Skip to content

fix(debugger): rebuild breakpoint condition when a probe stops capturing - #10159

Draft
watson wants to merge 1 commit into
watson/DEBUG-6081/guardrail-metricsfrom
watson/DEBUG-6081/refresh-breakpoint-on-capture-disabled
Draft

fix(debugger): rebuild breakpoint condition when a probe stops capturing#10159
watson wants to merge 1 commit into
watson/DEBUG-6081/guardrail-metricsfrom
watson/DEBUG-6081/refresh-breakpoint-on-capture-disabled

Conversation

@watson

@watson watson commented Sep 4, 2026

Copy link
Copy Markdown
Collaborator

What does this PR do?

Adds refreshBreakpoint(probe) to the breakpoints module, which replaces the breakpoint at a probe's location with one compiled from the current state of the probes attached to it, and calls it from the pause handler once a fatal capture error has permanently disabled snapshots or capture expressions for a probe.

Motivation

The breakpoint condition compiled for a location bakes in whether each probe produces snapshots. The sampler uses that flag to decide if a hit counts against the global snapshot rate limit and, since #10152, to classify a skipped hit as a snapshot or a log event. When the pause handler disabled capture for a probe the condition was never rebuilt, so such a probe kept eating into the global snapshot budget and its skipped hits kept being reported as snapshots, although every event it emitted from then on was a capture-less log event.

Additional Notes

The refresh runs after the main thread has been resumed and the results have been handed to the sender, under the same lock as the other breakpoint operations, and is a no-op for a probe that was removed in the meantime. All probes at a location share the breakpoint, so one refresh covers every probe disabled during the same pause.

The end-to-end test uses the large object safety threshold to trip the fatal error deterministically and checks that the following rate-limited hit is reported as events.skipped{event_type:log}; it fails without the fix (event_type:snapshot).

@datadog-prod-us1-6

datadog-prod-us1-6 Bot commented Sep 4, 2026

Copy link
Copy Markdown

Pipelines  Tests

⚠️ Warnings

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 15 Pipeline jobs failed

AppSec | AppSec / macos — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

TypeError: Cannot read properties of undefined (reading 'enabled') at /Users/runner/work/dd-trace-js/dd-trace-js/node_modules/mocha/lib/runner.js:959:12

AppSec | AppSec / ubuntu (node-active) — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

TypeError: Cannot read properties of undefined (reading 'enabled') at /home/runner/work/dd-trace-js/dd-trace-js/node_modules/mocha/lib/runner.js:959:12

AppSec | AppSec / ubuntu (node-latest) — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

TypeError: Cannot read properties of undefined (reading 'enabled') at /home/runner/work/dd-trace-js/dd-trace-js/node_modules/mocha/lib/runner.js:959:12

View all 15 failed jobs.

📋 Copy fix prompt
CI on my pull request is failing. Help me find and fix the root cause of each failing job below — they were flagged as caused by changes in this PR, so focus on the diff. For each job, explain the failure and propose a fix.

Before you start, set up the Datadog software-delivery tooling so you can
query the CI data yourself:

1. Check whether you already have the Datadog software-delivery MCP tools
   (e.g. a `search_datadog_ci_pipeline_events` tool) and the `unblock-pr` skill.
2. If either is missing, STOP and ask me for permission before installing
   anything. Do not install or run anything until I have said yes.
3. Only with my explicit approval, set up the Datadog software-delivery MCP
   server and skills by following:
     https://docs.datadoghq.com/getting_started/software_delivery_mcp_tools/
   then restart so the skill is picked up.
4. If I decline, skip all of the above and work from the context below alone.

Then run /unblock-pr — it will pull the CI data itself. The job context below is what we already know.

If /unblock-pr is not available — because I declined the setup above, or it did not install — work from the context below instead.

Datadog has already classified this failure as caused by changes in this PR.
Take that as given and work the fix:

1. Locate the change. Diff this branch against its base and find the change
   that produces this error. Explain the mechanism, don't just name a file:
     git fetch origin && git diff $(git merge-base origin/watson/DEBUG-6081/guardrail-metrics HEAD)...HEAD
2. Reproduce it locally. Run the failing job's command or test before
   proposing anything.
3. Propose the smallest fix that addresses the root cause — not a workaround,
   not a broadened assertion, not a disabled or skipped test.
4. Re-run the same command to confirm, and say exactly what you ran.
5. If the failure turns out to be intermittent rather than deterministic, say
   so plainly instead of "fixing" it — that is a flaky test, and patching it
   hides the problem.

