@hienlh/ppm 0.23.6 → 0.23.7

package/src/services/system-metrics/process-collector-linux.ts

@@ -4,14 +4,20 @@
  * already anchors the `/proc/<pid>/stat` parse on the last `)` so a process
  * name containing spaces cannot shift the fields.
  *
- * Per-process VRAM needs the one `nvidia-smi` call; per-process GPU busy % has
- * no unprivileged source at all, so `gpuPct` stays undefined here.
+ * Per-process VRAM needs the one `nvidia-smi` call. Per-process GPU busy % comes
+ * from DRM fdinfo where the driver publishes it (Intel, AMD) — the proprietary
+ * NVIDIA driver publishes neither, so an NVIDIA-only host still fills memory
+ * alone.
  */
 import { readProcTable, type ProcEntry } from "../proc-table-linux.ts";
 import type { ProcessCollection, ProcessCollector, RawProcessRow } from "./process-collector-types.ts";
 import { createStickyColumns } from "./process-collector-types.ts";
 import { readProcIoBytes, type ProcIoBytes } from "./process-io-linux.ts";
+import { readProcSwapMB } from "./process-swap-linux.ts";
+import { realLinuxFs } from "./linux-fs.ts";
+import { serviceKeyFromCgroup } from "../system-services/app-cgroup-linux.ts";
 import type { ProcessGpuMemoryCollector } from "./gpu-process-memory-nvidia.ts";
+import type { DrmGpuCollector } from "./gpu-fdinfo-linux.ts";
 
 const KB_PER_MB = 1024;
 
@@ -36,10 +42,20 @@ export function procEntriesToRows(entries: readonly ProcEntry[]): RawProcessRow[
 export interface LinuxProcessCollectorOptions {
   /** Injected so unit tests never touch a real `/proc`. */
   readIo?: (pid: number) => ProcIoBytes | null;
+  /** `VmSwap` for one pid, MB. Null = gone or unreadable. */
+  readSwap?: (pid: number) => number | null;
+  /** `/proc/<pid>/cgroup` for one pid, used only to name its systemd unit. */
+  readCgroup?: (pid: number) => string | null;
+  /** Whose `systemctl --user` the Services page is reading. Defaults to this
+   *  process's own uid. */
+  selfUid?: number;
   /** Omitted or null → no per-process VRAM query at all. The production wiring
    *  in `system-metrics-platform.ts` injects it; defaulting to a real collector
    *  here would make an innocent unit test spawn `nvidia-smi`. */
   gpuMemory?: ProcessGpuMemoryCollector | null;
+  /** Shared with the whole-GPU collector: it memoises one `/proc` walk per tick,
+   *  so whichever of the two asks first pays for it and both see the same numbers. */
+  drm?: DrmGpuCollector | null;
 }
 
 export function createLinuxProcessCollector(
@@ -47,7 +63,17 @@ export function createLinuxProcessCollector(
   opts: LinuxProcessCollectorOptions = {},
 ): ProcessCollector {
   const readIo = opts.readIo ?? readProcIoBytes;
+  const readSwap = opts.readSwap ?? readProcSwapMB;
+  // The Apps page reads the same file under a DIFFERENT rule (it wants the
+  // outermost app unit, this wants the innermost unit of any kind), so the two
+  // cannot share one read without one of them getting the wrong answer. 1.3 ms
+  // for 561 pids, measured on this host.
+  const readCgroup = opts.readCgroup ?? ((pid: number) => realLinuxFs.read(`/proc/${pid}/cgroup`));
+  // Which user manager is "ours" — a unit of another uid is not on the Services
+  // page at all, so its processes must not land on our same-named row.
+  const selfUid = opts.selfUid ?? process.getuid?.() ?? 0;
   const gpuMemory = opts.gpuMemory ?? null;
+  const drm = opts.drm ?? null;
   const observeColumns = createStickyColumns();
 
