dd-trace 6.19.0 → 6.20.0

package/packages/dd-trace/src/debugger/devtools_client/condition.js

@@ -3,9 +3,14 @@
 module.exports = {
   compile,
   compileSegments,
+  getRedactionError,
+  getSegmentRedactionErrors,
   templateRequiresEvaluation,
 }
 
+const { REDACTED_PLACEHOLDER } = require('../redaction')
+const { isRedactedIdentifier } = require('./snapshot/redaction')
+
 const identifierRegex = /^(@[\w$]+|[a-zA-Z_$][\w$]*)$/
 
 // The following identifiers have purposefully not been included in this list:
@@ -39,6 +44,16 @@ const reservedWords = new Set([
 
 const PRIMITIVE_TYPES = new Set(['string', 'number', 'bigint', 'boolean', 'undefined', 'symbol', 'null'])
 
+// What a dynamic template segment renders as when it references a redacted identifier and is therefore not evaluated.
+const REDACTED_SEGMENT = JSON.stringify(REDACTED_PLACEHOLDER)
+
+/**
+ * @typedef {{ str: string, dsl?: undefined, json?: undefined }} StaticTemplateSegment
+ * @typedef {{ str?: undefined, dsl: string, json: object }} DynamicTemplateSegment
+ * @typedef {StaticTemplateSegment|DynamicTemplateSegment} TemplateSegment
+ * @typedef {{ expr: string, message: string }} EvaluationError
+ */
+
 function templateRequiresEvaluation (segments) {
   if (segments === undefined) return false // There should always be segments, but just in case
   for (const { str } of segments) {
@@ -47,12 +62,29 @@ function templateRequiresEvaluation (segments) {
   return false
 }
 
+/**
+ * @param {TemplateSegment[]} segments - Template segments to compile into a JavaScript array expression.
+ */
 function compileSegments (segments) {
   let result = '['
   for (let i = 0; i < segments.length; i++) {
     const { str, dsl, json } = segments[i]
-    result += str === undefined
-      ? `(() => {
+    result += str === undefined ? compileSegment(dsl, json) : JSON.stringify(str)
+    if (i !== segments.length - 1) {
+      result += ','
+    }
+  }
+  return `${result}]`
+}
+
+/**
+ * @param {string} dsl - The original DSL expression.
+ * @param {object} json - The JSON expression AST.
+ */
+function compileSegment (dsl, json) {
+  if (findRedactedIdentifier(json) !== undefined) return REDACTED_SEGMENT
+
+  return `(() => {
           try {
             const result = ${compile(json)}
             return typeof result === 'string' ? result : $dd_inspectSegment(result)
@@ -60,12 +92,83 @@ function compileSegments (segments) {
             return { expr: ${JSON.stringify(dsl)}, message: \`\${e.name}: \${e.message}\` }
           }
         })()`
-      : JSON.stringify(str)
-    if (i !== segments.length - 1) {
-      result += ','
+}
+
+/**
+ * Get the evaluation errors for the dynamic template segments that are not evaluated because they reference a redacted
+ * identifier. The errors are the same every time the template is evaluated, so they are only computed once.
+ *
+ * @param {TemplateSegment[]} segments - Template segments to inspect.
+ * @returns {EvaluationError[]|undefined} The evaluation errors, if any segment references a redacted identifier.
+ */
+function getSegmentRedactionErrors (segments) {
+  let errors
+  for (const { str, dsl, json } of segments) {
+    if (str !== undefined) continue
+    const error = getRedactionError(dsl, json)
+    if (error !== undefined) {
+      errors ??= []
+      errors.push(error)
     }
   }
-  return `${result}]`
+  return errors
+}
+
+/**
+ * Get the evaluation error to report instead of evaluating an expression, because it reads a redacted identifier.
+ *
+ * @param {string} expr - The expression to report the error for.
+ * @param {object} json - The JSON expression AST.
+ * @returns {EvaluationError|undefined} The evaluation error, if the expression reads a redacted identifier.
+ */
+function getRedactionError (expr, json) {
+  const identifier = findRedactedIdentifier(json)
+  if (identifier === undefined) return
+  return { expr, message: `Could not evaluate the expression because '${identifier}' was redacted` }
+}
+
+/**
+ * Find the first redacted identifier referenced by an expression AST.
+ *
+ * @param {unknown} node - The JSON expression AST node to inspect.
+ * @returns {string|undefined} The redacted identifier, if one is referenced.
+ */
+function findRedactedIdentifier (node) {
+  if (node === null || typeof node !== 'object') return
+
+  // Expression nodes are single-key objects: the key is the operator, and the value is that operator's payload.
+  const [type, value] = Object.entries(node)[0]
+
+  // Root references and member/index keys are the only AST positions that name values being read.
+  if (type === 'ref') {
+    // A non-string `ref` is malformed. Leave it for `compile` to reject with a useful error.
+    return typeof value === 'string' && isRedactedIdentifier(value) ? value : undefined
+  } else if (type === 'getmember' || type === 'index') {
+    const key = findRedactedMemberKey(value[1])
+    if (key !== undefined) return key
+  }
+
+  // Other expression types can wrap redacted reads, e.g. substring(user.password, 0, 4), so walk their children.
+  if (!Array.isArray(value)) return findRedactedIdentifier(value)
+
+  let key
+  for (const child of value) {
+    key = findRedactedIdentifier(child)
+    if (key !== undefined) break
+  }
+  return key
+}
+
+/**
+ * @param {unknown} key - A member/index key expression.
+ * @returns {string|undefined} The redacted identifier, if the key references one.
+ */
+function findRedactedMemberKey (key) {
+  if (typeof key === 'string') {
+    return isRedactedIdentifier(key) ? key : undefined
+  }
+
+  return findRedactedIdentifier(key)
 }
 
