execweave 0.8.13__tar.gz → 0.8.15__tar.gz

{execweave-0.8.13 → execweave-0.8.15}/.github/workflows/provider-capability-stage-integrity.yml

@@ -78,6 +78,15 @@ jobs:
               && -n "$model_runtime_identity_changed" ]]; then
             args+=(--allow-test-change "tests/test_model_runtime.py=AUD-002 only: the historical llama.cpp request ID assertion now includes the sanitized endpoint scope; the test node ID and runtime privacy contract are unchanged")
           fi
+          threat_model_changed=""
+          if git diff --name-only "$BASELINE_REF...HEAD" \
+              | grep -qx 'tests/test_threat_model.py'; then
+            threat_model_changed=yes
+          fi
+          if [[ "$HEAD_REF" == "fix/0815-threat-model-pid-collision" \
+              && -n "$threat_model_changed" ]]; then
+            args+=(--allow-test-change "tests/test_threat_model.py=0.8.15 RC follow-up makes the existing outliving-child assertion hermetic against ambient host PID collisions; the historical test node ID and product expectation are unchanged")
+          fi
           if [[ "$HEAD_REF" == "fix/provider-isolation" ]]; then
             while IFS= read -r path; do
               case "$path" in

{execweave-0.8.13 → execweave-0.8.15}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: execweave
-Version: 0.8.13
+Version: 0.8.15
 Summary: Turn AI-agent runtime behavior into a local interactive execution graph.
 Project-URL: Homepage, https://github.com/Irish-kw/ExecWeave
 Project-URL: Repository, https://github.com/Irish-kw/ExecWeave

{execweave-0.8.13 → execweave-0.8.15}/pyproject.toml

@@ -4,8 +4,8 @@ build-backend = "hatchling.build"
 
 [project]
 name = "execweave"
-# ExecWeave v0.8.13 release metadata
-version = "0.8.13"
+# ExecWeave v0.8.15 release metadata
+version = "0.8.15"
 description = "Turn AI-agent runtime behavior into a local interactive execution graph."
 readme = "README.md"
 requires-python = ">=3.10"

{execweave-0.8.13 → execweave-0.8.15}/src/execweave/__init__.py

@@ -1,3 +1,3 @@
 """ExecWeave runtime graph package."""
 
-__version__ = "0.8.13"
+__version__ = "0.8.15"

{execweave-0.8.13 → execweave-0.8.15}/src/execweave/collector.py

@@ -1,7 +1,9 @@
 from __future__ import annotations
 
+import ctypes
 import os
 import subprocess
+import sys
 import time
 from dataclasses import dataclass
 from pathlib import Path
@@ -22,6 +24,10 @@ from .schema import Entity, RuntimeEvent
 from .sink import JsonlSink
 
 
+_PR_SET_CHILD_SUBREAPER = 36
+_PR_GET_CHILD_SUBREAPER = 37
+
+
 @dataclass(frozen=True)
 class ProcessSnapshot:
     pid: int
@@ -123,11 +129,13 @@ class RuntimeCollector:
         self.collect_filesystem = collect_filesystem
         self.collect_network = collect_network
         self._seen_processes: dict[int, ProcessSnapshot] = {}
+        self._discovered_processes: dict[int, ProcessSnapshot] = {}
         self._seen_connections: set[tuple[str, str | None, str | None, str]] = set()
         self._network_sample_attempts = 0
         self._network_sample_successes = 0
         self._network_sample_errors = 0
         self._network_access_denied = 0
+        self._collector_children_baseline: dict[int, float] | None = None
 
     def _filesystem_excluded_roots(self) -> list[Path]:
         """Return ExecWeave-owned paths that must never become workload evidence.
@@ -195,10 +203,12 @@ class RuntimeCollector:
             )
 
         process: subprocess.Popen[bytes] | None = None
+        owned: list[psutil.Process] = []
         return_code = 1
         interrupted = False
         collector_error_type: str | None = None
         workload_terminated_due_to_collector_error = False
+        subreaper_previous: bool | None = None
         post_command_probe = prepare_post_command_specialized_probe(command)
         try:
             if watcher is not None:
@@ -209,6 +219,12 @@ class RuntimeCollector:
                     command,
                     server_relay=True,
                 ) as launch_environment:
+                    subreaper_previous = self._enable_linux_child_subreaper()
+                    self._collector_children_baseline = (
+                        self._direct_child_lifetimes()
+                        if subreaper_previous is not None
+                        else None
+                    )
                     process = subprocess.Popen(
                         launch_command,
                         cwd=str(self.watch_root),
@@ -230,8 +246,6 @@ class RuntimeCollector:
             except KeyboardInterrupt:
                 interrupted = True
                 return_code = 130
-                if process is not None:
-                    self._terminate_process_tree(process)
 
             if not interrupted:
                 run_post_command_specialized_probe(
@@ -241,16 +255,26 @@ class RuntimeCollector:
             return return_code
         except BaseException as exc:
             collector_error_type = type(exc).__name__
-            if process is not None and self._owned_live_processes(process):
-                self._terminate_process_tree(process)
-                workload_terminated_due_to_collector_error = True
             raise
         finally:
+            # A workload exception is a nonzero child exit, not an exception in
+            # this collector. Finalize observed descendants on every exit path,
+            # including successful launchers that leave reparented children.
+            if process is not None:
+                owned = self._owned_live_processes(process)
+                workload_terminated_due_to_collector_error = (
+                    collector_error_type is not None and bool(owned)
+                )
+                self._terminate_process_tree(process, owned=owned)
+            self._restore_linux_child_subreaper(subreaper_previous)
             if watcher is not None:
                 watcher.stop()
-            workload_alive_after_cleanup = bool(
-                process is not None and self._owned_live_processes(process)
-            )
+            # A failed termination must not become a false clean result merely
+            # because the selected child has since reparented out of the tree.
+            workload_alive_after_cleanup = any(
+                self._process_is_live(candidate) for candidate in owned
+            ) or bool(process is not None and self._owned_live_processes(process))
+            self._collector_children_baseline = None
             self.sink.emit(
                 RuntimeEvent.create(
                     session_id=self.session_id,
@@ -278,6 +302,57 @@ class RuntimeCollector:
                 )
             )
 
+    @staticmethod
+    def _linux_child_subreaper_state() -> bool | None:
+        if not sys.platform.startswith("linux"):
+            return None
+        try:
+            libc = ctypes.CDLL(None, use_errno=True)
+            state = ctypes.c_int()
+            if libc.prctl(_PR_GET_CHILD_SUBREAPER, ctypes.byref(state), 0, 0, 0) != 0:
+                return None
+            return bool(state.value)
+        except (AttributeError, OSError):
+            return None
+
+    @staticmethod
+    def _set_linux_child_subreaper(enabled: bool) -> bool:
+        if not sys.platform.startswith("linux"):
+            return False
+        try:
+            libc = ctypes.CDLL(None, use_errno=True)
+            return libc.prctl(_PR_SET_CHILD_SUBREAPER, int(enabled), 0, 0, 0) == 0
+        except (AttributeError, OSError):
+            return False
+
+    @classmethod
+    def _enable_linux_child_subreaper(cls) -> bool | None:
+        previous = cls._linux_child_subreaper_state()
+        if previous is None:
+            return None
+        if not previous and not cls._set_linux_child_subreaper(True):
+            return None
+        return previous
+
+    @classmethod
+    def _restore_linux_child_subreaper(cls, previous: bool | None) -> None:
+        if previous is False:
+            cls._set_linux_child_subreaper(False)
+
+    @staticmethod
+    def _direct_child_lifetimes() -> dict[int, float]:
+        try:
+            children = psutil.Process(os.getpid()).children(recursive=False)
+        except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
+            return {}
+        lifetimes: dict[int, float] = {}
+        for child in children:
+            try:
+                lifetimes[child.pid] = child.create_time()
+            except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
+                continue
+        return lifetimes
+
     @staticmethod
     def _process_is_live(proc: psutil.Process) -> bool:
         try:
@@ -293,12 +368,13 @@ class RuntimeCollector:
     def _process_for_snapshot(self, snapshot: ProcessSnapshot) -> psutil.Process | None:
         try:
             process = psutil.Process(snapshot.pid)
+            # Cleanup needs identity, not readable exe/name/cmdline metadata.
+            # Never treat a reused PID as the process we originally observed.
+            if process.create_time() != snapshot.create_time:
+                return None
+            return process
         except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
             return None
-        current = _safe_process_snapshot(process)
-        if current is None or not self._same_process_lifetime(snapshot, current):
-            return None
-        return process
 
     def _owned_live_processes(
         self,
@@ -331,15 +407,39 @@ class RuntimeCollector:
             except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
                 pass
 
-        for snapshot in list(self._seen_processes.values()):
+        baseline = self._collector_children_baseline
+        if baseline is not None:
+            try:
+                collector_children = psutil.Process(os.getpid()).children(recursive=False)
+            except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
+                collector_children = []
+            for candidate in collector_children:
+                try:
+                    create_time = candidate.create_time()
+                except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
+                    continue
+                if baseline.get(candidate.pid) == create_time:
+                    continue
+                add_with_descendants(candidate)
+
+        snapshots = {**self._seen_processes, **self._discovered_processes}
+        for snapshot in snapshots.values():
             tracked = self._process_for_snapshot(snapshot)
             if tracked is not None:
                 add_with_descendants(tracked)
 
         return list(owned.values())
 
-    def _terminate_process_tree(self, process: subprocess.Popen[bytes]) -> None:
-        owned = self._owned_live_processes(process)
+    def _terminate_process_tree(
+        self,
+        process: subprocess.Popen[bytes],
+        *,
+        owned: list[psutil.Process] | None = None,
+    ) -> None:
+        # A caller's selection must survive reparenting between discovery and
+        # termination. Re-querying here can lose children we just proved owned.
+        if owned is None:
+            owned = self._owned_live_processes(process)
         # Terminate descendants/tracked orphans before the launcher/root when it is
         # still alive. Holding psutil handles also keeps cleanup robust if a parent
         # exits while the loop is running.
@@ -392,6 +492,11 @@ class RuntimeCollector:
             current[snapshot.pid] = snapshot
             process_objects[snapshot.pid] = proc
 
+        # Preserve the complete discovered tree before any event/network callback
+        # can raise. _seen_processes only contains successfully registered starts;
+        # a root callback can fail after its children have already reparented.
+        # Retain only the latest sample here, not an unbounded lifetime history.
+        self._discovered_processes = current
         for snapshot in current.values():
             previous = self._seen_processes.get(snapshot.pid)
             if previous is None or not self._same_process_lifetime(previous, snapshot):