   return {
@@ -58,28 +84,54 @@ export function createLinuxProcessCollector(
         return { rows: [], columns: observeColumns({}), warnings: ["Process list unavailable: /proc is not readable"] };
       }
       const gpuMemByPid = (await gpuMemory?.collect()) ?? null;
+      const drmByPid = drm?.usage().perProcess ?? null;
 
       let anyIo = false;
+      let anySwap = false;
       const rows = procEntriesToRows(table).map((r) => {
         // EACCES for another user's process is expected, not an error: that row
         // simply has no disk figures.
         const io = readIo(r.pid);
         if (io) anyIo = true;
+        // Both sources list only the processes actually using the GPU, so a
+        // missing pid means "measured, holding none" — not "unknown".
+        const drmRow = drmByPid?.get(r.pid);
+        const nvidiaMem = gpuMemByPid ? gpuMemByPid.get(r.pid) ?? 0 : undefined;
+        const drmMem = drmByPid ? (drmRow ? drmRow.vramMB + drmRow.sharedMB : 0) : undefined;
+        // A process that exited between the table read and now has neither; both
+        // stay absent for that row rather than being reported as zero.
+        const swapMB = readSwap(r.pid);
+        if (swapMB !== null) anySwap = true;
+        const unitKey = serviceKeyFromCgroup(readCgroup(r.pid) ?? "", selfUid);
         return {
           ...r,
+          ...(swapMB === null ? {} : { swapMB }),
+          ...(unitKey === null ? {} : { unitKey }),
           diskReadBytes: io?.readBytes,
           diskWriteBytes: io?.writeBytes,
-          // The query lists only processes holding VRAM, so a missing pid means
-          // "measured, holding none".
-          gpuMemMB: gpuMemByPid ? gpuMemByPid.get(r.pid) ?? 0 : undefined,
+          ...(drmByPid ? { gpuPct: drmRow?.gpuPct ?? 0 } : {}),
+          gpuMemMB: sumDefined(nvidiaMem, drmMem),
         };
       });
 
       return {
         rows,
-        columns: observeColumns({ disk: anyIo, gpu: gpuMemByPid !== null }),
+        columns: observeColumns({
+          disk: anyIo,
+          gpu: gpuMemByPid !== null || drmByPid !== null,
+          swap: anySwap,
+        }),
         warnings: [],
       };
     },
   };
 }
+
+/** Undefined only when NEITHER source measured anything — a host with one of the
+ *  two must not report "unknown" for a figure it really does have. */
+function sumDefined(a: number | undefined, b: number | undefined): number | undefined {
+  if (a === undefined && b === undefined) return undefined;
+  return round1((a ?? 0) + (b ?? 0));
+}
+
+const round1 = (n: number) => Math.round(n * 10) / 10;

package/src/services/system-metrics/process-collector-types.ts

@@ -13,6 +13,12 @@ export interface RawProcessRow {
   /** Cumulative CPU time (user + kernel), milliseconds. */
   cpuMs: number;
   ramMB: number;
+  /** Swapped-out anonymous memory, MB. `undefined` = this OS has no per-process
+   *  source; 0 is a real reading (a kernel thread has no address space). */
+  swapMB?: number;
+  /** `"<scope>:<unit>"` — which Services row owns this pid. Absent off systemd,
+   *  for a pid in no unit, and for another user's units. */
+  unitKey?: string;
   /** Epoch ms UTC; 0 when unknown. */
   startedAt: number;
   /** CUMULATIVE per-process byte counters. The rows builder turns them into
@@ -49,7 +55,7 @@ export interface ProcessCollector {
 
 /** Frozen: it is shared by every light-tier snapshot, so an accidental mutation
  *  would rewrite history for all of them. */
-export const NO_PROCESS_COLUMNS: ProcessColumnAvailability = Object.freeze({ disk: false, gpu: false, net: false });
+export const NO_PROCESS_COLUMNS: ProcessColumnAvailability = Object.freeze({ disk: false, gpu: false, net: false, swap: false });
 
