datadog 2.46.0 → 2.47.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 90e55c02331cafb4d96cd0dedf6edb09fc5a6c7f993ffd611d8ca13f12d42cdb
-  data.tar.gz: a99ea41f5975708838075815674c78e47a46ef8368188186d2e20653a8372b19
+  metadata.gz: f4a11a75d5b532014ee82ed0628621a2586ca9b05ab6b00c7136357b7b0a5445
+  data.tar.gz: d51c04201a7f931546374be3adc2c6445e523e98713b60c3e7167398da2dede2
 SHA512:
-  metadata.gz: 4061492c8bba7bf1238b6442d9275bbd7172978ecdbe4d4a92b53f0c67c2ca2d7b20947aaa42247fdc37ccbe81502710b4d69733e420e18fcd1e13d6e27b9864
-  data.tar.gz: 6fe366c5fcb305780a575c830bc77967be48605478071c1d16975242a95cb5c178b81dac776306f5b082b27770140174d29ad0c4dd7df3c9522b4a048883303f
+  metadata.gz: 344ce6f6622f0c6879f598917bab789aef9345a0498d3164b7481df27fdd916b8a4b65b69893fda1527db16ad01da921340441e35a880df4207ae6806966c31a
+  data.tar.gz: 2a77c07e5af10203211755104d3b4e117a70ef64d673d04330769b01a350d2bc8de024b5f7fad2954d95c50a99fa3526c1a473f169653437ad73cb51cea7e542

data/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 ## [Unreleased]
 
+## [2.47.0] - 2026-10-26
+
+### Added
+
+* Tracing: Add quantized request paths to outbound HTTP client resource names, such as `GET /users/*`; enable with `DD_TRACE_HTTP_CLIENT_RESOURCE_NAME_QUANTIZE=true`. ([#6298][])
+* Open Feature: Let evaluations opt out of flag evaluation events, metrics, and span tags with `dd_evaluation_telemetry_opt_out: true` in the evaluation context; enable it with `DD_FEATURE_FLAGS_EVALUATION_TELEMETRY_PER_SUBJECT_OPT_OUT_ENABLED=true`. ([#6486][])
+
+### Changed
+
+* AppSec: Update `libddwaf` to 1.30.0.1.0. ([#6548][])
+
+### Fixed
+
+* Core: Fix forked processes, such as Puma and Unicorn workers, reporting no runtime metrics when the parent process traced before forking. ([#6500][]) ([@dduugg][])
+* Profiling: Fix the "no signals" workaround being enabled when `mysql2` uses MariaDB Connector/C 3.x. ([#6543][])
+* AppSec: Fix ruleset updates with Remote Configuration. ([#6547][])
+* AppSec: Fix duplicate JSON serialization of Rails and Sinatra response objects when application security is enabled. ([#6548][])
+
 ## [2.46.0] - 2026-10-19
 
 ### Added
@@ -3851,7 +3869,8 @@ Release notes: https://github.com/DataDog/dd-trace-rb/releases/tag/v0.3.1
 Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 
 
-[Unreleased]: https://github.com/DataDog/dd-trace-rb/compare/v2.46.0...master
+[Unreleased]: https://github.com/DataDog/dd-trace-rb/compare/v2.47.0...master
+[2.47.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.46.0...v2.47.0
 [2.46.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.45.0...v2.46.0
 [2.45.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.44.0...v2.45.0
 [2.44.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.43.0...v2.44.0
@@ -5694,6 +5713,7 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#6261]: https://github.com/DataDog/dd-trace-rb/issues/6261
 [#6286]: https://github.com/DataDog/dd-trace-rb/issues/6286
 [#6291]: https://github.com/DataDog/dd-trace-rb/issues/6291
+[#6298]: https://github.com/DataDog/dd-trace-rb/issues/6298
 [#6316]: https://github.com/DataDog/dd-trace-rb/issues/6316
 [#6320]: https://github.com/DataDog/dd-trace-rb/issues/6320
 [#6339]: https://github.com/DataDog/dd-trace-rb/issues/6339
@@ -5721,7 +5741,12 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#6474]: https://github.com/DataDog/dd-trace-rb/issues/6474
 [#6481]: https://github.com/DataDog/dd-trace-rb/issues/6481
 [#6485]: https://github.com/DataDog/dd-trace-rb/issues/6485
+[#6486]: https://github.com/DataDog/dd-trace-rb/issues/6486
 [#6488]: https://github.com/DataDog/dd-trace-rb/issues/6488
+[#6500]: https://github.com/DataDog/dd-trace-rb/issues/6500
+[#6543]: https://github.com/DataDog/dd-trace-rb/issues/6543
+[#6547]: https://github.com/DataDog/dd-trace-rb/issues/6547
+[#6548]: https://github.com/DataDog/dd-trace-rb/issues/6548
 [@AdrianLC]: https://github.com/AdrianLC
 [@Azure7111]: https://github.com/Azure7111
 [@BabyGroot]: https://github.com/BabyGroot
@@ -5878,4 +5903,4 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [@y-yagi]: https://github.com/y-yagi
 [@yujideveloper]: https://github.com/yujideveloper
 [@yukimurasawa]: https://github.com/yukimurasawa
-[@zachmccormick]: https://github.com/zachmccormick
+[@zachmccormick]: https://github.com/zachmccormick

