@jshookmcp/jshook 0.2.3 → 0.2.6

package/dist/src/modules/process/memory/regions.protection.js

@@ -1,123 +1,123 @@
-import { readFileSync } from 'fs';
+import { promises as fsAsync } from 'fs';
 import { logger } from '../../../utils/logger.js';
 import { execAsync, executePowerShellScript, } from '../../process/memory/types.js';
-import { parseProcMaps, formatLinuxProtection } from './linux/mapsParser.js';
 import { nativeMemoryManager } from '../../../native/NativeMemoryManager.js';
 import { isKoffiAvailable } from '../../../native/NativeMemoryManager.utils.js';
+import { parseProcMaps, formatLinuxProtection } from './linux/mapsParser.js';
 function buildProtectionCheckScript(pid, address) {
-    return `
-Add-Type @"
-using System;
-using System.Runtime.InteropServices;
-using System.ComponentModel;
-
-public class ProtectionChecker {
-    [DllImport("kernel32.dll", SetLastError = true)]
-    public static extern IntPtr OpenProcess(int access, bool inherit, int pid);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    public static extern int VirtualQueryEx(IntPtr hProcess, IntPtr addr, out MEMORY_BASIC_INFORMATION info, int size);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    public static extern bool CloseHandle(IntPtr handle);
-
-    const int PROCESS_QUERY_INFORMATION = 0x0400;
-
-    [StructLayout(LayoutKind.Sequential)]
-    public struct MEMORY_BASIC_INFORMATION {
-        public IntPtr BaseAddress;
-        public IntPtr AllocationBase;
-        public uint AllocationProtect;
-        public IntPtr RegionSize;
-        public uint State;
-        public uint Protect;
-        public uint Type;
-    }
-
-    const uint MEM_COMMIT = 0x1000;
-    const uint PAGE_NOACCESS = 0x01;
-    const uint PAGE_READONLY = 0x02;
-    const uint PAGE_READWRITE = 0x04;
-    const uint PAGE_WRITECOPY = 0x08;
-    const uint PAGE_EXECUTE = 0x10;
-    const uint PAGE_EXECUTE_READ = 0x20;
-    const uint PAGE_EXECUTE_READWRITE = 0x40;
-    const uint PAGE_EXECUTE_WRITECOPY = 0x80;
-    const uint PAGE_GUARD = 0x100;
-
-    public static object CheckProtection(int pid, long address) {
-        IntPtr hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, false, pid);
-        if (hProcess == IntPtr.Zero) {
-            int error = Marshal.GetLastWin32Error();
-            throw new Win32Exception(error, "Failed to open process. Run as Administrator.");
-        }
-
-        try {
-            MEMORY_BASIC_INFORMATION info;
-            int infoSize = Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION));
-            int result = VirtualQueryEx(hProcess, (IntPtr)address, out info, infoSize);
-
-            if (result != infoSize) {
-                return new { success = false, error = "Failed to query memory region" };
-            }
-
-            if (info.State != MEM_COMMIT) {
-                return new {
-                    success = true,
-                    protection = "NOT_COMMITTED",
-                    isWritable = false,
-                    isReadable = false,
-                    isExecutable = false,
-                    regionStart = "0x" + info.BaseAddress.ToInt64().ToString("X"),
-                    regionSize = info.RegionSize.ToInt64()
-                };
-            }
-
-            uint protect = info.Protect;
-            string protectionStr = "";
-            bool isWritable = false;
-            bool isReadable = false;
-            bool isExecutable = false;
-
-            if ((protect & PAGE_NOACCESS) != 0) protectionStr += "NOACCESS ";
-            if ((protect & PAGE_READONLY) != 0) { protectionStr += "R "; isReadable = true; }
-            if ((protect & PAGE_READWRITE) != 0) { protectionStr += "RW "; isReadable = true; isWritable = true; }
-            if ((protect & PAGE_WRITECOPY) != 0) { protectionStr += "WC "; isReadable = true; isWritable = true; }
-            if ((protect & PAGE_EXECUTE) != 0) { protectionStr += "X "; isExecutable = true; }
-            if ((protect & PAGE_EXECUTE_READ) != 0) { protectionStr += "RX "; isReadable = true; isExecutable = true; }
-            if ((protect & PAGE_EXECUTE_READWRITE) != 0) { protectionStr += "RWX "; isReadable = true; isWritable = true; isExecutable = true; }
