datadog 2.36.0 → 2.37.0

data/lib/datadog/di/probe_file_loader.rb

@@ -2,6 +2,8 @@
 
 require 'json'
 
+require_relative 'fatal_exceptions'
+
 module Datadog
   module DI
     module ProbeFileLoader
@@ -47,7 +49,8 @@ module Datadog
 
               payload = component.probe_notification_builder.build_errored(probe, exc)
               component.probe_notifier_worker.add_status(payload, probe: probe)
-            rescue => exc
+            rescue Exception => exc # standard:disable Lint/RescueException
+              Datadog::DI.reraise_if_fatal(exc)
               raise if component.settings.dynamic_instrumentation.internal.propagate_all_exceptions
 
               component.logger.debug { "di: unhandled exception adding #{probe.type} probe at #{probe.location} (#{probe.id}) in DI probe file loader: #{exc.class}: #{exc.message}" }
@@ -58,7 +61,8 @@ module Datadog
               component.probe_notifier_worker.add_status(payload, probe: probe)
             end
           end
-        rescue => exc
+        rescue Exception => exc # standard:disable Lint/RescueException
+          Datadog::DI.reraise_if_fatal(exc)
           if component.settings.dynamic_instrumentation.internal.propagate_all_exceptions
             should_propagate = true
             raise
@@ -67,7 +71,8 @@ module Datadog
           component.logger.debug { "di: unhandled exception handling a probe in DI probe file loader: #{exc.class}: #{exc.message}" }
           component.telemetry&.report(exc, description: "Unhandled exception handling probe in DI probe file loader")
         end
-      rescue
+      rescue Exception => exc # standard:disable Lint/RescueException
+        Datadog::DI.reraise_if_fatal(exc)
         # We should generally never get here, but if component tree
         # initialization fails for some unexpected reason, don't nuke
         # the customer application.

data/lib/datadog/di/probe_manager.rb

@@ -2,6 +2,8 @@
 
 # rubocop:disable Lint/AssignmentInCondition
 
+require_relative 'fatal_exceptions'
+
 module Datadog
   module DI
     # Orchestrates probe lifecycle: installation, removal, and execution callbacks.
@@ -26,13 +28,13 @@ module Datadog
         @telemetry = telemetry
         @probe_repository = probe_repository
 
-        @definition_trace_point = TracePoint.trace(:end) do |tp|
+        @definition_trace_point = TracePoint.new(:end) do |tp|
           install_pending_method_probes(tp.self)
-        rescue => exc
+        rescue Exception => exc # standard:disable Lint/RescueException
+          Datadog::DI.reraise_if_fatal(exc)
           raise if settings.dynamic_instrumentation.internal.propagate_all_exceptions
           logger.debug { "di: unhandled exception in definition trace point: #{exc.class}: #{exc.message}" }
           telemetry&.report(exc, description: "Unhandled exception in definition trace point")
-          # TODO test this path
         end
       end
 
@@ -40,15 +42,68 @@ module Datadog
       attr_reader :telemetry
       attr_reader :probe_repository
 
