supply a valid $.Source in local execution's runtime context

@datadog/apps-backend's buildRuntimeFromJsFunctionWithActions is injected
into every backend function's bundle when that package is installed,
regardless of which specific function is called, and requires
$.Source.{initiator,runAsUser} to each be a User object with non-empty
id/orgId strings. Local execution's $ context never included Source,
so any app with @datadog/apps-backend installed (the create-apps scaffold
default) failed on its very first request -- not just functions that
call $.Actions, which was the only gap previously documented.

Confirmed by tracing the real, published package's bundled validation
logic and dd-source's production path: Source is populated upstream of
wf-actions-worker (the app-builder API layer, from the authenticated
caller's identity) before a bundled function ever runs -- it's plain
caller-supplied JSON by the time it reaches the script template, not a
server-signed value the runtime cross-checks. The validator only checks
shape (non-empty id/orgId strings), not a live session, so a synthetic
identity fully satisfies it.

Uses one placeholder identity for both initiator and runAsUser, since
on-behalf-of impersonation isn't meaningful when a single developer is
running their own code locally. No existing whoami-style endpoint exists
in this package's auth layer to fetch a real identity instead; real
identity resolution (if ever wanted) is a separate, non-blocking
enhancement, not a gap in this fix.

Verified against the real npm package (not a mock) via a new integration
test reusing the existing apps_backend_project fixture, and against a
real npm-linked scaffolded app calling getExecutionUser()/
getInitiatingUser() through /__dd/executeAction.

Author: tyffical

packages/plugins/apps/src/vite/local-exec-child.js

@@ -68,13 +68,33 @@ function makeActionsProxy(pathParts = []) {
     });
 }
 
+// @datadog/apps-backend's buildRuntimeFromJsFunctionWithActions (injected into
+// every bundle when that package is installed, regardless of which specific
+// function is called -- see virtual-entry.ts's SET_BACKEND_CONTEXT_SNIPPET)
+// requires $.Source.{initiator,runAsUser} to each be a User object with
+// non-empty id/orgId strings. In production this comes from the real
+// workflow-execution's trigger/run-as identity (domains/workflow's Go proto
+// data); no equivalent identity exists for a local fork, and no impersonation
+// (initiator vs. runAsUser) is meaningful when one developer is running their
+// own code locally, so both roles use the same clearly-synthetic identity.
+const LOCAL_DEV_USER = {
+    id: 'local-dev-user',
+    orgId: 'local-dev-org',
+    email: null,
+    name: 'Local Development',
+};
+
 process.on('message', async function onExecute(msg) {
     if (!msg || msg.type !== 'execute') {
         return;
     }
 
     try {
-        const $ = { backendFunctionArgs: msg.backendFunctionArgs, Actions: makeActionsProxy() };
+        const $ = {
+            backendFunctionArgs: msg.backendFunctionArgs,
+            Actions: makeActionsProxy(),
+            Source: { initiator: LOCAL_DEV_USER, runAsUser: LOCAL_DEV_USER },
+        };
         globalThis.$ = $;
 
         // The real bundled code (from vite.build(), format:'es', no externals

packages/plugins/apps/src/vite/local-execution.integration.test.ts

@@ -15,7 +15,7 @@
  */
 
 import { outputFileSync } from '@dd/core/helpers/fs';
-import { getTempWorkingDir } from '@dd/tests/_jest/helpers/env';
+import { getTempWorkingDir, prepareWorkingDir } from '@dd/tests/_jest/helpers/env';
 import { getMockLogger } from '@dd/tests/_jest/helpers/mocks';
 import { build } from 'vite';
 
@@ -247,4 +247,47 @@ describe('executeScriptLocally (real bundle, no mocks)', () => {
         await expect(execution).rejects.toThrow();
         expect(child?.killed).toBe(true);
     }, 20_000);
+
+    test('supplies a valid $.Source so @datadog/apps-backend does not throw, when the package is installed', async () => {
+        // Unlike the other tests in this file (a bare temp dir with only the
+        // one .backend.ts file written into it), this uses the real fixture
+        // project tree, which has a real @datadog/apps-backend installed --
+        // matching a real scaffolded app, and the exact condition that
+        // exposed this bug: isDatadogAppsBackendInstalled(workingDir) resolves
+        // true here, so generateDevVirtualEntryContent injects
+        // SET_BACKEND_CONTEXT_SNIPPET, which throws unless $.Source is valid.
+        const workingDir = await prepareWorkingDir(`local-exec-poc-apps-backend-${Date.now()}`);
+        const sourceCode = `
+            import { getExecutionUser, getInitiatingUser } from '@datadog/apps-backend/user';
+            export async function usesSdk() {
+                const [executionUser, initiatingUser] = await Promise.all([
+                    getExecutionUser(),
+                    getInitiatingUser(),
+                ]);
+                return { executionUser, initiatingUser };
+            }
+        `;
+        const code = await bundleRealBackendFunction(workingDir, 'usesSdk', sourceCode);
+
+        // Confirms the bundle actually took the @datadog/apps-backend branch
+        // (the bug this test guards would otherwise be silently untested if
+        // the fixture stopped resolving as installed for some other reason).
+        // Asserts on the snippet's literal comment, not the imported
+        // identifiers -- Rollup renames those during bundling.
+        expect(code).toContain('Supply the backend runtime context');
+
+        const func: BackendFunction = {
+            relativePath: 'src/usesSdk',
+            name: 'usesSdk',
+            absolutePath: `${workingDir}/src/usesSdk.backend.ts`,
+            allowedConnectionIds: [],
+        };
+
+        const outputs = await executeScriptLocally(code, func, [], log);
+
+        expect(outputs.data).toMatchObject({
+            executionUser: { id: 'local-dev-user', orgId: 'local-dev-org' },
+            initiatingUser: { id: 'local-dev-user', orgId: 'local-dev-org' },
+        });
+    }, 20_000);
 });