-            if ((protect & PAGE_EXECUTE_WRITECOPY) != 0) { protectionStr += "RWCX "; isReadable = true; isWritable = true; isExecutable = true; }
-            if ((protect & PAGE_GUARD) != 0) protectionStr += "GUARD ";
-
-            return new {
-                success = true,
-                protection = protectionStr.Trim(),
-                isWritable = isWritable,
-                isReadable = isReadable,
-                isExecutable = isExecutable,
-                regionStart = "0x" + info.BaseAddress.ToInt64().ToString("X"),
-                regionSize = info.RegionSize.ToInt64()
-            };
-        } finally {
-            CloseHandle(hProcess);
-        }
-    }
-}
-"@
-
-try {
-    $result = [ProtectionChecker]::CheckProtection(${pid}, ${address})
-    $result | ConvertTo-Json -Compress
-} catch {
-    @{ success = $false; error = $_.Exception.Message } | ConvertTo-Json -Compress
-}
+    return `
+Add-Type @"
+using System;
+using System.Runtime.InteropServices;
+using System.ComponentModel;
+
+public class ProtectionChecker {
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr OpenProcess(int access, bool inherit, int pid);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern int VirtualQueryEx(IntPtr hProcess, IntPtr addr, out MEMORY_BASIC_INFORMATION info, int size);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool CloseHandle(IntPtr handle);
+
+    const int PROCESS_QUERY_INFORMATION = 0x0400;
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct MEMORY_BASIC_INFORMATION {
+        public IntPtr BaseAddress;
+        public IntPtr AllocationBase;
+        public uint AllocationProtect;
+        public IntPtr RegionSize;
+        public uint State;
+        public uint Protect;
+        public uint Type;
+    }
+
+    const uint MEM_COMMIT = 0x1000;
+    const uint PAGE_NOACCESS = 0x01;
+    const uint PAGE_READONLY = 0x02;
+    const uint PAGE_READWRITE = 0x04;
+    const uint PAGE_WRITECOPY = 0x08;
+    const uint PAGE_EXECUTE = 0x10;
+    const uint PAGE_EXECUTE_READ = 0x20;
+    const uint PAGE_EXECUTE_READWRITE = 0x40;
+    const uint PAGE_EXECUTE_WRITECOPY = 0x80;
+    const uint PAGE_GUARD = 0x100;
+
+    public static object CheckProtection(int pid, long address) {
+        IntPtr hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, false, pid);
+        if (hProcess == IntPtr.Zero) {
+            int error = Marshal.GetLastWin32Error();
+            throw new Win32Exception(error, "Failed to open process. Run as Administrator.");
+        }
+
+        try {
+            MEMORY_BASIC_INFORMATION info;
+            int infoSize = Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION));
+            int result = VirtualQueryEx(hProcess, (IntPtr)address, out info, infoSize);
+
+            if (result != infoSize) {
+                return new { success = false, error = "Failed to query memory region" };
+            }
+
+            if (info.State != MEM_COMMIT) {
+                return new {
+                    success = true,
+                    protection = "NOT_COMMITTED",
+                    isWritable = false,
+                    isReadable = false,
+                    isExecutable = false,
+                    regionStart = "0x" + info.BaseAddress.ToInt64().ToString("X"),
+                    regionSize = info.RegionSize.ToInt64()
+                };
+            }
+
+            uint protect = info.Protect;
+            string protectionStr = "";
+            bool isWritable = false;
+            bool isReadable = false;
+            bool isExecutable = false;
+
+            if ((protect & PAGE_NOACCESS) != 0) protectionStr += "NOACCESS ";
+            if ((protect & PAGE_READONLY) != 0) { protectionStr += "R "; isReadable = true; }
+            if ((protect & PAGE_READWRITE) != 0) { protectionStr += "RW "; isReadable = true; isWritable = true; }
+            if ((protect & PAGE_WRITECOPY) != 0) { protectionStr += "WC "; isReadable = true; isWritable = true; }
+            if ((protect & PAGE_EXECUTE) != 0) { protectionStr += "X "; isExecutable = true; }
+            if ((protect & PAGE_EXECUTE_READ) != 0) { protectionStr += "RX "; isReadable = true; isExecutable = true; }
+            if ((protect & PAGE_EXECUTE_READWRITE) != 0) { protectionStr += "RWX "; isReadable = true; isWritable = true; isExecutable = true; }
+            if ((protect & PAGE_EXECUTE_WRITECOPY) != 0) { protectionStr += "RWCX "; isReadable = true; isWritable = true; isExecutable = true; }
+            if ((protect & PAGE_GUARD) != 0) protectionStr += "GUARD ";
+
+            return new {
+                success = true,
+                protection = protectionStr.Trim(),
+                isWritable = isWritable,
+                isReadable = isReadable,
+                isExecutable = isExecutable,
+                regionStart = "0x" + info.BaseAddress.ToInt64().ToString("X"),
+                regionSize = info.RegionSize.ToInt64()
+            };
+        } finally {
+            CloseHandle(hProcess);
+        }
+    }
+}
+"@
+
+try {
+    $result = [ProtectionChecker]::CheckProtection(${pid}, ${address})
+    $result | ConvertTo-Json -Compress
+} catch {
+    @{ success = $false; error = $_.Exception.Message } | ConvertTo-Json -Compress
+}
   `.trim();
 }
 export async function checkMemoryProtection(platform, pid, address) {
     const addrNum = BigInt(address.startsWith('0x') ? address : `0x${address}`);
     if (platform === 'linux') {
         try {
-            const mapsContent = readFileSync(`/proc/${pid}/maps`, 'utf-8');
+            const mapsContent = await fsAsync.readFile(`/proc/${pid}/maps`, 'utf-8');
             const regions = parseProcMaps(mapsContent);
             const region = regions.find((r) => addrNum >= r.start && addrNum < r.end);
             if (!region) {
@@ -139,8 +139,41 @@ export async function checkMemoryProtection(platform, pid, address) {
     }
     if (platform === 'darwin') {
         try {
-            const addrNum = parseInt(address, 16);
-            if (isNaN(addrNum))
+            const { createPlatformProvider } = await import('../../../native/platform/factory.js');
+            const provider = createPlatformProvider();
+            const avail = await provider.checkAvailability();
+            if (avail.available) {
+                const handle = provider.openProcess(pid, false);
+                try {
+                    const region = provider.queryRegion(handle, addrNum);
+                    if (region) {
+                        const protStr = [
+                            region.isReadable ? 'r' : '-',
+                            region.isWritable ? 'w' : '-',
+                            region.isExecutable ? 'x' : '-',
+                        ].join('');
+                        return {
+                            success: true,
+                            protection: protStr,
+                            isReadable: region.isReadable,
+                            isWritable: region.isWritable,
+                            isExecutable: region.isExecutable,
+                            regionStart: `0x${region.baseAddress.toString(16)}`,
+                            regionSize: region.size,
+                        };
+                    }
+                    return { success: false, error: `Address ${address} not found in any memory region` };
+                }
+                finally {
+                    provider.closeProcess(handle);
+                }
+            }
+        }
+        catch {
+        }
+        try {
+            const darwinAddr = parseInt(address, 16);
+            if (isNaN(darwinAddr))
                 return { success: false, error: 'Invalid address format' };
             const { stdout } = await execAsync(`vmmap -v ${pid}`, {
                 timeout: 15000,
@@ -153,7 +186,7 @@ export async function checkMemoryProtection(platform, pid, address) {
                     continue;
                 const start = parseInt(m[2], 16);
                 const end = parseInt(m[3], 16);
-                if (addrNum >= start && addrNum < end) {
+                if (darwinAddr >= start && darwinAddr < end) {
                     const prot = m[4];
                     return {
                         success: true,
@@ -195,11 +228,11 @@ export async function checkMemoryProtection(platform, pid, address) {
         }
     }
     try {
-        const addrNum = parseInt(address, 16);
-        if (isNaN(addrNum)) {
+        const winAddr = parseInt(address, 16);
+        if (isNaN(winAddr)) {
             return { success: false, error: 'Invalid address format' };
         }
-        const psScript = buildProtectionCheckScript(pid, addrNum);
+        const psScript = buildProtectionCheckScript(pid, winAddr);
         const { stdout } = await executePowerShellScript(psScript, {
             maxBuffer: 1024 * 1024,
             timeout: 30000,

package/dist/src/modules/process/memory/scanner.d.ts

@@ -1,6 +1,10 @@
 import type { Platform, MemoryScanResult, PatternType } from '../../process/memory/types.js';
 export { buildPatternBytesAndMask, patternToBytesMac } from './scanner.patterns.js';
-export declare function scanMemory(platform: Platform, pid: number, pattern: string, patternType?: PatternType): Promise<MemoryScanResult>;
+export interface ScanOptions {
+    patternType?: PatternType;
+    suspendTarget?: boolean;
+}
+export declare function scanMemory(platform: Platform, pid: number, pattern: string, patternType?: PatternType, suspendTarget?: boolean): Promise<MemoryScanResult>;
 export declare function scanMemoryFiltered(pid: number, pattern: string, addresses: string[], patternType: PatternType | undefined, _readMemoryFn: (pid: number, address: string, size: number) => Promise<{
     success: boolean;
     data?: string;

package/dist/src/modules/process/memory/scanner.darwin.js

@@ -1,6 +1,8 @@
 import { promises as fs } from 'node:fs';
+import { logger } from '../../../utils/logger.js';
 import { execAsync } from '../../process/memory/types.js';
 import { patternToBytesMac } from './scanner.patterns.js';
+import { findPatternInBuffer } from '../../../native/NativeMemoryManager.utils.js';
 export async function scanMemoryMac(pid, pattern, patternType) {
     let patternBytes;
     let patternMask;
@@ -16,52 +18,107 @@ export async function scanMemoryMac(pid, pattern, patternType) {
             error: e instanceof Error ? e.message : 'Invalid pattern',
         };
     }
+    try {
+        const nativeResult = await scanMemoryMacNative(pid, patternBytes, patternMask);
+        if (nativeResult)
+            return nativeResult;
+    }
+    catch (nativeErr) {
+        logger.debug('Native Mach scan failed, falling back to lldb:', nativeErr);
+    }
+    return scanMemoryMacLldb(pid, patternBytes, patternMask);
+}
+async function scanMemoryMacNative(pid, patternBytes, patternMask) {
+    const { createPlatformProvider } = await import('../../../native/platform/factory.js');
+    const provider = createPlatformProvider();
+    const avail = await provider.checkAvailability();
+    if (!avail.available)
+        return null;
+    const handle = provider.openProcess(pid, false);
+    const foundAddresses = [];
+    const maxResults = 1000;
+    const maxRegionSize = 32 * 1024 * 1024;
+    try {
+        let address = 0n;
+        for (let i = 0; i < 50000 && foundAddresses.length < maxResults; i++) {
+            const region = provider.queryRegion(handle, address);
+            if (!region)
+                break;
+            if (region.isReadable && region.size > 0 && region.size <= maxRegionSize) {
+                try {
+                    const result = provider.readMemory(handle, region.baseAddress, region.size);
+                    const matches = findPatternInBuffer(result.data, patternBytes, patternMask);
+                    for (const offset of matches) {
+                        foundAddresses.push(`0x${(region.baseAddress + BigInt(offset)).toString(16)}`);
+                        if (foundAddresses.length >= maxResults)
+                            break;
+                    }
+                }
+                catch {
+                }
+            }
+            address = region.baseAddress + BigInt(region.size);
+            if (address <= region.baseAddress)
+                break;
+        }
+    }
+    finally {
+        provider.closeProcess(handle);
+    }
+    logger.debug(`Native Mach scan completed (zero-pause): ${foundAddresses.length} results`);
+    return {
+        success: true,
+        addresses: foundAddresses,
+        stats: { patternLength: patternBytes.length, resultsFound: foundAddresses.length },
+    };
+}
+async function scanMemoryMacLldb(pid, patternBytes, patternMask) {
     const byteList = patternBytes.map((b) => `0x${b.toString(16)}`).join(',');
     const maskList = patternMask.join(',');
