debuganything 0.0.0-stage → 1.0.0

package/dist/chunk-MLDOO673.js

@@ -0,0 +1,1416 @@
+#!/usr/bin/env node
+import {
+  parseLsofFields
+} from "./chunk-NFL22T3H.js";
+import {
+  ResultBuilder,
+  humanBytes
+} from "./chunk-5BXTDASF.js";
+import {
+  targetPids
+} from "./chunk-5RAKTYW5.js";
+import {
+  platform
+} from "./chunk-D742WJPT.js";
+import {
+  LIMITS,
+  assertSafeBpfFragment,
+  clampDuration,
+  isRoot,
+  looksLikePermissionError,
+  rootRequiredLimitation,
+  runCapped
+} from "./chunk-STFC7C5C.js";
+
+// src/adapters/pyspy.ts
+import { readFileSync } from "fs";
+
+// src/stacks.ts
+function parseFolded(raw) {
+  const out = [];
+  for (const line of raw.split("\n")) {
+    const t = line.trimEnd();
+    if (!t) continue;
+    const sp = t.lastIndexOf(" ");
+    if (sp < 0) continue;
+    const count = Number(t.slice(sp + 1));
+    if (!Number.isFinite(count)) continue;
+    const frames = t.slice(0, sp).split(";").filter(Boolean);
+    if (frames.length) out.push({ frames, count });
+  }
+  return out;
+}
+function aggregateFrames(stacks, limit = 15) {
+  const self = /* @__PURE__ */ new Map();
+  const total = /* @__PURE__ */ new Map();
+  let totalSamples = 0;
+  for (const s of stacks) {
+    totalSamples += s.count;
+    const leaf = s.frames[s.frames.length - 1];
+    self.set(leaf, (self.get(leaf) ?? 0) + s.count);
+    for (const f of new Set(s.frames)) total.set(f, (total.get(f) ?? 0) + s.count);
+  }
+  const frames = [...total.keys()].map((frame) => ({
+    frame,
+    self: self.get(frame) ?? 0,
+    total: total.get(frame) ?? 0,
+    self_pct: totalSamples ? Math.round(1e3 * (self.get(frame) ?? 0) / totalSamples) / 10 : 0,
+    total_pct: totalSamples ? Math.round(1e3 * (total.get(frame) ?? 0) / totalSamples) / 10 : 0
+  })).sort((a, b) => b.self - a.self || b.total - a.total).slice(0, limit);
+  return { frames, totalSamples };
+}
+function hottestStacks(stacks, limit = 5, maxDepth = 12) {
+  const total = stacks.reduce((s, x) => s + x.count, 0);
+  return [...stacks].sort((a, b) => b.count - a.count).slice(0, limit).map((s) => ({ count: s.count, pct: total ? Math.round(1e3 * s.count / total) / 10 : 0, stack: s.frames.length > maxDepth ? [...s.frames.slice(0, 3), `\u2026 ${s.frames.length - maxDepth + 3} frames \u2026`, ...s.frames.slice(-(maxDepth - 4))] : s.frames }));
+}
+var IDLE_FRAME = /\b(semaphore_wait_trap|__psynch_mutexwait|__ulock_wait|__workq_kernreturn|__sigsuspend|__wait4|epoll_wait|epoll_pwait|kevent|poll|select|futex|nanosleep|clock_nanosleep|pthread_cond_wait|pthread_cond_timedwait|__psynch_cvwait|mach_msg|mach_msg2_trap|__semwait_signal|__select|__workq_kernreturn|uv__io_poll|uv_run|sleep|time\.sleep|wait|_wait_for_tstate_lock|<idle>|swapper)\b/i;
+function buildTree(stacks) {
+  const root = { name: "all", value: 0, children: /* @__PURE__ */ new Map() };
+  for (const s of stacks) {
+    root.value += s.count;
+    let cur = root;
+    for (const f of s.frames) {
+      let n = cur.children.get(f);
+      if (!n) {
+        n = { name: f, value: 0, children: /* @__PURE__ */ new Map() };
+        cur.children.set(f, n);
+      }
+      n.value += s.count;
+      cur = n;
+    }
+  }
+  return root;
+}
+function esc(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function colorFor(name) {
+  let h = 0;
+  for (let i = 0; i < name.length; i++) h = h * 31 + name.charCodeAt(i) >>> 0;
+  const r = 205 + h % 50;
+  const g = 60 + (h >> 8) % 120;
+  const b = (h >> 16) % 60;
+  return `rgb(${r},${g},${b})`;
+}
+function renderFlamegraph(stacks, opts = {}) {
+  const width = opts.width ?? 1200;
+  const rowH = 16;
+  const minW = opts.minWidthPx ?? 0.5;
+  const root = buildTree(stacks);
+  const total = root.value || 1;
+  let maxDepth = 0;
+  const rects = [];
+  const walk = (n, x, depth) => {
+    const w = n.value / total * width;
+    if (w < minW) return;
+    maxDepth = Math.max(maxDepth, depth);
+    const label = w > 40 ? n.name.slice(0, Math.floor(w / 7)) : "";
+    rects.push(
+      `<g class="f"><title>${esc(n.name)} (${n.value} samples, ${(100 * n.value / total).toFixed(2)}%)</title><rect x="${x.toFixed(2)}" y="${depth}" width="${w.toFixed(2)}" height="${rowH - 1}" fill="${colorFor(n.name)}" rx="1"/>${label ? `<text x="${(x + 2).toFixed(2)}" y="${depth + 11.5}">${esc(label)}</text>` : ""}</g>`
+    );
+    let cx = x;
+    const kids = [...n.children.values()].sort((a, b) => b.value - a.value);
+    for (const k of kids) {
+      walk(k, cx, depth + 1);
+      cx += k.value / total * width;
+    }
+  };
+  walk(root, 0, 0);
+  const height = (maxDepth + 1) * rowH + 40;
+  const body = rects.map((r) => r.replace(/ y="(\d+)"/, (_m, d) => ` y="${height - 24 - (Number(d) + 1) * rowH}"`).replace(/<text x="([\d.]+)" y="(\d+)\.5"/, (_m, x, d) => `<text x="${x}" y="${height - 24 - (Number(d) + 1) * rowH + 11.5}"`)).join("\n");
+  return `<?xml version="1.0" standalone="no"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="${width}" height="${height}" viewBox="0 0 ${width} ${height}" font-family="Verdana, sans-serif" font-size="11">
+<style>.f rect:hover{stroke:#000;stroke-width:1}.f text{pointer-events:none;fill:#000}</style>
+<rect width="100%" height="100%" fill="#f8f8f8"/>
+<text x="${width / 2}" y="18" text-anchor="middle" font-size="15">${esc(opts.title ?? "Flame Graph")} \u2014 ${total} samples</text>
+${body}
+<text x="8" y="${height - 6}" fill="#666">Generated by DEA (Debug Anything). Hover for counts; width = share of samples.</text>
+</svg>
+`;
+}
+
+// src/adapters/pyspy.ts
+function parsePySpyDump(raw) {
+  const out = { threads: [] };
+  let cur = null;
+  let localsTarget = null;
+  for (const line of raw.split("\n")) {
+    let m = /^Process (\d+): (.*)$/.exec(line);
+    if (m) {
+      out.pid = Number(m[1]);
+      out.command = m[2].trim();
+      continue;
+    }
+    m = /^Python v([\d.]+)/.exec(line);
+    if (m) {
+      out.python = m[1];
+      continue;
+    }
+    m = /^Thread (0x[0-9A-Fa-f]+|\d+) \((\w+)\)(?:: "(.*)")?(?:.*?\(os thread (\S+)\))?/.exec(line);
+    if (m) {
+      cur = { id: m[1], state: m[2], name: m[3] ?? "", frames: [], os_tid: m[4] };
+      out.threads.push(cur);
+      localsTarget = null;
+      continue;
+    }
+    if (!cur) continue;
+    m = /^\s{4}(\S.*?) \((.+?):(\d+)\)\s*$/.exec(line);
+    if (m) {
+      cur.frames.push({ func: m[1], file: m[2], line: Number(m[3]) });
+      localsTarget = null;
+      continue;
+    }
+    if (/^\s{8}(Arguments|Locals):/.test(line)) {
+      const f = cur.frames[cur.frames.length - 1];
+      if (f) {
+        f.locals ??= {};
+        localsTarget = f.locals;
+      }
+      continue;
+    }
+    m = /^\s{12}(\w+): (.*)$/.exec(line);
+    if (m && localsTarget) localsTarget[m[1]] = m[2].slice(0, 200);
+  }
+  return out;
+}
+var STDLIB_FILE = /(^|\/)(threading|queue|socket|selectors|ssl|asyncio\/[a-z_]+|concurrent\/futures\/[a-z_]+|subprocess|time|multiprocessing\/[a-z_]+)\.py$/;
+function sourceLine(file, line, reader = defaultReader) {
+  if (!file || !/\.py$/.test(file) || line < 1) return void 0;
+  const text = reader(file);
+  if (!text) return void 0;
+  return text.split("\n")[line - 1]?.trim().slice(0, 160);
+}
+var srcCache = /* @__PURE__ */ new Map();
+function defaultReader(f) {
+  if (srcCache.has(f)) return srcCache.get(f);
+  let v;
+  try {
+    v = readFileSync(f, "utf8");
+  } catch {
+    v = void 0;
+  }
+  srcCache.set(f, v);
+  return v;
+}
+var LOCK_SRC = /\bwith\b[^:]*(lock|mutex|sem|cond|rlock|lk\b)|\.acquire\(|\.__enter__\(|lock\(|Lock\(\)\.acquire/i;
+var JOIN_SRC = /\.join\(|\.result\(|\.wait\(|\.get\(|wait_for|as_completed|\.gather\(/;
+var SLEEP_SRC = /\bsleep\(/;
+var IO_SRC = /\.(recv|recv_into|recvfrom|read|readline|readinto|accept|connect|send|sendall|write)\(|requests\.|urlopen|httpx\.|\.execute\(|\.fetch(one|all|many)\(|\.commit\(|select\.select|\.poll\(/;
+function findLockWaits(dump, reader, cwd) {
+  const out = [];
+  const resolve = (f) => cwd && !f.startsWith("/") ? `${cwd.replace(/\/$/, "")}/${f}` : f;
+  for (const t of dump.threads) {
+    const top = t.frames[0];
+    if (!top) continue;
+    const user = t.frames.find((f) => !STDLIB_FILE.test(f.file) && !/<frozen|importlib|site-packages\/(werkzeug|flask|gunicorn|uvicorn|django)/.test(f.file)) ?? top;
+    const base = {
+      thread: t.name || t.id,
+      state: t.state,
+      waiting_in: `${top.func} (${top.file.split("/").pop()}:${top.line})`,
+      at: `${user.func} (${user.file.split("/").pop()}:${user.line})`,
+      lock_repr: Object.entries(top.locals ?? {}).find(([k]) => /lock|cond|mutex|sem/i.test(k))?.[1]
+    };
+    const inStdlib = STDLIB_FILE.test(top.file);
+    let kind;
+    if (inStdlib) {
+      if (/_wait_for_tstate_lock|^join$/.test(top.func)) kind = "join";
+      else if (/acquire|__enter__|^wait$|_acquire_restore|^get$|^put$/.test(top.func) && /threading|queue/.test(top.file)) kind = /^(get|put)$/.test(top.func) ? "join" : "lock";
+      else if (/sleep/.test(top.func)) kind = "sleep";
+      else if (/select|poll|recv|read|accept|connect|send|^wait$/.test(top.func)) kind = "io";
+      else if (/asyncio|run_forever|_run_once|serve_forever/.test(top.file + top.func)) kind = "idle_loop";
+    }
+    if (!kind && t.state !== "active") {
+      const src = sourceLine(resolve(top.file), top.line, reader);
+      if (src) {
+        if (LOCK_SRC.test(src)) kind = "lock";
+        else if (SLEEP_SRC.test(src)) kind = "sleep";
+        else if (JOIN_SRC.test(src)) kind = "join";
+        else if (IO_SRC.test(src)) kind = "io";
+        else kind = "native";
+        out.push({ ...base, kind, source: src });
+        continue;
+      }
+      if (!inStdlib) kind = "native";
+    }
+    if (kind) out.push({ ...base, kind });
+  }
+  return out;
+}
+async function targetCwd(pid) {
+  if (platform() === "linux") {
+    try {
