ethyca-fides 2.73.2b0__py2.py3-none-any.whl → 2.76.0rc2__py2.py3-none-any.whl

fides/api/task/execute_request_tasks.py

@@ -3,7 +3,7 @@ from typing import Callable, List, Optional, Tuple
 from celery.app.task import Task
 from loguru import logger
 from sqlalchemy.exc import OperationalError
-from sqlalchemy.orm import Query, Session
+from sqlalchemy.orm import Query, Session, selectinload
 from tenacity import (
     RetryCallState,
     retry,
@@ -21,6 +21,7 @@ from fides.api.common_exceptions import (
 )
 from fides.api.graph.config import TERMINATOR_ADDRESS, CollectionAddress
 from fides.api.models.connectionconfig import ConnectionConfig
+from fides.api.models.policy import Policy
 from fides.api.models.privacy_request import ExecutionLog, PrivacyRequest, RequestTask
 from fides.api.models.worker_task import (
     RESUMABLE_EXECUTION_LOG_STATUSES,
@@ -48,11 +49,23 @@ def get_privacy_request_and_task(
     session: Session, privacy_request_id: str, privacy_request_task_id: str
 ) -> Tuple[PrivacyRequest, RequestTask]:
     """
-    Retrieves and validates a privacy request and its associated task
+    Retrieves and validates a privacy request and its associated task.
+    Eager loads policy.rules to avoid N+1 queries during manual task execution.
     """
 
-    privacy_request: Optional[PrivacyRequest] = PrivacyRequest.get(
-        db=session, object_id=privacy_request_id
+    # Eager load relationships to avoid N+1 queries during manual task execution:
+    # - policy.rules: accessed by get_policy_convenience_fields()
+    # - provided_identities: accessed by get_persisted_identity()
+    # - custom_fields: accessed by get_persisted_custom_privacy_request_fields()
+    privacy_request: Optional[PrivacyRequest] = (
+        session.query(PrivacyRequest)
+        .options(
+            selectinload(PrivacyRequest.policy).selectinload(Policy.rules),  # type: ignore[attr-defined]
+            selectinload(PrivacyRequest.provided_identities),  # type: ignore[attr-defined]
+            selectinload(PrivacyRequest.custom_fields),  # type: ignore[attr-defined]
+        )
+        .filter(PrivacyRequest.id == privacy_request_id)
+        .first()
     )
     request_task: Optional[RequestTask] = RequestTask.get(
         db=session, object_id=privacy_request_task_id

fides/api/task/manual/manual_task_conditional_evaluation.py

@@ -8,13 +8,21 @@ from fides.api.models.manual_task import ManualTask
 from fides.api.models.manual_task.conditional_dependency import (
     ManualTaskConditionalDependency,
 )
+from fides.api.models.privacy_request import PrivacyRequest
 from fides.api.task.conditional_dependencies.evaluator import ConditionEvaluator
+from fides.api.task.conditional_dependencies.privacy_request.privacy_request_data import (
+    PrivacyRequestDataTransformer,
+)
 from fides.api.task.conditional_dependencies.schemas import EvaluationResult
+from fides.api.task.conditional_dependencies.util import extract_nested_field_value
 from fides.api.util.collection_util import Row
 
 
 def extract_conditional_dependency_data_from_inputs(
-    *inputs: list[Row], manual_task: ManualTask, input_keys: list[CollectionAddress]
+    *inputs: list[Row],
+    manual_task: ManualTask,
+    input_keys: list[CollectionAddress],
+    privacy_request: PrivacyRequest,
 ) -> dict[str, Any]:
     """
     Extract data for conditional dependency field addresses from input data.
@@ -33,14 +41,35 @@ def extract_conditional_dependency_data_from_inputs(
 
     conditional_data: dict[str, Any] = {}
 
-    # Get all conditional dependencies field addresses
+    # Get all task input conditional dependencies field addresses
     field_addresses = [
         dependency.field_address
         for dependency in manual_task.conditional_dependencies
         if dependency.field_address
+        and not dependency.field_address.startswith("privacy_request.")
     ]
 
