@hienlh/ppm 0.23.5 → 0.23.7

package/src/services/system-metrics/process-details-darwin.ts

@@ -0,0 +1,166 @@
+/**
+ * The same Details dialog as `process-details-linux.ts`, for macOS.
+ *
+ * It exists because the dialog was *lying* there: the service answered `null`
+ * for every non-Linux platform and the route turned that into a 404 reading
+ * "PID <n> is no longer running" — a sentence that is correct on Linux, where a
+ * vanished `/proc/<pid>` really does mean the process exited, and simply untrue
+ * anywhere else. A process sitting in the table at 4.2% CPU was reported dead.
+ *
+ * macOS has no `/proc`, but `ps` answers ten of the eleven fields, and two of
+ * them more directly than Linux does: `lstart` is a real timestamp rather than
+ * jiffies to be added to `btime`, and `user` is the login name already, so no
+ * `/etc/passwd` lookup is needed and it works across users. Only `cgroup` has no
+ * equivalent — macOS has no such concept — and it stays null, which the page
+ * draws as an em dash: the honest answer rather than an invented one.
+ *
+ * Measured on an M1 Max: `ps` for one pid 29.7 ms, `ps -M` 32.5 ms, `lsof` 37.5
+ * ms. The last three run concurrently, so a dialog costs about two spawns' wall
+ * time. That is affordable only because this is on-demand — it must never be
+ * moved onto the tick, which is the same rule the Linux module states.
+ */
+import type { ProcessDetails } from "../../types/system-metrics.ts";
+import { redactSecrets } from "../redact-secrets.ts";
+import { defaultRunner, type Runner } from "../host-info/spawn-runner.ts";
+
+/**
+ * BSD's state letters, which are NOT Linux's. The one that catches people is
+ * **U**: uninterruptible wait, spelled `D` on Linux. `I` is also real here —
+ * macOS marks a process idle once it has slept more than 20 seconds — and `Z`
+ * is far from rare: this host had 126 zombies against 645 sleepers.
+ */
+export const DARWIN_PROCESS_STATES: Record<string, string> = {
+  R: "Running", S: "Sleeping", I: "Idle", T: "Stopped",
+  U: "Uninterruptible sleep", Z: "Zombie",
+};
+
+export interface PsFields {
+  ppid: number;
+  state: string | null;
+  nice: number | null;
+  /** Epoch ms, or 0 when `lstart` did not parse — the UI draws 0 as an em dash. */
+  startedAt: number;
+  user: string | null;
+  exe: string | null;
+}
+
+/**
+ * One line of `ps -o ppid=,stat=,nice=,lstart=,user=,comm=`, e.g.
+ * `    1 S     0 Tue Sep  8 10:05:03 2026     thawng /System/…/Finder`
+ *
+ * Split by position, not by a delimiter, because `ps` on macOS offers none —
+ * and two fields contain spaces. `lstart` is **always five tokens** (verified
+ * across all 740 processes on a live host: a single-digit day pads with two
+ * spaces, which collapses on a `\s+` split rather than dropping a token), so
+ * every field up to `user` is at a fixed index and `comm` is whatever is left.
+ * It has to be last for that reason: a path like
+ * `/Applications/Google Chrome.app/…/Google Chrome Helper (Renderer)` holds six
+ * spaces, so anything after it could not be found again.
+ */
+export function parsePsLine(text: string | null | undefined): PsFields | null {
+  const line = (text ?? "").trim();
+  if (!line) return null;
+  const t = line.split(/\s+/);
+  // ppid, stat, nice, five for lstart, user — comm may legitimately be empty.
+  if (t.length < 9) return null;
+
+  const ppid = Number(t[0]);
+  if (!Number.isInteger(ppid) || ppid < 0) return null;
+
+  const nice = Number(t[2]);
+  const started = Date.parse(t.slice(3, 8).join(" "));
+  const exe = t.slice(9).join(" ");
+
+  return {
+    ppid,