 // TODO: Consider storing some of these functions that doesn't require closure access to the current scope on `process`

package/packages/dd-trace/src/debugger/devtools_client/config.js

@@ -27,4 +27,6 @@ function updateConfig (updates) {
   config.url = new URL(updates.url)
   config.dynamicInstrumentation.captureTimeoutNs =
     BigInt(updates.dynamicInstrumentation.DD_DYNAMIC_INSTRUMENTATION_CAPTURE_TIMEOUT_MS) * 1_000_000n
+  config.dynamicInstrumentation.evaluationTimeoutNs =
+    BigInt(updates.dynamicInstrumentation.DD_DYNAMIC_INSTRUMENTATION_EVALUATION_TIMEOUT_MS) * 1_000_000n
 }

package/packages/dd-trace/src/debugger/devtools_client/index.js

@@ -1,11 +1,12 @@
 'use strict'
 
 const { randomUUID } = require('crypto')
-const { parentPort, workerData: { probeSamplerBuffer } } = require('worker_threads')
+const { workerData: { probeSamplerBuffer, pauseDurationBuffer } } = require('worker_threads')
 const { version } = require('../../../../../package.json')
 const processTags = require('../../process-tags')
-const { INSPECT_SEGMENT_GLOBAL_PROPERTY } = require('../constants')
+const { INSPECT_SEGMENT_GLOBAL_PROPERTY, WORKER_ERROR_REASON } = require('../constants')
 const { EVENT_TYPE, INCOMPLETE_REASON } = require('../guardrail-metrics')
+const { PauseDurationHistogram } = require('../pause-duration-histogram')
 const {
   CONDITION_ERROR_FLAG,
   MAX_SAMPLED_PROBES_PER_PAUSE,
@@ -13,7 +14,7 @@ const {
   SAMPLED_PROBE_INDEXES_START,
   SAMPLED_PROBE_OVERFLOW_INDEX,
 } = require('../probe_sampler_constants')
-const { getTakeConditionErrorExpression } = require('./probe_sampler')
+const { getEvaluationTimedOutExpression, getTakeConditionErrorExpression } = require('./probe_sampler')
 const { breakpointToProbes, samplingIndexToProbe } = require('./state')
 const { refreshBreakpoints } = require('./breakpoints')
 const session = require('./session')
@@ -42,6 +43,7 @@ const getDDTagsExpression = `(() => {
 const threadId = config.parentThreadId === 0 ? `pid:${process.pid}` : `pid:${process.pid};tid:${config.parentThreadId}`
 const threadName = config.parentThreadId === 0 ? 'MainThread' : `WorkerThread:${config.parentThreadId}`
 const sampledProbeIndexes = new Int32Array(probeSamplerBuffer)
+const pauseDurations = new PauseDurationHistogram(pauseDurationBuffer)
 