     const tag = `${pid}_${Date.now()}`;
     const pyFile = `/tmp/lldb_scan_${tag}.py`;
     const cmdFile = `/tmp/lldb_scan_${tag}.txt`;
-    const pyScript = `
-import lldb, json, sys
-
-def __lldb_init_module(debugger, internal_dict):
-    proc = debugger.GetSelectedTarget().GetProcess()
-    pat = bytes([${byteList}])
-    mask = [${maskList}]
-    results = []
-    rl = proc.GetMemoryRegions()
-    for i in range(rl.GetSize()):
-        info = lldb.SBMemoryRegionInfo()
-        rl.GetMemoryRegionAtIndex(i, info)
-        if not info.IsReadable():
-            continue
-        s = info.GetRegionBase()
-        sz = info.GetRegionEnd() - s
-        if sz > 32 * 1024 * 1024:
-            continue
-        err = lldb.SBError()
-        data = proc.ReadMemory(s, sz, err)
-        if not err.Success():
-            continue
-        n = len(pat)
-        for j in range(len(data) - n + 1):
-            match = True
-            for k in range(n):
-                if mask[k] == 1 and data[j+k] != pat[k]:
-                    match = False
-                    break
-            if match:
-                results.append(hex(s + j))
-                if len(results) >= 1000:
-                    break
-        if len(results) >= 1000:
-            break
-    sys.stdout.write('SCAN_RESULT:' + json.dumps({
-        'success': True,
-        'addresses': results,
-        'stats': {'patternLength': len(pat), 'resultsFound': len(results)}
-    }) + '\\n')
-    sys.stdout.flush()
+    const pyScript = `
+import lldb, json, sys
+
+def __lldb_init_module(debugger, internal_dict):
+    proc = debugger.GetSelectedTarget().GetProcess()
+    pat = bytes([${byteList}])
+    mask = [${maskList}]
+    results = []
+    rl = proc.GetMemoryRegions()
+    for i in range(rl.GetSize()):
+        info = lldb.SBMemoryRegionInfo()
+        rl.GetMemoryRegionAtIndex(i, info)
+        if not info.IsReadable():
+            continue
+        s = info.GetRegionBase()
+        sz = info.GetRegionEnd() - s
+        if sz > 32 * 1024 * 1024:
+            continue
+        err = lldb.SBError()
+        data = proc.ReadMemory(s, sz, err)
+        if not err.Success():
+            continue
+        n = len(pat)
+        for j in range(len(data) - n + 1):
+            match = True
+            for k in range(n):
+                if mask[k] == 1 and data[j+k] != pat[k]:
+                    match = False
+                    break
+            if match:
+                results.append(hex(s + j))
+                if len(results) >= 1000:
+                    break
+        if len(results) >= 1000:
+            break
+    sys.stdout.write('SCAN_RESULT:' + json.dumps({
+        'success': True,
+        'addresses': results,
+        'stats': {'patternLength': len(pat), 'resultsFound': len(results)}
+    }) + '\\n')
+    sys.stdout.flush()
 `;
     await fs.writeFile(pyFile, pyScript, 'utf8');
     await fs.writeFile(cmdFile, `command script import ${pyFile}\nprocess detach\n`, 'utf8');

package/dist/src/modules/process/memory/scanner.js

@@ -3,15 +3,25 @@ import { scanMemoryWindows } from './scanner.windows.js';
 import { scanMemoryLinux } from './scanner.linux.js';
 import { scanMemoryMac } from './scanner.darwin.js';
 export { buildPatternBytesAndMask, patternToBytesMac } from './scanner.patterns.js';
-export async function scanMemory(platform, pid, pattern, patternType = 'hex') {
+export async function scanMemory(platform, pid, pattern, patternType = 'hex', suspendTarget = false) {
+    let suspended = false;
     try {
+        if (suspendTarget) {
+            suspended = await suspendProcess(platform, pid);
+            if (suspended) {
+                logger.info(`Suspended process ${pid} for consistent memory scan`);
+            }
+            else {
+                logger.warn(`Could not suspend process ${pid} — scanning unsuspended`);
+            }
+        }
         switch (platform) {
             case 'win32':
-                return scanMemoryWindows(pid, pattern, patternType);
+                return await scanMemoryWindows(pid, pattern, patternType);
             case 'linux':
-                return scanMemoryLinux(pid, pattern, patternType);
+                return await scanMemoryLinux(pid, pattern, patternType);
