saboteur 0.7.0 → 0.8.0

data/lib/saboteur/execution/external_runner.rb

@@ -0,0 +1,471 @@
+# SPDX-License-Identifier: MIT
+# frozen_string_literal: true
+
+require "fileutils"
+require "find"
+require "pathname"
+require "tmpdir"
+
+module Saboteur
+  module Execution
+    # Runs mutants through a user-supplied shell command (#140): each
+    # execution gets a FRESH disposable copy of the project tree, so every
+    # mutant and every neutral check starts from a pristine snapshot and a
+    # destructive command cannot poison later runs. The mutant is written
+    # into the copy - never the real file; the runner's own writes never
+    # follow symlinks and never leave the copy - and the command runs there
+    # with the caller's permissions: unsandboxed, with network and side
+    # effects exactly as if typed into a shell, including writing anywhere
+    # it chooses by absolute path. Its exit status decides the verdict: 0
+    # survived, non-zero killed (except the shell's 126/127 and signals,
+    # which read as command/setup errors), deadline timeout. It is the mode
+    # for target apps that cannot load inside this Ruby (apps on older
+    # Rubies); it is explicitly slower, now also one tree copy per
+    # execution.
+    #
+    # Safety shape, stated narrowly: the pristine reference is the real
+    # tree itself, read per subject as subject.file_source; the copy is
+    # not a canary and proves nothing by itself. Because only the copy is
+    # mutated, a failed write or a command that keeps writing in the
+    # background hits the copy, not the checkout; the command can still
+    # write anywhere else by absolute path, so only trusted commands
+    # belong here. The command's whole process group is TERM/KILLed and
+    # reaped in an ensure on every exit path (verdict, timeout, error,
+    # interrupt); a SIGKILL of this process can leave the group alive.
+    # Output capture is bounded as it is written (a ring buffer), so a
+    # chatty command cannot fill memory or disk. A neutral preflight runs
+    # the command once on an untouched copy before any mutant exists, so a
+    # typo command fails immediately with its own output.
+    class ExternalRunner
+      # The command is one test in the report's eyes: a kill names it as
+      # the killer, a run lists it as executed.
+      PSEUDO_TEST = "(test command)"
+
+      # Shell "cannot execute" / "command not found" read as setup errors,
+      # never as kills: the suite did not run.
+      SETUP_EXIT_CODES = [126, 127].freeze
+
+      # The child inherits this marker and Boot.refuse_recursion! refuses
+      # any saboteur run inside it, so a test command that itself invokes
+      # saboteur cannot mutate the copy mid-run.
+      CHILD_MARKER = "SABOTEUR_EXTERNAL_CHILD"
+
+      # Bundler env anchors a child command must never inherit (#435).
+      BUNDLER_ANCHOR_KEYS = %w[
+        BUNDLE_GEMFILE BUNDLE_BIN_PATH BUNDLER_SETUP BUNDLER_VERSION BUNDLE_APP_CONFIG
+      ].freeze
+
+      # with_unbundled_env deletes the whole BUNDLE_* prefix, which also
+      # drops settings the SHELL exported - CI commonly exports
+      # BUNDLE_PATH (plus resolution knobs) without writing .bundle/config,
+      # and the child's bundler then cannot find the app's gems (#449).
+      # Re-add these only when they came from the pre-bundler environment
+      # (Bundler.original_env), never from bundler's own activation, and
+      # never the anchor keys above.
+      BUNDLER_PASSTHROUGH_KEYS = %w[
+        BUNDLE_PATH BUNDLE_WITHOUT BUNDLE_WITH BUNDLE_FROZEN BUNDLE_DEPLOYMENT
+      ].freeze
+
+      # Bounded capture: only the last bytes of combined output are kept,
+      # for preflight and error messages.
+      OUTPUT_LIMIT = 64 * 1024
+
+      # Grace for the capture drain after the command exits: a descendant
+      # holding the pipe past this no longer blocks the run.
+      DRAIN_GRACE = 0.5
+
+      def initialize(command:, root:)
+        @command = command
+        # realpath, not expand_path: the tree must be judged by where it
+        # really is, so a subject path can be checked against the same
+        # canonical root without a symlink making it look outside (#305 QA).