 /**
  * Sticky column availability. A capability is advertised as soon as it has
@@ -64,6 +70,7 @@ export function createStickyColumns(): (seen: Partial<ProcessColumnAvailability>
     state.disk ||= seen.disk === true;
     state.gpu ||= seen.gpu === true;
     state.net ||= seen.net === true;
+    state.swap ||= seen.swap === true;
     return { ...state };
   };
 }

package/src/services/system-metrics/process-details-darwin.ts

@@ -0,0 +1,166 @@
+/**
+ * The same Details dialog as `process-details-linux.ts`, for macOS.
+ *
+ * It exists because the dialog was *lying* there: the service answered `null`
+ * for every non-Linux platform and the route turned that into a 404 reading
+ * "PID <n> is no longer running" — a sentence that is correct on Linux, where a
+ * vanished `/proc/<pid>` really does mean the process exited, and simply untrue
+ * anywhere else. A process sitting in the table at 4.2% CPU was reported dead.
+ *
+ * macOS has no `/proc`, but `ps` answers ten of the eleven fields, and two of
+ * them more directly than Linux does: `lstart` is a real timestamp rather than
+ * jiffies to be added to `btime`, and `user` is the login name already, so no
+ * `/etc/passwd` lookup is needed and it works across users. Only `cgroup` has no
+ * equivalent — macOS has no such concept — and it stays null, which the page
+ * draws as an em dash: the honest answer rather than an invented one.
+ *
+ * Measured on an M1 Max: `ps` for one pid 29.7 ms, `ps -M` 32.5 ms, `lsof` 37.5
+ * ms. The last three run concurrently, so a dialog costs about two spawns' wall
+ * time. That is affordable only because this is on-demand — it must never be
+ * moved onto the tick, which is the same rule the Linux module states.
+ */
+import type { ProcessDetails } from "../../types/system-metrics.ts";
+import { redactSecrets } from "../redact-secrets.ts";
+import { defaultRunner, type Runner } from "../host-info/spawn-runner.ts";
+
+/**
+ * BSD's state letters, which are NOT Linux's. The one that catches people is
+ * **U**: uninterruptible wait, spelled `D` on Linux. `I` is also real here —
+ * macOS marks a process idle once it has slept more than 20 seconds — and `Z`
+ * is far from rare: this host had 126 zombies against 645 sleepers.
+ */
+export const DARWIN_PROCESS_STATES: Record<string, string> = {
+  R: "Running", S: "Sleeping", I: "Idle", T: "Stopped",
+  U: "Uninterruptible sleep", Z: "Zombie",
+};
+
+export interface PsFields {
+  ppid: number;
+  state: string | null;
+  nice: number | null;
+  /** Epoch ms, or 0 when `lstart` did not parse — the UI draws 0 as an em dash. */
+  startedAt: number;
+  user: string | null;
+  exe: string | null;
+}
+
+/**
+ * One line of `ps -o ppid=,stat=,nice=,lstart=,user=,comm=`, e.g.
+ * `    1 S     0 Tue Sep  8 10:05:03 2026     thawng /System/…/Finder`
+ *
+ * Split by position, not by a delimiter, because `ps` on macOS offers none —
+ * and two fields contain spaces. `lstart` is **always five tokens** (verified
+ * across all 740 processes on a live host: a single-digit day pads with two
+ * spaces, which collapses on a `\s+` split rather than dropping a token), so
+ * every field up to `user` is at a fixed index and `comm` is whatever is left.
+ * It has to be last for that reason: a path like
+ * `/Applications/Google Chrome.app/…/Google Chrome Helper (Renderer)` holds six
+ * spaces, so anything after it could not be found again.
+ */
+export function parsePsLine(text: string | null | undefined): PsFields | null {
+  const line = (text ?? "").trim();
+  if (!line) return null;
+  const t = line.split(/\s+/);
+  // ppid, stat, nice, five for lstart, user — comm may legitimately be empty.
+  if (t.length < 9) return null;
+
+  const ppid = Number(t[0]);
+  if (!Number.isInteger(ppid) || ppid < 0) return null;
+
+  const nice = Number(t[2]);
+  const started = Date.parse(t.slice(3, 8).join(" "));
+  const exe = t.slice(9).join(" ");
+
+  return {
+    ppid,
+    state: DARWIN_PROCESS_STATES[t[1]![0] ?? ""] ?? null,
+    nice: Number.isFinite(nice) ? nice : null,
+    startedAt: Number.isFinite(started) ? started : 0,
+    user: t[8] || null,
+    exe: exe || null,
+  };
+}
+
+/**
+ * Thread count from a bare `ps -M -p <pid>` dump: one header line, then one line
+ * per thread.
+ *
+ * `-M` may not be combined with `-o` — asking for both prints the chosen columns
+ * AND leftovers of the thread layout on the same line, which parses as nonsense
+ * rather than failing, so this is deliberately a second call against the default
+ * format rather than a column added to the first.
+ */
+export function parseThreadCount(text: string | null | undefined): number | null {
+  const lines = (text ?? "").split("\n").filter((l) => l.trim().length > 0);
+  return lines.length > 1 ? lines.length - 1 : null;
+}
+
+/**
+ * `lsof -a -p <pid> -d cwd -Fn` in its machine-readable form: one field per
+ * line, prefixed by its type, `n` being the name.
+ *
+ * Another user's working directory comes back as exit 0 with **no output at
+ * all** rather than an error, which is the normal case on any machine with
+ * daemons on it — the same "absent, not failed" reading the Linux module gives
+ * an EACCES on `/proc/<pid>/cwd`.
+ */
+export function parseLsofCwd(text: string | null | undefined): string | null {
+  for (const line of (text ?? "").split("\n")) {
+    if (line.startsWith("n")) return line.slice(1).trim() || null;
+  }
+  return null;
+}
+
+/** The last path segment, for the `name` field — macOS has no `comm` truncated
+ *  to 15 characters to take it from, only the executable's full path. */
+function baseName(exe: string | null): string | null {
+  if (!exe) return null;
+  const cut = exe.lastIndexOf("/");
+  return (cut >= 0 ? exe.slice(cut + 1) : exe) || null;
+}
+
+/**
+ * Null when the pid is gone, which `ps` reports as a non-zero exit with nothing
+ * on stdout — so the route's "no longer running" is finally true when it is said.
+ */
+export async function readProcessDetailsDarwin(
+  pid: number,
+  run: Runner = defaultRunner,
+): Promise<ProcessDetails | null> {
+  if (!Number.isInteger(pid) || pid <= 0) return null;
+  const arg = String(pid);
+
+  const ps = await run(["ps", "-o", "ppid=,stat=,nice=,lstart=,user=,comm=", "-p", arg]);
+  if (ps.code !== 0) return null;
+  const fields = parsePsLine(ps.stdout);
+  if (!fields) return null;
+
+  // Concurrently: three independent spawns, and every one of them is allowed to
+  // fail on its own. A process whose command line or thread count cannot be read
+  // is still a process whose parent, user and state were just read successfully.
+  const [cmd, threads, cwd] = await Promise.all([
+    run(["ps", "-o", "command=", "-p", arg]),
+    run(["ps", "-M", "-p", arg]),
+    run(["lsof", "-a", "-p", arg, "-d", "cwd", "-Fn"]),
+  ]);
+
+  const command = cmd.code === 0 ? cmd.stdout.trim() : "";
+  return {
+    pid,
+    ppid: fields.ppid,
+    name: baseName(fields.exe) ?? arg,
+    startedAt: fields.startedAt,
+    // Redacted but NOT truncated, exactly as on Linux: showing the whole line is
+    // what this dialog is for.
+    command: command ? redactSecrets(command) : null,
+    exe: fields.exe,
+    cwd: cwd.code === 0 ? parseLsofCwd(cwd.stdout) : null,
+    user: fields.user,
+    state: fields.state,
+    threads: threads.code === 0 ? parseThreadCount(threads.stdout) : null,
+    nice: fields.nice,
+    // macOS has no cgroups. Null is the honest answer and renders as an em dash;
+    // inventing a value here would be the same mistake this file exists to undo.
+    cgroup: null,
+  };
+}

package/src/services/system-metrics/process-details-linux.ts

@@ -0,0 +1,150 @@
+/**
+ * On-demand facts for the process Details dialog — Mission Center's process
+ * properties. Fetched when the dialog opens, never per tick: it is a handful of
+ * reads per process and nobody needs `cwd` at 0.5 Hz.
+ *
+ * Every field is null when this pid's permissions do not expose it. Another
+ * user's `exe` and `cwd` are EACCES for an unprivileged PPM, which is the normal
+ * case on a shared machine and not an error.
+ */
+import type { ProcessDetails } from "../../types/system-metrics.ts";
+import { redactSecrets } from "../redact-secrets.ts";
+import { readAttr, realLinuxFs, type LinuxFs } from "./linux-fs.ts";
+
+const PROC = "/proc";
+/** Same assumption `proc-table-linux.ts` documents: 100 on every mainstream Linux. */
+const CLOCK_TICKS_PER_SEC = 100;
+
+/** The kernel's one-letter state, spelled out the way `ps` and Mission Center do. */
+export const PROCESS_STATES: Record<string, string> = {
+  R: "Running", S: "Sleeping", D: "Uninterruptible sleep", Z: "Zombie",
+  T: "Stopped", t: "Tracing stop", X: "Dead", I: "Idle", W: "Paging", K: "Wakekill",
+};
+
+export interface StatFields {
+  state: string;
+  ppid: number;
+  nice: number;
+  threads: number;
+  /** Ticks since boot. */
+  startTicks: number;
+  comm: string;
+}
+
+/**
+ * `/proc/<pid>/stat`, anchored on the LAST `)`.
+ *
+ * The second field is the executable name in parentheses and it is not escaped,
+ * so a process called `foo) 0 (bar` shifts every field after it for any parser
+ * that splits on whitespace. Anchoring on the last `)` is the only correct
+ * reading, and it is what `readProcTable` does too.
+ */
+export function parseStatFields(text: string): StatFields | null {
+  const close = text.lastIndexOf(")");
+  const open = text.indexOf("(");
+  if (close < 0 || open < 0 || close < open) return null;
+  const rest = text.slice(close + 1).trim().split(/\s+/);
+  // `rest[0]` is field 3 (state), so field N is at rest[N - 3].
+  const at = (field: number) => Number(rest[field - 3]);
+  const ppid = at(4);
+  if (!Number.isFinite(ppid)) return null;
+  return {
+    comm: text.slice(open + 1, close),
+    state: rest[0] ?? "",
+    ppid,
+    nice: at(19),
+    threads: at(20),
+    startTicks: at(22),
+  };
+}
+
+/** `/proc/stat`'s `btime` line: boot time as epoch SECONDS. */
+export function parseBootTimeSec(procStat: string | null): number | null {
+  const m = /^btime\s+(\d+)/m.exec(procStat ?? "");
+  const n = m ? Number(m[1]) : NaN;
+  return Number.isFinite(n) ? n : null;
+}
+
+/** The real uid from `/proc/<pid>/status`'s `Uid: real effective saved fs`. */
+export function parseUid(status: string | null): number | null {
+  const m = /^Uid:\s+(\d+)/m.exec(status ?? "");
+  const n = m ? Number(m[1]) : NaN;
+  return Number.isFinite(n) ? n : null;
+}
+
+/** uid → login name from `/etc/passwd`, which is world-readable by design. */
+export function lookupUser(uid: number, passwd: string | null): string | null {
+  for (const line of (passwd ?? "").split("\n")) {
+    const f = line.split(":");
+    if (f.length > 2 && Number(f[2]) === uid) return f[0] ?? null;
+  }
+  return null;
+}
+
+/** cgroup v2 writes one `0::<path>` line; v1 writes several, and the systemd
+ *  hierarchy is the one that names the unit. */
+export function parseCgroup(text: string | null): string | null {
+  const lines = (text ?? "").split("\n").filter(Boolean);
+  const v2 = lines.find((l) => l.startsWith("0::"));
+  if (v2) return v2.slice(3) || null;
+  const systemd = lines.find((l) => l.includes(":name=systemd:"));
+  const chosen = systemd ?? lines[0];
+  if (!chosen) return null;
+  const idx = chosen.indexOf(":", chosen.indexOf(":") + 1);
+  return idx >= 0 ? chosen.slice(idx + 1) || null : null;
+}
+
+export interface ProcessDetailsOptions {
+  fs?: LinuxFs;
+  /** Injected so the lookup is testable and read once per request, not per line. */
+  passwd?: () => string | null;
+}
+
+/** Null when the pid is gone (or /proc is unreadable) — the dialog then says so. */
+export function readProcessDetails(pid: number, opts: ProcessDetailsOptions = {}): ProcessDetails | null {
+  const fs = opts.fs ?? realLinuxFs;
+  if (!Number.isInteger(pid) || pid <= 0) return null;
+  const stat = fs.read(`${PROC}/${pid}/stat`);
+  const fields = stat ? parseStatFields(stat) : null;
+  if (!fields) return null;
+
+  const status = fs.read(`${PROC}/${pid}/status`);
+  const uid = parseUid(status);
+  const bootSec = parseBootTimeSec(fs.read(`${PROC}/stat`));
+  const rawCmdline = fs.read(`${PROC}/${pid}/cmdline`) ?? "";
+  // NUL-separated argv. A kernel thread has an empty cmdline, which is not a
+  // command line of "" — it has none at all.
+  const argv = rawCmdline.split("\0").filter(Boolean).join(" ");
+
+  return {
+    pid,
+    ppid: fields.ppid,
+    name: nameOf(status) ?? fields.comm,
+    startedAt: bootSec !== null && Number.isFinite(fields.startTicks)
+      ? Math.round((bootSec + fields.startTicks / CLOCK_TICKS_PER_SEC) * 1000)
+      : 0,
+    // Redacted but NOT truncated: the dialog exists to show the whole line, and
+    // the 160-char cut on a table row is a bandwidth decision, not a privacy one.
+    command: argv ? redactSecrets(argv) : null,
+    exe: fs.readlink(`${PROC}/${pid}/exe`),
+    cwd: fs.readlink(`${PROC}/${pid}/cwd`),
+    user: uid === null ? null : lookupUser(uid, (opts.passwd ?? (() => fs.read("/etc/passwd")))()),
+    state: describeState(fields.state),
+    threads: Number.isFinite(fields.threads) ? fields.threads : null,
+    nice: Number.isFinite(fields.nice) ? fields.nice : null,
+    cgroup: parseCgroup(fs.read(`${PROC}/${pid}/cgroup`)),
+  };
+}
+
+/** `/proc/<pid>/status`'s `Name:` is the same truncated comm, but without the
+ *  parenthesis quoting — preferred when present because it needs no unwrapping. */
+function nameOf(status: string | null): string | null {
+  const m = /^Name:\s*(.+)$/m.exec(status ?? "");
+  return m?.[1]?.trim() || null;
+}
+
+export function describeState(code: string): string | null {
+  if (!code) return null;
+  const word = PROCESS_STATES[code];
+  return word ? `${code} (${word})` : code;
+}

package/src/services/system-metrics/process-grouping.ts

@@ -16,7 +16,7 @@ const POSIX_BOUNDARY_NAMES: ReadonlySet<string> = new Set(["launchd", "systemd",
 const round1 = (n: number): number => Math.round(n * 10) / 10;
 