 // WARNING: The code above the line `await session.post('Debugger.resume')` is highly optimized. Please edit with care!
 session.on('Debugger.paused', async ({ params }) => {
@@ -49,7 +51,9 @@ session.on('Debugger.paused', async ({ params }) => {
 
   if (params.reason !== 'other') {
     // This error should not be caught, and should exit the worker thread, effectively stopping the debugging session
-    throw new Error(`Unexpected Debugger.paused reason: ${params.reason}`)
+    throw Object.assign(new Error(`Unexpected Debugger.paused reason: ${params.reason}`), {
+      reason: WORKER_ERROR_REASON.UNEXPECTED_PAUSE_REASON,
+    })
   }
 
   let maxReferenceDepth = 0
@@ -58,6 +62,7 @@ session.on('Debugger.paused', async ({ params }) => {
   let maxLength = 0
   let numberOfProbesWithSnapshots = 0
   let probesWithCaptureExpressions = false
+  let probesWithTemplates = false
   const probes = []
   // Expressions evaluated on the paused frame in one round trip, in the order of `probes`: the evaluated template for
   // probes whose template requires evaluation, and the recorded error for probes paused to report a condition error
@@ -125,6 +130,7 @@ session.on('Debugger.paused', async ({ params }) => {
       }
 
       if (probe.templateRequiresEvaluation) {
+        probesWithTemplates = true
         frameExpressions += `,${probe.template}`
       }
 
@@ -142,6 +148,7 @@ session.on('Debugger.paused', async ({ params }) => {
   const timestamp = Date.now()
 
   let evalResults
+  const evaluationStart = process.hrtime.bigint()
   const { result } = /** @type {EvaluateOnCallFrameResult} */ (
     await session.post('Debugger.evaluateOnCallFrame', {
       callFrameId: params.callFrames[0].callFrameId,
@@ -152,6 +159,10 @@ session.on('Debugger.paused', async ({ params }) => {
       includeCommandLineAPI: true,
     })
   )
+  // The templates of all probes at the location are evaluated together, so an exceeded budget is attributed to all of
+  // them. Evaluation can't be interrupted, so the budget is enforced by reporting and throttling after the fact.
+  const templatesTimedOut = probesWithTemplates &&
+    process.hrtime.bigint() - evaluationStart > config.dynamicInstrumentation.evaluationTimeoutNs
   if (result?.subtype === 'error') {
     log.error('[debugger:devtools_client] Error evaluating code on call frame: %s', result?.description)
     evalResults = []
@@ -180,7 +191,8 @@ session.on('Debugger.paused', async ({ params }) => {
       captureExpressionResults.set(probe.id, await evaluateCaptureExpressions(
         params.callFrames[0],
         probe.compiledCaptureExpressions,
-        start + config.dynamicInstrumentation.captureTimeoutNs
+        start + config.dynamicInstrumentation.captureTimeoutNs,
+        config.dynamicInstrumentation.evaluationTimeoutNs
       ))
     }
   }
@@ -188,6 +200,21 @@ session.on('Debugger.paused', async ({ params }) => {
   await session.post('Debugger.resume')
   reportPauseDuration(start)
 