If the right move is to re-run the job rather than change code, use the job
link in the context below. For GitHub Actions: `gh run rerun <run-id> --failed`,
where the run ID is the number after `/runs/` in that URL (not the trailing
number, which is the job ID).

Branch: watson/DEBUG-6081/refresh-breakpoint-on-capture-disabled

AppSec | AppSec / macos
Commit: 243cea9314e6d13205319fbeeef18266074d6677
Error (code / test):
TypeError: Cannot read properties of undefined (reading 'enabled') at /Users/runner/work/dd-trace-js/dd-trace-js/node_modules/mocha/lib/runner.js:959:12
CI job: https://github.com/DataDog/dd-trace-js/actions/runs/34023643845/job/101461398387

AppSec | AppSec / ubuntu (node-active)
Commit: 243cea9314e6d13205319fbeeef18266074d6677
Error (code / test):
TypeError: Cannot read properties of undefined (reading 'enabled') at /home/runner/work/dd-trace-js/dd-trace-js/node_modules/mocha/lib/runner.js:959:12
CI job: https://github.com/DataDog/dd-trace-js/actions/runs/34023643845/job/101461398299

AppSec | AppSec / ubuntu (node-latest)
Commit: 243cea9314e6d13205319fbeeef18266074d6677
Error (code / test):
TypeError: Cannot read properties of undefined (reading 'enabled') at /home/runner/work/dd-trace-js/dd-trace-js/node_modules/mocha/lib/runner.js:959:12
CI job: https://github.com/DataDog/dd-trace-js/actions/runs/34023643845/job/101461398336

Plus 3 more failing jobs not shown here.

🧪 3 Tests failed in 1 job

LLMObs | claude-agent-sdk — ❌ 3 tests failed

View more details · View in GitHub Actions

❌ Plugin claude-agent-sdk with @anthropic-ai/claude-agent-sdk >=0.2.113 (0.3.259) instruments a full agentic call with subagents from with @anthropic-ai/claude-agent-sdk >=0.2.113 (0.3.259)   View in Datadog
Claude Code returned an error result: Failed to authenticate. API Error: 401 �@������tu���8����~��QA@��]����D�\���\`,��$1��6a��ԉ��hp�x�.L��7S�(E�4ɤ�,/�C�*_�w�F&amp;m&gt;�����\���0�a߶g��y�C�DZJ&gt;���

Error: Claude Code returned an error result: Failed to authenticate. API Error: 401 �@������tu���8����~��QA@��]����D�\���\`,��$1��6a��ԉ��hp�x�.L��7S�(E�4ɤ�,/�C�*_�w�F&amp;m&gt;�����\���0�a߶g��y�C�DZJ&gt;���
    at Gy.readMessages (file:///home/runner/work/dd-trace-js/dd-trace-js/versions/@anthropic-ai/claude-agent-sdk@0/node_modules/@anthropic-ai/claude-agent-sdk/sdk.mjs:41643:20)
    at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
❌ esm with @anthropic-ai/claude-agent-sdk >=0.2.113 (0.3.259) is instrumented named from with @anthropic-ai/claude-agent-sdk >=0.2.113 (0.3.259)   View in Datadog
Process exited with status code 1.

Error: Process exited with status code 1.
    at ChildProcess.&lt;anonymous&gt; (integration-tests/helpers/index.js:266:25)
    at Object.onceWrapper (node:events:631:26)
    at ChildProcess.emit (node:events:509:28)
    at ChildProcess._handle.onexit (node:internal/child_process:295:12)
❌ esm with @anthropic-ai/claude-agent-sdk >=0.2.113 (0.3.259) is instrumented named-from-namespace from with @anthropic-ai/claude-agent-sdk >=0.2.113 (0.3.259)   View in Datadog
Process exited with status code 1.

Error: Process exited with status code 1.
    at ChildProcess.&lt;anonymous&gt; (integration-tests/helpers/index.js:266:25)
    at Object.onceWrapper (node:events:631:26)
    at ChildProcess.emit (node:events:509:28)
    at ChildProcess._handle.onexit (node:internal/child_process:295:12)

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

🎯 Code Coverage (details)
Patch Coverage: 100.00%
Overall Coverage: 74.86% (-11.02%)

Useful? React with 👍 / 👎

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 3c4c33e | Docs | View more details | Give us feedback!

@dd-octo-sts

dd-octo-sts Bot commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

Overall package size

Self size: 8.85 MB
Deduped: 9.51 MB
No deduping: 9.51 MB

Dependency sizes | name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.4.0 | 127.33 kB | 447.04 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |

🤖 This report was automatically generated by heaviest-objects-in-the-universe

@codecov

codecov Bot commented Sep 4, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.88%. Comparing base (727ac7c) to head (3c4c33e).