+      # Stops the probe manager without permanently releasing resources.
+      #
+      # Disables the class definition trace point and unhooks all installed
+      # probe instrumentation, but preserves the probe repository so that
+      # {#reopen} can re-install probes. Can be reversed by calling {#reopen}.
+      #
+      # Why preserve the repository: RC dispatch only delivers LIVE_DEBUGGING
+      # changes when the content hash changes. If a customer toggles DI off
+      # then back on in the UI with the same probe content, the receiver
+      # is not re-invoked, so probes wiped here would never be redelivered.
+      # Preserving the repo lets {#reopen} replay the probes locally.
+      #
+      # @return [void]
+      def stop
+        definition_trace_point.disable
+        probe_repository.synchronize do
+          probe_repository.installed_probes.each_value do |probe|
+            instrumenter.unhook(probe)
+          rescue => exc
+            raise if settings.dynamic_instrumentation.internal.propagate_all_exceptions
+            logger.debug { "di: error unhooking #{probe.type} probe at #{probe.location} (#{probe.id}) on stop: #{exc.class}: #{exc.message}" }
+            telemetry&.report(exc, description: "Error unhooking probe on stop")
+          end
+        end
+      end
+
+      # Re-enables the probe manager after a {#stop}.
+      #
+      # Re-enables the class definition trace point so that pending
+      # method probes can be installed when their target classes are defined,
+      # and re-hooks all previously-installed probes from the repository.
+      # If a probe's target is no longer present (e.g. code was unloaded
+      # between stop and reopen), it is demoted to pending so the trace
+      # point or code tracker can re-install it if the target reappears.
+      #
+      # @return [void]
+      def reopen
+        definition_trace_point.enable
+        probe_repository.synchronize do
+          # values.each so concurrent mutation of @installed_probes (via
+          # remove_installed below) does not iterate over a stale key set.
+          probe_repository.installed_probes.values.each do |probe|
+            instrumenter.hook(probe, self)
+          rescue Error::DITargetNotDefined
+            probe_repository.remove_installed(probe.id)
+            probe_repository.add_pending(probe)
+            logger.trace { "di: target for #{probe.type} probe (#{probe.id}) no longer defined on reopen, demoting to pending" }
+          rescue => exc
+            raise if settings.dynamic_instrumentation.internal.propagate_all_exceptions
+            logger.debug { "di: error re-hooking #{probe.type} probe at #{probe.location} (#{probe.id}) on reopen: #{exc.class}: #{exc.message}" }
+            telemetry&.report(exc, description: "Error re-hooking probe on reopen")
+          end
+        end
+      end
+
       # Shuts down the probe manager and releases all resources.
       #
       # Disables the class definition trace point and removes all installed
       # probe instrumentation. Called during component teardown.
+      # Unlike {#stop}, this is not reversible.
       #
       # @return [void]
-      #
-      # TODO test that close is called during component teardown and
-      # the trace point is cleared
       def close
         definition_trace_point.disable
         clear_hooks
@@ -129,7 +184,8 @@ module Datadog
             false
           end
         end
-      rescue => exc
+      rescue Exception => exc # standard:disable Lint/RescueException
+        Datadog::DI.reraise_if_fatal(exc)
         # In "propagate all exceptions" mode we will try to instrument again.
         raise if settings.dynamic_instrumentation.internal.propagate_all_exceptions
 
@@ -160,7 +216,8 @@ module Datadog
           begin
             instrumenter.unhook(probe)
             probe_repository.remove_installed(probe_id)
-          rescue => exc
+          rescue Exception => exc # standard:disable Lint/RescueException
+            Datadog::DI.reraise_if_fatal(exc)
             raise if settings.dynamic_instrumentation.internal.propagate_all_exceptions
             # Silence all exceptions?
             # TODO should we propagate here and rescue upstream?
@@ -190,7 +247,8 @@ module Datadog
                   break
                 rescue Error::DITargetNotDefined
                   # This should not happen... try installing again later?
-                rescue => exc
+                rescue Exception => exc # standard:disable Lint/RescueException
+                  Datadog::DI.reraise_if_fatal(exc)
                   raise if settings.dynamic_instrumentation.internal.propagate_all_exceptions
 
                   logger.debug { "di: error installing #{probe.type} probe at #{probe.location} (#{probe.id}) after class is defined: #{exc.class}: #{exc.message}" }

data/lib/datadog/di/probe_notification_builder.rb

@@ -2,6 +2,8 @@
 
 # rubocop:disable Lint/AssignmentInCondition
 
+require_relative 'fatal_exceptions'
+
 module Datadog
   module DI
     # Builds probe status notification and snapshot payloads.
@@ -366,7 +368,8 @@ module Datadog
           else
             raise ArgumentError, "Invalid template segment type: #{segment}"
           end
-        rescue => exc
+        rescue Exception => exc # standard:disable Lint/RescueException
+          Datadog::DI.reraise_if_fatal(exc)
           evaluation_errors << {
             message: "#{exc.class}: #{exc.message}",
             expr: segment.dsl_expr, # steep:ignore NoMethod

data/lib/datadog/di/probe_notifier_worker.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative '../core/semaphore'
+require_relative 'fatal_exceptions'
 
 module Datadog
   module DI
@@ -62,6 +63,7 @@ module Datadog
       # @return [void]
       def start
         return if @thread && @pid == Process.pid
+        @stop_requested = false
         logger.trace { "di: starting probe notifier: pid #{$$}" }
         @thread = Thread.new do
           loop do
@@ -92,10 +94,11 @@ module Datadog
 
             begin
               more = maybe_send
-            rescue => exc
+            rescue Exception => exc # standard:disable Lint/RescueException
+              Datadog::DI.reraise_if_fatal(exc)
               raise if settings.dynamic_instrumentation.internal.propagate_all_exceptions
 