+        @root = File.realpath(root)
+        @copy_root = nil
+        at_exit { close }
+      rescue SystemCallError
+        raise Error, "the test command root does not exist: #{root}"
+      end
+
+      # Runs the command once on an untouched copy before any mutant
+      # exists. A failing command can never claim kills, so fail the whole
+      # run here with the command's own output (#140, #305).
+      # deadline is absolute (CLOCK_MONOTONIC): the copy is made first and
+      # the command is admitted only with the time then remaining, so the
+      # copy can never eat the budget while the command still gets its full
+      # slice (#305 Architect). An already-spent deadline is a budget stop,
+      # not a command failure - and so is a wait cut short with the overall
+      # run budget also spent: the run is out of time, the command is not
+      # at fault (#305 QA).
+      # The budget only owns the outcome when it is the LIMITING deadline
+      # (budget_deadline <= deadline): an own-slice timeout stays the
+      # command's error even when the run budget is spent too, and the
+      # cause is fixed at the moment of admission or timeout, before
+      # TERM/KILL and the drain can cross the budget and relabel it (#305
+      # Principal).
+      def preflight!(deadline:, budget_deadline: nil)
+        budget_limited = !budget_deadline.nil? && budget_deadline <= deadline
+        result = with_fresh_copy do
+          remaining = deadline - monotonic
+          if remaining <= 0
+            raise BudgetPhaseTimeout, "the --max-duration budget stopped the external preflight" if budget_limited
+
+            raise Error, "the test command's preflight deadline was spent before the command could start"
+          end
+
+          spawn_and_wait(remaining, timeout_cause: budget_limited ? :budget : :own, budget_deadline: budget_deadline)
+        end
+        if result == :budget_timeout
+          raise BudgetPhaseTimeout, "the --max-duration budget stopped the external preflight"
+        end
+
+        case result
+        when 0 then true
+        when Exception
+          raise Error, "the test command could not be started: #{result.message}"
+        else
+          raise Error, "the test command fails on the unchanged tree " \
+                       "(#{describe_exit(result)}):\n#{last_output}"
+        end
+      end
+
+      # Mutation-visibility check (#441): the command must FAIL with the
+      # subject file replaced by a load-time error. A pass means the
+      # command never sees the copy's file - a RUBYLIB/-I path or an
+      # installed gem anchors it to the real tree, or the suite never
+      # loads the file - and every mutant on it "survives" unseen, so the
+      # score would read 0.0 % for nothing. Warn loudly and let the run
+      # continue: the file may legitimately be uncovered. The first
+      # runnable subject stands for the whole scope: anchoring breaks
+      # every file alike. Returns the warning, or nil when the command
+      # saw the broken file. Budget and deadline faults still raise.
+      def visibility_check(subject:, deadline:, budget_deadline: nil)
+        budget_limited = !budget_deadline.nil? && budget_deadline <= deadline
+        result = with_fresh_copy do
+          remaining = deadline - monotonic
+          if remaining <= 0
+            if budget_limited
+              raise BudgetPhaseTimeout,
+                    "the --max-duration budget stopped the mutation visibility check"
+            end
+
+            raise Error, "the mutation visibility check's deadline was spent before the command could start"
+          end
+
+          write_subject(subject, visibility_mutation(subject))
+          spawn_and_wait(remaining, timeout_cause: budget_limited ? :budget : :own,
+                                    budget_deadline: budget_deadline)
+        end
+        if result == :budget_timeout
+          raise BudgetPhaseTimeout,
+                "the --max-duration budget stopped the mutation visibility check"
+        end
+
+        visibility_warning(subject, result)
+      end
+
+      # Same contract as Runner#run. text, test_ids and eval_prefix belong
+      # to the in-process machinery and are ignored here. The neutral run
+      # (mutation nil) writes the unchanged bytes explicitly: every
+      # execution proves the write path against pristine content (#305).
+      def run(subject:, text:, test_ids:, timeout:, mutation: nil, eval_prefix: nil) # rubocop:disable Lint/UnusedMethodArgument
+        started = monotonic
+        message = nil
+        status = begin
+          with_fresh_copy do
+            write_subject(subject, mutation)
+            verdict_for(spawn_and_wait(timeout))
+          end
+        # A copy or write failure is this execution's outcome, never a crash
+        # of the run: report it with bounded context like any command error
+        # (#305 QA).