+    state: DARWIN_PROCESS_STATES[t[1]![0] ?? ""] ?? null,
+    nice: Number.isFinite(nice) ? nice : null,
+    startedAt: Number.isFinite(started) ? started : 0,
+    user: t[8] || null,
+    exe: exe || null,
+  };
+}
+
+/**
+ * Thread count from a bare `ps -M -p <pid>` dump: one header line, then one line
+ * per thread.
+ *
+ * `-M` may not be combined with `-o` — asking for both prints the chosen columns
+ * AND leftovers of the thread layout on the same line, which parses as nonsense
+ * rather than failing, so this is deliberately a second call against the default
+ * format rather than a column added to the first.
+ */
+export function parseThreadCount(text: string | null | undefined): number | null {
+  const lines = (text ?? "").split("\n").filter((l) => l.trim().length > 0);
+  return lines.length > 1 ? lines.length - 1 : null;
+}
+
+/**
+ * `lsof -a -p <pid> -d cwd -Fn` in its machine-readable form: one field per
+ * line, prefixed by its type, `n` being the name.
+ *
+ * Another user's working directory comes back as exit 0 with **no output at
+ * all** rather than an error, which is the normal case on any machine with
+ * daemons on it — the same "absent, not failed" reading the Linux module gives
+ * an EACCES on `/proc/<pid>/cwd`.
+ */
+export function parseLsofCwd(text: string | null | undefined): string | null {
+  for (const line of (text ?? "").split("\n")) {
+    if (line.startsWith("n")) return line.slice(1).trim() || null;
+  }
+  return null;
+}
+
+/** The last path segment, for the `name` field — macOS has no `comm` truncated
+ *  to 15 characters to take it from, only the executable's full path. */
+function baseName(exe: string | null): string | null {
+  if (!exe) return null;
+  const cut = exe.lastIndexOf("/");
+  return (cut >= 0 ? exe.slice(cut + 1) : exe) || null;
+}
+
+/**
+ * Null when the pid is gone, which `ps` reports as a non-zero exit with nothing
+ * on stdout — so the route's "no longer running" is finally true when it is said.
+ */
+export async function readProcessDetailsDarwin(
+  pid: number,
+  run: Runner = defaultRunner,
+): Promise<ProcessDetails | null> {
+  if (!Number.isInteger(pid) || pid <= 0) return null;
+  const arg = String(pid);
+
+  const ps = await run(["ps", "-o", "ppid=,stat=,nice=,lstart=,user=,comm=", "-p", arg]);
+  if (ps.code !== 0) return null;
+  const fields = parsePsLine(ps.stdout);
+  if (!fields) return null;
+
+  // Concurrently: three independent spawns, and every one of them is allowed to
+  // fail on its own. A process whose command line or thread count cannot be read
+  // is still a process whose parent, user and state were just read successfully.
+  const [cmd, threads, cwd] = await Promise.all([
+    run(["ps", "-o", "command=", "-p", arg]),
+    run(["ps", "-M", "-p", arg]),
+    run(["lsof", "-a", "-p", arg, "-d", "cwd", "-Fn"]),
+  ]);
+
+  const command = cmd.code === 0 ? cmd.stdout.trim() : "";
+  return {
+    pid,
+    ppid: fields.ppid,
+    name: baseName(fields.exe) ?? arg,
+    startedAt: fields.startedAt,
+    // Redacted but NOT truncated, exactly as on Linux: showing the whole line is
+    // what this dialog is for.
+    command: command ? redactSecrets(command) : null,
+    exe: fields.exe,
+    cwd: cwd.code === 0 ? parseLsofCwd(cwd.stdout) : null,
+    user: fields.user,
+    state: fields.state,
+    threads: threads.code === 0 ? parseThreadCount(threads.stdout) : null,
+    nice: fields.nice,
+    // macOS has no cgroups. Null is the honest answer and renders as an em dash;
+    // inventing a value here would be the same mistake this file exists to undo.
+    cgroup: null,
+  };
+}