-    # if no field addresses, return empty conditional data
+    # Get all privacy request conditional dependencies field addresses
+    privacy_request_field_addresses = {
+        dependency.field_address
+        for dependency in manual_task.conditional_dependencies
+        if dependency.field_address
+        and dependency.field_address.startswith("privacy_request.")
+    }
+    # If there are any privacy request conditional dependencies field addresses,
+    # transform the privacy request data into a dictionary structure for evaluation
+    if privacy_request_field_addresses:
+        privacy_request_data_transformer = PrivacyRequestDataTransformer(
+            privacy_request
+        )
+        conditional_privacy_request_data = (
+            privacy_request_data_transformer.to_evaluation_data(
+                privacy_request_field_addresses
+            )
+        )
+        conditional_data = {**conditional_privacy_request_data}
+
+    # if no field addresses, return conditional data which may contain privacy request data or be empty
     # This will allow the manual task to be executed if there are no conditional dependencies
     if not field_addresses:
         return conditional_data
@@ -103,30 +132,6 @@ def parse_field_address(field_address: str) -> tuple[str, list[str]]:
     return source_collection_key, field_path
 
 
-def extract_nested_field_value(data: Any, field_path: list[str]) -> Any:
-    """
-    Extract a nested field value by traversing the field path.
-
-    Args:
-        data: The data to extract from (usually a dict)
-        field_path: List of field names to traverse (e.g., ["profile", "preferences", "theme"])
-
-    Returns:
-        The value at the end of the field path, or None if not found
-    """
-    if not field_path:
-        return data
-
-    current = data
-    for field_name in field_path:
-        if isinstance(current, dict) and field_name in current:
-            current = current[field_name]
-        else:
-            return None
-
-    return current
-
-
 def set_nested_value(field_address: str, value: Any) -> dict[str, Any]:
     """
     Set a field value in the conditional data structure.

fides/api/task/manual/manual_task_graph_task.py

@@ -158,7 +158,10 @@ class ManualTaskGraphTask(GraphTask):
 
         # Extract conditional dependency data from inputs
         conditional_data = extract_conditional_dependency_data_from_inputs(
-            *inputs, manual_task=manual_task, input_keys=self.execution_node.input_keys
+            *inputs,
+            manual_task=manual_task,
+            input_keys=self.execution_node.input_keys,
+            privacy_request=self.resources.request,
         )
         # Evaluate conditional dependencies
         evaluation_result = evaluate_conditional_dependencies(

fides/api/task/manual/manual_task_utils.py

@@ -1,6 +1,6 @@
 from typing import Optional
 
-from sqlalchemy.orm import Session
+from sqlalchemy.orm import Session, selectinload
 
 from fides.api.graph.config import (
     Collection,
@@ -65,6 +65,12 @@ def get_manual_task_for_connection_config(
     return (
         db.query(ManualTask)
         .join(ConnectionConfig, ManualTask.parent_entity_id == ConnectionConfig.id)
+        .options(
+            selectinload(ManualTask.configs).selectinload(
+                "field_definitions"
+            ),  # type: ignore[attr-defined]
+            selectinload(ManualTask.conditional_dependencies),
+        )
         .filter(
             ConnectionConfig.key == connection_config_key,
             ManualTask.parent_entity_type == "connection_config",
@@ -121,21 +127,17 @@ def create_conditional_dependency_scalar_fields(
     return fields
 
 
-def create_collection_for_connection_key(
-    db: Session, connection_key: str
+def _create_collection_from_manual_task(
+    manual_task: ManualTask,
 ) -> Optional[Collection]:
-    # Get the manual task for this connection config
-    manual_task = get_manual_task_for_connection_config(db, connection_key)
-
-    if not manual_task:
-        return None
-
+    """Create a Collection from a ManualTask. Helper function to avoid duplication."""
     # Get conditional dependency field addresses - raw field data
     conditional_field_addresses: set[str] = {
         dependency.field_address
         for dependency in manual_task.conditional_dependencies
         if dependency.condition_type == ConditionalDependencyType.leaf
         and dependency.field_address is not None
+        and not dependency.field_address.startswith("privacy_request.")
     }
 
     # Create scalar fields for data category fields and conditional dependency field addresses
@@ -152,6 +154,18 @@ def create_collection_for_connection_key(
     return Collection(name=ManualTaskAddress.MANUAL_DATA_COLLECTION, fields=fields)
 
 
+def create_collection_for_connection_key(
+    db: Session, connection_key: str
+) -> Optional[Collection]:
+    # Get the manual task for this connection config
+    manual_task = get_manual_task_for_connection_config(db, connection_key)
+
+    if not manual_task:
+        return None
+
+    return _create_collection_from_manual_task(manual_task)
+
+
 def create_manual_task_artificial_graphs(db: Session) -> list[GraphDataset]:
     """
     Create artificial GraphDataset objects for manual tasks that can be included
@@ -167,23 +181,52 @@ def create_manual_task_artificial_graphs(db: Session) -> list[GraphDataset]:
     Returns:
         List of GraphDataset objects representing manual tasks as individual collections
     """
-    manual_task_graphs = []
+    manual_task_graphs: list[GraphDataset] = []
     manual_addresses = get_manual_task_addresses(db)
 