❗ There is a different number of reports uploaded between BASE (727ac7c) and HEAD (3c4c33e). Click for more details.

HEAD has 4 uploads less than BASE
Flag BASE (727ac7c) HEAD (3c4c33e)
master-coverage 11 9
apm-integrations 1 0
appsec 1 0
Additional details and impacted files
@@                           Coverage Diff                            @@
##           watson/DEBUG-6081/guardrail-metrics   #10159       +/-   ##
========================================================================
- Coverage                                85.90%   74.88%   -11.02%     
========================================================================
  Files                                      997      992        -5     
  Lines                                   153048   152771      -277     
  Branches                                    74       59       -15     
========================================================================
- Hits                                    131474   114404    -17070     
- Misses                                   21574    38367    +16793     
Flag Coverage Δ
ai-guard 65.00% <ø> (ø)
apm-capabilities 63.11% <ø> (ø)
apm-integrations ?
appsec ?
debugger 70.13% <100.00%> (+0.03%) ⬆️
instrumentation 53.72% <ø> (-0.01%) ⬇️
llmobs 78.15% <ø> (-0.85%) ⬇️
master-coverage 74.88% <100.00%> (-11.02%) ⬇️
openfeature 66.38% <ø> (ø)
platform 69.31% <ø> (ø)
profiling 66.75% <ø> (ø)
serverless 65.71% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@watson
watson force-pushed the watson/DEBUG-6081/refresh-breakpoint-on-capture-disabled branch from 8eee38a to 5f64639 Compare September 4, 2026 10:24
@pr-commenter

pr-commenter Bot commented Sep 4, 2026

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2026-09-06 09:22:52

Comparing candidate commit 3c4c33e in PR branch watson/DEBUG-6081/refresh-breakpoint-on-capture-disabled with baseline commit 727ac7c in branch watson/DEBUG-6081/guardrail-metrics.

📊 Benchmarking dashboard

Found 0 performance improvements and 0 performance regressions! Performance is the same for 2304 metrics, 9 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

  • 🟩 = significantly better candidate vs. baseline
  • 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

Unstable benchmarks

These benchmarks have a confidence interval too wide to call a change; treat them as noise rather than signal.

scenario:appsec-appsec-enabled-24

  • unstable max_rss_usage [-25.055MB; +8.700MB] or [-8.819%; +3.063%]

scenario:appsec-iast-with-vulnerability-iast-enabled-default-config-20

  • unstable max_rss_usage [-32.622MB; +36.739MB] or [-9.426%; +10.616%]

scenario:dogstatsd-aggregated-20

  • unstable cpu_usage_percentage [-6.449%; +3.859%]
  • unstable execution_time [-111.154ms; +168.230ms] or [-5.698%; +8.624%]
  • unstable throughput [-791489.719op/s; +525065.510op/s] or [-6.384%; +4.235%]

scenario:encoders-0.4-immediate-flush-20

  • unstable max_rss_usage [-7.180MB; +9.918MB] or [-9.214%; +12.728%]

scenario:fs-subscribed-26

  • unstable execution_time [-70.215ms; +106.334ms] or [-5.518%; +8.356%]

scenario:llmobs-encode-unicode-mixed-20

  • unstable max_rss_usage [-6.394MB; +9.451MB] or [-8.192%; +12.109%]

scenario:plugin-mongodb-core-deep-aggregate-26

  • unstable execution_time [-116.326ms; +163.831ms] or [-4.280%; +6.028%]

@watson
watson force-pushed the watson/DEBUG-6081/refresh-breakpoint-on-capture-disabled branch 3 times, most recently from 5644b43 to d1217f3 Compare September 4, 2026 15:41
The breakpoint condition compiled for a location bakes in whether each
probe produces snapshots. The probe sampler uses that flag to decide if
a hit counts against the global snapshot rate limit, and since the
guardrail metrics landed also to classify a skipped hit as a snapshot
or a log event.

When the pause handler hits a fatal capture error it permanently
disables snapshots or capture expressions for the probe, but the
breakpoint condition was never rebuilt. Such a probe kept eating into
the global snapshot budget and its skipped hits kept being reported as
snapshots, although every event it emitted from then on was a
capture-less log event.

Add `refreshBreakpoint()` to the breakpoints module, which replaces the
breakpoint at a probe's location with one compiled from the current
state of the probes attached to it, and call it from the pause handler
once the main thread has been resumed and the results are on their way.
@watson
watson force-pushed the watson/DEBUG-6081/refresh-breakpoint-on-capture-disabled branch from d1217f3 to 3c4c33e Compare September 6, 2026 09:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant