**` in a package.json
script therefore collapses to a single `*`, so the shell only passes
one directory level through to mocha/glob and specs deeper than that
are silently skipped. That is how a handful of suites were under-running
without anyone noticing.

Two coordinated pieces:

1. A new `findUnquotedGlobstar` helper (quote-state-aware, so it
   doesn't false-positive on patterns that are already quoted) runs
   over every `scripts` entry during `verify-exercised-tests` and
   fails the check with a pointer to the offending column if any
   unquoted `**` is found. Doing this via string scanning instead of
   a glob-expansion probe is important because `globSync` itself
   will happily expand `**` recursively regardless of quoting, so it
   can't distinguish "works locally because glob is being nice" from
   "broken in CI because sh already collapsed it".

2. Wrap the existing offenders in double quotes so they actually pass
   the check: `test:aiguard`, `test:debugger`, `test:trace:guardrails`,
   `test:esbuild`, `test:webpack`, `test:instrumentations:misc`,
   `test:core`, `test:code-origin`, `test:lambda`, `test:openfeature`,
   and `test:profiler`.

* test(debugger): work around fake-timers hasOwnProperty regression

Root cause is an upstream regression in fake-timers commit
`9c56bfdc` ("fix(#534): remove memory leak and potential security
issue"), which renamed what looked like a typo:

    -  clock[method].hadOwnProperty = Object.prototype.hasOwnProperty.call(
    +  clock[method].hasOwnProperty = Object.prototype.hasOwnProperty.call(

The original name (`hadOwnProperty`) was load-bearing: the property
holds a boolean flag used by `uninstall` to decide whether to
`delete` the method or write it back. After the rename, every fake
clock method has its inherited `Object.prototype.hasOwnProperty`
shadowed by a boolean. When sinon later does
`sinon.stub(process.hrtime, 'bigint')`, its `wrapMethod` goes

    const owned = object.hasOwnProperty
        ? object.hasOwnProperty(property)  // ← boolean, not callable
        : hasOwnProperty(object, property);

and crashes on the invocation.

