fix(otel-thread-ctx): detect AsyncContextFrame by reading CPED natively

#397 replaced the execArgv inference with a feature detection, but the probe
was indirect: it overrode `enterWith` on a throwaway AsyncLocalStorage and
checked whether `run()` dispatched through it. That `run()` goes through the
instance property is unspecified, and anything patching AsyncLocalStorage can
break it — including dd-trace-js, which patches async-context machinery. The
resulting false negative is the failure #397 set out to fix: `enter()` throwing
inside a diagnostic-channel subscriber, in application code.

Ask the question directly instead. `cpedMapContains(key, value)` reports
whether the isolate's ContinuationPreservedEmbedderData binds a key to a value,
so calling it from inside a `run()` with the probe storage and its own store
observes the property the addon actually depends on. It is the same slot, and
the same "is it a Map" question, that WallProfiler::SetContext asks before
storing a context; the key is the one whose identity hash is published as
otel_thread_ctx_nodejs_v1.als_identity_hash for the out-of-process reader to
look up. Verified empirically that the frame is keyed by the storage instance
with the store as value.

Checking the key and value rather than just "CPED holds a Map" matters: CPED is
a general embedder slot, so a Map another addon left there must not answer for
us — that would resurrect the silent false positive, where the writer looks
healthy from JS while readers see records nothing updates.

Uses the public v8::Map::Get, not the raw OrderedHashMap walk in map-get.hh.
Conflating "is ACF on" with "is our layout knowledge correct" would report a V8
layout change as ACF being unavailable; layout has its own coverage.

Lives in binding.cc rather than wall.cc so it works on Windows: wall.cc's
`#ifndef _WIN32` block is there for SIGPROF and the v8::base::TimeTicks symbol
trick, neither of which a CPED read needs. Gated on NODE_MAJOR_VERSION >= 22,
returning false below, which is the correct answer there rather than a missing
export. Total by construction — no context, slot unset or not a Map, key absent,
or a malformed call all yield false, never a throw, because the writer calls
this from ensureHook().

Detection routes verified on both Node lines: 24 default-on, 24 off via command
line, 24 off via NODE_OPTIONS, 22 off by default, 22 on via command line, 22 on
via NODE_OPTIONS. Five new tests pin the key/value discrimination; mutating the
helper to a bare IsMap check fails three of them and none of the pre-existing
ones. 124 passing on macOS, 175 passing / 2 pending in test:docker.

Author: szegedi

bindings/binding.cc

@@ -29,6 +29,69 @@
 #include <unistd.h>
 #endif
 
+// Whether the isolate's ContinuationPreservedEmbedderData currently binds
+// `key` to `value`.
+//
+// This exists for AsyncContextFrame feature detection. With ACF active, Node
+// implements AsyncLocalStorage#run by installing an AsyncContextFrame — a JS
+// Map keyed by the AsyncLocalStorage instance — as the CPED of the running
+// continuation. Calling this from inside a run() with the storage and its
+// store therefore observes the property this addon actually depends on,
+// instead of inferring it from the Node version, process.execArgv, or whether
+// run() happens to dispatch through the instance's enterWith.
+//
+// It is the same slot, and the same "is it a Map" question, that
+// WallProfiler::SetContext asks before storing a context, and the identity
+// hash published as otel_thread_ctx_nodejs_v1.als_identity_hash is the hash of
+// this very key — so a false answer here means both consumers are broken.
+//
+// Deliberately total: no context entered, CPED unset or not a Map, or the key
+// absent all yield false rather than throwing. The otel thread-ctx writer calls
+// this from ensureHook(), which runs inside dd-trace-js diagnostic-channel
+// subscribers, where an exception would surface in application code.
+//
+// Uses the public v8::Map::Get rather than the raw OrderedHashMap walk in
+// map-get.hh on purpose: this answers "is ACF on", and conflating it with "is
+// our map layout knowledge still correct" would report a V8 layout change as
+// ACF being unavailable. Layout is covered separately, by the GetValueFromMap
+// tests.
+static NAN_METHOD(CpedMapContains) {
+#if NODE_MAJOR_VERSION >= 22
+  auto isolate = info.GetIsolate();
+
+  // A malformed call must not accidentally answer true by comparing an absent
+  // key's undefined against an undefined expected value.
+  if (info.Length() < 2) {
+    info.GetReturnValue().Set(false);
+    return;
+  }
+
+  auto context = isolate->GetCurrentContext();
+  if (context.IsEmpty()) {
+    info.GetReturnValue().Set(false);
+    return;
+  }
+
+  auto cped = isolate->GetContinuationPreservedEmbedderData();
+  if (cped.IsEmpty() || !cped->IsMap()) {
+    info.GetReturnValue().Set(false);
+    return;
+  }
+
+  v8::Local<v8::Value> found;
+  if (!cped.As<v8::Map>()->Get(context, info[0]).ToLocal(&found)) {
+    info.GetReturnValue().Set(false);
+    return;
+  }
+
+  info.GetReturnValue().Set(found->StrictEquals(info[1]));
+#else
+  // No ContinuationPreservedEmbedderData, and no AsyncContextFrame to put in
+  // it, so false is the right answer rather than a missing export.
+  info.GetReturnValue().Set(false);
+#endif
+}
+
 static NAN_METHOD(GetNativeThreadId) {
 #ifdef __APPLE__
   uint64_t native_id;
@@ -56,4 +119,5 @@ NODE_MODULE_INIT(/* exports, module, context */) {
   dd::WallProfiler::Init(exports);
   dd::OtelThreadCtx::Init(exports);
   Nan::SetMethod(exports, "getNativeThreadId", GetNativeThreadId);
+  Nan::SetMethod(exports, "cpedMapContains", CpedMapContains);
 }

ts/src/async-context-frame.ts

@@ -15,6 +15,23 @@
  */
 
 import {AsyncLocalStorage} from 'node:async_hooks';
+import {join} from 'path';
+
+interface Addon {
+  cpedMapContains(key: unknown, value: unknown): boolean;
+}
+
+let addon: Addon | undefined;
+
+// Required lazily so importing this module doesn't force the addon to load;
+// memoized by isAsyncContextFrameActive, so this runs at most once per thread.
+function bindings(): Addon {
+  if (!addon) {
+    const findBinding = require('node-gyp-build');
+    addon = findBinding(join(__dirname, '..', '..')) as Addon;
+  }
+  return addon;
+}
 
 let active: boolean | undefined;
 