package/src/services/system-metrics/process-details-linux.ts

@@ -0,0 +1,150 @@
+/**
+ * On-demand facts for the process Details dialog — Mission Center's process
+ * properties. Fetched when the dialog opens, never per tick: it is a handful of
+ * reads per process and nobody needs `cwd` at 0.5 Hz.
+ *
+ * Every field is null when this pid's permissions do not expose it. Another
+ * user's `exe` and `cwd` are EACCES for an unprivileged PPM, which is the normal
+ * case on a shared machine and not an error.
+ */
+import type { ProcessDetails } from "../../types/system-metrics.ts";
+import { redactSecrets } from "../redact-secrets.ts";
+import { readAttr, realLinuxFs, type LinuxFs } from "./linux-fs.ts";
+
+const PROC = "/proc";
+/** Same assumption `proc-table-linux.ts` documents: 100 on every mainstream Linux. */
+const CLOCK_TICKS_PER_SEC = 100;
+
+/** The kernel's one-letter state, spelled out the way `ps` and Mission Center do. */
+export const PROCESS_STATES: Record<string, string> = {
+  R: "Running", S: "Sleeping", D: "Uninterruptible sleep", Z: "Zombie",
+  T: "Stopped", t: "Tracing stop", X: "Dead", I: "Idle", W: "Paging", K: "Wakekill",
+};
+
+export interface StatFields {
+  state: string;
+  ppid: number;
+  nice: number;
+  threads: number;
+  /** Ticks since boot. */
+  startTicks: number;
+  comm: string;
+}
+
+/**
+ * `/proc/<pid>/stat`, anchored on the LAST `)`.
+ *
+ * The second field is the executable name in parentheses and it is not escaped,
+ * so a process called `foo) 0 (bar` shifts every field after it for any parser
+ * that splits on whitespace. Anchoring on the last `)` is the only correct
+ * reading, and it is what `readProcTable` does too.
+ */
+export function parseStatFields(text: string): StatFields | null {
+  const close = text.lastIndexOf(")");
+  const open = text.indexOf("(");
+  if (close < 0 || open < 0 || close < open) return null;
+  const rest = text.slice(close + 1).trim().split(/\s+/);
+  // `rest[0]` is field 3 (state), so field N is at rest[N - 3].
+  const at = (field: number) => Number(rest[field - 3]);
+  const ppid = at(4);
+  if (!Number.isFinite(ppid)) return null;
+  return {
+    comm: text.slice(open + 1, close),
+    state: rest[0] ?? "",
+    ppid,
+    nice: at(19),
+    threads: at(20),
+    startTicks: at(22),
+  };
+}
+
+/** `/proc/stat`'s `btime` line: boot time as epoch SECONDS. */
+export function parseBootTimeSec(procStat: string | null): number | null {
+  const m = /^btime\s+(\d+)/m.exec(procStat ?? "");
+  const n = m ? Number(m[1]) : NaN;
+  return Number.isFinite(n) ? n : null;
+}
+
+/** The real uid from `/proc/<pid>/status`'s `Uid: real effective saved fs`. */
+export function parseUid(status: string | null): number | null {
+  const m = /^Uid:\s+(\d+)/m.exec(status ?? "");
+  const n = m ? Number(m[1]) : NaN;
+  return Number.isFinite(n) ? n : null;
+}
+
+/** uid → login name from `/etc/passwd`, which is world-readable by design. */
+export function lookupUser(uid: number, passwd: string | null): string | null {
+  for (const line of (passwd ?? "").split("\n")) {
+    const f = line.split(":");