Author: BridgeAR

package.json

@@ -24,44 +24,44 @@
     "release:proposal": "node scripts/release/proposal",
     "services": "node ./scripts/install_plugin_modules && node packages/dd-trace/test/setup/services",
     "test": "echo '\nError: The root \"npm test\" command is intentionally disabled.\n\nInstead, run specific test suites:\n  - npm run test:trace:core\n  - npm run test:appsec\n  - etc.\n\nOr run individual test files:\n  npx mocha path/to/test.spec.js\n\nSee CONTRIBUTING.md (Testing section) for more details.\n' && exit 1",
-    "test:aiguard": "mocha packages/dd-trace/test/aiguard/**/*.spec.js",
+    "test:aiguard": "mocha \"packages/dd-trace/test/aiguard/**/*.spec.js\"",
     "test:aiguard:ci": "nyc --silent node init && nyc -- npm run test:aiguard",
     "test:appsec": "mocha --exclude \"packages/dd-trace/test/appsec/**/*.plugin.spec.js\" \"packages/dd-trace/test/appsec/**/*.spec.js\"",
     "test:appsec:ci": "nyc --silent node init && nyc -- npm run test:appsec",
     "test:appsec:plugins": "mocha \"packages/dd-trace/test/appsec/**/*.@(${PLUGINS}).plugin.spec.js\"",
     "test:appsec:plugins:ci": "yarn services && nyc --silent node init && nyc -- npm run test:appsec:plugins",
-    "test:debugger": "mocha packages/dd-trace/test/debugger/**/*.spec.js",
+    "test:debugger": "mocha \"packages/dd-trace/test/debugger/**/*.spec.js\"",
     "test:debugger:ci": "nyc --silent node init && nyc -- npm run test:debugger",
     "test:eslint-rules": "node eslint-rules/*.test.mjs",
     "test:trace:core": "node scripts/mocha-parallel-files.js --expose-gc --timeout 30000 -- \"packages/dd-trace/test/*.spec.js\" \"packages/dd-trace/test/{agent,ci-visibility,config,crashtracking,datastreams,encode,exporters,msgpack,opentelemetry,opentracing,payload-tagging,plugins,remote_config,service-naming,standalone,telemetry,external-logger}/**/*.spec.js\"",
     "test:trace:core:ci": "nyc --silent node init && nyc -- npm run test:trace:core",
-    "test:trace:guardrails": "mocha packages/dd-trace/test/guardrails/**/*.spec.js",
+    "test:trace:guardrails": "mocha \"packages/dd-trace/test/guardrails/**/*.spec.js\"",
     "test:trace:guardrails:ci": "nyc --silent node init && nyc -- npm run test:trace:guardrails",
-    "test:esbuild": "mocha packages/datadog-esbuild/test/**/*.spec.js",
+    "test:esbuild": "mocha \"packages/datadog-esbuild/test/**/*.spec.js\"",
     "test:esbuild:ci": "nyc --silent node init && nyc -- npm run test:esbuild",
-    "test:webpack": "mocha packages/datadog-webpack/test/**/*.spec.js",
+    "test:webpack": "mocha \"packages/datadog-webpack/test/**/*.spec.js\"",
     "test:webpack:ci": "nyc --silent node init && nyc -- npm run test:webpack",
     "test:instrumentations": "mocha \"packages/datadog-instrumentations/test/@(${PLUGINS}).spec.js\"",
     "test:instrumentations:ci": "yarn services && nyc --silent node init && nyc -- npm run test:instrumentations",
-    "test:instrumentations:misc": "mocha packages/datadog-instrumentations/test/*/**/*.spec.js",
+    "test:instrumentations:misc": "mocha \"packages/datadog-instrumentations/test/*/**/*.spec.js\"",
     "test:instrumentations:misc:ci": "nyc --silent node init && nyc -- npm run test:instrumentations:misc",
-    "test:core": "node scripts/mocha-parallel-files.js --expose-gc --timeout 30000 -- packages/datadog-core/test/**/*.spec.js",
+    "test:core": "node scripts/mocha-parallel-files.js --expose-gc --timeout 30000 -- \"packages/datadog-core/test/**/*.spec.js\"",
     "test:core:ci": "nyc --silent node init && nyc -- npm run test:core",
-    "test:code-origin": "mocha packages/datadog-code-origin/test/**/*.spec.js",
+    "test:code-origin": "mocha \"packages/datadog-code-origin/test/**/*.spec.js\"",
     "test:code-origin:ci": "nyc --silent node init && nyc -- npm run test:code-origin",
-    "test:lambda": "mocha packages/dd-trace/test/lambda/**/*.spec.js",
+    "test:lambda": "mocha \"packages/dd-trace/test/lambda/**/*.spec.js\"",
     "test:lambda:ci": "nyc --silent node init && nyc -- npm run test:lambda",
     "test:llmobs:sdk": "mocha --exclude \"packages/dd-trace/test/llmobs/plugins/**/*.spec.js\" \"packages/dd-trace/test/llmobs/**/*.spec.js\"",
     "test:llmobs:sdk:ci": "nyc --silent node init && nyc -- npm run test:llmobs:sdk",
     "test:llmobs:plugins": "mocha \"packages/dd-trace/test/llmobs/plugins/@(${PLUGINS})/*.spec.js\"",
     "test:llmobs:plugins:ci": "yarn services && nyc --silent node init && nyc -- npm run test:llmobs:plugins",
-    "test:openfeature": "mocha packages/dd-trace/test/openfeature/**/*.spec.js",
+    "test:openfeature": "mocha \"packages/dd-trace/test/openfeature/**/*.spec.js\"",
     "test:openfeature:ci": "nyc --silent node init && nyc -- npm run test:openfeature",
     "test:plugins": "node --expose-gc ./node_modules/mocha/bin/mocha.js \"packages/datadog-plugin-@(${PLUGINS})/test/**/${SPEC:-*}*.spec.js\"",
     "test:plugins:ci": "yarn services && nyc --silent node init && nyc -- npm run test:plugins",
     "test:plugins:ci:flaky": "yarn services && nyc --silent node init && nyc -- npm run test:plugins -- --bail --retries 2",
     "test:plugins:upstream": "node ./packages/dd-trace/test/plugins/suite.js",
-    "test:profiler": "node scripts/mocha-parallel-files.js --expose-gc --timeout 30000 -- packages/dd-trace/test/profiling/**/*.spec.js",
+    "test:profiler": "node scripts/mocha-parallel-files.js --expose-gc --timeout 30000 -- \"packages/dd-trace/test/profiling/**/*.spec.js\"",
     "test:profiler:ci": "nyc --silent node init && nyc -- npm run test:profiler",
     "test:integration": "mocha --timeout 60000 \"integration-tests/*.spec.js\"",
     "test:integration:aiguard": "mocha --timeout 60000 \"integration-tests/aiguard/*.spec.js\"",

packages/dd-trace/test/debugger/devtools_client/snapshot/collector-deadline.spec.js

@@ -63,11 +63,14 @@ describe('debugger -> devtools client -> snapshot collector deadline', function
   it('should mark properties with timeout when deadline is exceeded', async function () {
     // Override the hrtime stub to advance time on each call
     // This simulates time passing during collection
+    // Drive process.hrtime.bigint() with a plain monotonic counter instead of reading
+    // `clock.now`. This works around a sinon fake-timers regression.
+    // TODO: Revert when a fix for https://github.com/sinonjs/fake-timers/pull/549#pullrequestreview-4158432441 lands.
     sinon.restore()
-    clock = sinon.useFakeTimers()
+    let nowNs = 0n
     sinon.stub(process.hrtime, 'bigint').callsFake(() => {
-      const time = BigInt(clock.now) * 1_000_000n
-      clock.tick(50) // Advance by 50ms after each call
+      const time = nowNs
+      nowNs += 50_000_000n // advance 50ms per call
       return time
     })
 
@@ -108,12 +111,15 @@ describe('debugger -> devtools client -> snapshot collector deadline', function
     let hrtimeCallCount = 0
 