-              logger.debug { "di: error in probe notifier worker: #{exc.class}: #{exc.message} (at #{exc.backtrace.first})" }
+              logger.debug { "di: error in probe notifier worker: #{exc.class}: #{exc.message} (at #{exc.backtrace&.first})" }
               telemetry&.report(exc, description: "Error in probe notifier worker")
             end
             @lock.synchronize do
@@ -257,40 +260,56 @@ module Datadog
         # if it has been more than 1 second since the last send of the same
         # event type.
         define_method("add_#{event_type}") do |event, probe: nil|
-          @lock.synchronize do
-            queue = send("#{event_type}_queue")
-            if queue.length > settings.dynamic_instrumentation.internal.snapshot_queue_capacity
-              if event_type == :status && probe
-                status = event.dig(:debugger, :diagnostics, :status)
-                logger.debug { "di: dropping status for #{probe.type} probe at #{probe.location} (#{probe.id}): #{status} because queue is full" }
-              else
-                logger.debug { "di: #{self.class.name}: dropping #{event_type} event because queue is full" }
-              end
-            else
-              if event_type == :status && probe
-                status = event.dig(:debugger, :diagnostics, :status)
-                logger.trace { "di: queueing status for #{probe.type} probe at #{probe.location} (#{probe.id}): #{status}" }
+          # Enqueueing reads DI configuration and writes debug/trace logs, both
+          # of which can call stdlib methods (e.g. Set#include? via the
+          # configuration layer's supported-configuration lookup). If a customer
+          # has a method probe on such a method, firing it here would re-enter
+          # the worker through probe_executed_callback and deadlock on @lock
+          # (recursive locking). Hold the re-entrancy guard for the duration so
+          # those DI-internal calls reach the original method without firing the
+          # probe. Restore the prior state afterwards so a caller that already
+          # holds the guard (e.g. run_method_probe post-processing calling
+          # add_snapshot) is not cleared early.
+          was_in_probe = Datadog::DI.in_probe?
+          Datadog::DI.enter_probe unless was_in_probe
+          begin
+            @lock.synchronize do
+              queue = send("#{event_type}_queue")
+              if queue.length > settings.dynamic_instrumentation.internal.snapshot_queue_capacity
+                if event_type == :status && probe
+                  status = event.dig(:debugger, :diagnostics, :status)
+                  logger.debug { "di: dropping status for #{probe.type} probe at #{probe.location} (#{probe.id}): #{status} because queue is full" }
+                else
+                  logger.debug { "di: #{self.class.name}: dropping #{event_type} event because queue is full" }
+                end
               else
-                logger.trace { "di: #{self.class.name}: queueing #{event_type} event" }
+                if event_type == :status && probe
+                  status = event.dig(:debugger, :diagnostics, :status)
+                  logger.trace { "di: queueing status for #{probe.type} probe at #{probe.location} (#{probe.id}): #{status}" }
+                else
+                  logger.trace { "di: #{self.class.name}: queueing #{event_type} event" }
+                end
+                queue << event
               end
-              queue << event
             end
-          end
 
-          # Figure out whether to wake up the worker thread.
-          # If minimum send interval has elapsed since the last send,
-          # wake up immediately.
-          @lock.synchronize do
-            unless @wake_scheduled
-              @wake_scheduled = true
-              set_sleep_remaining
-              wake.signal
+            # Figure out whether to wake up the worker thread.
+            # If minimum send interval has elapsed since the last send,
+            # wake up immediately.
+            @lock.synchronize do
+              unless @wake_scheduled
+                @wake_scheduled = true
+                set_sleep_remaining
+                wake.signal
+              end
             end
-          end
 
-          # Worker could be not running if the process forked - check and
-          # start it again in this case.
-          start
+            # Worker could be not running if the process forked - check and
+            # start it again in this case.
+            start
+          ensure
+            Datadog::DI.leave_probe unless was_in_probe
+          end
         end
 
         public "add_#{event_type}"
@@ -318,9 +337,10 @@ module Datadog
               @lock.synchronize do
                 @last_sent = time
               end
-            rescue => exc
+            rescue Exception => exc # standard:disable Lint/RescueException
+              Datadog::DI.reraise_if_fatal(exc)
               raise if settings.dynamic_instrumentation.internal.propagate_all_exceptions
-              logger.debug { "di: failed to send #{event_name}: #{exc.class}: #{exc.message} (at #{exc.backtrace.first})" }
+              logger.debug { "di: failed to send #{event_name}: #{exc.class}: #{exc.message} (at #{exc.backtrace&.first})" }
               telemetry&.report(exc, description: "Error sending #{event_type}")
             end
           end

data/lib/datadog/di/redactor.rb

@@ -186,8 +186,23 @@ module Datadog
       ]
 