{execweave-0.8.13 → execweave-0.8.15}/src/execweave/live_view_style.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 LIVE_STYLE = r""":root{color-scheme:dark;--bg:#0a0f16;--panel:#101722;--panel2:#151f2c;--panel3:#0d141e;--text:#edf2f7;--muted:#8fa0b5;--border:#263446;--border-strong:#34485e;--edge:#6f8298;--causal:#65c79b;--noncausal:#e5aa61;--inferred:#b18cff;--selected:#75b8ff;--latest:#77d7ff;--danger:#ff7b86;--node-agent:#1e4b7a;--node-process:#1d4e5f;--node-file:#1f5438;--node-network:#643d1f;--node-tool:#4f2f75;--node-model:#662952;--node-other:#334255;--shadow:0 14px 40px rgba(0,0,0,.18)}
 :root[data-theme="light"]{color-scheme:light;--bg:#eef3f8;--panel:#ffffff;--panel2:#f6f9fc;--panel3:#f9fbfd;--text:#172033;--muted:#66758a;--border:#d5dee8;--border-strong:#b9c7d7;--edge:#738195;--causal:#16855a;--noncausal:#b56a16;--inferred:#7b4dd8;--selected:#2563eb;--latest:#0f8fc5;--danger:#c2414f;--node-agent:#2d6391;--node-process:#2b697b;--node-file:#2c6e49;--node-network:#865328;--node-tool:#673d8e;--node-model:#7f3465;--node-other:#495c72;--shadow:0 14px 35px rgba(30,41,59,.08)}
 *{box-sizing:border-box}html,body{margin:0;width:100%;height:100%;overflow:hidden;background:var(--bg);color:var(--text);font:14px/1.45 Inter,ui-sans-serif,system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif}
-button,input{font:inherit}button{color:inherit}button:focus-visible,input:focus-visible{outline:2px solid var(--selected);outline-offset:2px}
+button,input,select{font:inherit}button{color:inherit}button:focus-visible,input:focus-visible,select:focus-visible{outline:2px solid var(--selected);outline-offset:2px}
 #app{display:grid;grid-template-columns:minmax(0,1fr) 340px;grid-template-rows:64px minmax(0,1fr) 230px;width:100%;height:100%;gap:0}
 header{grid-column:1/3;display:flex;align-items:center;gap:12px;padding:0 16px;background:color-mix(in srgb,var(--panel) 95%,transparent);border-bottom:1px solid var(--border);box-shadow:0 1px 0 rgba(255,255,255,.02);z-index:10;min-width:0}
 .brand{display:flex;align-items:center;gap:10px;min-width:max-content}.brand-mark{width:28px;height:28px;border-radius:8px;display:grid;place-items:center;background:linear-gradient(145deg,var(--panel2),var(--panel));border:1px solid var(--border-strong);font-weight:800;letter-spacing:-.06em}.brand-copy{display:flex;flex-direction:column;line-height:1.1}.brand-copy strong{font-size:14px}.brand-copy span{font-size:10px;color:var(--muted);letter-spacing:.08em;text-transform:uppercase;margin-top:3px}
@@ -14,6 +14,7 @@ header{grid-column:1/3;display:flex;align-items:center;gap:12px;padding:0 16px;b
 .icon-btn{height:34px;min-width:34px;padding:0 10px;border:1px solid var(--border);border-radius:8px;background:var(--panel2);cursor:pointer;transition:border-color .15s ease,background .15s ease}.icon-btn:hover{border-color:var(--border-strong);background:color-mix(in srgb,var(--panel2) 76%,var(--selected) 8%)}
 #graph-panel{grid-column:1;grid-row:2;min-width:0;min-height:0;display:grid;grid-template-rows:46px minmax(0,1fr);border-right:1px solid var(--border);background:var(--panel3)}
 .panel-bar{display:flex;align-items:center;gap:10px;padding:0 12px;border-bottom:1px solid var(--border);background:var(--panel);min-width:0}.panel-title{font-size:12px;font-weight:750;text-transform:uppercase;letter-spacing:.08em}.panel-subtitle{color:var(--muted);font-size:11px;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.panel-spacer{flex:1}
+.graph-file-filter{display:flex;align-items:center;gap:6px;color:var(--muted);font-size:11px;white-space:nowrap}.graph-file-filter select{height:30px;padding:0 8px;border:1px solid var(--border);border-radius:8px;background:var(--panel2);color:var(--text);cursor:pointer}.graph-file-filter select:hover{border-color:var(--border-strong)}
 .segmented{display:flex;align-items:center;padding:2px;border:1px solid var(--border);border-radius:9px;background:var(--panel2);gap:2px}.segmented button{height:28px;padding:0 10px;border:0;border-radius:7px;background:transparent;color:var(--muted);cursor:pointer;font-size:12px}.segmented button:hover{color:var(--text)}.segmented button.active{background:var(--panel);color:var(--text);box-shadow:inset 0 0 0 1px var(--border-strong)}
 .graph-actions{display:flex;align-items:center;gap:6px}.graph-actions button{height:30px;min-width:30px;padding:0 9px;border:1px solid var(--border);border-radius:8px;background:var(--panel2);cursor:pointer;color:var(--muted)}.graph-actions button:hover{color:var(--text);border-color:var(--border-strong)}
 #wrap{position:relative;overflow:hidden;min-width:0;min-height:0;background-image:radial-gradient(circle at 1px 1px,color-mix(in srgb,var(--border) 52%,transparent) 1px,transparent 0);background-size:22px 22px}svg{width:100%;height:100%;display:block;cursor:grab;user-select:none;touch-action:none}svg.panning{cursor:grabbing}