+    if (f.length > 2 && Number(f[2]) === uid) return f[0] ?? null;
+  }
+  return null;
+}
+
+/** cgroup v2 writes one `0::<path>` line; v1 writes several, and the systemd
+ *  hierarchy is the one that names the unit. */
+export function parseCgroup(text: string | null): string | null {
+  const lines = (text ?? "").split("\n").filter(Boolean);
+  const v2 = lines.find((l) => l.startsWith("0::"));
+  if (v2) return v2.slice(3) || null;
+  const systemd = lines.find((l) => l.includes(":name=systemd:"));
+  const chosen = systemd ?? lines[0];
+  if (!chosen) return null;
+  const idx = chosen.indexOf(":", chosen.indexOf(":") + 1);
+  return idx >= 0 ? chosen.slice(idx + 1) || null : null;
+}
+
+export interface ProcessDetailsOptions {
+  fs?: LinuxFs;
+  /** Injected so the lookup is testable and read once per request, not per line. */
+  passwd?: () => string | null;
+}
+
+/** Null when the pid is gone (or /proc is unreadable) — the dialog then says so. */
+export function readProcessDetails(pid: number, opts: ProcessDetailsOptions = {}): ProcessDetails | null {
+  const fs = opts.fs ?? realLinuxFs;
+  if (!Number.isInteger(pid) || pid <= 0) return null;
+  const stat = fs.read(`${PROC}/${pid}/stat`);
+  const fields = stat ? parseStatFields(stat) : null;
+  if (!fields) return null;
+
+  const status = fs.read(`${PROC}/${pid}/status`);
+  const uid = parseUid(status);
+  const bootSec = parseBootTimeSec(fs.read(`${PROC}/stat`));
+  const rawCmdline = fs.read(`${PROC}/${pid}/cmdline`) ?? "";
+  // NUL-separated argv. A kernel thread has an empty cmdline, which is not a
+  // command line of "" — it has none at all.
+  const argv = rawCmdline.split("\0").filter(Boolean).join(" ");
+
+  return {
+    pid,
+    ppid: fields.ppid,
+    name: nameOf(status) ?? fields.comm,
+    startedAt: bootSec !== null && Number.isFinite(fields.startTicks)
+      ? Math.round((bootSec + fields.startTicks / CLOCK_TICKS_PER_SEC) * 1000)
+      : 0,
+    // Redacted but NOT truncated: the dialog exists to show the whole line, and
+    // the 160-char cut on a table row is a bandwidth decision, not a privacy one.
+    command: argv ? redactSecrets(argv) : null,
+    exe: fs.readlink(`${PROC}/${pid}/exe`),
+    cwd: fs.readlink(`${PROC}/${pid}/cwd`),
+    user: uid === null ? null : lookupUser(uid, (opts.passwd ?? (() => fs.read("/etc/passwd")))()),
+    state: describeState(fields.state),
+    threads: Number.isFinite(fields.threads) ? fields.threads : null,
+    nice: Number.isFinite(fields.nice) ? fields.nice : null,
+    cgroup: parseCgroup(fs.read(`${PROC}/${pid}/cgroup`)),
+  };
+}
+
+/** `/proc/<pid>/status`'s `Name:` is the same truncated comm, but without the
+ *  parenthesis quoting — preferred when present because it needs no unwrapping. */
+function nameOf(status: string | null): string | null {
+  const m = /^Name:\s*(.+)$/m.exec(status ?? "");
+  return m?.[1]?.trim() || null;
+}
+
+export function describeState(code: string): string | null {
+  if (!code) return null;
+  const word = PROCESS_STATES[code];
+  return word ? `${code} (${word})` : code;
+}