 /** The optional per-process columns, which roll up by summation. */
-type OptionalMetric = "diskReadBps" | "diskWriteBps" | "gpuPct" | "gpuMemMB" | "netInBps" | "netOutBps";
+type OptionalMetric = "swapMB" | "diskReadBps" | "diskWriteBps" | "gpuPct" | "gpuMemMB" | "netInBps" | "netOutBps";
 
 /**
  * Sum over the members that HAVE a value; `undefined` when none does, so a
@@ -129,6 +129,7 @@ export function groupProcesses(
       count: g.procs.length,
       ppm: g.procs.some((p) => p.ppm),
       pids: g.procs.map((p) => p.pid),
+      swapMB: sumOptional(g.procs, "swapMB"),
       diskReadBps: sumOptional(g.procs, "diskReadBps"),
       diskWriteBps: sumOptional(g.procs, "diskWriteBps"),
       gpuPct: sumOptional(g.procs, "gpuPct"),

package/src/services/system-metrics/process-rows-builder.ts

@@ -93,6 +93,8 @@ export function buildProcessRows(input: BuildRowsInput): BuiltRows {
       command: sanitizeCommand(r.command, r.name),
       cpu: percentByKey.get(key) ?? 0,
       ramMB: Math.round(r.ramMB * 10) / 10,
+      ...(r.swapMB === undefined ? {} : { swapMB: Math.round(r.swapMB * 10) / 10 }),
+      ...(r.unitKey === undefined ? {} : { unitKey: r.unitKey }),
       startedAt: r.startedAt,
       ppm: ppmPids.has(r.pid),
       protected: !checkKillAllowed({ pid: r.pid, name: r.name }, false, guardCtx).allowed,

package/src/services/system-metrics/process-swap-linux.ts

@@ -0,0 +1,37 @@
+/**
+ * Per-process swap — Mission Center's Swap column, on the process table and on
+ * every Services row.
+ *
+ * `VmSwap` in `/proc/<pid>/status` is the only cheap source: `smaps_rollup` also
+ * carries it but walks every mapping, and on a 560-process desktop that is the
+ * difference between a few milliseconds and a tick that misses its deadline.
+ * Measured here: the whole table costs 3.2 ms, beside the 1.7 ms `/proc/<pid>/io`
+ * already pays every tick.
+ *
+ * A kernel thread has no address space and so no `VmSwap` line at all. That is
+ * 0 swapped bytes, not an unmeasurable one — the distinction matters because the
+ * table renders `undefined` as an em dash, and 335 of this host's 561 rows would
+ * otherwise be dashes on a column that really does read zero for them.
+ */
+import { readFileSync } from "node:fs";
+
+const KB_PER_MB = 1024;
+
+/** `VmSwap` in kB from a `/proc/<pid>/status` dump. A process with an address
+ *  space always has the line; one without is a kernel thread, i.e. 0. */
+export function parseVmSwapKB(status: string): number {
+  const m = /^VmSwap:\s+(\d+)\s*kB/m.exec(status);
+  if (!m) return 0;
+  const kb = Number(m[1]);
+  return Number.isFinite(kb) ? kb : 0;
+}
+
+/** Swapped MB for one pid, or null when the process is gone or unreadable —
+ *  another user's process is expected to refuse, and that row simply has none. */
+export function readProcSwapMB(pid: number): number | null {
+  try {
+    return parseVmSwapKB(readFileSync(`/proc/${pid}/status`, "utf-8")) / KB_PER_MB;
+  } catch {
+    return null;
+  }
+}

