Add standalone datadog-ipc-helper binary

.gitlab/build-sidecar.sh

@@ -22,3 +22,4 @@ fi
 SHARED=1 PROFILE=tracer-release host_os="${HOST_OS}" ./compile_rust.sh
 cp -v "${CARGO_TARGET_DIR:-target}/tracer-release/libddtrace_php.a" "libddtrace_php_$(uname -m)${suffix}.a"
 objcopy --compress-debug-sections "${CARGO_TARGET_DIR:-target}/tracer-release/libddtrace_php.so" "libddtrace_php_$(uname -m)${suffix}.so"
+cp -v "${CARGO_TARGET_DIR:-target}/tracer-release/datadog-ipc-helper" "datadog-ipc-helper$(uname -m)${suffix}"

.gitlab/compile_extension.sh

@@ -3,8 +3,8 @@ set -eo pipefail
 
 SWITCH_PHP_VERSION=${SWITCH_PHP_VERSION:-}
 WITH_ASAN=${WITH_ASAN:-}
-CARGO_TARGET_DIR=${CARGO_TARGET_DIR:-target}
 EXTENSION_DIR=${EXTENSION_DIR:-tmp/build_extension}
+export CARGO_TARGET_DIR=${CARGO_TARGET_DIR:-${PWD}/${EXTENSION_DIR}/target}
 MODULES_DIR=${MODULES_DIR:-${EXTENSION_DIR}/modules}
 
 # Generate VERSION with build id

.gitlab/generate-package.php

@@ -429,6 +429,7 @@
   artifacts:
     paths:
       - "libddtrace_php_*.*"
+      - "datadog-ipc-helper*"
 <?php
 }
 ?>

.gitlab/generate-tracer.php

@@ -44,6 +44,7 @@ function before_script_steps($with_docker_auth = false) {
     - git config --global --add safe.directory "${CI_PROJECT_DIR}/*"
     - mkdir -p tmp/build_extension/modules artifacts
     - mv "modules/${PHP_MAJOR_MINOR}-${SWITCH_PHP_VERSION}-${host_os}-${ARCH}/ddtrace.so" "tmp/build_extension/modules/"
+    - '[ -f "modules/${PHP_MAJOR_MINOR}-${SWITCH_PHP_VERSION}-${host_os}-${ARCH}/datadog-ipc-helper" ] && mv "modules/${PHP_MAJOR_MINOR}-${SWITCH_PHP_VERSION}-${host_os}-${ARCH}/datadog-ipc-helper" "tmp/build_extension/modules/" || true'
 <?php
 }
 ?>
@@ -86,6 +87,7 @@ function before_script_steps($with_docker_auth = false) {
     export out_dir="modules/${PHP_MAJOR_MINOR}-${SWITCH_PHP_VERSION}-${host_os}-${ARCH}/"
     mkdir -p "${out_dir}"
     mv "tmp/build_extension/modules/ddtrace.so" "${out_dir}"
+    [ -f "tmp/build_extension/modules/datadog-ipc-helper" ] && mv "tmp/build_extension/modules/datadog-ipc-helper" "${out_dir}" || true
   cache:
     - key:
         prefix: $CI_JOB_NAME

.gitlab/link-tracing-extension.sh

@@ -15,3 +15,7 @@ done
 for pid in "${pids[@]}"; do
   wait $pid
 done
+
+# Place datadog-ipc-helper in the extensions directory so it travels with ddtrace.so
+# through the artifact pipeline and gets installed alongside it.
+cp "datadog-ipc-helper$(uname -m)${suffix}" "extensions_$(uname -m)/datadog-ipc-helper"

Cargo.toml

@@ -1,5 +1,6 @@
 [workspace]
-members = ["components-rs", "components-rs/php_sidecar_mockgen", "profiling"]
+members = ["components-rs", "components-rs/sidecar-bin", "profiling"]
+exclude = ["tmp"]
 resolver = "2"
 
 [workspace.package]
@@ -25,6 +26,7 @@ codegen-units = 1
 panic = "abort"
 inherits = "release"
 
+
 [profile.profiler-release]
 panic = "abort"
 inherits = "release"