+    if not manual_addresses:
+        return manual_task_graphs
+
+    # Batch load all manual tasks with their relationships to avoid N+1 queries
+    connection_keys = [address.dataset for address in manual_addresses]
+    manual_tasks = (
+        db.query(ManualTask, ConnectionConfig.key)
+        .join(ConnectionConfig, ManualTask.parent_entity_id == ConnectionConfig.id)
+        .options(
+            selectinload(ManualTask.configs).selectinload(
+                "field_definitions"
+            ),  # type: ignore[attr-defined]
+            selectinload(ManualTask.conditional_dependencies),
+        )
+        .filter(
+            ConnectionConfig.key.in_(connection_keys),
+            ManualTask.parent_entity_type == "connection_config",
+        )
+        .all()
+    )
+
+    # Create a lookup map by connection key
+    manual_task_map = {connection_key: task for task, connection_key in manual_tasks}
+
     for address in manual_addresses:
         connection_key = address.dataset
+        manual_task = manual_task_map.get(connection_key)
 
-        # Get the collection for this connection config using the reusable function
-        collection = create_collection_for_connection_key(db, connection_key)
+        if not manual_task:
+            continue
 
-        if collection:  # Only create graph if there are collections
-            # Create a synthetic GraphDataset with all manual task collections
-            graph_dataset = GraphDataset(
-                name=connection_key,
-                collections=[collection],
-                connection_key=connection_key,
-            )
+        # Create collection using the helper function to avoid duplication
+        collection = _create_collection_from_manual_task(manual_task)
+        if not collection:
+            continue
+
+        # Create a synthetic GraphDataset with all manual task collections
+        graph_dataset = GraphDataset(
+            name=connection_key,
+            collections=[collection],
+            connection_key=connection_key,
+        )
 
-            manual_task_graphs.append(graph_dataset)
+        manual_task_graphs.append(graph_dataset)
 
     return manual_task_graphs

fides/api/tasks/__init__.py

@@ -1,6 +1,7 @@
 from typing import Any, ContextManager, Dict, List, Optional
 
 from celery import Celery, Task
+from celery.signals import setup_logging as celery_setup_logging
 from loguru import logger
 from sqlalchemy.exc import OperationalError
 from sqlalchemy.orm import Session
@@ -18,6 +19,8 @@ from fides.config import CONFIG, FidesConfig
 
 MESSAGING_QUEUE_NAME = "fidesops.messaging"
 PRIVACY_PREFERENCES_QUEUE_NAME = "fides.privacy_preferences"  # This queue is used in Fidesplus for saving privacy preferences and notices served
+PRIVACY_PREFERENCES_EXPORT_JOB_QUEUE_NAME = "fides.privacy_request_exports"
+PRIVACY_PREFERENCES_INGESTION_JOB_QUEUE_NAME = "fides.privacy_request_ingestion"
 DSR_QUEUE_NAME = "fides.dsr"  # This queue is used for running data subject requests
 CONSENT_WEBHOOK_QUEUE_NAME = "fidesplus.consent_webhooks"  # This queue is used for processing consent webhooks from 3rd-party APIs
 DISCOVERY_MONITORS_DETECTION_QUEUE_NAME = "fidesplus.discovery_monitors_detection"  # This queue is used for running discovery monitors detection tasks
@@ -123,6 +126,17 @@ def _create_celery(config: FidesConfig = CONFIG) -> Celery:
 celery_app = _create_celery(CONFIG)
 
 
+@celery_setup_logging.connect
+def configure_celery_logging(**kwargs: Any) -> None:
+    """
+    Prevent Celery from configuring logging on worker startup.
+
+    By connecting to the setup_logging signal and doing nothing, we prevent Celery
+    from overriding our Loguru logging configuration. Our logging setup in _create_celery
+    has already configured logging with InterceptHandler to capture all stdlib logs.
+    """
+
+
 def get_worker_ids() -> List[Optional[str]]:
     """
     Returns a list of the connected healthy worker UUIDs.