data/ext/datadog_profiling_native_extension/collectors_stack.c

@@ -41,7 +41,7 @@ static const char *get_or_compute_native_filename(void *function, st_table *nati
 static void initialize_static_ruby_actual_filename(VALUE profiling_module);
 static void add_truncated_frames_placeholder(ddog_prof_Location *locations);
 static void record_placeholder_stack_in_native_code(VALUE recorder_instance, sample_values values, sample_labels labels);
-static void maybe_trim_template_random_ids(ddog_CharSlice *name_slice, ddog_CharSlice *filename_slice);
+static void maybe_trim_template_random_ids(ddog_CharSlice *frame_name, ddog_CharSlice method_name, ddog_CharSlice filename);
 
 // NULL if we weren't able to get the native filename for the Ruby VM.
 // On a static Ruby without libruby.so, `get_or_compute_native_filename` returns `ruby_native_filename` but
@@ -438,7 +438,7 @@ void sample_thread(
       frame_name = name_slice;
     }
 
-    maybe_trim_template_random_ids(&frame_name, &filename_slice);
+    maybe_trim_template_random_ids(&frame_name, name_slice, filename_slice);
 
     int libdatadog_stores_stacks_flipped_from_rb_profile_frames_index = top_of_stack_position - i;
 
@@ -548,33 +548,50 @@ static const char *get_or_compute_native_filename(void *function, st_table *nati
 //  the extra "_".)
 //
 // This method trims these suffixes, so that we keep less data + the names correctly aggregate together.
-static void maybe_trim_template_random_ids(ddog_CharSlice *name_slice, ddog_CharSlice *filename_slice) {
+//
+// We match on `method_name` because it always ends with the ids, while `frame_name` can have DDTRACE_BLOCK_SUFFIX
+// after them ("Foo#_app_views_articles_index_html_erb__123_456 (block)"); in that case we move the suffix left over
+// the ids. A `frame_name` that is a Ruby String ends with the ids we just matched, so that write only ever lands on
+// a name we composed in the sample's own buffer.
+static void maybe_trim_template_random_ids(ddog_CharSlice *frame_name, ddog_CharSlice method_name, ddog_CharSlice filename) {
   // Check filename doesn't end with ".rb"; templates are usually along the lines of .html.erb/.html.haml/...
-  if (filename_slice->len < 3 || memcmp(filename_slice->ptr + filename_slice->len - 3, ".rb", 3) == 0) return;
+  if (filename.len < 3 || memcmp(filename.ptr + filename.len - 3, ".rb", 3) == 0) return;
 
-  if (name_slice->len > 1024) return;
-  if (name_slice->len == 0) return;
+  if (method_name.len > 1024) return;
+  if (method_name.len == 0) return;
 
-  int pos = ((int) name_slice->len) - 1;
+  int pos = ((int) method_name.len) - 1;
 
   // Let's match on something__number_number:
   // Find start of id suffix from the end...
-  if (name_slice->ptr[pos] < '0' || name_slice->ptr[pos] > '9') return;
+  if (method_name.ptr[pos] < '0' || method_name.ptr[pos] > '9') return;
 