       # Input can be a string or a symbol.
+      #
+      # Hash keys captured in snapshots often originate from a Rack environment
+      # (Rack/Rails/Sinatra middleware and controllers all keep `env` in scope).
+      # Rack rewrites incoming HTTP header names to the CGI form
+      # `HTTP_<HEADER>` with dashes converted to underscores — for example,
+      # `Authorization` becomes `HTTP_AUTHORIZATION`, `Cookie` becomes
+      # `HTTP_COOKIE`, `X-API-Key` becomes `HTTP_X_API_KEY`. Without stripping
+      # the prefix here, those keys normalize to `httpauthorization`,
+      # `httpcookie`, `httpxapikey`, etc., none of which appear in the default
+      # identifier list — so the values would not be matched against entries
+      # like `authorization`, `cookie`, or `xapikey`. The `\Ahttp_` anchor
+      # limits the strip to the literal CGI form, so identifiers that merely
+      # begin with the letters `http` (e.g. `httpinfo`) are unaffected. The
+      # strip must run before the punctuation gsub: the gsub removes the
+      # underscore, after which `\Ahttp_` could never match.
       def normalize(str)
-        str.to_s.strip.downcase.gsub(/[-_$@]/, "")
+        str.to_s.strip.downcase.sub(/\Ahttp_/, "").tr("-_$@", "")
       end
     end
   end

data/lib/datadog/di/remote.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative 'fatal_exceptions'
+
 module Datadog
   module DI
     # Provides an interface expected by the core Remote subsystem to
@@ -15,14 +17,125 @@ module Datadog
       class << self
         PRODUCT = 'LIVE_DEBUGGING'
 
+        # Declared here (not in Tracing::Remote::CAPABILITIES) so it is
+        # registered only with the gated DI block in Capabilities#register:
+        # when DI is explicitly disabled, or the runtime cannot run DI
+        # (JRuby, Ruby 2.5), that block — including this bit — is skipped.
+        # The enable signal itself is delivered in APM_TRACING payloads and
+        # routed here by Tracing::Remote.process_config.
+        CAPABILITIES = [
+          1 << 38, # APM_TRACING_ENABLE_DYNAMIC_INSTRUMENTATION: Implicit DI enablement
+        ].freeze
+
         def products
-          # TODO: do not send our product on unsupported runtimes
-          # (Ruby 2.5 / JRuby)
           [PRODUCT]
         end
 