+  // Ideally these throttles would be installed before resuming so a tight loop could not sample the probe again before
+  // the request is handled. That would keep the application paused for another inspector request even when the probe
+  // does not immediately run again, so we deliberately resume first. If the race occurs, the probe can perform one
+  // additional over-budget evaluation before the throttle takes effect, which is preferable to lengthening every
+  // timeout pause.
+  for (const probe of probes) {
+    // Condition errors are already throttled synchronously by the sampler; preserve that state and its classification.
+    if (conditionErrorProbes?.has(probe)) continue
+    if ((probe.templateRequiresEvaluation && templatesTimedOut) ||
+        captureExpressionResults?.get(probe.id)?.timedOut === true) {
+      // TODO: Batch all timed-out probes into a single Runtime.evaluate request.
+      throttleProbe(probe)
+    }
+  }
+
   const logger = {
     // We can safely use `location.file` from the first probe in the array, since all probes hit by `hitBreakpoints`
     // must exist in the same file since the debugger can only pause the main thread in one location.
@@ -322,6 +349,25 @@ session.on('Debugger.paused', async ({ params }) => {
             message += `{${result.message}}`
           }
         }
+        if (probe.templateRedactionErrors !== undefined) {
+          if (snapshot.evaluationErrors === undefined) {
+            snapshot.evaluationErrors = [...probe.templateRedactionErrors]
+          } else {
+            snapshot.evaluationErrors.push(...probe.templateRedactionErrors)
+          }
+        }
+      }
+      if (templatesTimedOut) {
+        const error = {
+          expr: '',
+          message: 'Template evaluation exceeded its time budget of ' +
+            `${config.dynamicInstrumentation.evaluationTimeoutNs / 1_000_000n}ms`,
+        }
+        if (snapshot.evaluationErrors === undefined) {
+          snapshot.evaluationErrors = [error]
+        } else {
+          snapshot.evaluationErrors.push(error)
+        }
       }
     } else {
       message = probe.template
@@ -358,11 +404,24 @@ session.on('Debugger.paused', async ({ params }) => {
  */
 function reportPauseDuration (start) {
   const durationMs = Number(process.hrtime.bigint() - start) / 1_000_000
-  parentPort.postMessage({ type: 'thread-paused', durationMs })
+  pauseDurations.record(durationMs)
   log.debug('[debugger:devtools_client] Finished processing breakpoints - instrumented thread paused for: ~%d ms',
     durationMs)
 }
 
+/**
+ * Throttle a probe in the runtime sampler because its template or capture expressions exceeded the evaluation time
+ * budget. The result has already been reported, so this only stops the probe from being evaluated again for a while.
+ *
+ * @param {{ id: string }} probe - The probe to throttle.
+ */
+function throttleProbe (probe) {
+  log.debug('[debugger:devtools_client] Evaluation of probe %s exceeded its time budget; throttling probe', probe.id)
+  session.post('Runtime.evaluate', { expression: getEvaluationTimedOutExpression(probe.id) }).catch((err) => {
+    log.error('[debugger:devtools_client] Error throttling probe %s', probe.id, err)
+  })
+}
+
 function processDD (result) {
   return result?.trace_id === undefined ? undefined : result
 }

package/packages/dd-trace/src/debugger/devtools_client/probe_sampler.js

@@ -7,6 +7,7 @@ const SAMPLER_EXPRESSION = `globalThis[Symbol.for(${JSON.stringify(DD_TRACE_SYMB
 
 module.exports = {
   compileBreakpointCondition,
+  getEvaluationTimedOutExpression,
   getRemoveProbeExpression,
   getTakeConditionErrorExpression,
   isSnapshotProducingProbe,
@@ -23,6 +24,16 @@ function isSnapshotProducingProbe (probe) {
   return probe.captureSnapshot === true || probe.compiledCaptureExpressions !== undefined
 }
 
+/**
+ * Build the expression that throttles a probe whose evaluation exceeded its time budget in the worker. Called by the
+ * devtools worker and evaluated on the debuggee.
+ *
+ * @param {string} id - The probe id.
+ */
+function getEvaluationTimedOutExpression (id) {
+  return `${SAMPLER_EXPRESSION}?.evaluationTimedOut(${JSON.stringify(id)})`
+}
+
 /**
  * Build the expression that removes a probe from runtime sampler state. Called by the devtools worker and evaluated on
  * the debuggee.
@@ -85,22 +96,23 @@ function compileBreakpointCondition (probes) {
  * }} probe - The probe to sample.
  */
 function compileProbeCondition (probe) {
-  const sample = `$dd_sampler.makeSampleDecision(${probe.samplingIndex}, ${JSON.stringify(probe.id)}, ` +
-    `${probe.nsBetweenSampling}n, ${isSnapshotProducingProbe(probe)})`
+  const id = JSON.stringify(probe.id)
+  const producesSnapshot = isSnapshotProducingProbe(probe)
+  const samplingArgs = `${probe.nsBetweenSampling}n, ${producesSnapshot}`
 
   if (probe.condition === undefined) {
-    return `$dd_sampled = ${sample} || $dd_sampled`
+    return `$dd_sampled = $dd_sampler.makeSampleDecision(${probe.samplingIndex}, ${id}, ${samplingArgs}) || $dd_sampled`
   }
 