+        rescue Error, SystemCallError => e
+          message = bounded(e.message)
+          :error
+        end
+        Runner::Outcome.new(status: status, runtime: monotonic - started,
+                            failed_ids: status == :killed ? [PSEUDO_TEST] : [],
+                            executed_ids: status == :error ? [] : [PSEUDO_TEST],
+                            message: message || (status == :error ? error_context : nil))
+      end
+
+      # Drops the current disposable copy. Public so the engine can release
+      # the tree as soon as the run ends; idempotent, and the at_exit
+      # backstop calls it again.
+      def close
+        FileUtils.rm_rf(@copy_root) if @copy_root
+        @copy_root = nil
+      rescue SystemCallError
+        nil
+      end
+
+      private
+
+      # A pristine copy of the tree for one execution (#305 QA/DevRel): the
+      # previous execution's copy - mutated file, command side effects and
+      # all - is dropped before the new one is made.
+      def with_fresh_copy
+        close
+        # realpath the copy root too: macOS tmp dirs are /var symlinked to
+        # /private/var, and the containment check compares canonical link
+        # targets against this root - both sides must be canonical (#305).
+        @copy_root = File.realpath(Dir.mktmpdir("saboteur-external-"))
+        FileUtils.cp_r(File.join(@root, "."), @copy_root, preserve: true)
+        rebuild_symlinks
+        yield
+      end
+
+      # cp_r keeps symlinks, and a write through a link that escapes the
+      # copy would land in the real tree. Links resolving inside the tree
+      # are REBUILT as relative links inside the copy: alias identity is
+      # preserved, so requiring the alias sees the same (possibly mutated)
+      # content as the real path, and the link can never point out (#305
+      # QA). Chains collapse to the final target, which is equivalent.
+      # Anything escaping the tree or unresolvable refuses the run.
+      def rebuild_symlinks
+        Find.find(@copy_root) do |path|
+          next unless File.symlink?(path)
+
+          target = File.realpath(path)
+          unless target.start_with?("#{@copy_root}/")
+            raise Error, "the tree links outside itself: #{path.sub("#{@copy_root}/", '')} -> #{target}; " \
+                         "external test commands need a self-contained tree"
+          end
+
+          relative = Pathname.new(target).relative_path_from(Pathname.new(File.dirname(path))).to_s
+          File.unlink(path)
+          File.symlink(relative, path)
+        rescue SystemCallError
+          raise Error, "unresolvable symlink in the tree: #{path.sub("#{@copy_root}/", '')}"
+        end
+      end
+
+      # The mutation's edits apply at absolute byte offsets in the file;
+      # the neutral run writes the original bytes back. The reference text
+      # is the real tree's, never the copy's (#305 DevRel canary).
+      def write_subject(subject, mutation)
+        path = File.join(@copy_root, relative(subject))
+        File.binwrite(path, mutation ? mutated_source(subject, mutation) : subject.file_source)
+      end
+
+      # The subject must live under the canonical root; anything else -
+      # absolute or `..` traversal - is refused, never joined onto the copy
+      # (#305 QA).
+      def relative(subject)
+        # realpath like the root: macOS tmp is /var symlinked to /private/var,
+        # so a spelled subject path must canonicalize before the containment
+        # check or every run is refused as outside the root (#442).
+        expanded = File.realpath(subject.file)
+        prefix = "#{@root}/"
+        raise Error, "the subject file is outside the project root: #{subject.file}" unless expanded.start_with?(prefix)
+
+        expanded[prefix.length..]
+      end
+
+      def mutated_source(subject, mutation)
+        source = subject.file_source.dup.b
+        mutation.edits.sort_by(&:start_byte).reverse_each do |edit|
+          source = source.byteslice(0, edit.start_byte) + edit.replacement.b + source.byteslice(edit.end_byte..)
+        end
+        source.force_encoding(Encoding::UTF_8)
+      end
+
+      def verdict_for(result)
+        case result
+        when :timeout then :timeout
+        when Exception, :signal, *SETUP_EXIT_CODES then :error
+        when 0 then :survived
+        else :killed
+        end
+      end
+
+      def error_context
+        "#{describe_exit(@last_result)}: #{last_output}"
+      end
+
+      # timeout_cause fixes who owns a timeout at the moment the wait ends,
+      # BEFORE the ensure's TERM/KILL grace and capture drain run: that
+      # cleanup can cross the run budget, and a budget crossed there must
+      # not relabel the command's own timeout as a budget stop (#305
+      # Principal). :budget_timeout is decided here, never after.