         def capabilities
-          []
+          CAPABILITIES
+        end
+
+        # Entry point for the RC-driven DI enable/disable path.
+        #
+        # Invoked from {Datadog::Tracing::Remote.process_config} when an
+        # APM_TRACING payload carries `dynamic_instrumentation_enabled`. Runs
+        # on the remote-config thread; never raises.
+        #
+        # @param enabled [Boolean] desired state from RC: true to start DI,
+        #   false to stop it. The `DD_DYNAMIC_INSTRUMENTATION_ENABLED=false`
+        #   env var blocks an enable here (see {.explicitly_disabled?}).
+        # @param repository [Datadog::Core::Remote::Configuration::Repository, nil]
+        #   the RC repository, passed by {Datadog::Tracing::Remote.process_config}
+        #   so that a stopped->started transition can reconcile against probes that
+        #   were delivered in an earlier poll. nil when called outside the RC
+        #   dispatch path (e.g. unit tests), in which case no reconcile happens.
+        # @return [void]
+        def handle_rc_enablement(enabled, repository = nil)
+          # allow_initialization: false because this runs on the remote-config
+          # thread (a callback context). The default `true` would synchronously
+          # build the entire component tree from the wrong thread if the RC
+          # signal lands before Components#initialize completed.
+          components = Datadog.send(:components, allow_initialization: false)
+          component = components&.dynamic_instrumentation
+          unless component
+            # The component is nil because Component.build returned nil at
+            # startup — a runtime precondition is not met (RC disabled, MRI
+            # required, Ruby 2.6+ required, Rails dev env, C extension absent).
+            # On disable, silently no-op: RC asking us to turn off something we
+            # don't have is fine. On enable, warn with the reason: this is the
+            # implicit-enablement counterpart to the warn-on-explicit message
+            # at build time. The customer who clicked "create probe" in the UI
+            # gets the same visibility a customer who set
+            # DD_DYNAMIC_INSTRUMENTATION_ENABLED would have gotten at boot.
+            if enabled
+              if explicitly_disabled?
+                Datadog.logger.warn(
+                  "di: cannot enable dynamic instrumentation via remote configuration " \
+                  "because DD_DYNAMIC_INSTRUMENTATION_ENABLED is explicitly set to false",
+                )
+              else
+                reason = DI.unsupported_reason
+                Datadog.logger.warn(
+                  "di: cannot enable dynamic instrumentation via remote configuration: " \
+                  "#{reason || "dynamic instrumentation was not initialized at startup"}",
+                )
+              end
+            end
+            return
+          end
+
+          if enabled
+            if explicitly_disabled?
+              Datadog.logger.warn(
+                "di: ignoring implicit enablement signal from remote configuration " \
+                "because DD_DYNAMIC_INSTRUMENTATION_ENABLED is explicitly set to false. " \
+                "To allow remote enablement, unset DD_DYNAMIC_INSTRUMENTATION_ENABLED.",
+              )
+              return
+            end
+            # component is non-nil here only because Component.build's preconditions
+            # passed, which is the same condition under which di/base.rb is loaded
+            # and DI.activate_tracking is defined.
+            DI.activate_tracking
+            was_started = component.started?
+            component.start!
+            # A probe delivered in an earlier poll while the component was stopped
+            # was dropped by #receivers (which ignores changes while !started?) and
+            # never entered the probe repository. RC dispatch only re-delivers a
+            # config when its content hash changes (Core::Remote::Client#apply_config
+            # skips unchanged content), so the probe would otherwise stay dropped
+            # until the customer edits it. On the stopped->started transition,
+            # reconcile against the current LIVE_DEBUGGING contents so it installs now.
+            replay_current_probes(repository, component) if repository && !was_started
+          else
+            component.stop!
+          end
+        rescue => e
+          Datadog.logger.debug { "di: error handling implicit enablement: #{e.class}: #{e.message}" }
+          Datadog.send(:components, allow_initialization: false)&.telemetry&.report(
+            e,
+            description: "Error handling DI implicit enablement",
+          )
+        end
+
+        # Symmetric to {DI::Component.explicitly_enabled?} (see there for why
+        # using_default? rather than options[:enabled].default_precedence?).
+        #
+        # Canonical home for the explicit-disable check: it gates
+        # {DI::Component.build} and the DI block in
+        # {Core::Remote::Client::Capabilities#register}. The latter runs before
+        # DI::Component is loaded, so the check lives here on DI::Remote (always
+        # required by capabilities.rb) rather than on DI::Component. The
+        # `settings` argument lets those startup callers pass the settings being
+        # configured; the RC handler omits it and reads the global config.
+        #
+        # @param settings [Datadog::Core::Configuration::Settings]
+        # @return [Boolean] true when the customer set
+        #   `DD_DYNAMIC_INSTRUMENTATION_ENABLED=false` (or the programmatic
+        #   equivalent), which blocks DI build and RC-driven enablement.
+        def explicitly_disabled?(settings = Datadog.configuration)
+          !settings.dynamic_instrumentation.using_default?(:enabled) &&
+            !settings.dynamic_instrumentation.enabled
         end
 
         def receivers(telemetry)
@@ -32,17 +145,18 @@ module Datadog
             # DEV: Apply this refactor to AppSec as well if implemented.
 