package/src/services/system-metrics/process-grouping.ts

@@ -16,7 +16,7 @@ const POSIX_BOUNDARY_NAMES: ReadonlySet<string> = new Set(["launchd", "systemd",
 const round1 = (n: number): number => Math.round(n * 10) / 10;
 
 /** The optional per-process columns, which roll up by summation. */
-type OptionalMetric = "diskReadBps" | "diskWriteBps" | "gpuPct" | "gpuMemMB" | "netInBps" | "netOutBps";
+type OptionalMetric = "swapMB" | "diskReadBps" | "diskWriteBps" | "gpuPct" | "gpuMemMB" | "netInBps" | "netOutBps";
 
 /**
  * Sum over the members that HAVE a value; `undefined` when none does, so a
@@ -129,6 +129,7 @@ export function groupProcesses(
       count: g.procs.length,
       ppm: g.procs.some((p) => p.ppm),
       pids: g.procs.map((p) => p.pid),
+      swapMB: sumOptional(g.procs, "swapMB"),
       diskReadBps: sumOptional(g.procs, "diskReadBps"),
       diskWriteBps: sumOptional(g.procs, "diskWriteBps"),
       gpuPct: sumOptional(g.procs, "gpuPct"),

package/src/services/system-metrics/process-rows-builder.ts

@@ -93,6 +93,8 @@ export function buildProcessRows(input: BuildRowsInput): BuiltRows {
       command: sanitizeCommand(r.command, r.name),
       cpu: percentByKey.get(key) ?? 0,
       ramMB: Math.round(r.ramMB * 10) / 10,
+      ...(r.swapMB === undefined ? {} : { swapMB: Math.round(r.swapMB * 10) / 10 }),
+      ...(r.unitKey === undefined ? {} : { unitKey: r.unitKey }),
       startedAt: r.startedAt,
       ppm: ppmPids.has(r.pid),
       protected: !checkKillAllowed({ pid: r.pid, name: r.name }, false, guardCtx).allowed,

package/src/services/system-metrics/process-swap-linux.ts

@@ -0,0 +1,37 @@
+/**
+ * Per-process swap — Mission Center's Swap column, on the process table and on
+ * every Services row.
+ *
+ * `VmSwap` in `/proc/<pid>/status` is the only cheap source: `smaps_rollup` also
+ * carries it but walks every mapping, and on a 560-process desktop that is the
+ * difference between a few milliseconds and a tick that misses its deadline.
+ * Measured here: the whole table costs 3.2 ms, beside the 1.7 ms `/proc/<pid>/io`
+ * already pays every tick.
+ *
+ * A kernel thread has no address space and so no `VmSwap` line at all. That is
+ * 0 swapped bytes, not an unmeasurable one — the distinction matters because the
+ * table renders `undefined` as an em dash, and 335 of this host's 561 rows would
+ * otherwise be dashes on a column that really does read zero for them.
+ */
+import { readFileSync } from "node:fs";
+
+const KB_PER_MB = 1024;
+
+/** `VmSwap` in kB from a `/proc/<pid>/status` dump. A process with an address
+ *  space always has the line; one without is a kernel thread, i.e. 0. */
+export function parseVmSwapKB(status: string): number {
+  const m = /^VmSwap:\s+(\d+)\s*kB/m.exec(status);
+  if (!m) return 0;
+  const kb = Number(m[1]);
+  return Number.isFinite(kb) ? kb : 0;
+}
+
+/** Swapped MB for one pid, or null when the process is gone or unreadable —
+ *  another user's process is expected to refuse, and that row simply has none. */
+export function readProcSwapMB(pid: number): number | null {
+  try {
+    return parseVmSwapKB(readFileSync(`/proc/${pid}/status`, "utf-8")) / KB_PER_MB;
+  } catch {
+    return null;
+  }
+}