Makefile

@@ -22,6 +22,9 @@ BENCHMARK_EXTRA ?=
 COMPONENTS_BUILD_DIR = $(PROJECT_ROOT)/tmp/build_components
 SO_FILE = $(BUILD_DIR)/modules/ddtrace.so
 AR_FILE = $(BUILD_DIR)/modules/ddtrace.a
+SIDECAR_BIN_DEBUG = $(BUILD_DIR)/target/debug/datadog-ipc-helper
+SIDECAR_BIN_RELEASE = $(BUILD_DIR)/target/tracer-release/datadog-ipc-helper
+SIDECAR_BIN = $(if $(RUST_DEBUG_BUILD),$(SIDECAR_BIN_DEBUG),$(SIDECAR_BIN_RELEASE))
 WALL_FLAGS = -Wall -Wextra
 CFLAGS ?= $(shell [ -n "${DD_TRACE_DOCKER_DEBUG}" ] && echo -O0 || echo -O2) -g $(WALL_FLAGS)
 LDFLAGS ?=
@@ -48,7 +51,7 @@ RUN_TESTS_CMD := DD_SERVICE= DD_ENV= REPORT_EXIT_STATUS=1 TEST_PHP_SRCDIR=$(PROJ
 
 C_FILES = $(shell find components components-rs ext src/dogstatsd zend_abstract_interface -name '*.c' -o -name '*.h' | awk '{ printf "$(BUILD_DIR)/%s\n", $$1 }' )
 TEST_FILES = $(shell find tests/ext -name '*.php*' -o -name '*.inc' -o -name '*.json' -o -name '*.yaml' -o -name 'CONFLICTS' | awk '{ printf "$(BUILD_DIR)/%s\n", $$1 }' )
-RUST_FILES = $(BUILD_DIR)/Cargo.toml $(BUILD_DIR)/Cargo.lock $(shell find components-rs -name '*.c' -o -name '*.rs' -o -name 'Cargo.toml' | awk '{ printf "$(BUILD_DIR)/%s\n", $$1 }' ) $(shell find libdatadog/{build-common,datadog-ffe,datadog-ipc,datadog-ipc-macros,datadog-live-debugger,datadog-live-debugger-ffi,datadog-remote-config,datadog-sidecar,datadog-sidecar-ffi,datadog-sidecar-macros,libdd-alloc,libdd-common,libdd-common-ffi,libdd-crashtracker,libdd-crashtracker-ffi,libdd-data-pipeline,libdd-ddsketch,libdd-dogstatsd-client,libdd-library-config,libdd-library-config-ffi,libdd-log,libdd-telemetry,libdd-telemetry-ffi,libdd-tinybytes,libdd-trace-*,spawn_worker,tools/{cc_utils,sidecar_mockgen},libdd-trace-*,Cargo.toml} \( -type l -o -type f \) \( -path "*/src*" -o -path "*/examples*" -o -path "*Cargo.toml" -o -path "*/build.rs" -o -path "*/tests/dataservice.rs" -o -path "*/tests/service_functional.rs" \) -not -path "*/datadog-ipc/build.rs" -not -path "*/datadog-sidecar-ffi/build.rs")
+RUST_FILES = $(BUILD_DIR)/Cargo.toml $(BUILD_DIR)/Cargo.lock $(shell find components-rs -name '*.c' -o -name '*.rs' -o -name 'Cargo.toml' | awk '{ printf "$(BUILD_DIR)/%s\n", $$1 }' ) $(shell find libdatadog/{build-common,datadog-ffe,datadog-ipc,datadog-ipc-macros,datadog-live-debugger,datadog-live-debugger-ffi,datadog-remote-config,datadog-sidecar,datadog-sidecar-appsec-ffi,datadog-sidecar-ffi,datadog-sidecar-macros,libdd-alloc,libdd-common,libdd-common-ffi,libdd-crashtracker,libdd-crashtracker-ffi,libdd-data-pipeline,libdd-ddsketch,libdd-dogstatsd-client,libdd-library-config,libdd-library-config-ffi,libdd-log,libdd-telemetry,libdd-telemetry-ffi,libdd-tinybytes,libdd-trace-*,spawn_worker,tools/cc_utils,libdd-trace-*,Cargo.toml} \( -type l -o -type f \) \( -path "*/src*" -o -path "*/examples*" -o -path "*Cargo.toml" -o -path "*/build.rs" -o -path "*/tests/dataservice.rs" -o -path "*/tests/service_functional.rs" \) -not -path "*/datadog-ipc/build.rs" -not -path "*/datadog-sidecar-ffi/build.rs")
 ALL_OBJECT_FILES = $(C_FILES) $(RUST_FILES) $(BUILD_DIR)/Makefile
 TEST_OPCACHE_FILES = $(shell find tests/opcache -name '*.php*' -o -name '.gitkeep' | awk '{ printf "$(BUILD_DIR)/%s\n", $$1 }' )
 TEST_STUB_FILES = $(shell find tests/ext -type d -name 'stubs' -exec find '{}' -type f \; | awk '{ printf "$(BUILD_DIR)/%s\n", $$1 }' )
@@ -63,7 +66,9 @@ else
 	SED_I = sed -i ''
 endif
 