-  // A condition that throws is reported once per throttle window and skipped at probe entry in between
-  return `if ($dd_sampler.shouldEvaluateCondition(${JSON.stringify(probe.id)})) {
+  // The sampler times the condition against the evaluation budget, from `shouldEvaluateCondition` until it either
+  // returns or throws. A condition that throws or exceeds its budget is reported once per throttle window and skipped
+  // at probe entry in between.
+  return `if ($dd_sampler.shouldEvaluateCondition(${id}, ${producesSnapshot})) {
       try {
-        if ((${probe.condition}) === true) {
-          $dd_sampled = ${sample} || $dd_sampled
-        }
+        $dd_sampled = $dd_sampler.conditionEvaluated(${probe.samplingIndex}, ${id}, (${probe.condition}) === true,
+          ${samplingArgs}) || $dd_sampled
       } catch ($dd_error) {
-        $dd_sampled = $dd_sampler.conditionError(${probe.samplingIndex}, ${JSON.stringify(probe.id)}, $dd_error) ||
-          $dd_sampled
+        $dd_sampled = $dd_sampler.conditionError(${probe.samplingIndex}, ${id}, $dd_error) || $dd_sampled
       }
     }`
 }

package/packages/dd-trace/src/debugger/devtools_client/remote_config.js

@@ -1,6 +1,7 @@
 'use strict'
 
 const { workerData: { probePort } } = require('node:worker_threads')
+const { WORKER_ERROR_REASON } = require('../constants')
 const { addBreakpoint, removeBreakpoint, modifyBreakpoint } = require('./breakpoints')
 const { ackReceived, ackInstalled, ackError } = require('./status')
 const log = require('./log')
@@ -54,7 +55,8 @@ probePort.on('message', async ({ action, probe, ackId }) => {
     await processMsg(action, probe)
     probePort.postMessage({ ackId })
   } catch (err) {
-    probePort.postMessage({ ackId, error: err })
+    // Structured cloning an Error drops its custom properties, so send the reason separately.
+    probePort.postMessage({ ackId, error: err, reason: err.reason })
     ackError(err, probe)
   }
 })
@@ -72,18 +74,20 @@ async function processMsg (action, probe) {
   if (action !== 'unapply') ackReceived(probe)
 
   if (probe.type !== 'LOG_PROBE') {
-    throw new Error(`Unsupported probe type: ${probe.type} (id: ${probe.id}, version: ${probe.version})`)
+    throw Object.assign(new Error(
+      `Unsupported probe type: ${probe.type} (id: ${probe.id}, version: ${probe.version})`
+    ), { reason: WORKER_ERROR_REASON.UNSUPPORTED_PROBE_TYPE })
   }
   if (!probe.where.sourceFile && !probe.where.lines) {
-    throw new Error(
+    throw Object.assign(new Error(
       // eslint-disable-next-line @stylistic/max-len
       `Unsupported probe insertion point! Only line-based probes are supported (id: ${probe.id}, version: ${probe.version})`
-    )
+    ), { reason: WORKER_ERROR_REASON.UNSUPPORTED_INSERTION_POINT })
   }
   if (probe.captureSnapshot && probe.captureExpressions?.length > 0) {
-    throw new Error(
+    throw Object.assign(new Error(
       `Cannot set both captureSnapshot and captureExpressions (probe: ${probe.id}, version: ${probe.version})`
-    )
+    ), { reason: WORKER_ERROR_REASON.CONFLICTING_CAPTURE_OPTIONS })
   }
 
   switch (action) {
@@ -99,8 +103,8 @@ async function processMsg (action, probe) {
       ackInstalled(probe)
       break
     default:
-      throw new Error(
+      throw Object.assign(new Error(
         `Cannot process probe ${probe.id} (version: ${probe.version}) - unknown remote configuration action: ${action}`
-      )
+      ), { reason: WORKER_ERROR_REASON.UNKNOWN_REMOTE_CONFIG_ACTION })
   }
 }