fides/api/util/cache.py

@@ -17,6 +17,8 @@ from fides.api.tasks import (
     DISCOVERY_MONITORS_PROMOTION_QUEUE_NAME,
     DSR_QUEUE_NAME,
     MESSAGING_QUEUE_NAME,
+    PRIVACY_PREFERENCES_EXPORT_JOB_QUEUE_NAME,
+    PRIVACY_PREFERENCES_INGESTION_JOB_QUEUE_NAME,
     PRIVACY_PREFERENCES_QUEUE_NAME,
     celery_app,
 )
@@ -432,6 +434,8 @@ def get_queue_counts() -> Dict[str, int]:
         for queue in [
             MESSAGING_QUEUE_NAME,
             PRIVACY_PREFERENCES_QUEUE_NAME,
+            PRIVACY_PREFERENCES_EXPORT_JOB_QUEUE_NAME,
+            PRIVACY_PREFERENCES_INGESTION_JOB_QUEUE_NAME,
             DSR_QUEUE_NAME,
             DISCOVERY_MONITORS_DETECTION_QUEUE_NAME,
             DISCOVERY_MONITORS_CLASSIFICATION_QUEUE_NAME,

fides/api/util/connection_util.py

@@ -55,9 +55,8 @@ def requeue_requires_input_requests(db: Session) -> None:
     lingering in a "requires_input" state.
     """
     if not AccessManualWebhook.get_enabled(db):
-        for pr in PrivacyRequest.filter(
-            db=db,
-            conditions=(PrivacyRequest.status == PrivacyRequestStatus.requires_input),
+        for pr in PrivacyRequest.query_without_large_columns(db).filter(
+            PrivacyRequest.status == PrivacyRequestStatus.requires_input
         ):
             logger.info(
                 "Queuing privacy request '{} with '{}' status now that manual inputs are no longer required.",

fides/api/util/fuzzy_search_utils.py

@@ -66,7 +66,13 @@ def build_automaton(
 
     logger.debug("Creating new automaton...")
     automaton = ahocorasick.Automaton()  # pylint: disable=c-extension-no-member
-    all_privacy_requests: List[PrivacyRequest] = db.query(PrivacyRequest).yield_per(1000)  # type: ignore
+    # Use query_without_large_columns to prevent OOM errors when building automaton
+    # We only need identity data, not filtered results or access result URLs
+    all_privacy_requests: List[
+        PrivacyRequest
+    ] = PrivacyRequest.query_without_large_columns(db).yield_per(
+        1000
+    )  # type: ignore
     for request in all_privacy_requests:
         _add_decrypted_identities_to_automaton(request.get_persisted_identity().__dict__, request.id, automaton)  # type: ignore
     set_automaton_cache_signal()

fides/api/util/lock.py

@@ -1,7 +1,7 @@
 from __future__ import annotations
 
 from contextlib import contextmanager
-from typing import Generator
+from typing import Generator, Optional
 
 from loguru import logger
 from redis.lock import Lock
@@ -18,7 +18,12 @@ def get_redis_lock(lock_key: str, timeout: int) -> Lock:
 
 
 @contextmanager
-def redis_lock(lock_key: str, timeout: int) -> Generator[Lock | None, None, None]:
+def redis_lock(
+    lock_key: str,
+    timeout: int,
+    blocking: bool = False,
+    blocking_timeout: Optional[int] = None,
+) -> Generator[Lock | None, None, None]:
     """
     A context manager for acquiring a Redis lock.
     If the lock is acquired, it yields the lock object.
@@ -30,7 +35,12 @@ def redis_lock(lock_key: str, timeout: int) -> Generator[Lock | None, None, None
     """
     lock = get_redis_lock(lock_key, timeout)
 
-    if not lock.acquire(blocking=False):
+    # If we're blocking but no blocking timeout is provided
+    # fall back to the lock timeout as the blocking timeout
+    if blocking and blocking_timeout is None:
+        blocking_timeout = timeout
+
+    if not lock.acquire(blocking=blocking, blocking_timeout=blocking_timeout):
         logger.info(
             f"Another process is already running for lock '{lock_key}'. Skipping this execution."
         )

fides/api/util/logger.py

@@ -7,8 +7,10 @@ Defines the logging format and other helper functions to be used throughout the
 from __future__ import annotations
 
 import logging
+import os
 import sys
 from contextlib import contextmanager
+from types import FrameType
 from typing import TYPE_CHECKING, Any, Dict, Generator, List, Optional
 
 from loguru import logger
@@ -24,6 +26,37 @@ if TYPE_CHECKING:
 MASKED = "MASKED"
 