     // Override the hrtime stub to track calls and advance time
+    // Drive process.hrtime.bigint() with a plain monotonic counter instead of reading
+    // `clock.now`. This works around a sinon fake-timers regression.
+    // TODO: Revert when a fix for https://github.com/sinonjs/fake-timers/pull/549#pullrequestreview-4158432441 lands.
     sinon.restore()
-    clock = sinon.useFakeTimers()
+    let nowNs = 0n
     sinon.stub(process.hrtime, 'bigint').callsFake(() => {
-      const time = BigInt(clock.now) * 1_000_000n
+      const time = nowNs
       hrtimeCallCount++
-      clock.tick(30) // Advance by 30ms after each call
+      nowNs += 30_000_000n // advance 30ms per call
       return time
     })
 

packages/dd-trace/test/debugger/index.spec.js

@@ -70,6 +70,8 @@ describe('debugger/index', () => {
       tags: {
         'runtime-id': 'test-runtime-id',
       },
+      version: '1.2.3',
+      env: 'test-env',
       url: new URL('http://localhost:8126'),
     }
 
@@ -225,6 +227,7 @@ describe('debugger/index', () => {
         dynamicInstrumentation: {
           enabled: true,
         },
+        env: 'test-env',
         hostname: 'test-host',
         inputPath: '/debugger/v2/input',
         logLevel: 'info',
@@ -234,6 +237,7 @@ describe('debugger/index', () => {
         runtimeId: 'test-runtime-id',
         service: 'test-service',
         url: 'http://localhost:8126/',
+        version: '1.2.3',
       })
     })
   })

scripts/verify-exercised-tests.js

@@ -265,6 +265,56 @@ function parseInlineAssignments (prefix) {
   return out
 }
 
+/**
+ * Find `**` occurrences in a script string that are NOT inside quotes.
+ *
+ * POSIX sh (which is what `npm run`/`yarn run` invokes) does NOT support globstar, so an
+ * unquoted `**` collapses to `*` (single directory level). For recursive glob matching to
+ * reach mocha/glob intact, the pattern must be quoted so the shell passes it through as a
+ * literal string. This analyzer cannot rely on `globSync` alone for the check because it
+ * expands `**` recursively regardless of quoting — hiding the bug that the shell actually
+ * breaks unquoted patterns.
+ *
+ * @param {string} script
+ * @returns {{ column: number, context: string }[]}
+ */
+function findUnquotedGlobstar (script) {
+  /** @type {{ column: number, context: string }[]} */
+  const out = []
+  /** @type {'"'|"'"|null} */
+  let quote = null
+
+  for (let i = 0; i < script.length; i++) {
+    const ch = script[i]
+
+    if (quote) {
+      // In double-quoted strings, `\` escapes the next character.
+      if (quote === '"' && ch === '\\' && i + 1 < script.length) {
+        i++
+        continue
+      }
+      if (ch === quote) quote = null
+      continue
+    }
+
+    if (ch === '"' || ch === "'") {
+      quote = ch
+      continue
+    }
+
+    if (ch === '*' && script[i + 1] === '*') {
+      // Capture a short context window so the error message points to the offending token.
+      const start = Math.max(0, i - 20)
+      const end = Math.min(script.length, i + 25)
+      out.push({ column: i, context: script.slice(start, end) })
+      // Skip the second `*` to avoid double-reporting.
+      i++
+    }
+  }
+
+  return out
+}
+
 /**
  * Extract `export NAME=value` assignments from a multi-line `run:` string.
  * @param {string} run
@@ -927,6 +977,31 @@ function main () {
   const knownScripts = new Set(Object.keys(scripts))
   const scriptPrefixes = buildScriptPrefixSet(scripts)
 
+  // Detect `**` globs in scripts that are not wrapped in quotes. POSIX sh drops globstar, so
+  // unquoted `**` degrades to `*` and only a single directory level is passed through to
+  // mocha/globSync — silently missing any spec file deeper than one subdirectory.
+  /** @type {string[]} */
+  const unquotedGlobstar = []
+  for (const scriptName of Object.keys(scripts).sort((a, b) => a.localeCompare(b, 'en'))) {
+    const cmd = scripts[scriptName]
+    if (typeof cmd !== 'string') continue
+
+    for (const hit of findUnquotedGlobstar(cmd)) {
+      unquotedGlobstar.push(
+        `package.json: script "${scriptName}" contains an unquoted "**" at column ${hit.column} ` +
+        `(near "${hit.context.trim()}"). Wrap the glob in double quotes so POSIX sh passes ` +
+        'it through to mocha/glob as a literal; otherwise `**` collapses to `*` and specs ' +
+        'deeper than one subdirectory are silently skipped.'
+      )
+    }
+  }
+
+  if (unquotedGlobstar.length) {
+    process.stderr.write('Unquoted `**` globs detected in package.json scripts:\n')
+    for (const msg of unquotedGlobstar) process.stderr.write(`- ${msg}\n`)
+    process.exit(1)
+  }
+
   const testFiles = findTestFiles(repoRoot)
   const { globs, matchedFiles } = expandScriptGlobs(repoRoot, scripts)