             component = DI.component
-            # We should always have a non-nil DI component here, because we
-            # only add DI product to remote config request if DI is enabled.
-            # Ideally, we should be injected with the DI component here
-            # rather than having to retrieve it from global state.
-            # If the component is nil for some reason, we also don't have a
-            # logger instance to report the issue.
-            if component
+            if component&.started?
               changes.each do |change|
                 case change.type
                 when :insert
-                  add_probe(change.content, component) # steep:ignore NoMethod
+                  # A stopped->started reconcile (#replay_current_probes) may have
+                  # installed this probe earlier in the same dispatch — the enable
+                  # signal is carried by the Tracing receiver, which runs before the
+                  # DI receiver. Skip the redundant install rather than letting
+                  # probe_manager raise AlreadyInstrumented and report a false error.
+                  unless probe_in_content_known?(change.content, component) # steep:ignore NoMethod
+                    add_probe(change.content, component) # steep:ignore NoMethod
+                  end
                 when :update
                   # We do not implement updates at the moment, remove the
                   # probe and reinstall.
@@ -89,7 +203,8 @@ module Datadog
             # message.
             # TODO assert content state (errored for this example)
             content.errored("Error applying dynamic instrumentation configuration: #{exc.class}: #{exc.message}")
-          rescue => exc
+          rescue Exception => exc # standard:disable Lint/RescueException
+            Datadog::DI.reraise_if_fatal(exc)
             raise if component.settings.dynamic_instrumentation.internal.propagate_all_exceptions
 
             component.logger.debug { "di: unhandled exception adding #{probe.type} probe at #{probe.location} (#{probe.id}) in DI remote receiver: #{exc.class}: #{exc.message}" }
@@ -114,7 +229,8 @@ module Datadog
           # try to remove instrumentation that is still supposed to be
           # active.
           #current_probe_ids[probe_spec.fetch('id')] = true
-        rescue => exc
+        rescue Exception => exc # standard:disable Lint/RescueException
+          Datadog::DI.reraise_if_fatal(exc)
           raise if component.settings.dynamic_instrumentation.internal.propagate_all_exceptions
 
           component.logger.debug { "di: unhandled exception handling a probe in DI remote receiver: #{exc.class}: #{exc.message}" }
@@ -124,6 +240,50 @@ module Datadog
           content.errored("Error applying dynamic instrumentation configuration: #{exc.class}: #{exc.message}")
         end
 
+        # Reconciles the DI probe repository against the LIVE_DEBUGGING configs
+        # currently held by the RC repository. Called on the stopped->started
+        # transition to install probes that arrived while DI was stopped: those
+        # were dropped by {.receivers} and RC will not re-dispatch them because
+        # their content hash is unchanged.
+        #
+        # Probes already tracked by the component (installed, pending, or failed)
+        # are skipped, so a probe handled in the same dispatch by {.receivers} is
+        # not added twice.
+        def replay_current_probes(repository, component)
+          repository.contents.each do |content|
+            next unless content.path.product == PRODUCT
+
+            begin
+              probe_id = parse_content(content)["id"]
+            rescue => exc
+              component.logger.debug { "di: skipping unparseable LIVE_DEBUGGING content on enable reconcile: #{exc.class}: #{exc.message}" }
+              next
+            end
+
+            next if probe_id && probe_known?(probe_id, component)
+
+            add_probe(content, component)
+          end
+        end
+
+        def probe_known?(probe_id, component)
+          repo = component.probe_manager.probe_repository
+          !!(repo.find_installed(probe_id) ||
+            repo.find_pending(probe_id) ||
+            repo.find_failed(probe_id))
+        end
+
+        # True when the probe carried by +content+ is already tracked by the
+        # component. Returns false when the id cannot be determined, so add_probe
+        # still runs and reports the parse error through its own handling.
+        def probe_in_content_known?(content, component)
+          probe_id = parse_content(content)["id"]
+          !!(probe_id && probe_known?(probe_id, component))
+        rescue => exc
+          component.logger.debug { "di: could not check probe id for insert dedup: #{exc.class}: #{exc.message}" }
+          false
+        end
+
         # This method does not mark +previous_content+ as succeeded or errored,
         # because that content is from a previous RC response and has already
         # been marked. Removal of probes happens when an RC entry disappears,
@@ -133,7 +293,8 @@ module Datadog
           probe_spec = parse_content(previous_content)
           probe_id = probe_spec.fetch('id')
           component.probe_manager.remove_probe(probe_id)
-        rescue => exc
+        rescue Exception => exc # standard:disable Lint/RescueException
+          Datadog::DI.reraise_if_fatal(exc)
           raise if component.settings.dynamic_instrumentation.internal.propagate_all_exceptions
 
           component.logger.debug { "di: unhandled exception removing probes in DI remote receiver: #{exc.class}: #{exc.message}" }

data/lib/datadog/di/serializer.rb

@@ -44,8 +44,11 @@ module Datadog
     class Serializer
       # Exception classes that should never be caught during serialization.
       # These represent fatal conditions (signals, interrupts, system exit)
-      # that must propagate to the caller.
-      FATAL_EXCEPTION_CLASSES = [SignalException, Interrupt, SystemExit].freeze
+      # that must propagate to the caller. NoMemoryError is deliberately
+      # excluded (unlike DI::FATAL_EXCEPTION_CLASSES): serialization of large
+      # or deeply recursive objects can exhaust memory, and the serializer must
+      # return a safe stub rather than tear the process down.
+      SERIALIZABLE_FATAL_EXCEPTION_CLASSES = [SystemExit, SignalException].freeze
 