-all: $(BUILD_DIR)/configure $(SO_FILE)
+SIDECAR_BIN_IN_MODULES = $(BUILD_DIR)/modules/datadog-ipc-helper
+
+all: $(BUILD_DIR)/configure $(SO_FILE) $(SIDECAR_BIN_IN_MODULES)
 
 # The following differentiation exists so we can build only (but always) the relevant files while executing tests
 #  - when a `.phpt` changes, we only copy the file to the build dir and we DO NOT rebuild
@@ -104,8 +109,6 @@ $(BUILD_DIR)/%: %
 
 JUNIT_RESULTS_DIR := $(shell pwd)
 
-all: $(BUILD_DIR)/configure $(SO_FILE)
-
 $(BUILD_DIR)/configure: $(M4_FILES) $(BUILD_DIR)/ddtrace.sym $(BUILD_DIR)/VERSION
 	$(Q) (cd $(BUILD_DIR); phpize && $(SED_I) 's/\/FAILED/\/\\bFAILED/' $(BUILD_DIR)/run-tests.php) # Fix PHP 5.4 exit code bug when running selected tests (FAILED vs XFAILED)
 
@@ -116,16 +119,25 @@ $(BUILD_DIR)/run-tests.php: $(if $(ASSUME_COMPILED),, $(BUILD_DIR)/configure)
 $(BUILD_DIR)/Makefile: $(BUILD_DIR)/configure
 	$(Q) (cd $(BUILD_DIR); $(if $(ASAN),CFLAGS="${CFLAGS} -DZEND_TRACK_ARENA_ALLOC") ./configure --$(if $(RUST_DEBUG_BUILD),enable,disable)-ddtrace-rust-debug $(if $(ASAN), --enable-ddtrace-sanitize) $(EXTRA_CONFIGURE_OPTIONS))
 
+
 $(SO_FILE): $(if $(ASSUME_COMPILED),, $(ALL_OBJECT_FILES) $(BUILD_DIR)/compile_rust.sh)
 	$(if $(ASSUME_COMPILED),,$(Q) $(MAKE) -C $(BUILD_DIR) -j)
 
+$(SIDECAR_BIN_IN_MODULES): $(SO_FILE)
+	$(Q) cp $(SIDECAR_BIN) $@
+
 $(AR_FILE): $(ALL_OBJECT_FILES)
 	$(Q) $(MAKE) -C $(BUILD_DIR) -j ./modules/ddtrace.a all
 
 $(PHP_EXTENSION_DIR)/ddtrace.so: $(SO_FILE)
 	$(Q) $(SUDO) $(if $(ASSUME_COMPILED),cp $(BUILD_DIR)/modules/ddtrace.so $(PHP_EXTENSION_DIR)/ddtrace.so,$(MAKE) -C $(BUILD_DIR) install)
 
+$(PHP_EXTENSION_DIR)/datadog-ipc-helper: $(SIDECAR_BIN)
+	$(Q) $(SUDO) cp $(SIDECAR_BIN) $(PHP_EXTENSION_DIR)/datadog-ipc-helper
+
 install: $(PHP_EXTENSION_DIR)/ddtrace.so
+	$(if $(wildcard $(SIDECAR_BIN_IN_MODULES)),$(Q) $(SUDO) cp $(SIDECAR_BIN_IN_MODULES) $(PHP_EXTENSION_DIR)/datadog-ipc-helper,\
+	$(if $(wildcard $(SIDECAR_BIN)),$(Q) $(SUDO) cp $(SIDECAR_BIN) $(PHP_EXTENSION_DIR)/datadog-ipc-helper))
 
 set_static_option:
 	$(eval EXTRA_CONFIGURE_OPTIONS := --enable-ddtrace-rust-library-split)
@@ -416,7 +428,7 @@ clang_format_fix:
 cbindgen: remove_cbindgen generate_cbindgen
 