+      const { readlink } = await import("fs/promises");
+      return await readlink(`/proc/${pid}/cwd`);
+    } catch {
+      return void 0;
+    }
+  }
+  const r = await runCapped("lsof", ["-a", "-p", String(pid), "-d", "cwd", "-Fn"], { timeoutMs: 5e3 });
+  return r.stdout.split("\n").find((l) => l.startsWith("n"))?.slice(1);
+}
+function sameLockGroups(waits) {
+  const by = /* @__PURE__ */ new Map();
+  for (const w of waits) {
+    if (!w.lock_repr || w.kind !== "lock") continue;
+    const k = w.lock_repr.replace(/\s+/g, " ");
+    by.set(k, [...by.get(k) ?? [], w.thread]);
+  }
+  return [...by].filter(([, t]) => t.length > 1).map(([lock, threads]) => ({ lock, threads }));
+}
+function needsSudoNote(b, stderr, cmd) {
+  if (looksLikePermissionError(stderr) || /Operation not permitted|ptrace|task_for_pid|Permission denied/i.test(stderr)) {
+    b.limitation(rootRequiredLimitation("py-spy", cmd));
+    if (platform() === "darwin") b.limitation("macOS: py-spy needs sudo (or the target must be a child of this process). SIP blocks task_for_pid otherwise.");
+    if (platform() === "linux") b.limitation("Linux: set kernel.yama.ptrace_scope=0 or run with CAP_SYS_PTRACE; inside Docker add --cap-add SYS_PTRACE");
+    return true;
+  }
+  return false;
+}
+async function summarizePySpyDump(b, dump, art, pid) {
+  const active = dump.threads.filter((t) => t.state === "active");
+  const summaryEv = b.evidenceOf(
+    "stack_summary",
+    `${dump.threads.length} thread(s): ${active.length} active, ${dump.threads.length - active.length} idle; python ${dump.python ?? "?"}`,
+    dump.threads.map((t) => ({ thread: t.name || t.id, state: t.state, top: t.frames[0] ? `${t.frames[0].func} (${t.frames[0].file.split("/").pop()}:${t.frames[0].line})` : "?", depth: t.frames.length })),
+    { artifact: art }
+  );
+  for (const t of dump.threads.slice(0, 12)) {
+    b.evidenceOf(
+      "stack",
+      `${t.name || t.id} [${t.state}]: ${t.frames.slice(0, 4).map((f) => `${f.func}@${f.file.split("/").pop()}:${f.line}`).join(" \u2190 ")}`,
+      { thread: t.name || t.id, state: t.state, frames: t.frames.slice(0, 15).map((f) => ({ func: f.func, file: f.file, line: f.line, ...f.locals ? { locals: f.locals } : {} })) },
+      { artifact: art }
+    );
+  }
+  const cwd = pid ? await targetCwd(pid) : void 0;
+  const waits = findLockWaits(dump, void 0, cwd);
+  const locks = waits.filter((w) => w.kind === "lock");
+  const joins = waits.filter((w) => w.kind === "join");
+  const io = waits.filter((w) => w.kind === "io");
+  const sleeps = waits.filter((w) => w.kind === "sleep");
+  const natives = waits.filter((w) => w.kind === "native");
+  const loops = waits.filter((w) => w.kind === "idle_loop");
+  const fmt = (w) => `${w.thread} at ${w.at}${w.source ? ` [${w.source}]` : ""}`;
+  if (waits.length) {
+    const waitEv = b.evidenceOf(
+      "lock_wait",
+      `${waits.length} blocked thread(s): ${locks.length} on locks, ${joins.length} joining/waiting, ${io.length} in I/O, ${sleeps.length} sleeping, ${natives.length} in other native calls, ${loops.length} idle event loops`,
+      waits.map((w) => ({ thread: w.thread, kind: w.kind, at: w.at, waiting_in: w.waiting_in, source: w.source, lock_repr: w.lock_repr })),
+      { artifact: art }
+    );
+    const groups = sameLockGroups(waits);
+    if (groups.length) b.finding("high", `${groups[0].threads.length} threads wait on the same lock ${groups[0].lock}: ${groups[0].threads.join(", ")}`, [waitEv], "observed");
+    if (locks.length >= 2 && active.length === 0) {
+      b.finding(
+        "high",
+        `likely deadlock: ${locks.length} thread(s) blocked acquiring locks and no thread is running \u2014 ${locks.slice(0, 6).map(fmt).join("; ")}`,
+        [waitEv, summaryEv],
+        "inferred",
+        `${joins.length ? `${joins.length} thread(s) are joined on them (${joins.slice(0, 3).map((w) => w.thread).join(", ")}). ` : ""}Re-run dump_stacks: identical positions confirm a deadlock. Handoff: attach a step debugger (e.g. mcp-debugger) at ${locks[0].at} to inspect lock owners.`
+      );
+    } else if (locks.length) {
+      b.finding("warn", `${locks.length} thread(s) blocked acquiring a lock: ${locks.slice(0, 6).map(fmt).join("; ")}`, [waitEv], "observed");
+    }
+    if (joins.length >= 3 && !locks.length) b.finding("warn", `${joins.length} thread(s) waiting on other threads/queues: ${joins.slice(0, 4).map(fmt).join("; ")}`, [waitEv], "observed");
+    if (io.length) b.finding(io.length >= 3 ? "warn" : "info", `${io.length} thread(s) blocked in I/O: ${io.slice(0, 4).map(fmt).join("; ")}`, [waitEv], "observed", "inspect_sockets shows which remote they talk to.");
+    if (sleeps.length) b.finding("info", `${sleeps.length} thread(s) in sleep(): ${sleeps.slice(0, 3).map(fmt).join("; ")}`, [waitEv], "observed");
+    if (natives.length) b.finding("info", `${natives.length} thread(s) blocked in native calls from user code: ${natives.slice(0, 3).map(fmt).join("; ")}`, [waitEv], "observed");
+  }
+  if (b.findingCount === 0 && active.length === 0) b.finding("info", "all threads idle \u2014 the process is not stuck in Python code; if the caller hangs, look at the network path (inspect_sockets)", [summaryEv], "inferred");
+  if (active.length) {
+    const t = active[0];
+    const f = t.frames[0];
+    if (f) b.finding("info", `active thread ${t.name || t.id} is executing ${f.func} (${f.file.split("/").pop()}:${f.line})`, [summaryEv]);
+  }
+}
+async function dumpStacks(ctx, withLocals, tool = "dump_stacks") {
+  const { session, target } = ctx;
+  const b = new ResultBuilder(tool, session, target);
+  if (!target.pid) return b.fail("no pid").build();
+  const args = ["dump", "--pid", String(target.pid), "--nonblocking"];
+  if (withLocals) args.push("--locals");
+  const cmd = `py-spy ${args.join(" ")}`;
+  const r = await runCapped("py-spy", args, { timeoutMs: 3e4 });
+  const raw = r.stdout + (r.stderr ? `
+--- stderr ---
+${r.stderr}` : "");
+  const art = await b.writeArtifact("pyspy-dump.txt", raw, "raw_text", cmd);
+  if (r.exitCode !== 0) {
+    if (!needsSudoNote(b, r.stderr, cmd)) b.limitation(`py-spy exited ${r.exitCode}: ${r.stderr.trim().slice(0, 300)}`);
+    b.next(`import_artifact (pyspy_dump, after running the sudo command above)`, "inspect_sockets", "inspect_files", "snapshot_memory");
+    return b.fail("py-spy dump failed").build();
+  }
+  await summarizePySpyDump(b, parsePySpyDump(r.stdout), art, target.pid);
+  b.limitation("instant snapshot (nonblocking); take two dumps to distinguish a hang from a slow step");
+  b.next("inspect_sockets", "trace_syscalls", "profile_cpu");
+  return b.build();
+}
+async function profileCpu(ctx, args) {
+  const { session, target } = ctx;
+  const b = new ResultBuilder("profile_cpu", session, target);
+  if (!target.pid) return b.fail("no pid").build();
+  const duration = clampDuration(args.duration_s, 15);
+  const rawPath = b.artifactPath("pyspy-folded.txt");
+  const cmdArgs = ["record", "--pid", String(target.pid), "--duration", String(duration), "--format", "raw", "--output", rawPath, "--nonblocking", "--subprocesses"];
+  const r = await runCapped("py-spy", cmdArgs, { timeoutMs: duration * 1e3 + LIMITS.DURATION_SLACK_MS + 5e3 });
+  if (r.exitCode !== 0) {
+    await b.writeArtifact("pyspy-stderr.txt", r.stderr, "raw_text");
+    if (!needsSudoNote(b, r.stderr, `py-spy ${cmdArgs.join(" ")}`)) b.limitation(`py-spy exited ${r.exitCode}: ${r.stderr.trim().slice(0, 300)}`);
+    b.next("import_artifact (folded, after running the sudo command above)", "inspect_sockets", "snapshot_memory");
+    return b.fail("py-spy record failed").build();
+  }
+  const { readFile: readFile4 } = await import("fs/promises");
+  const folded = await readFile4(rawPath, "utf8").catch(() => "");
+  await b.addArtifact(rawPath, "folded_stacks", { description: `py-spy record ${duration}s, folded stacks` });
+  return summarizeProfile(b, folded, duration, "py-spy", 100);
+}
+async function summarizeProfile(b, folded, duration, profiler, sampleHz) {
+  const stacks = parseFolded(folded);
+  if (!stacks.length) {
+    b.limitation(`${profiler} produced no samples in ${duration}s (process idle, or sampling blocked)`);
+    const ev = b.evidenceOf("metric", "0 samples", { name: "samples", value: 0 });
+    b.finding("info", `no CPU samples in ${duration}s \u2014 the process is idle or sleeping, not CPU-bound`, [ev], "inferred");
+    b.next("dump_stacks", "trace_syscalls", "inspect_sockets");
+    return b.build();
+  }
+  const { frames, totalSamples } = aggregateFrames(stacks, 15);
+  const workStacks = stacks.filter((s) => !IDLE_FRAME.test(s.frames[s.frames.length - 1]));
+  const workSamples = workStacks.reduce((n, s) => n + s.count, 0);
+  const idlePct = Math.round(100 * (totalSamples - workSamples) / totalSamples);
+  const { frames: workFrames } = aggregateFrames(workStacks, 15);
+  const hot = hottestStacks(workStacks.length ? workStacks : stacks, 5);
+  const svg = renderFlamegraph(stacks, { title: `${profiler} ${duration}s pid ${b.target.pid}` });
+  const svgPath = await b.writeArtifact("flamegraph.svg", svg, "flamegraph_svg", "flame graph (all threads, idle included)");
+  const busyWall = sampleHz ? Math.min(100, Math.round(100 * workSamples / (sampleHz * duration))) : void 0;
+  const framesEv = b.evidenceOf(
+    "frame_hot",
+    workFrames.length ? `top self among ${workSamples} work samples: ${workFrames.slice(0, 5).map((f) => `${shortFrame(f.frame)} ${f.self_pct}%`).join(", ")}` : `no work frames; all ${totalSamples} samples idle`,
+    (workFrames.length ? workFrames : frames).map((f) => ({ frame: f.frame, self: f.self, total: f.total, self_pct: f.self_pct, total_pct: f.total_pct })),
+    { artifact: svgPath }
+  );
+  const stacksEv = b.evidenceOf("stack", `hottest work stack (${hot[0]?.pct}% of work): ${hot[0]?.stack.slice(-4).map(shortFrame).join(" \u2190 ")}`, hot, { artifact: svgPath });