+      def spawn_and_wait(timeout, timeout_cause: :own, budget_deadline: nil)
+        # Always through the shell: users write pipelines and redirects,
+        # and a bare unknown word must exit 127 instead of raising ENOENT.
+        start_capture
+        pid = spawn_shell
+        # The parent's copy of the write end closes right after the spawn:
+        # while it stays open the reader never sees EOF and the drain below
+        # would always wait out its grace (#305 Architect).
+        @capture_writer.close
+        @capture_writer = nil
+        @last_result = await_exit(pid, timeout)
+        if @last_result == :timeout && timeout_cause == :budget && budget_deadline && monotonic >= budget_deadline
+          @last_result = :budget_timeout
+        end
+        @last_result
+      rescue SystemCallError => e
+        @last_result = e
+      ensure
+        # The whole process group goes down on every exit path - verdict,
+        # timeout, error and interrupt alike - so background descendants
+        # cannot write after the verdict is in (#305).
+        reap_tree(pid) if pid
+        finish_capture
+      end
+
+      def spawn_shell
+        Process.spawn(child_env, ["/bin/sh", "sh"], "-c", @command, chdir: @copy_root,
+                                                                    pgroup: true,
+                                                                    out: @capture_writer,
+                                                                    err: @capture_writer,
+                                                                    unsetenv_others: true)
+      end
+
+      # A `bundle exec saboteur` parent - or a shell with BUNDLE_GEMFILE
+      # exported - anchors the child command's bundler to the REAL tree:
+      # the child resolves the project gem from the unmutated checkout, the
+      # mutant is never exercised and every mutant survives (#435). The
+      # copy carries its own Gemfile, so the child's bundler must resolve
+      # from @copy_root instead: hand the child the unbundled environment
+      # and drop the anchor keys outright (they can also sit in Bundler's
+      # ORIGINAL_ENV and survive with_unbundled_env). RUBYOPT/RUBYLIB keep
+      # their non-bundler parts; everything else passes through unchanged.
+      def child_env
+        env = defined?(Bundler) ? Bundler.with_unbundled_env { ENV.to_h } : ENV.to_h
+        BUNDLER_ANCHOR_KEYS.each { |key| env.delete(key) }
+        if defined?(Bundler)
+          original = Bundler.original_env
+          BUNDLER_PASSTHROUGH_KEYS.each { |key| env[key] = original[key] if original.key?(key) }
+        end
+        if (rubyopt = env["RUBYOPT"])
+          rubyopt = rubyopt.gsub(%r{\s*-rbundler/setup}, "").strip
+          rubyopt.empty? ? env.delete("RUBYOPT") : env["RUBYOPT"] = rubyopt
+        end
+        env.merge(CHILD_MARKER => "1")
+      end
+
+      # Only a failing exit proves the command saw the broken file; a
+      # pass is the anchoring or no-coverage case, and a timeout or setup
+      # failure leaves visibility unknown. Both warn and name the file.
+      def visibility_warning(subject, result)
+        return nil if result.is_a?(Integer) && !result.zero? && !SETUP_EXIT_CODES.include?(result)
+
+        detail = case result
+                 when 0 then "the test command still passed"
+                 when :timeout then "the test command timed out"
+                 when :signal, *SETUP_EXIT_CODES then "the test command could not run (#{describe_exit(result)})"
+                 when Exception then "the test command could not be started: #{result.message}"
+                 end
+        "mutation visibility check failed for #{relative(subject)}: #{detail} with the file replaced by a " \
+          "load-time error, so mutants in it may all survive unseen and the score would read 0.0 %. The " \
+          "command must load the project's code from the mutated copy; check for anchors to the real tree " \
+          "(RUBYLIB, -I paths, an installed gem) or narrow the scope to files the suite loads."
+      end
+
+      # The whole file becomes a load-time error: any load of it from the
+      # copy fails the suite, while a command anchored elsewhere is
+      # untouched. Valid syntax, so only an actual load trips it.