       # Third-party library integration / custom serializers.
       #
@@ -177,7 +180,9 @@ module Datadog
             if condition
               begin
                 condition_result = condition.call(value)
-              rescue => e
+              rescue Exception => e # standard:disable Lint/RescueException
+                raise if SERIALIZABLE_FATAL_EXCEPTION_CLASSES.any? { |klass| e.is_a?(klass) }
+
                 # If a custom serializer condition raises an exception (e.g., regex match
                 # against invalid UTF-8), skip it and continue with the next serializer.
                 # We don't want custom serializer conditions to break the entire serialization.
@@ -331,7 +336,7 @@ module Datadog
         rescue Exception => exc # standard:disable Lint/RescueException
           # Re-raise fatal exceptions that should not be caught
           # (signals, interrupts, system exit)
-          raise if FATAL_EXCEPTION_CLASSES.any? { |klass| exc.is_a?(klass) }
+          raise if SERIALIZABLE_FATAL_EXCEPTION_CLASSES.any? { |klass| exc.is_a?(klass) }
 
           # Catch all other exceptions including SystemStackError and NoMemoryError.
           # These inherit from Exception (not StandardError) but can occur during
@@ -429,7 +434,9 @@ module Datadog
           end
           "#<#{class_name(value.class)}#{serialized}>"
         end
-      rescue => exc
+      rescue Exception => exc # standard:disable Lint/RescueException
+        raise if SERIALIZABLE_FATAL_EXCEPTION_CLASSES.any? { |klass| exc.is_a?(klass) }
+
         telemetry&.report(exc, description: "Error serializing for message")
         # TODO class_name(foo) can also fail, which we don't handle here.
         # Telemetry reporting could potentially also fail?

data/lib/datadog/di/transport/input.rb

@@ -7,6 +7,7 @@ require_relative '../../core/transport/parcel'
 require_relative '../../core/transport/request'
 require_relative '../../core/transport/transport'
 require_relative '../error'
+require_relative '../fatal_exceptions'
 require_relative 'http/input'
 
 module Datadog
@@ -77,7 +78,8 @@ module Datadog
                 next
               end
               encoded_snapshots << encoded
-            rescue => exc
+            rescue Exception => exc # standard:disable Lint/RescueException
+              Datadog::DI.reraise_if_fatal(exc)
               # Serialization failed for this snapshot - report via callback
               # This catches JSON::GeneratorError, Encoding errors, TypeError, etc.
               probe_id = snapshot.dig(:debugger, :snapshot, :probe, :id)
@@ -87,7 +89,8 @@ module Datadog
               if probe_id
                 begin
                   on_serialization_error.call(probe_id, exc)
-                rescue => callback_exc
+                rescue Exception => callback_exc # standard:disable Lint/RescueException
+                  Datadog::DI.reraise_if_fatal(callback_exc)
                   logger.debug { "di: error in serialization error callback for probe #{probe_id}: #{callback_exc.class}: #{callback_exc.message}" }
                   telemetry&.report(callback_exc, description: "Error in serialization error callback")
                 end
@@ -109,8 +112,9 @@ module Datadog
               # subsequent chunks are attempted to be sent.
               begin
                 send_input_chunk(chunked_payload, serialized_tags)
-              rescue => exc
-                logger.debug { "di: failed to send snapshot chunk: #{exc.class}: #{exc.message} (at #{exc.backtrace.first})" }
+              rescue Exception => exc # standard:disable Lint/RescueException
+                Datadog::DI.reraise_if_fatal(exc)
+                logger.debug { "di: failed to send snapshot chunk: #{exc.class}: #{exc.message} (at #{exc.backtrace&.first})" }
                 telemetry&.report(exc, description: "Error sending snapshot chunk")
               end
             end