+  const metricEv = b.evidenceOf(
+    "metric",
+    `${totalSamples} samples over ${duration}s: ${workSamples} work, ${idlePct}% idle/wait${busyWall !== void 0 ? `; \u2248${busyWall}% of wall time CPU-busy (${sampleHz} Hz)` : ""}`,
+    { name: "samples", value: totalSamples, work_samples: workSamples, idle_pct: idlePct, busy_wall_pct: busyWall, duration_s: duration, sample_hz: sampleHz }
+  );
+  const topWork = workFrames[0];
+  if (topWork && topWork.self_pct >= 20) {
+    b.finding(busyWall === void 0 || busyWall >= 25 ? "high" : "warn", `${shortFrame(topWork.frame)} accounts for ${topWork.self_pct}% of CPU work (${topWork.total_pct}% inclusive)${busyWall !== void 0 ? `; the process was CPU-busy \u2248${busyWall}% of the time` : ""}`, [framesEv, stacksEv, metricEv], "observed", `Hot path: ${hot[0]?.stack.slice(-6).map(shortFrame).join(" \u2190 ")}. Handoff: attach a step debugger (e.g. mcp-debugger) at ${topWork.frame}.`);
+  } else if (topWork && topWork.self_pct >= 8) {
+    b.finding("warn", `${shortFrame(topWork.frame)} is the top CPU frame at ${topWork.self_pct}% of work`, [framesEv, stacksEv], "observed");
+  }
+  if (busyWall !== void 0 && busyWall < 15) {
+    b.finding("info", `process CPU-busy only \u2248${busyWall}% of wall time \u2014 mostly waiting, not CPU-bound`, [metricEv], "inferred", "Look at trace_syscalls (what is it waiting on?) and inspect_sockets (whom?).");
+  } else if (busyWall === void 0 && idlePct >= 90 && !topWork) {
+    b.finding("info", `~${idlePct}% of samples are in idle/wait frames \u2014 the process is mostly waiting, not CPU-bound`, [metricEv], "inferred");
+  }
+  if (b.findingCount === 0) b.finding("info", `CPU spread thin: top work frame ${shortFrame((workFrames[0] ?? frames[0]).frame)} at ${(workFrames[0] ?? frames[0]).self_pct}%`, [framesEv]);
+  b.limitation(`sampled ${duration}s only (${profiler}${sampleHz ? ` @ ${sampleHz} Hz` : ""}); idle frames across all threads are excluded from the hot-frame ranking`);
+  b.next("trace_syscalls", "dump_stacks", "inspect_sockets");
+  if (topWork && topWork.self_pct >= 20 && (profiler === "perf" || profiler === "sample")) {
+    const dso = /\(([^)]+)\)\s*$/.exec(topWork.frame)?.[1];
+    b.next(`static analysis: decompile ${shortFrame(topWork.frame).replace(/\s*\(.*$/, "")}${dso ? ` in ${dso}` : ""} to see what the hot code does`);
+  }
+  return b.build();
+}
+function shortFrame(f) {
+  return f.replace(/\(([^)]*\/)?([^/)]+)\)/, "($2)").replace(/\+0x[0-9a-f]+/, "").slice(0, 80);
+}
+var pyspyAdapter = {
+  name: "py-spy",
+  tools: ["profile_cpu", "dump_stacks", "snapshot_memory"],
+  platforms: ["linux", "darwin"],
+  requires: ["py-spy"],
+  runtimes: ["python"],
+  install: { linux: "pip install py-spy   (or: cargo install py-spy)", darwin: "pip install py-spy   (or: brew install py-spy)" },
+  priority: 20,
+  check(base, env) {
+    if (env.platform === "darwin" && !env.isRoot) base.notes.push("macOS: attaching to processes you did not spawn requires sudo");
+    if (env.platform === "linux" && env.ptraceScope !== null && env.ptraceScope >= 1 && !env.isRoot) base.notes.push(`ptrace_scope=${env.ptraceScope}: can only attach to child processes without root`);
+    return base;
+  },
+  async run(tool, args, ctx) {
+    if (tool === "dump_stacks") return dumpStacks(ctx, false);
+    if (tool === "profile_cpu") return profileCpu(ctx, args);
+    if (tool === "snapshot_memory") {
+      const { snapshotMemoryGeneric } = await import("./psmem-UB3VCMG3.js");
+      const base = await snapshotMemoryGeneric(ctx, args);
+      const dump = await dumpStacks(ctx, true, "snapshot_memory");
+      return mergeResults(base, dump, ["instant stack+locals via py-spy; Python has no retained-size heap view without tracemalloc \u2014 enable tracemalloc in the app for allocation-site attribution"]);
+    }
+    throw new Error(`py-spy adapter cannot run ${tool}`);
+  }
+};
+function mergeResults(base, extra, limitations = []) {
+  const offsetE = base.evidence.length;
+  const offsetF = base.findings.length;
+  const idMap = /* @__PURE__ */ new Map();
+  const evidence = [...base.evidence];
+  for (const e of extra.evidence) {
+    const id = `e${evidence.length + 1}`;
+    idMap.set(e.id, id);
+    evidence.push({ ...e, id });
+  }
+  const findings = [...base.findings];
+  for (const f of extra.findings) {
+    findings.push({ ...f, id: `f${findings.length + 1}`, evidence_ids: f.evidence_ids.map((x) => idMap.get(x) ?? x) });
+  }
+  void offsetE;
+  void offsetF;
+  return {
+    ...base,
+    ok: base.ok || extra.ok,
+    findings,
+    evidence,
+    limitations: [.../* @__PURE__ */ new Set([...base.limitations, ...extra.limitations, ...limitations])],
+    suggested_next: [.../* @__PURE__ */ new Set([...base.suggested_next, ...extra.suggested_next])],
+    artifacts: [...base.artifacts, ...extra.artifacts],
+    duration_ms: base.duration_ms + extra.duration_ms,
+    error: base.ok || extra.ok ? void 0 : base.error ?? extra.error
+  };
+}
+
+// src/adapters/strace.ts
+import { readFile } from "fs/promises";
+var CATEGORY_SETS = {
+  network: "%network",
+  file: "%file,%desc",
+  process: "%process",
+  signal: "%signal",
+  memory: "%memory",
+  all: "all"
+};
+var LINE_RE = /^(?:\[pid\s+(\d+)\]\s+|(\d+)\s+)?(?:(\d{2}:\d{2}:\d{2}\.\d+)\s+)?(\w+)\((.*?)\)\s+=\s+(.+?)(?:\s+<([\d.]+)>)?$/;
+var UNFINISHED_RE = /^(?:\[pid\s+(\d+)\]\s+|(\d+)\s+)?(?:(\d{2}:\d{2}:\d{2}\.\d+)\s+)?(\w+)\((.*)<unfinished \.\.\.>$/;
+var RESUMED_RE = /^(?:\[pid\s+(\d+)\]\s+|(\d+)\s+)?(?:(\d{2}:\d{2}:\d{2}\.\d+)\s+)?<\.\.\. (\w+) resumed>\s*(.*?)\)?\s+=\s+(.+?)(?:\s+<([\d.]+)>)?$/;
+function parseStrace(raw) {
+  const out = [];
+  const lines = raw.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i].trimEnd();
+    if (!line || line.startsWith("strace:") || /\+\+\+ (exited|killed)|--- SIG/.test(line)) continue;
+    let m = LINE_RE.exec(line);
+    if (m) {
+      const result = m[6];
+      const errno = /^-1 ([A-Z]+)/.exec(result)?.[1];
+      out.push({ pid: m[1] ? Number(m[1]) : m[2] ? Number(m[2]) : void 0, time: m[3], name: m[4], args: m[5], result, errno, duration_s: m[7] ? Number(m[7]) : void 0, line: i + 1 });
+      continue;
+    }
+    m = UNFINISHED_RE.exec(line);
+    if (m) {
+      out.push({ pid: m[1] ? Number(m[1]) : m[2] ? Number(m[2]) : void 0, time: m[3], name: m[4], args: m[5], result: "?", unfinished: true, line: i + 1 });
+      continue;
+    }
+    m = RESUMED_RE.exec(line);
+    if (m) {
+      const result = m[6];
+      const errno = /^-1 ([A-Z]+)/.exec(result)?.[1];
+      const pid = m[1] ? Number(m[1]) : m[2] ? Number(m[2]) : void 0;
+      const open = [...out].reverse().find((r) => r.unfinished && r.name === m[4] && r.pid === pid && r.result === "?");
+      if (open) {
+        open.result = result;
+        open.errno = errno;
+        open.duration_s = m[7] ? Number(m[7]) : void 0;
+        open.args += m[5] ?? "";
+        open.resumed = true;
+      } else out.push({ pid, time: m[3], name: m[4], args: m[5] ?? "", result, errno, duration_s: m[7] ? Number(m[7]) : void 0, resumed: true, line: i + 1 });
+    }
+  }
+  return out;
+}
+var WAIT_SYSCALLS = /* @__PURE__ */ new Set(["futex", "epoll_wait", "epoll_pwait", "epoll_pwait2", "poll", "ppoll", "select", "pselect6", "nanosleep", "clock_nanosleep", "wait4", "waitid", "read", "recvfrom", "recvmsg", "recv", "accept", "accept4", "connect", "flock", "fcntl", "io_uring_enter", "rt_sigtimedwait", "pause", "sched_yield"]);
+function aggregateSyscalls(records) {
+  const by = /* @__PURE__ */ new Map();
+  const errBy = /* @__PURE__ */ new Map();
+  let totalMs = 0;
+  let waitMs = 0;
+  for (const r of records) {
+    const s = by.get(r.name) ?? { syscall: r.name, count: 0, total_ms: 0, avg_ms: 0, max_ms: 0, errors: 0 };
+    s.count++;
+    const ms = (r.duration_s ?? 0) * 1e3;
+    s.total_ms += ms;
+    s.max_ms = Math.max(s.max_ms, ms);
+    if (r.errno) {
+      s.errors++;
+      const k = `${r.errno}:${r.name}`;
+      const e = errBy.get(k) ?? { errno: r.errno, syscall: r.name, count: 0, example: r.args.slice(0, 120) };
+      e.count++;
+      errBy.set(k, e);
+    }
+    by.set(r.name, s);
+    totalMs += ms;
+    if (WAIT_SYSCALLS.has(r.name)) waitMs += ms;
+  }
+  const stats = [...by.values()].map((s) => ({ ...s, total_ms: round(s.total_ms), avg_ms: round(s.count ? s.total_ms / s.count : 0), max_ms: round(s.max_ms) })).sort((a, b) => b.total_ms - a.total_ms);
+  const errors = [...errBy.values()].sort((a, b) => b.count - a.count);
+  const slowest = [...records].filter((r) => r.duration_s !== void 0).sort((a, b) => b.duration_s - a.duration_s).slice(0, 10);
+  return { stats, errors, slowest, totalMs: round(totalMs), waitMs: round(waitMs) };
+}
+function round(n) {
+  return Math.round(n * 1e3) / 1e3;
+}
+function describeArgs(r) {
+  const path = /"([^"]{1,120})"/.exec(r.args)?.[1];
+  const addr = /sin_addr=inet_addr\("([^"]+)"\)|sin6_addr=inet_pton\([^,]+,\s*"([^"]+)"|sun_path="([^"]+)"/.exec(r.args);
+  const port = /sin6?_port=htons\((\d+)\)/.exec(r.args)?.[1];
+  const parts = [];
+  if (path && !addr) parts.push(path);
+  if (addr) parts.push(`${addr[1] ?? addr[2] ?? addr[3]}${port ? `:${port}` : ""}`);
+  if (!parts.length) parts.push(r.args.slice(0, 60));
+  return parts.join(" ");
+}
+function summarizeSyscallRecords(b, records, duration, artifactPath) {
+  const agg = aggregateSyscalls(records);
+  const topEv = b.evidenceOf(
+    "syscall_stat",
+    `${records.length} syscalls, ${agg.totalMs} ms inside the kernel over ${duration}s; top by time: ${agg.stats.slice(0, 5).map((s) => `${s.syscall} ${s.total_ms}ms\xD7${s.count}`).join(", ")}`,
+    agg.stats.slice(0, 20),
+    { artifact: artifactPath }
+  );
+  const slow = agg.slowest.slice(0, 8).map((rec) => ({ syscall: rec.name, ms: round((rec.duration_s ?? 0) * 1e3), pid: rec.pid, at: rec.time, target: describeArgs(rec), result: rec.result.slice(0, 60), line: rec.line }));
+  const slowEv = b.evidenceOf("syscall_slow", slow.length ? `slowest: ${slow.slice(0, 3).map((s) => `${s.syscall}(${s.target}) ${s.ms}ms`).join("; ")}` : "no timed syscalls", slow, { artifact: artifactPath, lines: slow[0] ? [slow[0].line, slow[0].line] : void 0 });
+  const errEv = b.evidenceOf("syscall_error", agg.errors.length ? `errors: ${agg.errors.slice(0, 5).map((e) => `${e.syscall}\u2192${e.errno}\xD7${e.count}`).join(", ")}` : "no failing syscalls", agg.errors.slice(0, 15), { artifact: artifactPath });
+  const waitPct = agg.totalMs ? Math.round(100 * agg.waitMs / agg.totalMs) : 0;
+  const waitEv = b.evidenceOf("metric", `${waitPct}% of kernel time in blocking waits (futex/poll/epoll/read/recv/nanosleep)`, { name: "wait_pct", value: waitPct, wait_ms: agg.waitMs, total_ms: agg.totalMs });
+  const top = agg.stats[0];
+  if (top && agg.totalMs > 0 && top.total_ms / agg.totalMs > 0.5) {
+    const isWait = WAIT_SYSCALLS.has(top.syscall);
+    b.finding(isWait ? "info" : "warn", `${top.syscall} dominates: ${top.total_ms} ms over ${top.count} calls (${Math.round(100 * top.total_ms / agg.totalMs)}% of kernel time)${isWait ? " \u2014 blocking wait, the process is waiting on something" : ""}`, [topEv, slowEv], "observed");
+  }
+  const nanosleep = agg.stats.find((s) => /nanosleep/.test(s.syscall));
+  if (nanosleep && nanosleep.total_ms > duration * 100) b.finding("warn", `${nanosleep.total_ms} ms in ${nanosleep.syscall} (${nanosleep.count} calls) \u2014 deliberate sleeps/timers on the request path`, [topEv], "inferred");
+  const fileChurn = agg.stats.filter((s) => /^(openat|open|stat|newfstatat|statx|lstat|access|readlink)$/.test(s.syscall)).reduce((n, s) => n + s.count, 0);
+  if (fileChurn > duration * 200) b.finding("warn", `${fileChurn} path lookups (open/stat) in ${duration}s \u2014 filesystem churn (missing cache? module resolution per request?)`, [topEv], "inferred");
+  const reads = agg.stats.find((s) => s.syscall === "read");
+  if (reads && reads.count > duration * 300) b.finding("warn", `${reads.count} read() calls in ${duration}s (avg ${reads.avg_ms} ms) \u2014 many small reads; sync I/O in a loop?`, [topEv], "inferred");
+  for (const e of agg.errors.slice(0, 4)) {
+    const sev = /ECONNREFUSED|ETIMEDOUT|EHOSTUNREACH|ENETUNREACH|EMFILE|ENOSPC|ENOMEM/.test(e.errno) ? "high" : e.count > 50 ? "warn" : "info";
+    const hint = e.errno === "EAGAIN" ? " (non-blocking I/O would-block; normal for event loops unless excessive)" : e.errno === "ENOENT" ? ` (missing file; e.g. ${e.example?.split(",")[0]})` : e.errno === "ECONNREFUSED" ? " \u2014 a downstream service is not accepting connections" : "";
+    b.finding(sev, `${e.count}\xD7 ${e.syscall} failed with ${e.errno}${hint}`, [errEv], "observed");
+  }
+  if (slow[0] && slow[0].ms > 500) b.finding("warn", `slowest single call: ${slow[0].syscall}(${slow[0].target}) took ${slow[0].ms} ms`, [slowEv], "observed");
+  if (b.findingCount === 0) b.finding("info", `${records.length} syscalls in ${duration}s, nothing dominant; top ${top?.syscall ?? "?"}`, [topEv, waitEv]);
+}
+async function traceSyscalls(ctx, args) {
+  const { session, target } = ctx;
+  const b = new ResultBuilder("trace_syscalls", session, target);
+  if (!target.pid) return b.fail("no pid").build();
+  const duration = clampDuration(args.duration_s, 10);
+  const cats = args.categories?.length ? args.categories : ["all"];
+  const set = cats.includes("all") ? "all" : [...new Set(cats.map((c) => CATEGORY_SETS[c]))].join(",");
+  const out = b.artifactPath("strace.log");
+  const straceArgs = ["-f", "-T", "-tt", "-qq", "-s", "64", "-e", `trace=${set}`, "-p", String(target.pid), "-o", out];
+  const r = await runCapped("strace", straceArgs, { timeoutMs: duration * 1e3, captureInMemory: true });
+  const raw = await readFile(out, "utf8").catch(() => "");
+  const art = await b.addArtifact(out, "raw_text", { description: `strace ${straceArgs.join(" ")} for ${duration}s`, truncated: r.outputCapped });
+  if (!raw.trim()) {
+    const cmd = `strace ${straceArgs.join(" ")}`;
+    if (looksLikePermissionError(r.stderr)) {
+      b.limitation(rootRequiredLimitation("trace_syscalls", cmd));
+      b.limitation("Linux: kernel.yama.ptrace_scope \u2265 1 blocks attaching to non-child processes; sudo sysctl kernel.yama.ptrace_scope=0 for this boot, or run Debug Anything as root / with CAP_SYS_PTRACE");
+      b.next("import_artifact (strace, after running the sudo command above)", "inspect_sockets", "inspect_files", "snapshot_memory");
+      return b.fail("strace could not attach (permission denied)").build();
+    }
+    if (r.stderr.trim()) b.limitation(`strace: ${r.stderr.trim().slice(0, 300)}`);
+    const ev = b.evidenceOf("syscall_stat", `0 syscalls in ${duration}s`, { name: "syscalls", count: 0 });
+    b.finding("info", `no syscalls in ${duration}s \u2014 the process made no kernel calls (spinning in user space, or fully idle in a wait that started before the trace)`, [ev], "inferred");
+    b.next("dump_stacks", "profile_cpu");
+    return b.build();
+  }
+  summarizeSyscallRecords(b, parseStrace(raw), duration, art.path);
+  b.limitation(`traced ${duration}s only (${set}); strace adds overhead to every syscall \u2014 latencies are inflated`);
+  if (r.outputCapped) b.limitation(`raw log hit the ${LIMITS.MAX_RAW_BYTES / 1024 / 1024} MB cap and was cut short`);
+  b.next("profile_cpu", "inspect_sockets", "inspect_files");
+  return b.build();
+}
+var straceAdapter = {
+  name: "strace",
+  tools: ["trace_syscalls"],
+  platforms: ["linux"],
+  requires: ["strace"],
+  install: { linux: "sudo apt install strace  |  sudo dnf install strace  |  apk add strace" },
+  priority: 10,
+  check(base, env) {
+    if (env.ptraceScope !== null && env.ptraceScope >= 1 && !env.isRoot) base.notes.push(`ptrace_scope=${env.ptraceScope}: can only trace child processes without root`);
+    return base;
+  },
+  async run(tool, args, ctx) {
+    if (tool !== "trace_syscalls") throw new Error(`strace adapter cannot run ${tool}`);
+    return traceSyscalls(ctx, args);
+  }
+};
+
+// src/adapters/gdb.ts
+function parseGdbBacktrace(raw) {
+  const threads = [];
+  let cur = null;
+  for (const line of raw.split("\n")) {
+    let m = /^Thread (\d+) \(Thread 0x[0-9a-f]+ \(LWP (\d+)\)(?: "([^"]*)")?\):?/.exec(line) ?? /^Thread (\d+) \((?:process )?(\d+)(?: "([^"]*)")?\):?/.exec(line);
+    if (m) {
+      cur = { index: Number(m[1]), tid: Number(m[2]), name: m[3], frames: [] };
+      threads.push(cur);
+      continue;
+    }
+    m = /^#(\d+)\s+(?:(0x[0-9a-f]+) in )?(\S+?)\s*\((?:[^)]*)\)(?: at (\S+))?(?: from (\S+))?/.exec(line);
+    if (m && cur) {
+      cur.frames.push({ n: Number(m[1]), func: m[3], loc: m[4] ?? m[5], addr: m[2] });
+      continue;
+    }
+  }
+  return threads;
+}
+var LOCK_FUNCS = /^(__GI_)?(pthread_mutex_lock|__lll_lock_wait|__lll_lock_wait_private|pthread_rwlock_(rd|wr)lock|uv_mutex_lock|__lll_lock|_?_pthread_mutex_firstfit_lock_slow|__psynch_mutexwait|__ulock_wait)$|absl::Mutex::Lock|std::mutex::lock|SpinLock|ObjectMonitor::enter|futex_wait_queue|__futex_abstimed_wait_(common|cancelable)/;
+var IDLE_FUNCS = /pthread_cond_wait|pthread_cond_timedwait|__psynch_cvwait|uv_cond_wait|sem_wait|uv_sem_wait|semaphore_wait_trap|Monitor::wait|epoll_wait|epoll_pwait|^(__GI_)?p?poll$|^select$|^pselect6$|kevent|io_uring_enter|uv__io_poll|^pause$|sigwait|sigtimedwait|^wait4$|^waitid$|mach_msg|__workq_kernreturn|_dispatch_(worker|event_loop)|GCDAsync|^swapper$|__semwait_signal/;
+var IO_FUNCS = /^(__GI_)?(read|recv|recvfrom|recvmsg|accept|accept4|connect|nanosleep|clock_nanosleep|__clock_nanosleep|__select|__recvfrom|__read_nocancel|__connect|__accept)$|__libc_read|__libc_recv|SSL_read|usleep|^sleep$/;
+function classifyNativeThreads(threads) {
+  const lock = [];
+  const io = [];
+  const idle = [];
+  const running = [];
+  const isSys = (f) => LOCK_FUNCS.test(f) || IDLE_FUNCS.test(f) || IO_FUNCS.test(f) || /^(__|_IO_|std::|uv_|uv__|start_thread|thread_start|_pthread_start|clone|clone3|\?\?|_dispatch|libsystem)/.test(f);
+  for (const t of threads) {
+    const top = t.frames.slice(0, 4);
+    const lockF = top.find((f) => LOCK_FUNCS.test(f.func));
+    const idleF = top.find((f) => IDLE_FUNCS.test(f.func));
+    const ioF = top.find((f) => IO_FUNCS.test(f.func));
+    const user = t.frames.find((f) => !isSys(f.func));
+    const at = user ? `${user.func}${user.loc ? ` (${user.loc.split("/").pop()})` : ""}` : t.frames.find((f) => !LOCK_FUNCS.test(f.func) && !IDLE_FUNCS.test(f.func) && !IO_FUNCS.test(f.func))?.func ?? "?";
+    const label = `${t.name ? `${t.name} ` : ""}#${t.index}${t.tid ? ` (tid ${t.tid})` : ""}`;
+    if (lockF) lock.push({ thread: label, waiting_in: lockF.func, at, kind: "lock" });
+    else if (idleF) idle.push({ thread: label, waiting_in: idleF.func, at, kind: "idle" });
+    else if (ioF) io.push({ thread: label, waiting_in: ioF.func, at, kind: "io" });
+    else running.push(t);
+  }
+  return { lock, io, idle, running };
+}
+async function summarizeNativeStacks(b, threads, artifact, debugger_) {
+  if (!threads.length) {
+    b.limitation(`${debugger_} produced no thread backtraces (no symbols? target exited?)`);
+    return b.fail(`${debugger_}: no stacks parsed`).build();
+  }
+  const { lock, io, idle, running } = classifyNativeThreads(threads);
+  const summaryEv = b.evidenceOf(
+    "stack_summary",
+    `${threads.length} thread(s): ${running.length} running/other, ${lock.length} in locks, ${io.length} in blocking I/O, ${idle.length} idle (cond/event waits)`,
+    threads.map((t) => ({ thread: `${t.name ?? ""}#${t.index}`, tid: t.tid, top: t.frames[0]?.func ?? "?", depth: t.frames.length })),
+    { artifact }
+  );
+  for (const t of threads.slice(0, 12)) {
+    b.evidenceOf("stack", `${t.name ? `${t.name} ` : ""}#${t.index}: ${t.frames.slice(0, 5).map((f) => f.func).join(" \u2190 ")}`, { thread: `${t.name ?? ""}#${t.index}`, frames: t.frames.slice(0, 20).map((f) => `${f.func}${f.loc ? ` (${f.loc.split("/").pop()})` : ""}`) }, { artifact });
+  }
+  const noSymbols = threads.flatMap((t) => t.frames).filter((f) => f.func === "??").length;
+  if (noSymbols > 0) b.limitation(`${noSymbols} frame(s) have no symbols (stripped binaries); install debug symbols for better names`);
+  if (lock.length) {
+    const lockEv = b.evidenceOf("lock_wait", `${lock.length} thread(s) blocked on locks: ${lock.map((l) => `${l.thread} in ${l.waiting_in} at ${l.at}`).join("; ")}`, lock, { artifact });
+    if (lock.length >= 2 && running.length === 0) b.finding("high", `likely deadlock: ${lock.length} threads blocked in lock acquisition and none running (${lock.map((l) => `${l.thread}@${l.at}`).join(", ")})`, [lockEv, summaryEv], "inferred", "Take a second dump_stacks; identical positions confirm it. Handoff: step debugger at the lock sites.");
+    else b.finding("warn", `${lock.length} thread(s) waiting on locks: ${lock.map((l) => `${l.thread} at ${l.at}`).join("; ")}`, [lockEv], "observed");
+  }
+  if (io.length) {
+    const ioEv = b.evidenceOf("lock_wait", `${io.length} thread(s) in blocking I/O/sleep: ${io.slice(0, 5).map((l) => `${l.thread} in ${l.waiting_in} at ${l.at}`).join("; ")}`, io, { artifact });
+    const mainBlocked = io.find((l) => /#1\b/.test(l.thread));
+    if (mainBlocked) b.finding("warn", `main thread is blocked in ${mainBlocked.waiting_in} at ${mainBlocked.at} \u2014 waiting on a peer, a file or a timer`, [ioEv], "observed", "inspect_sockets shows which remote; trace_syscalls shows how long each wait takes.");
+    else b.finding("info", `${io.length} thread(s) blocked in I/O: ${io.slice(0, 3).map((l) => `${l.thread} in ${l.waiting_in}`).join("; ")}`, [ioEv]);
+  }
+  if (idle.length) {
+    const idleEv = b.evidenceOf("stack_summary", `${idle.length} idle thread(s) in ${[...new Set(idle.map((i) => i.waiting_in))].join(", ")}`, idle.slice(0, 20), { artifact });
+    if (!lock.length && !io.length && running.length === 0) b.finding("info", `all ${threads.length} threads are idle in event/condition waits (${[...new Set(idle.map((i) => i.waiting_in))].slice(0, 4).join(", ")}) \u2014 not stuck in user code; if callers hang, the work is pending elsewhere (inspect_sockets, trace_syscalls)`, [idleEv, summaryEv], "inferred");
+  }
+  if (running.length) {
+    const t = running[0];
+    b.finding("info", `thread ${t.name ?? ""}#${t.index} is executing ${t.frames[0]?.func ?? "?"}${t.frames[1] ? ` \u2190 ${t.frames[1].func}` : ""}`, [summaryEv]);
+  }
+  b.limitation("instant snapshot; the target was paused for the duration of the dump (typically <1 s)");
+  b.next("inspect_sockets", "trace_syscalls", "profile_cpu");
+  const interesting = lock[0]?.at ?? io.find((l) => /#1\b/.test(l.thread))?.at;
+  if (interesting && interesting !== "?") b.next(`static analysis: decompile ${interesting.replace(/\s*\(.*$/, "")} to see what it locks/reads`);
+  return b.build();
+}
+async function dumpStacks2(ctx) {
+  const { session, target } = ctx;
+  const b = new ResultBuilder("dump_stacks", session, target);
+  if (!target.pid) return b.fail("no pid").build();
+  const args = ["-p", String(target.pid), "-batch", "-q", "-nx", "-ex", "set pagination off", "-ex", "thread apply all bt 25", "-ex", "detach", "-ex", "quit"];
+  const r = await runCapped("gdb", args, { timeoutMs: 45e3 });
+  const raw = r.stdout + (r.stderr ? `
+--- stderr ---
+${r.stderr}` : "");
+  const art = await b.writeArtifact("gdb-bt.txt", raw, "raw_text", `gdb ${args.join(" ")}`);
+  if (looksLikePermissionError(r.stderr) || /ptrace: Operation not permitted/.test(raw)) {
+    b.limitation(rootRequiredLimitation("dump_stacks", `gdb ${args.join(" ")}`));
+    b.limitation("Linux: kernel.yama.ptrace_scope \u2265 1 blocks attaching to non-child processes");
+    b.next("import_artifact (gdb, after running the sudo command above)", "inspect_sockets", "inspect_files", "snapshot_memory");
+    return b.fail("gdb could not attach (permission denied)").build();
+  }
+  const threads = parseGdbBacktrace(r.stdout);
+  if (target.runtime === "node") b.limitation("native stacks only; JS frames show as v8 internals. For JS-level stacks use Node's inspector (--inspect) or `node --cpu-prof`.");
+  return summarizeNativeStacks(b, threads, art, "gdb");
+}
+var gdbAdapter = {
+  name: "gdb",
+  tools: ["dump_stacks"],
+  platforms: ["linux"],
+  requires: ["gdb"],
+  runtimes: ["native", "node", "go", "java", "unknown"],
+  install: { linux: "sudo apt install gdb  |  sudo dnf install gdb" },
+  priority: 5,
+  check(base, env) {
+    if (env.ptraceScope !== null && env.ptraceScope >= 1 && !env.isRoot) base.notes.push(`ptrace_scope=${env.ptraceScope}: can only attach to child processes without root`);
+    return base;
+  },
+  async run(tool, _args, ctx) {
+    if (tool !== "dump_stacks") throw new Error(`gdb adapter cannot run ${tool}`);
+    return dumpStacks2(ctx);
+  }
+};
+
+// src/adapters/lldb.ts
+function parseLldbBacktrace(raw) {
+  const threads = [];
+  let cur = null;
+  for (const line of raw.split("\n")) {
+    let m = /^\*?\s*thread #(\d+)(?:, name = '([^']*)')?(?:, queue = '([^']*)')?/.exec(line);
+    if (m) {
+      const idx = Number(m[1]);
+      const existing = threads.find((t) => t.index === idx);
+      if (existing) {
+        cur = existing;
+        cur.frames = [];
+        continue;
+      }
+      cur = { index: idx, name: m[2] ?? m[3], frames: [] };
+      threads.push(cur);
+      continue;
+    }
+    m = /^\s*(?:\*\s*)?frame #(\d+): (0x[0-9a-f]+) ([^`]+)`(.+?)(?: \+ \d+)?(?: at (\S+))?$/.exec(line);
+    if (m && cur) {
+      const func = m[4].replace(/\(.*$/, "").trim();
+      cur.frames.push({ n: Number(m[1]), func, loc: m[5] ?? m[3], addr: m[2] });
+    }
+  }
+  return threads;
+}
+async function dumpStacks3(ctx) {
+  const { session, target } = ctx;
+  const b = new ResultBuilder("dump_stacks", session, target);
+  if (!target.pid) return b.fail("no pid").build();
+  const args = ["-p", String(target.pid), "--batch", "-o", "thread backtrace all", "-o", "detach", "-o", "quit"];
+  const r = await runCapped("lldb", args, { timeoutMs: 45e3 });
+  const raw = r.stdout + (r.stderr ? `
+--- stderr ---
+${r.stderr}` : "");
+  const art = await b.writeArtifact("lldb-bt.txt", raw, "raw_text", `lldb ${args.join(" ")}`);
+  if (looksLikePermissionError(raw) || /attach failed|not permitted|Permission denied|does not exist|unable to attach/i.test(raw)) {
+    b.limitation(rootRequiredLimitation("dump_stacks", `lldb ${args.join(" ")}`));
+    b.limitation("macOS: attaching to a process you did not spawn needs sudo, or the target must opt in (com.apple.security.get-task-allow). Hardened/SIP-protected binaries cannot be attached at all.");
+    b.next("import_artifact (lldb, after running the sudo command above)", "inspect_sockets", "snapshot_memory", "profile_cpu (sample, own processes)");
+    return b.fail("lldb could not attach (permission denied)").build();
+  }
+  const threads = parseLldbBacktrace(r.stdout);
+  if (target.runtime === "node") b.limitation("native stacks only; JS frames appear as v8 internals. For JS-level stacks use the inspector (--inspect).");
+  return summarizeNativeStacks(b, threads, art, "lldb");
+}
+var lldbAdapter = {
+  name: "lldb",
+  tools: ["dump_stacks"],
+  platforms: ["darwin"],
+  requires: ["lldb"],
+  runtimes: ["native", "node", "go", "java", "unknown"],
+  install: { darwin: "xcode-select --install" },
+  priority: 5,
+  check(base, env) {
+    if (!env.isRoot) base.notes.push("macOS: attaching needs sudo unless the target is your own debuggable child");
+    return base;
+  },
+  async run(tool, _args, ctx) {
+    if (tool !== "dump_stacks") throw new Error(`lldb adapter cannot run ${tool}`);
+    return dumpStacks3(ctx);
+  }
+};
+
+// src/adapters/perf.ts
+import { readFile as readFile2 } from "fs/promises";
+function perfScriptToFolded(raw, opts = {}) {
+  const counts = /* @__PURE__ */ new Map();
+  let comm = null;
+  let frames = [];
+  const flush = () => {
+    if (comm !== null && frames.length) {
+      const stack = [...opts.includeComm ? [comm] : [], ...frames.reverse()];
+      const key = stack.join(";");
+      counts.set(key, (counts.get(key) ?? 0) + 1);
+    }
+    comm = null;
+    frames = [];
+  };
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) {
+      flush();
+      continue;
+    }
+    if (!/^\s/.test(line)) {
+      flush();
+      const m2 = /^(\S+)\s+\d+/.exec(line);
+      comm = m2 ? m2[1] : "?";
+      continue;
+    }
+    const m = /^\s+[0-9a-f]+\s+(.+?)(?:\+0x[0-9a-f]+)?\s+\((.*)\)\s*$/.exec(line);
+    if (m && comm !== null) {
+      let sym = m[1];
+      const dso = m[2];
+      if (sym === "[unknown]") sym = `[unknown] (${dso.split("/").pop()})`;
+      frames.push(sym.replace(/;/g, ","));
+    }
+  }
+  flush();
+  return [...counts].map(([k, v]) => `${k} ${v}`).join("\n") + (counts.size ? "\n" : "");
+}
+async function profileCpu2(ctx, args) {
+  const { session, target } = ctx;
+  const b = new ResultBuilder("profile_cpu", session, target);
+  if (!target.pid) return b.fail("no pid").build();
+  const duration = clampDuration(args.duration_s, 15);
+  const dataPath = b.artifactPath("perf.data");
+  const recArgs = ["record", "-F", "99", "-g", "--call-graph", "fp", "-p", String(target.pid), "-o", dataPath, "--", "sleep", String(duration)];
+  const rec = await runCapped("perf", recArgs, { timeoutMs: duration * 1e3 + LIMITS.DURATION_SLACK_MS + 1e4 });
+  if (rec.exitCode !== 0 || looksLikePermissionError(rec.stderr) || /perf_event_open|Permission|not permitted/i.test(rec.stderr)) {
+    await b.writeArtifact("perf-stderr.txt", rec.stderr, "raw_text");
+    if (looksLikePermissionError(rec.stderr) || /paranoid|perf_event_open/i.test(rec.stderr)) {
+      b.limitation(rootRequiredLimitation("profile_cpu", `perf ${recArgs.join(" ")}`));
+      b.limitation("Linux: lower kernel.perf_event_paranoid to 1 (sudo sysctl kernel.perf_event_paranoid=1) or grant CAP_PERFMON; inside Docker add --cap-add PERFMON --cap-add SYS_ADMIN");
+      b.next("import_artifact (perf_script, after running the sudo command above)", "dump_stacks", "trace_syscalls", "snapshot_memory");
+      return b.fail("perf record needs permissions").build();
+    }
+    b.limitation(`perf record exited ${rec.exitCode}: ${rec.stderr.trim().slice(0, 300)}`);
+    return b.fail("perf record failed").build();
+  }
+  const scriptPath = b.artifactPath("perf-script.txt");
+  const scr = await runCapped("perf", ["script", "-i", dataPath, "-F", "comm,pid,time,event,ip,sym,dso"], { timeoutMs: 6e4, stdoutFile: scriptPath });
+  const raw = await readFile2(scriptPath, "utf8").catch(() => "");
+  await b.addArtifact(dataPath, "raw_text", { description: "perf.data (binary)" });
+  await b.addArtifact(scriptPath, "raw_text", { description: "perf script output", truncated: scr.outputCapped });
+  const folded = perfScriptToFolded(raw);
+  await b.writeArtifact("perf-folded.txt", folded, "folded_stacks", "folded stacks");
+  const unknown = (folded.match(/\[unknown\]/g) ?? []).length;
+  if (unknown > 0) b.limitation(`${unknown} stack frames have no symbols${target.runtime === "node" ? " \u2014 start Node with --perf-basic-prof (or --perf-prof) so JIT frames get names" : target.runtime === "java" ? " \u2014 use perf-map-agent or async-profiler for JIT frames" : "; install debug symbols or build with frame pointers"}`);
+  b.limitation("perf samples at 99 Hz with frame-pointer unwinding; frames may be missing in code built without frame pointers (use --call-graph dwarf manually for those)");
+  return summarizeProfile(b, folded, duration, "perf", 99);
+}
+var perfAdapter = {
+  name: "perf",
+  tools: ["profile_cpu"],
+  platforms: ["linux"],
+  requires: ["perf"],
+  runtimes: ["native", "node", "go", "java", "unknown"],
+  install: { linux: "sudo apt install linux-perf  (Debian/Ubuntu: linux-tools-$(uname -r))  |  sudo dnf install perf" },
+  priority: 5,
+  check(base, env) {
+    if (env.perfParanoid !== null && env.perfParanoid > 1 && !env.isRoot) base.notes.push(`perf_event_paranoid=${env.perfParanoid}: cannot profile other processes without root`);
+    return base;
+  },
+  async run(tool, args, ctx) {
+    if (tool !== "profile_cpu") throw new Error(`perf adapter cannot run ${tool}`);
+    return profileCpu2(ctx, args);
+  }
+};
+
+// src/adapters/tcpdump.ts
+function splitHostPort(s) {
+  const m = /^(.*)\.(\d+)$/.exec(s);
+  if (!m) return { host: s };
+  return { host: m[1], port: Number(m[2]) };
+}
+function parseTcpdump(raw) {
+  const out = [];
+  for (const line of raw.split("\n")) {
+    const m = /^(\d+\.\d+) (?:[\w.-]+\s+(In|Out|B|M|P)\s+)?(IP6?|ARP) (.*)$/.exec(line.trim());
+    if (!m) continue;
+    const ts = Number(m[1]);
+    const dir = m[2];
+    const proto = m[3];
+    const rest = m[4];
+    const flow = /^(\S+) > (\S+): (.*)$/.exec(rest);
+    if (!flow) continue;
+    const s = splitHostPort(flow[1]);
+    const d = splitHostPort(flow[2].replace(/:$/, ""));
+    const body = flow[3];
+    const pkt = { ts, proto, src: s.host, sport: s.port, dst: d.host, dport: d.port, kind: "other", dir };
+    if (/^Flags \[/.test(body)) {
+      pkt.kind = "tcp";
+      pkt.flags = /^Flags \[([^\]]*)\]/.exec(body)?.[1];
+      pkt.seq = /\bseq (\d+(?::\d+)?)/.exec(body)?.[1];
+      const len = /length (\d+)/.exec(body);
+      if (len) pkt.length = Number(len[1]);
+      const sni = /SNI=([A-Za-z0-9.-]+)/.exec(body);
+      if (sni) pkt.tlsSni = sni[1];
+    } else if (/^\d+\+?\$? [A-Z]+\??/.test(body) || /^\d+ [A-Z]+\? /.test(body) || /\b(A|AAAA|CNAME|MX|TXT|SRV)\?/.test(body) && (d.port === 53 || s.port === 53)) {
+      pkt.kind = "dns";
+      const q = /\b(?:A|AAAA|CNAME|MX|TXT|SRV|PTR)\? ([^\s,]+)/.exec(body);
+      if (q) pkt.dnsQuery = q[1].replace(/\.$/, "");
+    } else if (/^UDP, length (\d+)/.test(body)) {
+      pkt.kind = "udp";
+      pkt.length = Number(/length (\d+)/.exec(body)[1]);
+    }
+    out.push(pkt);
+  }
+  return out;
+}
+function summarizeTraffic(pkts, localPorts) {
+  const remotes = /* @__PURE__ */ new Map();
+  const dns = /* @__PURE__ */ new Map();
+  const sni = /* @__PURE__ */ new Map();
+  let rst = 0;
+  let retransmits = 0;
+  let bytes = 0;
+  const deduped = [];
+  const lastSeen = /* @__PURE__ */ new Map();
+  for (const p of pkts) {
+    const key = `${p.src}:${p.sport}>${p.dst}:${p.dport}|${p.flags ?? ""}|${p.seq ?? ""}|${p.length ?? ""}|${p.kind}`;
+    const prev = lastSeen.get(key);
+    lastSeen.set(key, p.ts);
+    if (prev !== void 0 && p.ts - prev < 2e-3 && p.dir !== void 0) continue;
+    deduped.push(p);
+  }
+  const seenSeq = /* @__PURE__ */ new Map();
+  const syns = /* @__PURE__ */ new Map();
+  const synacks = /* @__PURE__ */ new Set();
+  for (const p of deduped) {
+    const isLocalSrc = p.sport !== void 0 && localPorts.has(p.sport);
+    const remoteHost = isLocalSrc ? p.dst : p.src;
+    const r = remotes.get(remoteHost) ?? { remote: remoteHost, packets: 0, bytes: 0, rst: 0, syn: 0, fin: 0, retransmits: 0 };
+    r.packets++;
+    r.bytes += p.length ?? 0;
+    bytes += p.length ?? 0;
+    if (p.kind === "tcp" && p.flags) {
+      if (p.flags.includes("R")) {
+        r.rst++;
+        rst++;
+      }
+      if (p.flags === "S") {
+        r.syn++;
+        syns.set(`${p.src}:${p.sport}>${p.dst}:${p.dport}`, (syns.get(`${p.src}:${p.sport}>${p.dst}:${p.dport}`) ?? 0) + 1);
+      }
+      if (p.flags === "S.") synacks.add(`${p.dst}:${p.dport}>${p.src}:${p.sport}`);
+      if (p.flags.includes("F")) r.fin++;
+      if ((p.length ?? 0) > 0 && p.seq) {
+        const key = `${p.src}:${p.sport}>${p.dst}:${p.dport}|${p.seq}`;
+        const first = seenSeq.get(key);
+        if (first !== void 0 && p.ts - first > 2e-3) {
+          r.retransmits++;
+          retransmits++;
+        } else if (first === void 0) seenSeq.set(key, p.ts);
+      }
+    }
+    if (p.kind === "dns" && p.dnsQuery) dns.set(p.dnsQuery, (dns.get(p.dnsQuery) ?? 0) + 1);
+    if (p.tlsSni) sni.set(p.tlsSni, (sni.get(p.tlsSni) ?? 0) + 1);
+    remotes.set(remoteHost, r);
+  }
+  let synNoAck = 0;
+  for (const [flow, n] of syns) if (!synacks.has(flow)) synNoAck += n;
+  const ts = deduped.map((p) => p.ts);
+  return {
+    packets: deduped.length,
+    bytes,
+    byRemote: [...remotes.values()].sort((a, b) => b.bytes - a.bytes || b.packets - a.packets),
+    rst,
+    syn_no_synack: synNoAck,
+    retransmits,
+    dns: [...dns].map(([name, count]) => ({ name, count })).sort((a, b) => b.count - a.count),
+    sni: [...sni].map(([name, count]) => ({ name, count })).sort((a, b) => b.count - a.count),
+    duration_s: ts.length ? Math.round((Math.max(...ts) - Math.min(...ts)) * 100) / 100 : 0
+  };
+}
+function buildFilter(ports, extra) {
+  const uniq = [...new Set(ports.filter((p) => p > 0 && p < 65536))].slice(0, 40);
+  if (!uniq.length) throw new Error("target has no sockets/ports to scope the capture to; refusing an unbounded capture");
+  const portExpr = uniq.length === 1 ? `port ${uniq[0]}` : `(${uniq.map((p) => `port ${p}`).join(" or ")})`;
+  const base = `(${portExpr} or (udp and port 53))`;
+  return extra ? `${base} and (${assertSafeBpfFragment(extra)})` : base;
+}
+function summarizeCaptureEvidence(b, pkts, localPorts, meta) {
+  const { filter, duration } = meta;
+  const local = localPorts;
+  const s = summarizeTraffic(pkts, local);
+  const filterEv = b.evidenceOf("note", `filter: ${filter}`, { filter, ports: [...local].slice(0, 40), duration_s: duration });
+  const totalEv = b.evidenceOf("packet_summary", `${s.packets} packets, ${humanBytes(s.bytes)} payload over ${s.duration_s}s; RST=${s.rst} retransmit\u2248${s.retransmits} unanswered SYN=${s.syn_no_synack}`, { name: "packets", packets: s.packets, bytes: s.bytes, rst: s.rst, retransmits: s.retransmits, syn_no_synack: s.syn_no_synack, duration_s: s.duration_s }, { artifact: meta.pcapPath ?? meta.textPath });
+  const remoteEv = b.evidenceOf("packet_summary", s.byRemote.length ? `per remote: ${s.byRemote.slice(0, 5).map((r2) => `${r2.remote} ${r2.packets}p/${humanBytes(r2.bytes)}${r2.rst ? ` RST\xD7${r2.rst}` : ""}${r2.retransmits ? ` rtx\xD7${r2.retransmits}` : ""}`).join("; ")}` : "no packets matched", s.byRemote.slice(0, 25), { artifact: meta.textPath });
+  if (s.dns.length) b.evidenceOf("dns_query", `DNS: ${s.dns.slice(0, 6).map((d) => `${d.name}\xD7${d.count}`).join(", ")}`, s.dns.slice(0, 30), { artifact: meta.textPath });
+  if (s.sni.length) b.evidenceOf("tls_sni", `TLS SNI: ${s.sni.slice(0, 6).map((d) => `${d.name}\xD7${d.count}`).join(", ")}`, s.sni.slice(0, 30), { artifact: meta.textPath });
+  if (s.packets === 0) b.finding("info", `no packets on the target's ports in ${duration}s`, [totalEv, filterEv]);
+  if (s.rst > 0) {
+    const worst = [...s.byRemote].sort((a, c) => c.rst - a.rst)[0];
+    b.finding(s.rst >= 10 ? "high" : "warn", `${s.rst} TCP RST(s), most with ${worst.remote} (${worst.rst}) \u2014 connections are being refused or torn down abruptly`, [totalEv, remoteEv], "observed");
+  }
+  if (s.syn_no_synack > 0) b.finding("high", `${s.syn_no_synack} SYN(s) never got a SYN-ACK \u2014 a remote is unreachable or firewalled`, [totalEv, remoteEv], "observed");
+  if (s.retransmits >= 5) b.finding("warn", `\u2248${s.retransmits} probable retransmissions \u2014 packet loss or a slow peer`, [totalEv], "inferred");
+  const dnsRepeat = s.dns.find((d) => d.count >= 20);