package/src/services/system-metrics/signal-executor.ts

@@ -0,0 +1,84 @@
+/**
+ * Delivers ONE signal to a process, or to its whole collected tree — Mission
+ * Center's "Send Signal" submenu. Separate from `executeKill` on purpose: a kill
+ * escalates SIGTERM to SIGKILL after a grace period, which is right for "end this
+ * process" and wrong for every other signal. Asking for SIGSTOP must send SIGSTOP
+ * and nothing else.
+ *
+ * Pids are validated integers passed to `process.kill` or as argv elements —
+ * never interpolated into a shell string.
+ */
+import type { ProcessSignal, SignalProcessResult } from "../../types/system-metrics.ts";
+import type { Runner } from "../host-info/spawn-runner.ts";
+import { defaultRunner } from "../host-info/spawn-runner.ts";
+import { collectProcessTree } from "../windows-process-tree.ts";
+
+/** Windows has no signals. `taskkill` is the only delivery there and it can only
+ *  mean "end it", so those two map and the rest are refused with a reason. */
+export const WINDOWS_SUPPORTED_SIGNALS: ReadonlySet<ProcessSignal> = new Set<ProcessSignal>(["TERM", "KILL"]);
+
+export interface SignalExecutorDeps {
+  platform: NodeJS.Platform;
+  run: Runner;
+  signal: (pid: number, sig: NodeJS.Signals) => void;
+  collectTree: (pid: number) => number[];
+}
+
+export const defaultSignalExecutorDeps: SignalExecutorDeps = {
+  platform: process.platform,
+  run: defaultRunner,
+  signal: (pid, sig) => { process.kill(pid, sig); },
+  collectTree: collectProcessTree,
+};
+
+/** Which signals this host can actually deliver, for the client to build its menu. */
+export function supportedSignals(platform: NodeJS.Platform = process.platform): ProcessSignal[] {
+  return platform === "win32"
+    ? [...WINDOWS_SUPPORTED_SIGNALS]
+    : ["TERM", "KILL", "STOP", "CONT", "HUP", "INT", "USR1", "USR2"];
+}
+
+/** Throws on executor failure; the handler maps that to 500. */
+export async function executeSignal(
+  pid: number,
+  signal: ProcessSignal,
+  tree: boolean,
+  deps: SignalExecutorDeps = defaultSignalExecutorDeps,
+): Promise<SignalProcessResult> {
+  if (!Number.isInteger(pid) || pid <= 0) throw new Error(`Invalid PID ${pid}`);
+
+  if (deps.platform === "win32") {
+    if (!WINDOWS_SUPPORTED_SIGNALS.has(signal)) {
+      throw new Error(`Windows cannot deliver SIG${signal}`);
+    }
+    const argv = tree
+      ? ["taskkill", "/PID", String(pid), "/T", "/F"]
+      : ["taskkill", "/PID", String(pid), "/F"];
+    const r = await deps.run(argv, 5000);
+    if (r.code !== 0 || r.timedOut) {
+      throw new Error((r.stderr || r.stdout || `taskkill exited ${r.timedOut ? "on timeout" : r.code}`).trim());
+    }
+    return { pid, signal, tree, method: "taskkill", signalled: [pid] };
+  }
+
+  const posix = `SIG${signal}` as NodeJS.Signals;
+  if (!tree) {
+    deps.signal(pid, posix);
+    return { pid, signal, tree: false, method: "signal", signalled: [pid] };
+  }
+
+  // Enumerate BEFORE signalling: SIGKILL on the root reparents its children to
+  // init, and the tree can no longer be recovered afterwards. Children are
+  // signalled first so a parent cannot fork a replacement mid-sweep.
+  const pids = deps.collectTree(pid);
+  const signalled: number[] = [];
+  for (const target of pids) {
+    // A process exiting between the walk and the signal is the normal case here,
+    // not a failure of the request — it is simply not in the result.
+    try {
+      deps.signal(target, posix);
+      signalled.push(target);
+    } catch { /* already gone */ }
+  }
+  return { pid, signal, tree: true, method: "signal", signalled };
+}

