fix(tracing): parse ACP ingress headers with explicit W3C propagator + repeated-header support

- Use TraceContextTextMapPropagator().extract() instead of the ambient global
  propagator, so OTEL_PROPAGATORS=datadog (plausible in a DD shop; dd_only is the
  default mode) can't silently disable W3C extraction.
- Build a dict-of-lists carrier so repeated `tracestate` header lines are combined
  (W3C/RFC7230 MUST) instead of collapsing to the last value.
- Parse only traceparent/tracestate, so arbitrary inbound `baggage` isn't pulled
  into the downstream context.

Addresses the review comments on repeated-header collapse, ambient-propagator
dependence, and the implicit trust boundary. `traceparent` is single-valued, so
trace linkage (this PR's purpose) is unchanged.

Tests: repeated tracestate combined; inbound baggage not extracted.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: NiteshDhanpal

src/agentex/lib/sdk/fastacp/base/base_acp_server.py

@@ -47,8 +47,8 @@
 
 
 def _attach_incoming_otel_context(scope_headers: list[tuple[bytes, bytes]]) -> object | None:
-    """Extract the inbound W3C trace context (traceparent/tracestate/baggage) from
-    ASGI headers and make it the active OpenTelemetry context for the request.
+    """Extract the inbound W3C trace context (traceparent/tracestate) from ASGI
+    headers and make it the active OpenTelemetry context for the request.
 
     FastACP is not otherwise instrumented to *continue* an incoming trace: the
     gateway forwards the traceparent header, but nothing on the Python side
@@ -64,10 +64,22 @@ def _attach_incoming_otel_context(scope_headers: list[tuple[bytes, bytes]]) -> o
     """
     try:
         from opentelemetry import context as _otel_context
-        from opentelemetry.propagate import extract
-
-        carrier = {k.decode("latin-1"): v.decode("latin-1") for k, v in scope_headers}
-        return _otel_context.attach(extract(carrier))
+        from opentelemetry.trace.propagation.tracecontext import TraceContextTextMapPropagator
+
+        # ASGI headers are a list that can repeat a name, and a dict comprehension
+        # keeps only the last value -- which silently drops repeated `tracestate`
+        # lines (W3C/RFC7230 say they MUST be combined). Build a dict-of-lists so
+        # the propagator's getter sees every value and `TraceState.from_header`
+        # combines them; `traceparent` is single-valued so it is unaffected.
+        carrier: dict[str, list[str]] = {}
+        for k, v in scope_headers:
+            carrier.setdefault(k.decode("latin-1").lower(), []).append(v.decode("latin-1"))
+        # Use the W3C propagator explicitly rather than the ambient global one:
+        # this ingress is W3C by contract, and `OTEL_PROPAGATORS=datadog` (plausible
+        # in a DD shop, and dd_only is the default mode) would otherwise silently
+        # extract nothing. It also parses only traceparent/tracestate, so arbitrary
+        # inbound `baggage` is not pulled into the downstream context.
+        return _otel_context.attach(TraceContextTextMapPropagator().extract(carrier))
     except Exception:  # pragma: no cover - obs must never break a request
         return None
 

tests/test_trace_context_extraction.py

@@ -46,5 +46,42 @@ def test_no_inbound_traceparent_is_fail_open() -> None:
     _detach_otel_context(token)
 
 
+def test_repeated_tracestate_headers_are_combined() -> None:
+    # ASGI can deliver tracestate as multiple header lines; W3C/RFC7230 require
+    # combining them. The old dict-comprehension carrier kept only the last.
+    from opentelemetry import trace as _trace
+
+    trace_id = "0af7651916cd43dd8448eb211c80319c"
+    headers = [
+        (b"traceparent", f"00-{trace_id}-b7ad6b7169203331-01".encode()),
+        (b"tracestate", b"vendora=1"),
+        (b"tracestate", b"vendorb=2"),
+    ]
+    token = _attach_incoming_otel_context(headers)
+    try:
+        ts = _trace.get_current_span().get_span_context().trace_state
+        assert ts.get("vendora") == "1"
+        assert ts.get("vendorb") == "2"  # would be missing if repeats collapsed
+    finally:
+        _detach_otel_context(token)
+
+
+def test_inbound_baggage_is_not_extracted() -> None:
+    # W3C tracecontext-only extraction: arbitrary inbound baggage (attacker-
+    # controlled keys) must not be pulled into the downstream context.
+    from opentelemetry.baggage import get_all
+
+    trace_id = "0af7651916cd43dd8448eb211c80319c"
+    headers = [
+        (b"traceparent", f"00-{trace_id}-b7ad6b7169203331-01".encode()),
+        (b"baggage", b"user_id=secret,role=admin"),
+    ]
+    token = _attach_incoming_otel_context(headers)
+    try:
+        assert get_all() == {}
+    finally:
+        _detach_otel_context(token)
+
+
 def test_detach_none_is_safe() -> None:
     _detach_otel_context(None)