   // ...now match a bunch of numbers and interspersed underscores
   for (int underscores = 0; pos >= 0 && underscores < 2; pos--) {
-    if (name_slice->ptr[pos] == '_') underscores++;
-    else if (name_slice->ptr[pos] < '0' || name_slice->ptr[pos] > '9') return;
+    if (method_name.ptr[pos] == '_') underscores++;
+    else if (method_name.ptr[pos] < '0' || method_name.ptr[pos] > '9') return;
   }
 
   // Make sure there's something left before the underscores (hence the <= instead of <) + match the last underscore
-  if (pos <= 0 || name_slice->ptr[pos] != '_') return;
+  if (pos <= 0 || method_name.ptr[pos] != '_') return;
 
   // Does it have the optional third underscore? If so, remove it as well
-  if (pos > 1 && name_slice->ptr[pos-1] == '_') pos--;
+  if (pos > 1 && method_name.ptr[pos-1] == '_') pos--;
+
+  // If we got here, we matched on our pattern. Let's remove the ids from the end of the frame name.
+  size_t random_ids_len = method_name.len - pos;
+
+  static const char block_suffix[] = DDTRACE_BLOCK_SUFFIX;
+  size_t block_suffix_len = sizeof(block_suffix) - 1;
+
+  if (
+    frame_name->len >= random_ids_len + block_suffix_len &&
+    memcmp(frame_name->ptr + frame_name->len - block_suffix_len, block_suffix, block_suffix_len) == 0
+  ) {
+    memcpy((char *) frame_name->ptr + frame_name->len - block_suffix_len - random_ids_len, block_suffix, block_suffix_len);
+  }
 
-  // If we got here, we matched on our pattern. Let's slice the length of the string to exclude it.
-  name_slice->len = pos;
+  frame_name->len -= random_ids_len;
 }
 
 static void add_truncated_frames_placeholder(ddog_prof_Location *locations) {

data/ext/datadog_profiling_native_extension/private_vm_api_access.c

@@ -1136,7 +1136,7 @@ static ssize_t calculate_iseq_label(VALUE owner, const rb_iseq_t *iseq, char *bu
       // We use "Foo#bar (block)" because it's much faster and looks better in the UI.
       const rb_iseq_t* method_iseq = ISEQ_BODY(iseq)->local_iseq;
 
-      static const char suffix[] = " (block)";
+      static const char suffix[] = DDTRACE_BLOCK_SUFFIX;
       size_t suffix_len = sizeof(suffix) - 1;
 
       // Only use the result if there is enough space for both parts

data/ext/datadog_profiling_native_extension/private_vm_api_access.h

@@ -102,6 +102,9 @@ VALUE ddtrace_alloc_free_rb_mod_name(VALUE mod);
 // if the module does not have a permanent name (e.g. `#<Module:0x0123>::Foo`).
 VALUE ddtrace_permanent_mod_name(VALUE mod);
 
+// Suffix ddtrace_location_label() adds to blocks, e.g. "Foo#bar (block)"
+#define DDTRACE_BLOCK_SUFFIX " (block)"
+
 ssize_t ddtrace_location_label(const rb_callable_method_entry_t *cme, const rb_iseq_t *iseq, char *buf, size_t buf_size);
 VALUE ddtrace_location_base_label(const rb_callable_method_entry_t *cme, const rb_iseq_t *iseq);
 void* ddtrace_cme_cfunc_func(const rb_callable_method_entry_t *cme);

data/ext/libdatadog_extconf_helpers.rb

@@ -11,7 +11,7 @@ module Datadog
   module LibdatadogExtconfHelpers
     # Used to make sure the correct gem version gets loaded, as extconf.rb does not get run with "bundle exec" and thus
     # may see multiple libdatadog versions. See https://github.com/DataDog/dd-trace-rb/pull/2531 for the horror story.
-    LIBDATADOG_VERSION = "~> 46.0.0.1.1"
+    LIBDATADOG_VERSION = "~> 46.1.0.1.1"
 
     # Used as an workaround for a limitation with how dynamic linking works in environments where the datadog gem and
     # libdatadog are moved after the extension gets compiled.

data/lib/datadog/appsec/contrib/rails/gateway/watcher.rb

@@ -66,10 +66,23 @@ module Datadog
                 gateway.watch("rails.response.body.json") do |stack, container|
                   context = container.context
 
+                  body_bytesize = container.data.bytesize
+                  limit = Datadog.configuration.appsec.body_parsing_size_limit
+
                   persistent_data = {
-                    "server.response.body" => container.data,
+                    "server.response.body.byte_length" => body_bytesize,
                   }
-                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if limit > 0 && body_bytesize <= limit
+                    json = extract_json(container.data)
+                    persistent_data["server.response.body"] = WAF::JSONString.new(json) if json
+                  end
+
+                  result = begin
+                    context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+                  rescue WAF::ConversionError
+                    next stack.call(container)
+                  end
 
                   if result.match?
                     context.events.push(
@@ -85,6 +98,20 @@ module Datadog
                   stack.call(container)
                 end
               end
+
+              private
+
+              def extract_json(body)
+                return body unless body.start_with?("/**/")
+                return unless body.end_with?(")")
+
+                # NOTE: Best-effort support for standard Rails JSONP callbacks.
+                #       Callback expressions with parentheses may prevent extraction
+                opening_parenthesis_index = body.b.index("(")
+                return unless opening_parenthesis_index
+
+                body.byteslice(opening_parenthesis_index + 1, body.bytesize - opening_parenthesis_index - 2) #: String
+              end
             end
           end
         end

data/lib/datadog/appsec/contrib/rails/patches/render_to_body_patch.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require_relative "../../../utils/hash_coercion"
 require_relative "../../../instrumentation/gateway/argument"
 
 module Datadog
@@ -8,8 +7,8 @@ module Datadog
     module Contrib
       module Rails
         module Patches
-          # A patch targeting `AbstractController::Rendering#render_to_body`
-          # method to capture JSON response body right before it is serialized.
+          # A patch for `AbstractController::Rendering#render_to_body` that captures
+          # the serialized JSON response body for AppSec inspection
           module RenderToBodyPatch
             def render_to_body(options = {})
               return super unless options.key?(:json)
@@ -17,13 +16,15 @@ module Datadog
               context = request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
               return super unless context
 
-              data = Utils::HashCoercion.coerce(options[:json])
-              return super unless data
+              # NOTE: Custom renderers can return streaming bodies, which we
+              #       currently do not inspect
+              body = super
+              return body unless body.is_a?(String)
 
-              container = Instrumentation::Gateway::DataContainer.new(data, context: context)
+              container = Instrumentation::Gateway::DataContainer.new(body, context: context)
               Instrumentation.gateway.push("rails.response.body.json", container)
 
-              super
+              body
             end
           end
         end

data/lib/datadog/appsec/contrib/sinatra/gateway/watcher.rb

@@ -101,10 +101,22 @@ module Datadog
                 gateway.watch("sinatra.response.body.json") do |stack, container|
                   context = container.context # : Context
 
+                  body_bytesize = container.data.bytesize
+                  limit = Datadog.configuration.appsec.body_parsing_size_limit
+
                   persistent_data = {
-                    "server.response.body" => container.data,
+                    "server.response.body.byte_length" => body_bytesize,
                   }
-                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if limit > 0 && body_bytesize <= limit
+                    persistent_data["server.response.body"] = WAF::JSONString.new(container.data)
+                  end
+
+                  result = begin
+                    context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+                  rescue WAF::ConversionError
+                    next stack.call(container)
+                  end
 
                   if result.match?
                     context.events.push(

data/lib/datadog/appsec/contrib/sinatra/patches/json_patch.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require_relative "../../../utils/hash_coercion"
 require_relative "../../../instrumentation/gateway/argument"
 
 module Datadog
@@ -8,20 +7,22 @@ module Datadog
     module Contrib
       module Sinatra
         module Patches
-          # A patch targeting `Sinatra::JSON#json` method to capture JSON response
-          # body right before it is serialized.
+          # A patch for `Sinatra::JSON#json` that captures the serialized
+          # response body for AppSec inspection
           module JsonPatch
             def json(object, options = {})
               context = @request.env[Datadog::AppSec::Ext::CONTEXT_KEY] # : Context?
               return super unless context
 