+      def visibility_mutation(subject)
+        source = subject.file_source
+        edit = Saboteur::MutationSource::Edit.new(file: subject.file, start_byte: 0, end_byte: source.bytesize,
+                                                  replacement: 'raise "saboteur mutation visibility check: ' \
+                                                               'this file must not load during the check"')
+        Saboteur::MutationSource::Mutation.new(subject_id: subject.id, operator: "visibility_check", edits: [edit],
+                                               coarse: false)
+      end
+
+      def await_exit(pid, timeout)
+        deadline = monotonic + timeout
+        loop do
+          done, status = Process.wait2(pid, Process::WNOHANG)
+          return status.exitstatus || :signal if done
+          return :timeout if monotonic >= deadline
+
+          sleep 0.01
+        end
+      end
+
+      def reap_tree(pid)
+        return unless tree_alive?(pid)
+
+        Process.kill("TERM", -pid)
+        deadline = monotonic + 2
+        sleep 0.02 while monotonic < deadline && tree_alive?(pid)
+        Process.kill("KILL", -pid) if tree_alive?(pid)
+        Process.wait2(pid)
+      rescue SystemCallError
+        nil
+      end
+
+      def tree_alive?(pid)
+        Process.kill(0, -pid)
+        true
+      rescue SystemCallError
+        false
+      end
+
+      # A ring buffer on a pipe: output is bounded as it is written, never
+      # spooled to disk (Principal, #305). The buffer lives outside the
+      # thread so a bounded drain still keeps what was captured.
+      def start_capture
+        @capture_reader, @capture_writer = IO.pipe
+        @capture_buffer = +""
+        @capture_thread = Thread.new do
+          loop do
+            @capture_buffer << @capture_reader.readpartial(16_384)
+            if @capture_buffer.bytesize > OUTPUT_LIMIT
+              @capture_buffer = @capture_buffer.byteslice(-OUTPUT_LIMIT, OUTPUT_LIMIT)
+            end
+          end
+        rescue IOError # EOFError included: the command closed its output
+          nil
+        end
+      end
+
+      # The command is done, but a descendant that escaped the process
+      # group (setsid/daemon) can hold the write end open forever, so the
+      # drain is bounded: the reader gets a short grace to see EOF, then it
+      # is killed and its captured bytes kept. Escaped sessions are not
+      # contained - they only cannot block the run or leak the fd (#305
+      # Architect). Both parent ends are always closed.
+      def finish_capture
+        @capture_writer&.close
+        if @capture_thread
+          @capture_thread.join(DRAIN_GRACE) || @capture_thread.kill
+          @capture_thread.join
+        end
+        @capture_reader&.close
+        @captured = @capture_buffer
+        @capture_reader = @capture_writer = @capture_thread = @capture_buffer = nil
+      end
+
+      # Captured bytes become report JSON: force UTF-8 and drop invalid
+      # sequences - the ring buffer can start mid-multibyte after a
+      # truncation (#305 Principal).
+      def last_output
+        bounded(@captured.to_s).strip.then { |text| text.empty? ? "(no output)" : text }
+      end
+
+      def bounded(text)
+        text.dup.force_encoding(Encoding::UTF_8).scrub("")[0, OUTPUT_LIMIT]
+      end
+
+      def describe_exit(result)
+        if SETUP_EXIT_CODES.include?(result)
+          "exit #{result} - the shell could not run the command"
+        elsif result == :signal
+          "killed by a signal"
+        elsif result == :timeout
+          "timed out"
+        elsif result.is_a?(Exception)
+          "could not start: #{result.message}"
+        else
+          "exit #{result}"
+        end
+      end
+
+      def monotonic
+        Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      end
+    end
+  end
+end

data/lib/saboteur/execution/marker_sweep.rb

@@ -0,0 +1,79 @@
+# SPDX-License-Identifier: MIT
+# frozen_string_literal: true
+
+require "fiddle"
+
+module Saboteur
+  module Execution
+    # Finds the processes carrying a run's supervision marker (#365). A
+    # descendant that leaves the child's process group and loses its
+    # intermediate parent between two tree polls is invisible to
+    # ProcessTree; the marker survives both escapes, in one of two
+    # channels:
+    #
+    # comm - the child sets its /proc/<pid>/comm at start; fork copies it
+    #        and setsid keeps it, so a fork-only descendant (Process.daemon)
+    #        stays named. An exec or a self-rename (puma, sidekiq) drops it.