package/packages/dd-trace/src/debugger/devtools_client/send.js

@@ -85,6 +85,20 @@ function send (message, logger, dd, snapshot, processTags, eventType, incomplete
       json = JSON.stringify(payload)
     }
     size = Buffer.byteLength(json)
+
+    if (size > MAX_LOG_PAYLOAD_SIZE_BYTES) {
+      // Trimming is best-effort: the pruner can only replace leaf nodes deep inside the snapshot and the fallback only
+      // drops captures, so a payload whose bytes sit elsewhere - a very deep stack, say - can stay over the cap. There
+      // is nothing to gain from sending it: the intake truncates the log message, then throws the snapshot away, and
+      // drops the event anyway if that still doesn't fit.
+      log.debug(
+        '[debugger:devtools_client] Dropping probe result for probe %s: payload is too large (%d bytes)',
+        snapshot.probe.id,
+        size
+      )
+      guardrailMetrics.eventDropped(DROPPED_REASON.PAYLOAD_TOO_LARGE, eventType)
+      return
+    }
   }
 
   if (jsonBuffer.write(json, size)) {

package/packages/dd-trace/src/debugger/devtools_client/snapshot/index.js

@@ -106,6 +106,13 @@ function isCollectable (scope) {
  * @property {CaptureLimits} limits - Fully resolved capture limits (precomputed at probe setup)
  */
 
+/**
+ * @typedef {object} RedactedCaptureExpression
+ * @property {string} name - The name of the expression
+ * @property {{ expr: string, message: string }} redactionError - Reported instead of evaluating the expression, as it
+ *   reads a redacted identifier
+ */
+
 /**
  * @typedef {object} CaptureExpressionResult
  * @property {() => Record<string, ReturnType<typeof processRemoteObject>>} processCaptureExpressions - Callback to
@@ -116,6 +123,7 @@ function isCollectable (scope) {
  * @property {import('./processor').IncompleteCapture} incomplete - The capture limits enforced on the expressions,
  *   including a runtime error for every expression that threw or could not be evaluated. Only fully populated once
  *   `processCaptureExpressions` has run.
+ * @property {boolean} timedOut - Whether evaluating an expression exceeded the evaluation time budget
  */
 
 /**
@@ -130,12 +138,20 @@ function isCollectable (scope) {
  * Collects raw data while paused, returns a callback to process after resume.
  *
  * @param {import('inspector').Debugger.CallFrame} callFrame - The call frame to evaluate expressions on
- * @param {CompiledCaptureExpression[]} expressions - The compiled expressions with precomputed capture limits
+ * @param {(CompiledCaptureExpression|RedactedCaptureExpression)[]} expressions - The compiled expressions with
+ *   precomputed capture limits
  * @param {bigint} [deadlineNs] - The deadline in nanoseconds. Defaults to {@link BIGINT_MAX}. If the deadline is
  *   reached, the snapshot will be truncated.
+ * @param {bigint} [evaluationTimeoutNs] - The time budget in nanoseconds for evaluating a single expression. Defaults
+ *   to {@link BIGINT_MAX}. Evaluation can't be interrupted, so an exceeded budget is reported as an evaluation error.
  * @returns {Promise<CaptureExpressionResult>} Raw results with deferred processing callback
  */
-async function evaluateCaptureExpressions (callFrame, expressions, deadlineNs = BIGINT_MAX) {
+async function evaluateCaptureExpressions (
+  callFrame,
+  expressions,
+  deadlineNs = BIGINT_MAX,
+  evaluationTimeoutNs = BIGINT_MAX
+) {
   /** @type {{ name: string, remoteObject: object, maxLength: number }[]} */
   const rawResults = []
   /** @type {{ expr: string, message: string }[]} */
@@ -146,12 +162,20 @@ async function evaluateCaptureExpressions (callFrame, expressions, deadlineNs =
   const incomplete = { reasons: 0 }
   /** @type {Record<string, ReturnType<typeof processRemoteObject>> | null} */
   let processedResult = null
+  let timedOut = false
 