package/src/services/system-metrics/signal-request-handler.ts

@@ -0,0 +1,92 @@
+/**
+ * The signal decision chain, transport-free like the kill one and deliberately
+ * built from the SAME parts: parse → live re-query → identity check → guard on
+ * the FRESH name → execute.
+ *
+ * The guard is `checkKillAllowed` unchanged. A SIGSTOP on systemd wedges the
+ * machine as thoroughly as a SIGKILL would, and SIGSTOP on PPM's own supervisor
+ * hangs every session — "can this process be signalled" and "can this process be
+ * ended" are the same question, so they must not be two lists that can drift.
+ */
+import type {
+  MetricsPlatform, ProcessSignal, SignalProcessRequest, SignalProcessResult,
+} from "../../types/system-metrics.ts";
+import { PROCESS_SIGNALS } from "../../types/system-metrics.ts";
+import { ok, err, type ApiResponse } from "../../types/api.ts";
+import type { ProcessCollector } from "./process-collector-types.ts";
+import { identityMatches, resolveLiveProcess } from "./kill-identity-resolver.ts";
+import { checkKillAllowed } from "./kill-guard.ts";
+import type { ProtectedPids } from "./ppm-protected-pids.ts";
+
+export interface SignalHandlerDeps {
+  platform: MetricsPlatform;
+  collector: ProcessCollector;
+  resolveProtected: (isAlive: (pid: number) => boolean, nameOf: (pid: number) => string | undefined) => ProtectedPids;
+  execute: (pid: number, signal: ProcessSignal, tree: boolean) => Promise<SignalProcessResult>;
+  /** Signals this host can deliver; anything else is a 400 before any re-query. */
+  supported: readonly ProcessSignal[];
+  /** Audit line: pid + name + signal + result ONLY. `~/.ppm/ppm.log`'s tail is
+   *  served unauthenticated by `/api/logs/recent`, so no command line here. */
+  log: (line: string) => void;
+}
+
+export type SignalStatus = 200 | 400 | 403 | 404 | 409 | 500;
+
+export interface SignalOutcome {
+  status: SignalStatus;
+  body: ApiResponse<SignalProcessResult>;
+}
+
+export function parseSignalRequest(body: unknown): SignalProcessRequest | null {
+  if (!body || typeof body !== "object") return null;
+  const b = body as Record<string, unknown>;
+  if (typeof b.pid !== "number" || !Number.isInteger(b.pid) || b.pid <= 0) return null;
+  if (typeof b.startedAt !== "number" || !Number.isFinite(b.startedAt) || b.startedAt < 0) return null;
+  if (b.tree !== undefined && typeof b.tree !== "boolean") return null;
+  if (typeof b.signal !== "string" || !PROCESS_SIGNALS.includes(b.signal as ProcessSignal)) return null;
+  return { pid: b.pid, startedAt: b.startedAt, signal: b.signal as ProcessSignal, tree: b.tree === true };
+}
+
+export async function handleSignalRequest(body: unknown, deps: SignalHandlerDeps): Promise<SignalOutcome> {
+  const req = parseSignalRequest(body);
+  if (!req) {
+    return { status: 400, body: err(`Body must be {pid, startedAt, signal: one of ${PROCESS_SIGNALS.join("|")}, tree?}`) };
+  }
+  if (!deps.supported.includes(req.signal)) {
+    return { status: 400, body: err(`This host cannot deliver SIG${req.signal}`) };
+  }
+  const tree = req.tree === true;
+
+  const { live, maps } = await resolveLiveProcess(req.pid, deps.collector);
+  if (!live) return { status: 404, body: err(`PID ${req.pid} is no longer running`) };
+  if (!identityMatches(req.startedAt, live.startedAt)) {
+    return { status: 409, body: err(`PID ${req.pid} was recycled — refresh and try again`) };
+  }
+
+  const protectedPids = deps.resolveProtected(
+    (pid) => maps.byPid.has(pid),
+    (pid) => maps.byPid.get(pid)?.name.toLowerCase(),
+  );
+  const verdict = checkKillAllowed({ pid: live.pid, name: live.name }, tree, {
+    platform: deps.platform,
+    protectedPids: protectedPids.pids,
+    ppidOf: maps.ppidOf,
+    startedAtOf: maps.startedAtOf,
+  });
+  const prefix = `[SystemMetrics] signal=${req.signal} pid=${live.pid} name=${live.name} tree=${tree}`;
+  if (!verdict.allowed) {
+    deps.log(`${prefix} → refused: ${verdict.reason}`);
+    return { status: 403, body: err(verdict.reason ?? "Refused") };
+  }
+
+  deps.log(`${prefix} → allowed`);
+  try {
+    const result = await deps.execute(live.pid, req.signal, tree);
+    deps.log(`${prefix} → done (${result.signalled.length} signalled)`);
+    return { status: 200, body: ok(result) };
+  } catch (e) {
+    const message = (e as Error)?.message ?? String(e);
+    deps.log(`${prefix} → failed: ${message}`);
+    return { status: 500, body: err(`Failed to signal PID ${live.pid}: ${message}`) };
+  }
+}