-              data = Utils::HashCoercion.coerce(object)
-              return super unless data
+              # NOTE: Custom renderers can return streaming bodies, which we
+              #       currently do not inspect
+              body = super
+              return body unless body.is_a?(String)
 
-              container = Instrumentation::Gateway::DataContainer.new(data, context: context)
+              container = Instrumentation::Gateway::DataContainer.new(body, context: context)
               Instrumentation.gateway.push("sinatra.response.body.json", container)
 
-              super
+              body
             end
           end
         end

data/lib/datadog/appsec/security_engine/engine.rb

@@ -71,7 +71,8 @@ module Datadog
           if is_ruleset_update &&
               (diagnostics.key?("error") ||
               diagnostics.dig("rules", "error") ||
-              diagnostics.dig("processors", "errors"))
+              diagnostics.dig("processors", "error"))
+            @waf_builder.remove_config_at_path(path)
             diagnostics = load_default_config(telemetry: AppSec.telemetry)
             @reconfigured_ruleset_version = diagnostics["ruleset_version"]
             report_configuration_diagnostics(diagnostics, action: "update", telemetry: AppSec.telemetry)

data/lib/datadog/core/configuration/components.rb

@@ -55,7 +55,7 @@ module Datadog
           # extension, remote config off, non-MRI). Under the always-build model
           # it is non-nil even when the DI setting defaults to off, so a built
           # SymbolDatabase component is inert until an upload is actually
-          # permitted: the component's own gate (see Component#upload_allowed?)
+          # permitted: the component's own gate, SymbolDatabase::Component#upload_allowed?,
           # only extracts and uploads when DI is truly active or the customer
           # opted in explicitly. This mirrors DI advertising/building a component
           # by default while installing no probes until it is enabled.
@@ -288,12 +288,20 @@ module Datadog
             end
           end
 
+          if dynamic_instrumentation && old_state
+            dynamic_instrumentation.record_rc_enablement_signal_paths(old_state.rc_enablement_signal_paths)
+          end
+
           if remote && old_state&.remote_started?
             # The library was reconfigured and previously it already started
             # the remote component (i.e., it received at least one request
             # through the installed Rack middleware which started the remote).
             # If the new configuration also has remote enabled, start the
             # new remote right away.
+            #
+            # The DI signal-path restore above must precede this: the
+            # replacement client's first sync can dispatch the APM_TRACING
+            # merge, whose withdrawal branch reads the recorded paths.
             remote.start
           end
 
@@ -405,19 +413,12 @@ module Datadog
           # di_implicitly_enabled distinguishes RC-driven start from explicit
           # start (env var or programmatic) so that an explicit
           # `enabled = false` on reconfiguration can take effect.
-          #
-          # using_default? — not `!enabled` — because Datadog.configure has
-          # already mutated the singleton settings by the time #state runs,
-          # so `!enabled` would treat a customer's explicit
-          # `enabled = false` as "implicitly enabled" and restart DI.
-          # using_default? asks "did the customer ever touch this setting",
-          # which is the right question for RC carry-over.
-          di_implicit = dynamic_instrumentation&.started? &&
-            @settings.dynamic_instrumentation.using_default?(:enabled)
+          di_implicit = dynamic_instrumentation&.implicitly_enabled?
           ComponentsState.new(
             telemetry_enabled: telemetry.enabled,
             remote_started: remote&.started?,
             di_implicitly_enabled: di_implicit || false,
+            rc_enablement_signal_paths: dynamic_instrumentation&.rc_enablement_signal_paths || [],
           )
         end
 

data/lib/datadog/core/configuration/components_state.rb

@@ -5,10 +5,12 @@ module Datadog
     module Configuration
       # Stores the state of component tree when replacing the tree.
       class ComponentsState
-        def initialize(telemetry_enabled:, remote_started:, di_implicitly_enabled: false)
+        def initialize(telemetry_enabled:, remote_started:, di_implicitly_enabled: false,
+          rc_enablement_signal_paths: [])
           @telemetry_enabled = !!telemetry_enabled
           @remote_started = !!remote_started
           @di_implicitly_enabled = !!di_implicitly_enabled
+          @rc_enablement_signal_paths = rc_enablement_signal_paths || []
         end
 
         def telemetry_enabled?
@@ -22,6 +24,11 @@ module Datadog
         def di_implicitly_enabled?
           @di_implicitly_enabled
         end
+
+        # The RC enable-signal carrier paths recorded by the replaced tree's DI component.
+        #
+        # @return [Array<Core::Remote::Configuration::Path>]
+        attr_reader :rc_enablement_signal_paths
       end
     end
   end

data/lib/datadog/core/configuration/supported_configurations.rb

@@ -72,6 +72,7 @@ module Datadog
           "DD_FEATURE_FLAGS_CONFIGURATION_SOURCE_AGENTLESS_POLL_INTERVAL_SECONDS",
           "DD_FEATURE_FLAGS_CONFIGURATION_SOURCE_AGENTLESS_REQUEST_TIMEOUT_SECONDS",
           "DD_FEATURE_FLAGS_ENABLED",
+          "DD_FEATURE_FLAGS_EVALUATION_TELEMETRY_PER_SUBJECT_OPT_OUT_ENABLED",
           "DD_FLAGGING_EVALUATION_COUNTS_ENABLED",
           "DD_GIT_COMMIT_SHA",
           "DD_GIT_REPOSITORY_URL",
@@ -242,6 +243,7 @@ module Datadog
           "DD_TRACE_HTTP_ANALYTICS_ENABLED",
           "DD_TRACE_HTTP_ANALYTICS_SAMPLE_RATE",
           "DD_TRACE_HTTP_CLIENT_ERROR_STATUSES",
+          "DD_TRACE_HTTP_CLIENT_RESOURCE_NAME_QUANTIZE",
           "DD_TRACE_HTTP_DISTRIBUTED_TRACING",
           "DD_TRACE_HTTP_ENABLED",
           "DD_TRACE_HTTP_ERROR_STATUS_CODES",

data/lib/datadog/core/remote/client.rb

@@ -16,6 +16,12 @@ module Datadog
 
         attr_reader :transport, :repository, :id, :dispatcher, :settings, :logger
 
+        # Whether the initial reconcile is still pending, to run on the first
+        # sync whose response contains targets.
+        #
+        # @return [Boolean]
+        attr_reader :pending_initial_reconcile
+
         def initialize(transport, capabilities, settings:, logger:, repository: Configuration::Repository.new)
           @transport = transport
           @settings = settings
@@ -25,27 +31,52 @@ module Datadog
           @id = SecureRandom.uuid
           @capabilities = capabilities
           @dispatcher = Dispatcher.new(@capabilities.receivers)
+          @pending_initial_reconcile = true
         end
 
+        # Polls the agent for remote configuration, applies the response to
+        # the repository and dispatches the resulting changes to the receivers.
+        #
+        # The agent sends an empty response when it holds no targets newer
+        # than the targets version the client reported. Until the client
+        # applies a response that carries targets, it reports the initial
+        # targets version, so an empty response then means the agent has not
+        # received targets from the backend. The initial reconcile therefore
+        # waits for a response that carries targets.
+        #
+        # @return [void]
+        # @raise [TransportError] when the agent reports an internal error
+        # @raise [SyncError] when the response cannot be applied to the repository
         def sync
           # TODO: Skip sync if no capabilities are registered
           response = transport.send_config(payload)
 
           if response.ok?
-            process_response(response)
+            changes = process_response(response)
+            if pending_initial_reconcile && !response.empty?
+              dispatcher.reconcile(changes, repository)
+              @pending_initial_reconcile = false
+            end
           elsif response.internal_error?
             raise TransportError, response.to_s
           end
+          nil
         end
 
         private
 
+        # Applies an OK response to the repository and returns the resulting
+        # change set, which is empty when the response is empty.
+        #
+        # @param response [Transport::Config::Response] the response returned by the agent
+        # @return [Configuration::Repository::ChangeSet] the changes applied by this response
+        # @raise [SyncError] when the response cannot be applied to the repository
         def process_response(response)
           # when response is completely empty, do nothing as in: leave as is
           if response.empty?
             logger.debug { "remote: empty response => NOOP" }
 