   for (let i = 0; i < expressions.length; i++) {
-    const { name, expression, limits } = expressions[i]
+    const captureExpression = expressions[i]
+    if ('redactionError' in captureExpression) {
+      evaluationErrors.push(captureExpression.redactionError)
+      continue
+    }
+
+    const { name, expression, limits } = captureExpression
     const { maxReferenceDepth, maxCollectionSize, maxFieldCount, maxLength } = limits
 
     try {
+      const evaluationStart = process.hrtime.bigint()
       const { result, exceptionDetails } = /** @type {EvaluateOnCallFrameResult} */ (
         // eslint-disable-next-line no-await-in-loop
         await session.post('Debugger.evaluateOnCallFrame', {
@@ -159,6 +183,13 @@ async function evaluateCaptureExpressions (callFrame, expressions, deadlineNs =
           expression,
         })
       )
+      if (process.hrtime.bigint() - evaluationStart > evaluationTimeoutNs) {
+        timedOut = true
+        evaluationErrors.push({
+          expr: name,
+          message: `Expression evaluation exceeded its time budget of ${evaluationTimeoutNs / 1_000_000n}ms`,
+        })
+      }
 
       // Handle evaluation exceptions (maybe transient - bad expression, undefined var, etc.)
       if (exceptionDetails) {
@@ -197,10 +228,16 @@ async function evaluateCaptureExpressions (callFrame, expressions, deadlineNs =
           // and are recorded when processed, unless they end up redacted.
           rawResults.push({ name, remoteObject: result, maxLength })
           // Add stub entries for remaining uncaptured expressions. The stubs are used as-is, so record them here.
-          if (i + 1 < expressions.length) incomplete.reasons |= INCOMPLETE_REASON.TIMEOUT
+          // Redacted expressions are never evaluated, so they are reported the same way as without a timeout.
           for (let j = i + 1; j < expressions.length; j++) {
+            const remaining = expressions[j]
+            if ('redactionError' in remaining) {
+              evaluationErrors.push(remaining.redactionError)
+              continue
+            }
+            incomplete.reasons |= INCOMPLETE_REASON.TIMEOUT
             rawResults.push({
-              name: expressions[j].name,
+              name: remaining.name,
               remoteObject: { notCapturedReason: 'timeout' },
               maxLength: 0,
             })
@@ -238,6 +275,7 @@ async function evaluateCaptureExpressions (callFrame, expressions, deadlineNs =
     evaluationErrors,
     fatalErrors,
     incomplete,
+    timedOut,
   }
 }
 

package/packages/dd-trace/src/debugger/devtools_client/snapshot/processor.js

@@ -3,7 +3,7 @@
 const { INCOMPLETE_REASON } = require('../../guardrail-metrics')
 const { LARGE_OBJECT_SKIP_THRESHOLD } = require('./constants')
 const { collectionSizeSym, largeCollectionSkipThresholdSym, fieldCountSym, timeBudgetSym } = require('./symbols')
-const { normalizeName, REDACTED_IDENTIFIERS } = require('./redaction')
+const { isRedactedIdentifier } = require('./redaction')
 
 module.exports = {
   processRawState: processProperties,
@@ -347,21 +347,16 @@ function arrayBufferToString (bytes, size) {
 }
 
 function shouldRedactProperty (prop) {
-  return REDACTED_IDENTIFIERS.has(getNormalizedNameFromProp(prop))
+  return isRedactedIdentifier(prop.name, prop.symbol !== undefined)
 }
 
 function shouldRedactMapValue (key) {
   const isSymbol = key.value.type === 'symbol'
   if (!isSymbol && key.value.type !== 'string') return false // WeakMaps uses objects as keys
-  const name = normalizeName(
+  return isRedactedIdentifier(
     isSymbol ? key.value.description : key.value.value,
     isSymbol
   )
-  return REDACTED_IDENTIFIERS.has(name)
-}
-
-function getNormalizedNameFromProp (prop) {
-  return normalizeName(prop.name, prop.symbol !== undefined)
 }
 
 function setNotCaptureReasonOnCollection (result, collection, incomplete) {