package/src/services/system-metrics/system-metrics-platform.ts

@@ -1,9 +1,14 @@
 /** Per-OS collector wiring for the snapshot service. Nothing here spawns until
  *  a full-tier tick actually calls a collector. */
 import type { MetricsPlatform } from "../../types/system-metrics.ts";
+import type { AppCollector } from "../system-services/apps-linux.ts";
+import { createLinuxAppCollector } from "../system-services/apps-linux.ts";
 import type { ProcessCollector } from "./process-collector-types.ts";
 import { EMPTY_PROCESS_COLLECTOR } from "./process-collector-types.ts";
 import type { DiskNetCounters } from "./disk-net-collector-linux.ts";
+import type { DeviceCollector } from "./device-collector-types.ts";
+import { collectLinuxDevices } from "./device-collector-linux.ts";
+import { createDrmGpuCollector } from "./gpu-fdinfo-linux.ts";
 import { collectLinuxDiskNet } from "./disk-net-collector-linux.ts";
 import { collectDarwinDiskNet } from "./disk-net-collector-darwin.ts";
 import { createNvidiaGpuCollector, type GpuCollector } from "./gpu-collector-nvidia.ts";
@@ -20,6 +25,12 @@ export interface PlatformCollectors {
   /** Null on win32: the counters ride along in the process round trip. */
   diskNet: (() => Promise<DiskNetCounters>) | null;
   gpus: GpuCollector;
+  /** Per-drive and per-interface figures. Null where the host has no source for
+   *  them, which the client reads as "this machine lists no devices". */
+  devices: DeviceCollector | null;
+  /** Desktop applications with a live process. Null off Linux, which has neither
+   *  .desktop entries in the XDG sense nor app cgroups to read them from. */
+  apps: AppCollector | null;
 }
 
 export function toMetricsPlatform(p: NodeJS.Platform = process.platform): MetricsPlatform {
@@ -30,22 +41,37 @@ export function createPlatformCollectors(platform: MetricsPlatform = toMetricsPl
   const gpus = createNvidiaGpuCollector();
   switch (platform) {
     case "win32":
-      return { platform, processes: createWindowsProcessCollector(), diskNet: null, gpus };
+      return { platform, processes: createWindowsProcessCollector(), diskNet: null, gpus, devices: null, apps: null };
     case "darwin":
       return {
         platform,
         processes: createDarwinProcessCollector(undefined, undefined, { net: createDarwinProcessNetCollector() }),
         diskNet: () => collectDarwinDiskNet(),
         gpus,
+        devices: null,
+        apps: null,
       };
-    case "linux":
+    case "linux": {
+      // ONE collector for both: the whole-GPU figures and the process rows are
+      // built from the same `/proc` walk, so they can never disagree, and the
+      // walk is paid for once per tick rather than twice.
+      const drm = createDrmGpuCollector();
+      // Its desktop-entry scan is lazy, so a host where nobody opens the Apps
+      // page never pays for it.
+      const apps = createLinuxAppCollector();
       return {
         platform,
-        processes: createLinuxProcessCollector(readProcTable, { gpuMemory: createNvidiaProcessMemoryCollector() }),
+        processes: createLinuxProcessCollector(readProcTable, {
+          gpuMemory: createNvidiaProcessMemoryCollector(),
+          drm,
+        }),
         diskNet: async () => collectLinuxDiskNet(),
         gpus,
+        devices: (prev) => collectLinuxDevices(prev, drm),
+        apps: (processes) => apps.collect(processes),
       };
+    }
     default:
-      return { platform, processes: EMPTY_PROCESS_COLLECTOR, diskNet: null, gpus };
+      return { platform, processes: EMPTY_PROCESS_COLLECTOR, diskNet: null, gpus, devices: null, apps: null };
   }
 }