 remove_cbindgen:
-	rm -f components-rs/ddtrace.h components-rs/live-debugger.h components-rs/telemetry.h components-rs/sidecar.h components-rs/common.h components-rs/crashtracker.h components-rs/library-config.h
+	rm -f components-rs/ddtrace.h components-rs/live-debugger.h components-rs/telemetry.h components-rs/sidecar.h components-rs/sidecar-appsec.h components-rs/common.h components-rs/crashtracker.h components-rs/library-config.h
 
 generate_cbindgen: cbindgen_binary # Regenerate components-rs/ddtrace.h components-rs/live-debugger.h components-rs/telemetry.h components-rs/sidecar.h components-rs/common.h components-rs/crashtracker.h components-rs/library-config.h
 	( \
@@ -436,6 +448,9 @@ generate_cbindgen: cbindgen_binary # Regenerate components-rs/ddtrace.h componen
 		$(command rustup && echo run nightly --) cbindgen --crate datadog-sidecar-ffi  \
 			--config datadog-sidecar-ffi/cbindgen.toml \
 			--output $(PROJECT_ROOT)/components-rs/sidecar.h; \
+		$(command rustup && echo run nightly --) cbindgen --crate datadog-sidecar-appsec-ffi  \
+			--config datadog-sidecar-appsec-ffi/cbindgen.toml \
+			--output $(PROJECT_ROOT)/components-rs/sidecar-appsec.h; \
 		$(command rustup && echo run nightly --) cbindgen --crate libdd-crashtracker-ffi  \
 			--config libdd-crashtracker-ffi/cbindgen.toml \
 			--output $(PROJECT_ROOT)/components-rs/crashtracker.h; \
@@ -446,7 +461,7 @@ generate_cbindgen: cbindgen_binary # Regenerate components-rs/ddtrace.h componen
 			mkdir -pv "$(BUILD_DIR)"; \
 			export CARGO_TARGET_DIR="$(BUILD_DIR)/target"; \
 		fi; \
-		cargo run -p tools --bin dedup_headers -- $(PROJECT_ROOT)/components-rs/common.h $(PROJECT_ROOT)/components-rs/ddtrace.h $(PROJECT_ROOT)/components-rs/live-debugger.h $(PROJECT_ROOT)/components-rs/telemetry.h $(PROJECT_ROOT)/components-rs/sidecar.h $(PROJECT_ROOT)/components-rs/crashtracker.h $(PROJECT_ROOT)/components-rs/library-config.h \
+		cargo run -p tools --bin dedup_headers -- $(PROJECT_ROOT)/components-rs/common.h $(PROJECT_ROOT)/components-rs/ddtrace.h $(PROJECT_ROOT)/components-rs/live-debugger.h $(PROJECT_ROOT)/components-rs/telemetry.h $(PROJECT_ROOT)/components-rs/sidecar.h $(PROJECT_ROOT)/components-rs/sidecar-appsec.h $(PROJECT_ROOT)/components-rs/crashtracker.h $(PROJECT_ROOT)/components-rs/library-config.h \
 	)
 
 cbindgen_binary:

appsec/helper-rust/CLAUDE.md

@@ -351,6 +351,11 @@ pipeline by walking parent pipelines and their child bridges to find one contain
 that match the filter. It polls every 30 seconds with a default 60-minute timeout.
 Exit codes: 0 = all passed, 1 = failures, 2 = timed out.
 
+**IMPORTANT**: The script waits for ALL matched jobs to finish before reporting the final
+result. Failed jobs are printed as they appear, but exit(1) is only issued once
+`running == 0`. Never conclude that CI passed or failed from an intermediate snapshot
+while jobs are still running — always wait for `running=0` before drawing conclusions.
+
 To monitor a pipeline and get a spoken notification when done, spawn a background agent
 (model: Haiku) with this prompt:
 
@@ -366,6 +371,11 @@ Once it exits, use the speak_when_done MCP tool to say:
 - Exit 2: "Pipeline monitoring timed out"
 ```
 
+**Note on the Haiku agent**: Give it a Bash timeout of at least 600000 ms (10 min) when
+pipelines are large. The default 2-minute tool timeout causes it to exit before all jobs
+complete, producing a misleadingly optimistic "1 failure" when hundreds more are still
+running. Use `--timeout 90` for large pipelines.
+
 ## Misc Notes
 
 - Always ask for confirmation before reverting, committing, or pushing anything with git