fix(agentless): enforce 64-bit trace IDs for agentless intake (#7820)

bengl · web-flow · commit 5b2f0b899d37 · 2026-03-19T16:05:13.000Z
fix(agentless): enforce 64-bit trace IDs for agentless intake

The agentless intake only accepts 64-bit trace IDs. This change ensures
64-bit enforcement at three layers:

1. Config: disable 128-bit trace ID generation when agentless is enabled
2. Encoder: strip _dd.p.tid meta tag (upper 64 bits of 128-bit IDs)
3. Encoder: truncate trace_id to lower 64 bits via .slice(-16)

The config disable is in the calculated layer so env vars can still
override it if needed; the encoder provides defense-in-depth regardless.

Co-Authored-By: Claude Opus 4.6 &lt;noreply@anthropic.com&gt;

Co-authored-by: bryan.english &lt;bryan.english@datadoghq.com&gt;
diff --git a/packages/dd-trace/src/config/index.js b/packages/dd-trace/src/config/index.js
@@ -1125,6 +1125,8 @@ class Config {
       setBoolean(calc, 'reportHostname', true)
       // Clear sampling rules - server-side sampling handles this
       calc['sampler.rules'] = []
+      // Agentless intake only accepts 64-bit trace IDs; disable 128-bit generation
+      setBoolean(calc, 'traceId128BitGenerationEnabled', false)
     }
 
     if (this.#isCiVisibility()) {
diff --git a/packages/dd-trace/src/encode/agentless-json.js b/packages/dd-trace/src/encode/agentless-json.js
@@ -16,6 +16,9 @@ const SOFT_LIMIT = 8 * 1024 * 1024 // 8MB
 function formatSpan (span, isFirstSpan) {
   span = normalizeSpan(truncateSpan(span, false))
 
+  // Remove _dd.p.tid (the upper 64 bits of a 128-bit trace ID) since trace_id is truncated to lower 64 bits
+  delete span.meta['_dd.p.tid']
+
   if (span.span_events) {
     span.meta.events = JSON.stringify(span.span_events)
     delete span.span_events
@@ -45,7 +48,7 @@ function formatSpan (span, isFirstSpan) {
  */
 function spanToJSON (span) {
   const result = {
-    trace_id: span.trace_id.toString(16).toLowerCase(),
+    trace_id: span.trace_id.toString(16).toLowerCase().slice(-16),
     span_id: span.span_id.toString(16).toLowerCase(),
     parent_id: span.parent_id.toString(16).toLowerCase(),
     name: span.name,
diff --git a/packages/dd-trace/test/config/index.spec.js b/packages/dd-trace/test/config/index.spec.js
@@ -3869,6 +3869,20 @@ rules:
       assert.deepStrictEqual(config.sampler.rules, [])
     })
 
+    it('should disable 128-bit trace ID generation when agentless is enabled', () => {
+      process.env._DD_APM_TRACING_AGENTLESS_ENABLED = 'true'
+      const config = getConfig()
+      assert.strictEqual(config.traceId128BitGenerationEnabled, false)
+    })
+
+    it('should allow env var to override agentless 128-bit disable', () => {
+      process.env._DD_APM_TRACING_AGENTLESS_ENABLED = 'true'
+      process.env.DD_TRACE_128_BIT_TRACEID_GENERATION_ENABLED = 'true'
+      const config = getConfig()
+      // Env var has higher priority than calculated; encoder truncation is the safety net
+      assert.strictEqual(config.traceId128BitGenerationEnabled, true)
+    })
+
     it('should not affect other config when agentless is disabled', () => {
       process.env._DD_APM_TRACING_AGENTLESS_ENABLED = 'false'
       const config = getConfig()
diff --git a/packages/dd-trace/test/encode/agentless-json.spec.js b/packages/dd-trace/test/encode/agentless-json.spec.js
@@ -91,19 +91,31 @@ describe('AgentlessJSONEncoder', () => {
       })
     })
 
-    it('should encode 128-bit trace IDs correctly', () => {
-      // 128-bit trace IDs are used in W3C Trace Context
-      data[0].trace_id = id('0123456789abcdef0123456789abcdef')
+    it('should truncate 128-bit trace IDs to 64-bit', () => {
+      // 128-bit trace IDs (e.g. from W3C Trace Context or 128-bit generation) should be truncated
+      data[0].trace_id = id('aaaaaaaaaaaaaaaa0123456789abcdef')
 
       encoder.encode(data)
 
       const buffer = encoder.makePayload()
       const decoded = JSON.parse(buffer.toString())
       const span = decoded.traces[0].spans[0]
 
-      // Should be full 32-character hex string
-      assert.strictEqual(span.trace_id, '0123456789abcdef0123456789abcdef')
-      assert.strictEqual(span.trace_id.length, 32)
+      // Should be lower 64 bits only (16-character hex string)
+      assert.strictEqual(span.trace_id, '0123456789abcdef')
+      assert.strictEqual(span.trace_id.length, 16)
+    })
+
+    it('should strip _dd.p.tid from meta', () => {
+      data[0].meta['_dd.p.tid'] = '0123456700000000'
+
+      encoder.encode(data)
+
+      const buffer = encoder.makePayload()
+      const decoded = JSON.parse(buffer.toString())
+      const span = decoded.traces[0].spans[0]
+
+      assert.strictEqual(span.meta['_dd.p.tid'], undefined)
     })
 
     it('should include span fields with start time converted to seconds', () => {

Original file line number	Diff line number	Diff line change
`@@ -1125,6 +1125,8 @@ class Config {`
`1125`	`1125`	`setBoolean(calc, 'reportHostname', true)`
`1126`	`1126`	`// Clear sampling rules - server-side sampling handles this`
`1127`	`1127`	`calc['sampler.rules'] = []`
	`1128`	`+ // Agentless intake only accepts 64-bit trace IDs; disable 128-bit generation`
	`1129`	`+ setBoolean(calc, 'traceId128BitGenerationEnabled', false)`
`1128`	`1130`	`}`
`1129`	`1131`
`1130`	`1132`	`if (this.#isCiVisibility()) {`