@@ -39,19 +56,34 @@ let active: boolean | undefined;
  *   main thread's command line either, and tooling sometimes rewrites
  *   `process.execArgv` outright.
  *
- * With ACF, `run()` is implemented in terms of `enterWith()`; without it, it
- * isn't. Memoized: the answer is fixed for the life of the thread.
+ * Detected by asking the addon what is in the CPED slot during a `run()`. With
+ * ACF, Node installs an AsyncContextFrame — a JS Map keyed by the
+ * `AsyncLocalStorage` instance, valued by its store — as the running
+ * continuation's CPED; without it, nothing writes the slot. So a probe storage
+ * whose own store is visible there is direct evidence, and it is evidence about
+ * the exact slot both consumers read: `WallProfiler::SetContext` requires that
+ * Map, and the thread-ctx reader looks this very key up by the identity hash
+ * published as `als_identity_hash`.
+ *
+ * Observing whether `run()` delegates to `enterWith()` would be an indirect
+ * proxy for the same thing: it holds today, but it depends on `run()`
+ * dispatching through the instance property, which is unspecified and which
+ * anything patching `AsyncLocalStorage` can break — and the failure would be
+ * silent and in the dangerous direction.
+ *
+ * Memoized: the answer is fixed for the life of the thread.
  */
 export function isAsyncContextFrameActive(): boolean {
   if (active === undefined) {
-    const probe = new AsyncLocalStorage<number>();
-    let delegated = false;
-    probe.enterWith = () => {
-      delegated = true;
-    };
-    probe.run(0, () => {});
+    const probe = new AsyncLocalStorage<object>();
+    // Object identity, so a stray equal-valued binding can't answer for us.
+    const sentinel = {};
+    let bound = false;
+    probe.run(sentinel, () => {
+      bound = bindings().cpedMapContains(probe, sentinel);
+    });
     probe.disable();
-    active = delegated;
+    active = bound;
   }
   return active;
 }

ts/test/test-async-context-frame.ts

@@ -15,11 +15,16 @@
  */
 
 import {strict as assert} from 'assert';
+import {AsyncLocalStorage} from 'node:async_hooks';
 import {fork} from 'node:child_process';
 import {join} from 'node:path';
 
 import {isAsyncContextFrameActive} from '../src/async-context-frame';
 
+const addon = require('node-gyp-build')(join(__dirname, '..', '..')) as {
+  cpedMapContains(key?: unknown, value?: unknown): boolean;
+};
+
 const CHILD = join(__dirname, 'async-context-frame-child.js');
 
 const major = Number(process.versions.node.split('.')[0]);
@@ -119,3 +124,71 @@ describe('isAsyncContextFrameActive', () => {
     assert.equal(active, true);
   });
 });
+
+// The detection asks whether the running storage is bound to its own store,
+// not merely whether the CPED slot holds a Map. These pin that difference:
+// without them, weakening the helper to a bare IsMap check would still pass
+// every test above.
+describe('cpedMapContains', () => {
+  beforeEach(function () {
+    // With ACF off nothing writes the slot, so every answer here is false for
+    // an uninteresting reason. The routes that discriminate on/off are covered
+    // by the child-process cases above.
+    if (!isAsyncContextFrameActive()) this.skip();
+  });
+
+  it('finds the running storage bound to its store', () => {
+    const als = new AsyncLocalStorage<object>();
+    const store = {};
+    let found = false;
+    als.run(store, () => {
+      found = addon.cpedMapContains(als, store);
+    });
+    als.disable();
+    assert.equal(found, true);
+  });
+
+  it('does not match a foreign key', () => {
+    // CPED is a general embedder slot. Another native addon storing a Map there
+    // must not be able to answer for us, which is the false positive an IsMap
+    // check would admit.
+    const als = new AsyncLocalStorage<object>();
+    const store = {};
+    let found = true;
+    als.run(store, () => {
+      found = addon.cpedMapContains(new AsyncLocalStorage<object>(), store);
+    });
+    als.disable();
+    assert.equal(found, false);
+  });
+
+  it('does not match a different value for the right key', () => {
+    const als = new AsyncLocalStorage<object>();
+    let found = true;
+    als.run({}, () => {
+      found = addon.cpedMapContains(als, {});
+    });
+    als.disable();
+    assert.equal(found, false);
+  });
+
+  it('is false outside any run', () => {
+    const als = new AsyncLocalStorage<object>();
+    const store = {};
+    als.run(store, () => {});
+    als.disable();
+    assert.equal(addon.cpedMapContains(als, store), false);
+  });
+
+  it('is false when called without a key and value', () => {
+    // An absent key reads as undefined; so would a missing expected value, so
+    // a malformed call must not compare the two and report success.
+    const als = new AsyncLocalStorage<object>();
+    let found = true;
+    als.run({}, () => {
+      found = addon.cpedMapContains();
+    });
+    als.disable();
+    assert.equal(found, false);
+  });
+});