+    # environ - /proc/<pid>/environ is frozen at each exec, so an exec'd
+    #        descendant shows the environment it was started with, marker
+    #        included; a fork-only descendant shows the top process's exec
+    #        environment instead, which never had the marker - that path is
+    #        what the comm channel covers.
+    #
+    # Linux only. Other platforms keep the gap from #365 rather than ship
+    # an unverified parser.
+    module MarkerSweep
+      PR_SET_NAME = 15
+
+      module_function
+
+      # Best-effort: set this process's comm to the run's marker. comm - not
+      # $0, which project code can read - survives fork and setsid; an exec
+      # resets it, which the environment channel covers instead. Without a
+      # usable prctl (macOS) the environment marker still names exec'd
+      # descendants and the tree still tracks the rest.
+      def write_comm(marker)
+        prctl = Fiddle::Function.new(Fiddle::Handle::DEFAULT["prctl"],
+                                     [Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP] + ([Fiddle::TYPE_LONG] * 3),
+                                     Fiddle::TYPE_INT)
+        prctl.call(PR_SET_NAME, "#{Supervisor::COMM_PREFIX}#{marker}", 0, 0, 0)
+        nil
+      rescue StandardError, Fiddle::DLError
+        nil
+      end
+
+      def available?
+        File.exist?("/proc/self/environ")
+      end
+
+      # Live candidate pids marked in either channel. A process that exits
+      # or turns unreadable mid-sweep is skipped; the caller's rounds see
+      # what remains. The environment value is a colon-joined list so a
+      # nested run keeps its ancestors' markers reachable.
+      def marked_pids(marker, env_var)
+        comm_name = "#{Supervisor::COMM_PREFIX}#{marker}"
+        env_prefix = "#{env_var}="
+        Dir.children("/proc").filter_map do |name|
+          next unless name.match?(/\A\d+\z/)
+
+          pid = name.to_i
+          next if pid == Process.pid
+
+          pid if comm_marked?(pid, comm_name) || environ_marked?(pid, env_prefix, marker)
+        rescue SystemCallError, IOError
+          nil
+        end
+      end
+
+      def comm_marked?(pid, comm_name)
+        File.read(File.join("/proc", pid.to_s, "comm")).chomp == comm_name
+      end
+
+      def environ_marked?(pid, env_prefix, marker)
+        entries = File.binread(File.join("/proc", pid.to_s, "environ")).split("\0")
+        value = entries.find { |entry| entry.start_with?(env_prefix) }&.[](env_prefix.length..)
+        value&.split(":")&.include?(marker) || false
+      end
+    end
+  end
+end

data/lib/saboteur/execution/peak_memory.rb

@@ -0,0 +1,28 @@
+# SPDX-License-Identifier: MIT
+# frozen_string_literal: true
+
+module Saboteur
+  module Execution
+    # Peak resident memory of a process from its proc status (#202). VmHWM is
+    # the kernel's exact high-water mark, so no sampling interval can miss
+    # it. Nil wherever procfs is absent (macOS), so reports omit the section
+    # instead of printing a fake zero.
+    module PeakMemory
+      PROC_STATUS = "/proc/self/status"
+
+      module_function
+
+      # This process's peak RSS in MB, or nil when procfs is unavailable.
+      def peak_mb(path = PROC_STATUS)
+        rss_mb(File.read(path))
+      rescue SystemCallError
+        nil
+      end
+
+      def rss_mb(status)
+        kb = status[/^VmHWM:\s*(\d+) kB/, 1]
+        kb && (kb.to_i / 1024.0).round(1)
+      end
+    end
+  end
+end

data/lib/saboteur/execution/process_table.rb

@@ -17,6 +17,18 @@ module Saboteur
     #   started     start time, so a recycled pid is never mistaken for one
     #               we saw earlier
     module ProcessTable
+      # A pid's command line for messages, /proc first and ps elsewhere;
+      # nil when the process is already gone. Capped for one-line display.
+      def self.command(pid)
+        command = if File.readable?("/proc/#{pid}/cmdline")
+                    File.binread("/proc/#{pid}/cmdline").tr("\0", " ").strip
+                  else
+                    `ps -o command= -p #{pid}`.strip
+                  end
+        command.empty? ? nil : command.slice(0, 120)
+      rescue SystemCallError
+        nil
+      end
       Entry = Data.define(:pid, :ppid, :pgid, :rss_kb, :zombie, :started)
 
       def self.backends