 
+class InterceptHandler(logging.Handler):
+    """
+    Intercept standard library logging and redirect to Loguru.
+
+    This handler is added to the root logger to capture logs from libraries
+    that use standard library logging (SQLAlchemy, Alembic, Celery, etc.)
+    and route them through Loguru for consistent formatting and serialization.
+    """
+
+    def emit(self, record: logging.LogRecord) -> None:
+        """Emit a log record by routing it through Loguru."""
+        try:
+            level = logger.level(record.levelname).name
+        except ValueError:
+            level = str(record.levelno)
+
+        frame: Optional[FrameType] = logging.currentframe()
+        depth = 2
+        # Get the directory path of the logging module to match all files within it
+        logging_module_path = os.path.dirname(logging.__file__) + os.sep
+        while frame is not None and frame.f_code.co_filename.startswith(
+            logging_module_path
+        ):
+            frame = frame.f_back
+            depth += 1
+
+        logger.opt(depth=depth, exception=record.exc_info).log(
+            level, record.getMessage()
+        )
+
+
 class RedisSink:
     """A sink that writes log messages to Redis."""
 
@@ -134,18 +167,30 @@ def create_handler_dicts(
         "catch": True,
     }
 
+    # Helper function to check if a log record has custom extra context
+    # Loguru always includes an 'extra' dict, so we need to check if it has any keys
+    def has_custom_extra(log_record: Dict) -> bool:
+        """Check if log record has custom extra context beyond Loguru's defaults."""
+        extra = log_record.get("extra", {})
+        return len(extra) > 0
+
+    # Helper to filter logs without custom extra
+    def filter_standard(log_record: Dict) -> bool:
+        """Filter for logs without custom extra context."""
+        return not has_custom_extra(log_record)
+
     # Configure handler
     standard_dict = {
         **base_config,
         "sink": sink,
-        "filter": lambda logRecord: not bool(logRecord["extra"]),
+        "filter": filter_standard,
     }
 
     # Create extra dict with additional formatting for logs with extra context
     extra_dict = {
         **standard_dict,
         "format": log_format + " | <dim>{extra}</dim>",
-        "filter": lambda logRecord: bool(logRecord["extra"]),
+        "filter": has_custom_extra,
     }
 
     return [standard_dict, extra_dict]
@@ -171,13 +216,14 @@ def setup(config: FidesConfig) -> None:
     # Configure main sink from config
     destination = config.logging.destination
     main_sink = sys.stdout if not destination else destination
+    is_json_serialization = config.logging.serialization == "json"
     handlers.extend(
         create_handler_dicts(
             level=config.logging.level,
             include_called_from=config.dev_mode,
             sink=main_sink,
-            serialize=config.logging.serialization == "json",
-            colorize=config.logging.colorize,
+            serialize=is_json_serialization,
+            colorize=config.logging.colorize and not is_json_serialization,
         )
     )
 
@@ -196,6 +242,14 @@ def setup(config: FidesConfig) -> None:
 
     logger.configure(handlers=handlers)
 
+    # Add InterceptHandler to root logger to capture standard library logs
+    # This intercepts logs from SQLAlchemy, Alembic, Celery, etc.
+    logging.root.handlers = [InterceptHandler()]
+    logging.root.setLevel(config.logging.level)
+
+    # Capture Python warnings and redirect them to logging so they get formatted by Loguru
+    logging.captureWarnings(True)
+
 
 def obfuscate_message(message: str) -> str:
     """

fides/api/util/logger_context_utils.py

@@ -165,7 +165,9 @@ def request_details(
 
     if response is not None:
         if CONFIG.dev_mode and response.content:
-            details[LoggerContextKeys.response.value] = response.content.decode("utf-8")
+            details[LoggerContextKeys.response.value] = response.content.decode(
+                "utf-8", errors="replace"
+            )
 
         details[LoggerContextKeys.status_code.value] = response.status_code
 

fides/api/util/memory_watchdog.py

@@ -13,6 +13,7 @@ killed by the system's OOM killer which would result in a WorkerLostError and in
 
 from __future__ import annotations
 
+import gc
 import os
 import signal
 import threading
@@ -21,6 +22,7 @@ from functools import wraps
 from types import FrameType, TracebackType
 from typing import Any, Callable, Literal, Optional, Type, TypeVar, Union
 
+import objgraph  # type: ignore
 import psutil  # type: ignore
 from loguru import logger
 