             case 'darwin':
-                return scanMemoryMac(pid, pattern, patternType);
+                return await scanMemoryMac(pid, pattern, patternType);
             default:
                 return { success: false, addresses: [], error: `Memory scan not supported on ${platform}` };
         }
@@ -24,6 +34,12 @@ export async function scanMemory(platform, pid, pattern, patternType = 'hex') {
             error: error instanceof Error ? error.message : String(error),
         };
     }
+    finally {
+        if (suspended) {
+            await resumeProcess(platform, pid);
+            logger.info(`Resumed process ${pid} after memory scan`);
+        }
+    }
 }
 export async function scanMemoryFiltered(pid, pattern, addresses, patternType = 'hex', _readMemoryFn, scanMemoryFn) {
     const validAddresses = [];
@@ -59,3 +75,71 @@ export async function scanMemoryFiltered(pid, pattern, addresses, patternType =
         stats: { resultsFound: results.length, patternLength: pattern.length },
     };
 }
+async function suspendProcess(platform, pid) {
+    try {
+        switch (platform) {
+            case 'darwin': {
+                const { createPlatformProvider } = await import('../../../native/platform/factory.js');
+                const provider = createPlatformProvider();
+                const avail = await provider.checkAvailability();
+                if (!avail.available)
+                    return false;
+                const handle = provider.openProcess(pid, false);
+                try {
+                    const { taskSuspend } = await import('../../../native/platform/darwin/DarwinAPI.js');
+                    const { machTaskSelf, taskForPid, KERN } = await import('../../../native/platform/darwin/DarwinAPI.js');
+                    const { kr, task } = taskForPid(machTaskSelf(), pid);
+                    if (kr !== KERN.SUCCESS)
+                        return false;
+                    const suspendKr = taskSuspend(task);
+                    return suspendKr === KERN.SUCCESS;
+                }
+                finally {
+                    provider.closeProcess(handle);
+                }
+            }
+            case 'linux': {
+                const { execAsync } = await import('../../process/memory/types.js');
+                await execAsync(`kill -STOP ${pid}`, { timeout: 2000 });
+                return true;
+            }
+            case 'win32': {
+                const { execAsync } = await import('../../process/memory/types.js');
+                await execAsync(`powershell -NoProfile -Command "(Add-Type -MemberDefinition '[DllImport("ntdll.dll")] public static extern int NtSuspendProcess(IntPtr h);' -Name W -Namespace N -PassThru)::NtSuspendProcess((Get-Process -Id ${pid}).Handle)"`, { timeout: 5000 });
+                return true;
+            }
+            default:
+                return false;
+        }
+    }
+    catch (err) {
+        logger.warn(`Failed to suspend process ${pid}:`, err);
+        return false;
+    }
+}
+async function resumeProcess(platform, pid) {
+    try {
+        switch (platform) {
+            case 'darwin': {
+                const { machTaskSelf, taskForPid, taskResume, KERN } = await import('../../../native/platform/darwin/DarwinAPI.js');
+                const { kr, task } = taskForPid(machTaskSelf(), pid);
+                if (kr === KERN.SUCCESS)
+                    taskResume(task);
+                break;
+            }
+            case 'linux': {
+                const { execAsync } = await import('../../process/memory/types.js');
+                await execAsync(`kill -CONT ${pid}`, { timeout: 2000 });
+                break;
+            }
+            case 'win32': {
+                const { execAsync } = await import('../../process/memory/types.js');
+                await execAsync(`powershell -NoProfile -Command "(Add-Type -MemberDefinition '[DllImport("ntdll.dll")] public static extern int NtResumeProcess(IntPtr h);' -Name W -Namespace N -PassThru)::NtResumeProcess((Get-Process -Id ${pid}).Handle)"`, { timeout: 5000 });
+                break;
+            }
+        }
+    }
+    catch (err) {
+        logger.error(`CRITICAL: Failed to resume process ${pid} — may need manual SIGCONT:`, err);
+    }
+}