package/src/services/system-metrics/signal-executor.ts

@@ -0,0 +1,84 @@
+/**
+ * Delivers ONE signal to a process, or to its whole collected tree — Mission
+ * Center's "Send Signal" submenu. Separate from `executeKill` on purpose: a kill
+ * escalates SIGTERM to SIGKILL after a grace period, which is right for "end this
+ * process" and wrong for every other signal. Asking for SIGSTOP must send SIGSTOP
+ * and nothing else.
+ *
+ * Pids are validated integers passed to `process.kill` or as argv elements —
+ * never interpolated into a shell string.
+ */
+import type { ProcessSignal, SignalProcessResult } from "../../types/system-metrics.ts";
+import type { Runner } from "../host-info/spawn-runner.ts";
+import { defaultRunner } from "../host-info/spawn-runner.ts";
+import { collectProcessTree } from "../windows-process-tree.ts";
+
+/** Windows has no signals. `taskkill` is the only delivery there and it can only
+ *  mean "end it", so those two map and the rest are refused with a reason. */
+export const WINDOWS_SUPPORTED_SIGNALS: ReadonlySet<ProcessSignal> = new Set<ProcessSignal>(["TERM", "KILL"]);
+
+export interface SignalExecutorDeps {
+  platform: NodeJS.Platform;
+  run: Runner;
+  signal: (pid: number, sig: NodeJS.Signals) => void;
+  collectTree: (pid: number) => number[];
+}
+
+export const defaultSignalExecutorDeps: SignalExecutorDeps = {
+  platform: process.platform,
+  run: defaultRunner,
+  signal: (pid, sig) => { process.kill(pid, sig); },
+  collectTree: collectProcessTree,
+};
+
+/** Which signals this host can actually deliver, for the client to build its menu. */
+export function supportedSignals(platform: NodeJS.Platform = process.platform): ProcessSignal[] {
+  return platform === "win32"
+    ? [...WINDOWS_SUPPORTED_SIGNALS]
+    : ["TERM", "KILL", "STOP", "CONT", "HUP", "INT", "USR1", "USR2"];
+}
+
+/** Throws on executor failure; the handler maps that to 500. */
+export async function executeSignal(
+  pid: number,
+  signal: ProcessSignal,
+  tree: boolean,
+  deps: SignalExecutorDeps = defaultSignalExecutorDeps,
+): Promise<SignalProcessResult> {
+  if (!Number.isInteger(pid) || pid <= 0) throw new Error(`Invalid PID ${pid}`);
+
+  if (deps.platform === "win32") {
+    if (!WINDOWS_SUPPORTED_SIGNALS.has(signal)) {
+      throw new Error(`Windows cannot deliver SIG${signal}`);
+    }
+    const argv = tree
+      ? ["taskkill", "/PID", String(pid), "/T", "/F"]
+      : ["taskkill", "/PID", String(pid), "/F"];
+    const r = await deps.run(argv, 5000);
+    if (r.code !== 0 || r.timedOut) {
+      throw new Error((r.stderr || r.stdout || `taskkill exited ${r.timedOut ? "on timeout" : r.code}`).trim());
+    }
+    return { pid, signal, tree, method: "taskkill", signalled: [pid] };
+  }
+
+  const posix = `SIG${signal}` as NodeJS.Signals;
+  if (!tree) {
+    deps.signal(pid, posix);
+    return { pid, signal, tree: false, method: "signal", signalled: [pid] };
+  }
+
+  // Enumerate BEFORE signalling: SIGKILL on the root reparents its children to
+  // init, and the tree can no longer be recovered afterwards. Children are
+  // signalled first so a parent cannot fork a replacement mid-sweep.
+  const pids = deps.collectTree(pid);
+  const signalled: number[] = [];
+  for (const target of pids) {
+    // A process exiting between the walk and the signal is the normal case here,
+    // not a failure of the request — it is simply not in the result.
+    try {
+      deps.signal(target, posix);
+      signalled.push(target);
+    } catch { /* already gone */ }
+  }
+  return { pid, signal, tree: true, method: "signal", signalled };
+}