-            return
+            return Configuration::Repository::ChangeSet.new
           end
 
           begin
@@ -61,7 +92,7 @@ module Datadog
           end
 
           # To make sure steep does not complain
-          return unless paths && targets && contents
+          return Configuration::Repository::ChangeSet.new unless paths && targets && contents
 
           # TODO: sometimes it can strangely be so that paths.empty?
           # TODO: sometimes it can strangely be so that targets.empty?
@@ -69,6 +100,14 @@ module Datadog
           apply_config(paths, targets, contents)
         end
 
+        # Applies the response to the repository in a transaction, dispatches the
+        # resulting changes to the receivers and returns them.
+        #
+        # @param paths [Array<Configuration::Path>] ingress paths from the response
+        # @param targets [Configuration::TargetMap] targets keyed by path
+        # @param contents [Configuration::ContentList] contents from the response
+        # @return [Configuration::Repository::ChangeSet] the changes applied by the transaction
+        # @raise [SyncError] when a path has no matching target or content
         def apply_config(paths, targets, contents)
           changes = repository.transaction do |current, transaction|
             # paths to be removed: previously applied paths minus ingress paths
@@ -121,6 +160,8 @@ module Datadog
           else
             dispatcher.dispatch(changes, repository)
           end
+
+          changes
         end
 
         def payload # standard:disable Metrics/MethodLength

data/lib/datadog/core/remote/dispatcher.rb

@@ -23,16 +23,39 @@ module Datadog
 
         def dispatch(changes, repository)
           receivers.each do |receiver|
-            matching_changes = changes.select { |c| receiver.match?(c.path) }
+            matching = matching_changes(changes, receiver)
 
-            receiver.call(repository, matching_changes) if matching_changes.any?
+            receiver.call(repository, matching) if matching.any?
           end
+          nil
+        end
+
+        # Calls each receiver that declares initial-reconcile participation and has no
+        # matching change in `changes`, passing an empty change list.
+        def reconcile(changes, repository)
+          receivers.each do |receiver|
+            next unless receiver.initial_reconcile?
+
+            receiver.call(repository, []) unless any_matching?(changes, receiver)
+          end
+          nil
+        end
+
+        private
+
+        def matching_changes(changes, receiver)
+          changes.select { |change| receiver.match?(change.path) }
+        end
+
+        def any_matching?(changes, receiver)
+          changes.any? { |change| receiver.match?(change.path) }
         end
 
         # Store Matcher and block to be executed on a match
         class Receiver
-          def initialize(matcher, &block)
+          def initialize(matcher, initial_reconcile: false, &block)
             @block = block
+            @initial_reconcile = initial_reconcile
             @matcher = matcher
           end
 
@@ -40,6 +63,14 @@ module Datadog
             @matcher.match?(path)
           end
 
+          # Whether #reconcile may call this receiver with an empty change
+          # list on the client's first sync. A participating receiver must
+          # act on the repository's current contents when the change list is
+          # empty.
+          def initial_reconcile?
+            @initial_reconcile
+          end
+
           def call(repository, changes)
             @block.call(repository, changes)
           end

data/lib/datadog/core/workers/runtime_metrics.rb

@@ -32,7 +32,7 @@ module Datadog
           end
 
           # Workers::Async::Thread settings
-          self.fork_policy = options.fetch(:fork_policy, Workers::Async::Thread::FORK_POLICY_STOP)
+          self.fork_policy = options.fetch(:fork_policy, Workers::Async::Thread::FORK_POLICY_RESTART)
 
           # Workers::IntervalLoop settings
           self.loop_base_interval = options.fetch(:interval, DEFAULT_FLUSH_INTERVAL)

data/lib/datadog/di/capture_expression_evaluator.rb

@@ -59,7 +59,7 @@ module Datadog
         probe.capture_expressions.each do |capture_expression|
           name = capture_expression.name
 
-          if Core::Utils::Time.get_time >= deadline
+          if Process.clock_gettime(Process::CLOCK_THREAD_CPUTIME_ID, :float_second) >= deadline
             output[name] = {notCapturedReason: "timeout"}
             telemetry&.inc(DI::TELEMETRY_NAMESPACE, "capture_expressions_skipped_by_timeout", 1)
             guardrails_telemetry.skipped(