Add helper rewrite in rust

[cataphract]

Description

Passing integration and system-tests.

Further integration into sidecar and protocol changes pending.

Reviewer checklist

• Test coverage seems ok.
• Appropriate labels assigned.

[datadog-datadog-prod-us1]

⚠️ Tests

✨ Fix all issues with BitsAI or with Cursor

⚠️ Warnings

🧪 1028 Tests failed

testSearchPhpBinaries from integration.DDTrace\Tests\Integration\PHPInstallerTest (Datadog) (Fix with Cursor)

Risky Test
phpvfscomposer://tests/vendor/phpunit/phpunit/phpunit:52

testSimplePushAndProcess from laravel-58-test.DDTrace\Tests\Integrations\Laravel\V5_8\QueueTest (Datadog) (Fix with Cursor)

Risky Test
phpvfscomposer://tests/vendor/phpunit/phpunit/phpunit:97

testSimplePushAndProcess from laravel-8x-test.DDTrace\Tests\Integrations\Laravel\V8_x\QueueTest (Datadog) (Fix with Cursor)

DDTrace\Tests\Integrations\Laravel\V8_x\QueueTest::testSimplePushAndProcess
Test code or tested code printed unexpected output: spanLinksTraceId: 69a845da0000000007ddab68b37abce8
tid: 69a845da00000000
hexProcessTraceId: 07ddab68b37abce8
hexProcessSpanId: 8c395874159c1173
processTraceId: 566797594294664424
processSpanId: 10104204494584418675

View all

ℹ️ Info

❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 1098f3c | Docs | Datadog PR Page | Was this helpful? React with 👍/👎 or give us feedback!}

[codecov-commenter]

Codecov Report

❌ Patch coverage is 84.81291% with 828 lines in your changes missing coverage. Please review.
✅ Project coverage is 68.64%. Comparing base (988edd2) to head (1098f3c).

Files with missing lines	Patch %	Lines
appsec/helper-rust/src/client.rs	89.58%	97 Missing ⚠️
appsec/helper-rust/src/lib.rs	53.47%	87 Missing ⚠️
appsec/helper-rust/src/rc.rs	85.71%	68 Missing ⚠️
appsec/src/extension/ddappsec.c	25.31%	52 Missing and 7 partials ⚠️
appsec/helper-rust/src/service.rs	90.95%	57 Missing ⚠️
appsec/helper-rust/src/telemetry/sidecar.rs	79.10%	56 Missing ⚠️
appsec/src/extension/helper_process.c	8.19%	56 Missing ⚠️
appsec/helper-rust/src/lock.rs	68.37%	37 Missing ⚠️
appsec/helper-rust/src/service/sampler.rs	90.76%	34 Missing ⚠️
appsec/helper-rust/src/service/waf_diag.rs	88.38%	28 Missing ⚠️
... and 19 more

❌ Your patch status has failed because the patch coverage (84.81%) is below the target coverage (90.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3581      +/-   ##
==========================================
+ Coverage   62.18%   68.64%   +6.45%     
==========================================
  Files         141      165      +24     
  Lines       13352    18774    +5422     
  Branches     1746     1768      +22     
==========================================
+ Hits         8303    12887    +4584     
- Misses       4259     5086     +827     
- Partials      790      801      +11     

Flag	Coverage Δ
helper-rust-integration	78.85% <78.85%> (?)
helper-rust-unit	49.39% <49.39%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
appsec/helper-rust/src/service/metrics.rs	100.00% <100.00%> (ø)
appsec/src/extension/configuration.h	100.00% <ø> (ø)
appsec/src/extension/user_tracking.c	75.00% <100.00%> (+0.08%)	⬆️
appsec/src/helper/client.cpp	75.46% <100.00%> (+0.05%)	⬆️
appsec/src/helper/client.hpp	89.58% <ø> (ø)
appsec/src/helper/engine.cpp	91.73% <100.00%> (ø)
appsec/src/helper/engine.hpp	100.00% <ø> (ø)
appsec/src/helper/network/proto.hpp	93.22% <ø> (ø)
appsec/src/helper/subscriber/base.hpp	100.00% <ø> (ø)
appsec/src/helper/subscriber/waf.cpp	71.57% <100.00%> (+0.04%)	⬆️
... and 30 more

... and 3 files with indirect coverage changes

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 988edd2...1098f3c. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[pr-commenter]

Benchmarks [ appsec ]

Benchmark execution time: 2026-03-04 15:16:10

Comparing candidate commit 1098f3c in PR branch glopes/helper-rust with baseline commit 988edd2 in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 0 unstable metrics.

[pr-commenter]

Benchmarks [ tracer ]

Benchmark execution time: 2026-03-04 12:25:07

Comparing candidate commit e162af9 in PR branch glopes/helper-rust with baseline commit 8cd0131 in branch master.

Found 2 performance improvements and 0 performance regressions! Performance is the same for 190 metrics, 2 unstable metrics.

scenario:MessagePackSerializationBench/benchMessagePackSerialization

• 🟩 execution_time [-6.504µs; -5.736µs] or [-5.806%; -5.120%]

scenario:MessagePackSerializationBench/benchMessagePackSerialization-opcache

• 🟩 execution_time [-3.486µs; -2.554µs] or [-3.201%; -2.345%]

[morrisonlevi]

This PR is so large that github will only permit me to review it one file at a time. I didn't even know that was a thing! You're going to need to break it down into a series of smaller PRs, probably.

[bwoebi]

@morrisonlevi I've had success for very big PRs with the PHPStorm/CLion github integrations in the past. Doesn't matter for small PRs, but can definitely recommend it for extra-large PRs :-)