+  if (dnsRepeat) b.finding("warn", `${dnsRepeat.name} resolved ${dnsRepeat.count}\xD7 in ${duration}s \u2014 no DNS caching`, [b.evidenceOf("dns_query", "repeated lookups", dnsRepeat)], "inferred");
+  if (b.findingCount === 0 && s.packets > 0) b.finding("info", `${s.packets} packets, top remote ${s.byRemote[0]?.remote} (${humanBytes(s.byRemote[0]?.bytes ?? 0)})`, [remoteEv]);
+}
+async function targetPorts(pids) {
+  const r = await runCapped("lsof", ["-nP", "-w", "-a", "-F", "pcufatsinTP", "-i", "-p", pids.join(",")], { timeoutMs: 15e3 });
+  const ports = [];
+  for (const e of parseLsofFields(r.stdout)) {
+    if (e.type !== "IPv4" && e.type !== "IPv6") continue;
+    const local = e.name.split("->")[0];
+    const port = Number(local.slice(local.lastIndexOf(":") + 1));
+    if (port) ports.push(port);
+    const remote = e.name.split("->")[1];
+    if (remote) {
+      const rp = Number(remote.slice(remote.lastIndexOf(":") + 1));
+      if (rp) ports.push(rp);
+    }
+  }
+  return ports;
+}
+async function captureTraffic(ctx, args) {
+  const { session, target } = ctx;
+  const b = new ResultBuilder("capture_traffic", session, target);
+  const pids = targetPids(target);
+  if (!pids.length) return b.fail("no pid; cannot derive the target's ports").build();
+  const duration = clampDuration(args.duration_s, 10, LIMITS.MAX_CAPTURE_WALL_MS);
+  let filter;
+  let ports;
+  try {
+    ports = await targetPorts(pids);
+    filter = buildFilter(ports, args.filter);
+  } catch (err) {
+    b.limitation(err.message);
+    return b.fail("refusing unbounded capture").build();
+  }
+  const pcap = b.artifactPath("capture.pcap");
+  const iface = platform() === "linux" ? "any" : "any";
+  const tdArgs = ["-i", iface, "-nn", "-q", "-U", "-s", "256", "-w", pcap, "-G", String(duration), "-W", "1", filter];
+  const r = await runCapped("tcpdump", tdArgs, { timeoutMs: duration * 1e3 + LIMITS.DURATION_SLACK_MS + 3e3 });
+  if (looksLikePermissionError(r.stderr) || /You don't have permission|Operation not permitted|cannot open BPF device/i.test(r.stderr)) {
+    b.limitation(rootRequiredLimitation("capture_traffic", `tcpdump ${tdArgs.map((a) => a === filter ? `'${a}'` : a).join(" ")}`));
+    if (platform() === "darwin") b.limitation("macOS: add yourself to the access_bpf group (install Wireshark's ChmodBPF) or run with sudo");
+    if (platform() === "linux") b.limitation("Linux: sudo setcap cap_net_raw,cap_net_admin=eip $(which tcpdump)  grants capture without root");
+    return b.fail("tcpdump needs permissions").build();
+  }
+  const art = await b.addArtifact(pcap, "pcap", { description: `tcpdump ${duration}s, filter: ${filter}` });
+  const read = await runCapped("tcpdump", ["-nn", "-tt", "-r", pcap], { timeoutMs: 3e4 });
+  const textPath = await b.writeArtifact("capture.txt", read.stdout, "raw_text", "tcpdump -nn -tt -r capture.pcap");
+  summarizeCaptureEvidence(b, parseTcpdump(read.stdout), new Set(ports), { filter, duration, pcapPath: art.path, textPath });
+  b.limitation("retransmits = same flow and TCP seq range seen again >2 ms later (loopback In/Out duplicates collapsed); open the .pcap in Wireshark for exact analysis");
+  b.limitation("TLS SNI and payloads need a deeper snaplen/-v; this capture used -s 256 -q. Raw .pcap may contain secrets and is NOT redacted");
+  if (!isRoot()) b.limitation("capture ran without root \u2014 if it worked, your user has BPF access");
+  b.next("inspect_sockets", "trace_syscalls");
+  return b.build();
+}
+var tcpdumpAdapter = {
+  name: "tcpdump",
+  tools: ["capture_traffic"],
+  platforms: ["linux", "darwin"],
+  requires: ["tcpdump", "lsof"],
+  install: { linux: "sudo apt install tcpdump", darwin: "preinstalled (/usr/sbin/tcpdump); needs sudo or access_bpf group" },
+  priority: 10,
+  check(base, env) {
+    if (!env.isRoot) base.notes.push("needs root or CAP_NET_RAW / access_bpf group; requires consent: true");
+    return base;
+  },
+  async run(tool, args, ctx) {
+    if (tool !== "capture_traffic") throw new Error(`tcpdump adapter cannot run ${tool}`);
+    return captureTraffic(ctx, args);
+  }
+};
+
+// src/adapters/sample_macos.ts
+import { readFile as readFile3 } from "fs/promises";
+function sampleToFolded(raw) {
+  const start = raw.indexOf("Call graph:");
+  if (start < 0) return "";
+  const end = raw.indexOf("\nTotal number in stack", start);
+  const section = raw.slice(start, end > 0 ? end : void 0).split("\n").slice(1);
+  const stack = [];
+  const out = [];
+  const flushLeaf = (node, path) => {
+    const self = node.count - node.childSum;
+    if (self > 0) out.push(`${[...path, node.name].join(";")} ${self}`);
+  };
+  for (const line of section) {
+    if (!line.trim()) continue;
+    const m = /^((?:\s|[+!:|])*?)(\d+)\s+(.+?)(?:\s{2}\(in ([^)]+)\))?(?:\s+\+\s+\d+)?(?:\s+\[0x[0-9a-f]+(?:,0x[0-9a-f]+)?\])?\s*$/.exec(line);
+    if (!m) continue;
+    const depth = Math.max(0, Math.floor((m[1].length - 4) / 2));
+    const count = Number(m[2]);
+    let name = m[3].trim();
+    const dso = m[4];
+    if (/^Thread_\d+/.test(name)) name = name.replace(/\s+DispatchQueue.*$/, "").replace(/\s{2,}.*$/, "");
+    if (dso && !/^Thread_/.test(name)) name = `${name} (${dso})`;
+    name = name.replace(/;/g, ",");
+    while (stack.length && stack[stack.length - 1].depth >= depth) {
+      const node = stack.pop();
+      flushLeaf(node, stack.map((s) => s.name));
+    }
+    const parent = stack[stack.length - 1];
+    if (parent) parent.childSum += count;
+    stack.push({ depth, name, count, childSum: 0 });
+  }
+  while (stack.length) {
+    const node = stack.pop();
+    flushLeaf(node, stack.map((s) => s.name));
+  }
+  return out.join("\n") + (out.length ? "\n" : "");
+}
+async function profileCpu3(ctx, args) {
+  const { session, target } = ctx;
+  const b = new ResultBuilder("profile_cpu", session, target);
+  if (!target.pid) return b.fail("no pid").build();
+  const duration = clampDuration(args.duration_s, 15);
+  const out = b.artifactPath("sample.txt");
+  const sArgs = [String(target.pid), String(duration), "1", "-mayDie", "-file", out];
+  const r = await runCapped("sample", sArgs, { timeoutMs: duration * 1e3 + LIMITS.DURATION_SLACK_MS + 1e4 });
+  const raw = await readFile3(out, "utf8").catch(() => "");
+  if (!raw) {
+    if (looksLikePermissionError(r.stderr + r.stdout) || /Unable to sample|not permitted|failed to attach|Sampling failed/i.test(r.stderr + r.stdout)) {
+      b.limitation(rootRequiredLimitation("profile_cpu", `sample ${sArgs.join(" ")}`));
+      b.limitation("macOS: sampling another user's or a hardened process needs sudo");
+      return b.fail("sample could not attach").build();
+    }
+    b.limitation(`sample: ${(r.stderr || r.stdout).trim().slice(0, 300)}`);
+    return b.fail("sample produced no output").build();
+  }
+  await b.addArtifact(out, "raw_text", { description: `sample ${duration}s` });
+  const folded = sampleToFolded(raw);
+  await b.writeArtifact("sample-folded.txt", folded, "folded_stacks", "folded stacks derived from sample call graph");
+  b.limitation("`sample` samples every 1 ms across all threads including idle ones; idle frames (kevent, __psynch_cvwait, mach_msg) are expected to dominate for servers");
+  return summarizeProfile(b, folded, duration, "sample", 1e3);
+}
+var sampleMacosAdapter = {
+  name: "sample",
+  tools: ["profile_cpu"],
+  platforms: ["darwin"],
+  requires: ["sample"],
+  runtimes: ["native", "node", "go", "java", "unknown"],
+  install: { darwin: "preinstalled (/usr/bin/sample)" },
+  priority: 5,
+  async run(tool, args, ctx) {
+    if (tool !== "profile_cpu") throw new Error(`sample adapter cannot run ${tool}`);
+    return profileCpu3(ctx, args);
+  }
+};
+
+// src/adapters/fs_usage.ts
+var DARWIN_ERRNO = { 1: "EPERM", 2: "ENOENT", 4: "EINTR", 5: "EIO", 9: "EBADF", 11: "EDEADLK", 12: "ENOMEM", 13: "EACCES", 17: "EEXIST", 20: "ENOTDIR", 21: "EISDIR", 22: "EINVAL", 24: "EMFILE", 28: "ENOSPC", 32: "EPIPE", 35: "EAGAIN", 36: "EINPROGRESS", 54: "ECONNRESET", 57: "ENOTCONN", 60: "ETIMEDOUT", 61: "ECONNREFUSED", 65: "EHOSTUNREACH" };
+function parseFsUsage(raw) {
+  const out = [];
+  const lines = raw.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i].trimEnd();
+    const m = /^(\d{2}:\d{2}:\d{2}\.\d+)\s+(\S+)\s+(.*?)\s+(\d+\.\d{6})(?:\s+(W))?\s+(\S+?)\.(\d+)\s*$/.exec(line);
+    if (!m) continue;
+    const name = m[2].replace(/\[.*$/, "");
+    const args = m[3].trim();
+    const err = /\[\s*(\d+)\]/.exec(args);
+    const errno = err ? DARWIN_ERRNO[Number(err[1])] ?? `E${err[1]}` : void 0;
+    out.push({ pid: Number(m[7]), time: m[1], name, args: args.replace(/\[\s*\d+\]\s*/, "").replace(/^\(\S+\)\s*/, ""), result: errno ? `-1 ${errno}` : m[5] ? "0 (blocked)" : "0", errno, duration_s: Number(m[4]), line: i + 1 });
+  }
+  return out;
+}
+var FS_FILTERS = { network: "network", file: "filesys", process: "exec", signal: void 0, memory: void 0, all: "filesys,network,exec" };
+async function traceSyscalls2(ctx, args) {
+  const { session, target } = ctx;
+  const b = new ResultBuilder("trace_syscalls", session, target);
+  if (!target.pid) return b.fail("no pid").build();
+  const duration = clampDuration(args.duration_s, 10);
+  const cats = args.categories?.length ? args.categories : ["all"];
+  const filters = [...new Set(cats.map((c) => FS_FILTERS[c]).filter(Boolean))].join(",") || "filesys,network";
+  const out = b.artifactPath("fs_usage.txt");
+  const fsArgs = ["-w", "-f", filters, "-p", String(target.pid)];
+  const cmd = `sudo fs_usage ${fsArgs.join(" ")} > ${out}`;
+  if (!isRoot()) {
+    b.limitation(rootRequiredLimitation("trace_syscalls", `fs_usage ${fsArgs.join(" ")}`));
+    b.limitation(`macOS has no strace; fs_usage needs root. Run for ~${duration}s then Ctrl-C:  ${cmd}   and then:  debuganything import fs_usage ${out} --session ${session.id}`);