@@ -56,6 +58,118 @@ class MemoryLimitExceeded(RuntimeError):
         self.memory_percent: Optional[float] = memory_percent
 
 
+def _capture_heap_dump() -> None:
+    """Capture and log actionable heap dump information for memory leak diagnosis.
+
+    This function builds and logs a comprehensive memory profiling report as a single
+    message to help identify memory leaks. It's designed to be called when memory
+    threshold is exceeded, just before task termination.
+
+    The report includes:
+    - Process memory stats (RSS, VMS)
+    - Top 10 object type counts (spot anomalies like 100k of a custom class)
+    - Garbage collector stats (uncollectable objects indicate leaks)
+
+    All exceptions are caught to ensure heap dump failures don't prevent graceful
+    task termination.
+    """
+    try:
+        # Force garbage collection to get accurate counts
+        gc.collect()
+
+        report_lines = [
+            "",  # Leading newline for visual separation
+            "=" * 80,
+            "MEMORY DUMP",
+            "=" * 80,
+            "",
+        ]
+
+        # Section 1: Process Memory Stats
+        try:
+            process = psutil.Process()
+            mem_info = process.memory_info()
+            report_lines.extend(
+                [
+                    "PROCESS MEMORY STATS",
+                    "-" * 80,
+                    f"RSS (Resident Set Size):  {mem_info.rss / 1024 / 1024:.1f} MiB",
+                    f"VMS (Virtual Memory):     {mem_info.vms / 1024 / 1024:.1f} MiB",
+                    "",
+                ]
+            )
+        except Exception as exc:
+            logger.debug("Failed to get process memory stats: {}", exc)
+
+        # Section 2: Object Type Counts (most actionable for finding leaks)
+        type_stats = objgraph.most_common_types(limit=10)
+
+        report_lines.extend(
+            [
+                "OBJECT TYPE COUNTS (Top 10)",
+                "-" * 80,
+            ]
+        )
+
+        if type_stats:
+            max_typename_len = max(len(typename) for typename, _ in type_stats)
+
+            for typename, count in type_stats:
+                # Right-align count for easy scanning
+                report_lines.append(f"{typename:<{max_typename_len}}  {count:>10,}")
+        else:
+            report_lines.append("No object type data available")
+
+        report_lines.append("")
+
+        # Section 3: Garbage Collector Stats
+        gc_count = gc.get_count()
+
+        report_lines.extend(
+            [
+                "GARBAGE COLLECTOR STATS",
+                "-" * 80,
+                f"Collections: gen0={gc_count[0]}, gen1={gc_count[1]}, gen2={gc_count[2]}",
+                f"Tracked objects: {len(gc.get_objects()):,}",
+            ]
+        )
+
+        # Show uncollectable objects (strong indicator of memory leaks)
+        uncollectable = gc.garbage
+        if uncollectable:
+            report_lines.append(
+                f"⚠ UNCOLLECTABLE OBJECTS: {len(uncollectable)} (LEAK DETECTED!)"
+            )
+            # Show types of uncollectable objects
+            uncollectable_types: dict[str, int] = {}
+            for obj in uncollectable[:50]:  # Limit to first 50
+                obj_type = type(obj).__name__
+                uncollectable_types[obj_type] = uncollectable_types.get(obj_type, 0) + 1
+            for obj_type, count in sorted(
+                uncollectable_types.items(), key=lambda x: x[1], reverse=True
+            ):
+                report_lines.append(f"  {obj_type}: {count}")
+        else:
+            report_lines.append("No uncollectable objects detected")
+
+        report_lines.extend(
+            [
+                "",
+                "=" * 80,
+                "END OF MEMORY DUMP",
+                "=" * 80,
+                "",
+            ]
+        )
+
+        # Log the entire report as a single message
+        heap_dump_report = "\n".join(report_lines)
+        logger.error(heap_dump_report)
+
+    except Exception as exc:  # pragma: no cover
+        logger.exception("Failed to capture heap dump: {}", exc)
+
+
 class MemoryWatchdog:
     """Background memory monitor that enables graceful task termination.
 
@@ -138,6 +252,10 @@ class MemoryWatchdog:
         """Convert the signal into an exception on the main thread."""
         current_percent = _system_memory_percent()
         logger.error("Memory limit exceeded: {}%", current_percent)
+
+        # Capture heap dump before terminating
+        _capture_heap_dump()
+
         self.stop()
         raise MemoryLimitExceeded(
             "Memory usage exceeded threshold", memory_percent=current_percent