+    b.limitation("or run the target on Linux (docker/linux-lab) where strace gives the full breakdown");
+    b.next(`import_artifact (fs_usage, ${out})`, "inspect_sockets", "profile_cpu");
+    return b.fail("fs_usage needs root; Debug Anything never escalates").build();
+  }
+  const r = await runCapped("fs_usage", fsArgs, { timeoutMs: duration * 1e3, stdoutFile: out, captureInMemory: false });
+  const { readFile: readFile4 } = await import("fs/promises");
+  const raw = await readFile4(out, "utf8").catch(() => "");
+  const art = await b.addArtifact(out, "raw_text", { description: `fs_usage ${fsArgs.join(" ")} for ${duration}s`, truncated: r.outputCapped });
+  if (!raw.trim()) {
+    if (looksLikePermissionError(r.stderr)) {
+      b.limitation(rootRequiredLimitation("trace_syscalls", `fs_usage ${fsArgs.join(" ")}`));
+      return b.fail("fs_usage could not run (permission denied)").build();
+    }
+    const ev = b.evidenceOf("syscall_stat", `0 syscalls in ${duration}s`, { name: "syscalls", count: 0 });
+    b.finding("info", `no file/network syscalls in ${duration}s \u2014 idle, or spinning in user space`, [ev], "inferred");
+    return b.build();
+  }
+  summarizeSyscallRecords(b, parseFsUsage(raw), duration, art.path);
+  b.limitation(`fs_usage shows file and network calls only (filters: ${filters}); futex/select/kevent waits are not included \u2014 use dump_stacks for those`);
+  if (r.outputCapped) b.limitation(`raw log hit the ${LIMITS.MAX_RAW_BYTES / 1024 / 1024} MB cap`);
+  b.next("profile_cpu", "inspect_sockets", "inspect_files");
+  return b.build();
+}
+var fsUsageAdapter = {
+  name: "fs_usage",
+  tools: ["trace_syscalls"],
+  platforms: ["darwin"],
+  requires: ["fs_usage"],
+  install: { darwin: "preinstalled (/usr/bin/fs_usage); needs sudo" },
+  priority: 5,
+  check(base, env) {
+    if (!env.isRoot) base.notes.push("needs root: Debug Anything will print the sudo command and you can `debuganything import fs_usage <file>`");
+    return base;
+  },
+  async run(tool, args, ctx) {
+    if (tool !== "trace_syscalls") throw new Error(`fs_usage adapter cannot run ${tool}`);
+    return traceSyscalls2(ctx, args);
+  }
+};
+
+// src/adapters/jvm.ts
+function parseJstack(raw) {
+  const threads = [];
+  let cur;
+  let deadlock;
+  const lines = raw.split("\n");
+  for (const line of lines) {
+    if (/^Found .* Java-level deadlock/i.test(line)) deadlock = [line.trim()];
+    else if (deadlock && deadlock.length < 40 && line.trim()) deadlock.push(line.trim());
+    const head = line.match(/^"(.+)"\s+(#(\d+)\s+)?(daemon\s+)?prio=/) ?? line.match(/^"(.+)"\s+(#(\d+))?.*(daemon)?.*\bnid=/);
+    if (head) {
+      cur = { name: head[1], id: head[3] ? Number(head[3]) : void 0, daemon: /\bdaemon\b/.test(line), frames: [], holding: [] };
+      threads.push(cur);
+      continue;
+    }
+    if (!cur) continue;
+    const st = line.match(/^\s+java\.lang\.Thread\.State:\s+(\w+)/);
+    if (st) {
+      cur.state = st[1];
+      continue;
+    }
+    const at = line.match(/^\s+at\s+([\w.$/<>]+)\((.*?)\)/);
+    if (at) {
+      cur.frames.push({ func: at[1], loc: at[2] && at[2] !== "Native Method" ? at[2] : void 0 });
+      continue;
+    }
+    const wait = line.match(/^\s+-\s+(?:waiting to lock|parking to wait for|waiting on)\s+<(0x[0-9a-f]+)>/);
+    if (wait) {
+      cur.waitingToLock = wait[1];
+      continue;
+    }
+    const locked = line.match(/^\s+-\s+locked\s+<(0x[0-9a-f]+)>/);
+    if (locked) cur.holding.push(locked[1]);
+  }
+  return { threads: threads.filter((t) => t.frames.length || t.state), deadlockText: deadlock?.join("\n") };
+}
+async function summarizeJavaStacks(b, dump, artifact) {
+  const ts = dump.threads;
+  if (!ts.length) {
+    b.limitation("no Java threads parsed (expected `jstack <pid>` or `jcmd <pid> Thread.print` output)");
+    return b.fail("jstack: no threads parsed").build();
+  }
+  const byState = /* @__PURE__ */ new Map();
+  for (const t of ts) {
+    const s = t.state ?? "UNKNOWN";
+    byState.set(s, [...byState.get(s) ?? [], t]);
+  }
+  const blocked = byState.get("BLOCKED") ?? [];
+  const runnable = byState.get("RUNNABLE") ?? [];
+  const summaryEv = b.evidenceOf(
+    "stack_summary",
+    `${ts.length} JVM thread(s): ${[...byState].map(([s, v]) => `${s}=${v.length}`).join(" ")}`,
+    ts.slice(0, 200).map((t) => ({ name: t.name, state: t.state, daemon: t.daemon, top: t.frames[0]?.func })),
+    { artifact }
+  );
+  for (const t of ts.filter((x) => x.state === "BLOCKED" || x.name === "main").slice(0, 10)) {
+    b.evidenceOf("stack", `${t.name} [${t.state}]: ${t.frames.slice(0, 5).map((f) => f.func.split(".").slice(-2).join(".")).join(" \u2190 ")}`, { name: t.name, state: t.state, waiting_to_lock: t.waitingToLock, holding: t.holding, frames: t.frames.slice(0, 20).map((f) => `${f.func}${f.loc ? ` (${f.loc})` : ""}`) }, { artifact });
+  }
+  if (dump.deadlockText) {
+    const dlEv = b.evidenceOf("lock_wait", dump.deadlockText.split("\n")[0], { jstack_deadlock_section: dump.deadlockText }, { artifact });
+    b.finding("high", `the JVM itself reports a deadlock: ${dump.deadlockText.split("\n")[0]}`, [dlEv, summaryEv], "observed", dump.deadlockText);
+  } else if (blocked.length >= 2) {
+    const holders = /* @__PURE__ */ new Map();
+    for (const t of ts) for (const m of t.holding) holders.set(m, t);
+    const cycles = blocked.filter((t) => {
+      const holder = t.waitingToLock ? holders.get(t.waitingToLock) : void 0;
+      return holder && holder.waitingToLock && holders.get(holder.waitingToLock)?.name === t.name;
+    });
+    const lockEv = b.evidenceOf("lock_wait", `${blocked.length} BLOCKED thread(s): ${blocked.slice(0, 6).map((t) => `${t.name} wants <${t.waitingToLock ?? "?"}> at ${t.frames[0]?.func ?? "?"}`).join("; ")}`, blocked.slice(0, 30).map((t) => ({ name: t.name, wants: t.waitingToLock, holds: t.holding, at: t.frames[0]?.func })), { artifact });
+    if (cycles.length) b.finding("high", `deadlock: circular monitor wait between ${cycles.map((t) => t.name).join(" and ")}`, [lockEv, summaryEv], "inferred", "Each thread holds the monitor the other wants.");
+    else {
+      const wantCounts = /* @__PURE__ */ new Map();
+      for (const t of blocked) if (t.waitingToLock) wantCounts.set(t.waitingToLock, (wantCounts.get(t.waitingToLock) ?? 0) + 1);
+      const hot = [...wantCounts].sort((a, c) => c[1] - a[1])[0];
+      if (hot && hot[1] >= 3) {
+        const holder = holders.get(hot[0]);
+        b.finding("high", `monitor contention: ${hot[1]} threads blocked on <${hot[0]}>${holder ? `, held by ${holder.name} at ${holder.frames[0]?.func ?? "?"}` : ""}`, [lockEv], "observed");
+      } else b.finding("warn", `${blocked.length} thread(s) BLOCKED on monitors`, [lockEv], "observed");
+    }
+  }
+  const main = ts.find((t) => t.name === "main");
+  if (main && (main.state === "WAITING" || main.state === "TIMED_WAITING") && !dump.deadlockText) {
+    const ev = b.evidenceOf("stack", `main is ${main.state} in ${main.frames[0]?.func ?? "?"}`, main.frames.slice(0, 10).map((f) => f.func), { artifact });
+    b.finding("info", `main thread is ${main.state} in ${main.frames[0]?.func ?? "?"} \u2014 normal for servers; relevant if this process should be doing work`, [ev]);
+  }
+  if (ts.length >= 500) b.finding("warn", `${ts.length} threads \u2014 likely an unbounded thread pool or a thread leak`, [summaryEv], "inferred");
+  if (!b.findingCount) b.finding("info", `${ts.length} threads, ${runnable.length} RUNNABLE, no monitor contention visible`, [summaryEv]);
+  b.next("inspect_sockets", "snapshot_memory", "profile_cpu");
+  return b.build();
+}
+async function liveDump(ctx) {
+  const { session, target } = ctx;
+  const b = new ResultBuilder("dump_stacks", session, target);
+  const pid = target.pid;
+  if (!pid) return b.fail("no resolved pid for target").build();
+  const bad = (x) => x.exitCode !== 0 || !/java\.lang\.Thread\.State:|Full thread dump/.test(x.stdout);
+  let r = await runCapped("jcmd", [String(pid), "Thread.print", "-l"], { timeoutMs: 2e4 });
+  if (bad(r)) r = await runCapped("jstack", ["-l", String(pid)], { timeoutMs: 2e4 });
+  if (bad(r)) {
+    if (/Operation not permitted|AttachNotSupported|well-known file is not secure/i.test(r.stderr + r.stdout)) {
+      b.limitation(rootRequiredLimitation("dump_stacks", `jstack -l ${pid}`));
+      b.limitation("the JVM attach mechanism requires the same user as the target (or root)");
+      b.next(`import_artifact (tool: jstack) after running it yourself`);
+      return b.fail("jstack/jcmd could not attach").build();
+    }
+    return b.fail(`jcmd/jstack failed: ${(r.stderr || r.stdout).slice(0, 300)}`).build();
+  }
+  const art = await b.writeArtifact("jstack.txt", r.stdout, "raw_text", "JVM thread dump");
+  return summarizeJavaStacks(b, parseJstack(r.stdout), art);
+}
+var jvmAdapter = {
+  name: "jstack",
+  tools: ["dump_stacks"],
+  platforms: ["linux", "darwin"],
+  requires: ["jcmd"],
+  runtimes: ["java"],
+  install: { linux: "install a JDK (jcmd/jstack ship with it)", darwin: "brew install openjdk" },
+  priority: 20,
+  async run(tool, _args, ctx) {
+    if (tool !== "dump_stacks") throw new Error(`jstack adapter cannot run ${tool}`);
+    return liveDump(ctx);
+  }
+};
+
+export {
+  parsePySpyDump,
+  summarizePySpyDump,
+  summarizeProfile,
+  pyspyAdapter,
+  mergeResults,
+  parseStrace,
+  summarizeSyscallRecords,
+  straceAdapter,
+  parseGdbBacktrace,
+  summarizeNativeStacks,
+  gdbAdapter,
+  parseLldbBacktrace,
+  lldbAdapter,
+  perfScriptToFolded,
+  perfAdapter,
+  parseTcpdump,
+  summarizeCaptureEvidence,
+  tcpdumpAdapter,
+  sampleToFolded,
+  sampleMacosAdapter,
+  parseFsUsage,
+  fsUsageAdapter,
+  parseJstack,
+  summarizeJavaStacks,
+  jvmAdapter
+};
+//# sourceMappingURL=chunk-MLDOO673.js.map