{execweave-0.8.13 → execweave-0.8.15}/src/execweave/viewer_dashboard_clean.py

@@ -99,6 +99,24 @@ function execweaveDashboardGraph(data){
     if(!outgoing.has(edge.source))outgoing.set(edge.source,[]);
     incoming.get(edge.target).push(edge);outgoing.get(edge.source).push(edge);
   }
+  const fileDisplayMode=String(globalThis.__execweaveFileDisplayMode||'changed');
+  const fileTypes=new Set(['file','directory']);
+  const fileMutationEvents=new Set(['filesystem.created','filesystem.modified','filesystem.moved','filesystem.deleted']);
+  const fileMutationRelation=relation=>/(^|_)(WROTE|WRITE|WRITES|CREATE|CREATED|UPDATE|UPDATED|EDIT|EDITED|DELETE|DELETED|MOVE|MOVED|RENAME|RENAMED|PATCH|REPLACE|REPLACED|SAVE|SAVED|MODIFY|MODIFIED)($|_)/.test(String(relation||'').toUpperCase());
+  const fileReadRelation=relation=>/(^|_)(READ|OPEN|SCAN|LIST|STAT|INSPECT|OBSERVE|OBSERVED)($|_)/.test(String(relation||'').toUpperCase());
+  const fileActivity=node=>{
+    if(!fileTypes.has(String(node?.type||'')))return'other';
+    const eventTypes=Array.isArray(node?.event_types)?node.event_types:[];
+    const related=[...(incoming.get(node.id)||[]),...(outgoing.get(node.id)||[])];
+    const relatedEventTypes=related.flatMap(edge=>Array.isArray(edge?.event_types)?edge.event_types:[]);
+    const allEventTypes=[...eventTypes,...relatedEventTypes].map(String);
+    if(allEventTypes.some(value=>fileMutationEvents.has(value)))return'changed';
+    if(related.some(edge=>fileMutationRelation(edge?.relation)))return'changed';
+    const observedEvents=allEventTypes.some(value=>value.startsWith('filesystem.'));
+    if(observedEvents||related.some(edge=>fileReadRelation(edge?.relation)))return'observed';
+    return'unknown';
+  };
+  const fileVisible=node=>{const activity=fileActivity(node);if(activity==='other')return true;if(fileDisplayMode==='hide')return false;if(fileDisplayMode==='all')return true;return activity!=='observed'};
   const provider=node=>String(node?.attributes?.provider||'unknown').toLowerCase();
   const toolName=node=>String(node?.attributes?.tool_name||node?.attributes?.native_name||node?.name||'tool');
   const toolKey=node=>`${provider(node)}\u0000${toolName(node).trim().toLowerCase()}`;
@@ -205,7 +223,10 @@ function execweaveDashboardGraph(data){
   };
   for(const group of groups.values())group.occurrences.sort(occurrenceOrder);
   for(const list of toolOccurrences.values())list.sort(occurrenceOrder);
-  let visibleNodes=allNodes.filter(node=>node&&node.id&&!hiddenIds.has(node.id)).filter(node=>node.type!=='tool'||toolCanonicalId.get(node.id)===node.id).map(node=>{
+  const candidateNodes=allNodes.filter(node=>node&&node.id&&!hiddenIds.has(node.id)).filter(node=>node.type!=='tool'||toolCanonicalId.get(node.id)===node.id);
+  const hiddenFileObservationCount=candidateNodes.filter(node=>fileTypes.has(String(node?.type||''))&&!fileVisible(node)).length;
+  let visibleNodes=candidateNodes.filter(node=>fileVisible(node)).map(node=>{
+    if(fileTypes.has(String(node?.type||'')))return{...node,attributes:{...attrsOf(node),viewer_file_activity:fileActivity(node)}};
     if(node.type!=='tool')return node;
     const occurrences=toolOccurrences.get(node.id)||[],members=toolMembersByRepresentative.get(node.id)||[node];
     if(!occurrences.length&&members.length===1)return node;
@@ -214,7 +235,8 @@ function execweaveDashboardGraph(data){
   });
 
   const canonicalTypes=new Set(['process','file']);
-  const foldableTypes=new Set(['process','file','network_endpoint']);
+  const foldableTypes=new Set(['process','file','directory','network_endpoint']);
+  const foldType=node=>{const type=String(node?.type||'');return type==='file'||type==='directory'?'filesystem':type};
   const declaredBudget=Number(globalThis.__execweaveFoldBudget);
   const FOLD_BUDGET=Number.isFinite(declaredBudget)&&declaredBudget>=1?Math.floor(declaredBudget):12;
   const canonicalGroups=new Map();
@@ -246,19 +268,21 @@ function execweaveDashboardGraph(data){
 
   let foldedNodeCount=0;
   const byType=new Map();
-  for(const node of nodes){const type=String(node?.type||'');if(!foldableTypes.has(type))continue;if(!byType.has(type))byType.set(type,[]);byType.get(type).push(node)}
+  for(const node of nodes){const rawType=String(node?.type||'');if(!foldableTypes.has(rawType))continue;const type=foldType(node);if(!byType.has(type))byType.set(type,[]);byType.get(type).push(node)}
   const folds=[];
   for(const[type,members]of byType){
     if(members.length<=FOLD_BUDGET)continue;
     const recency=node=>String(node?.last_seen||node?.first_seen||'');
     const ordered=[...members].sort((a,b)=>recency(b).localeCompare(recency(a)));
     const older=ordered.slice(FOLD_BUDGET);if(!older.length)continue;
-    const keep=new Set(ordered.slice(0,FOLD_BUDGET).map(node=>node.id));
+    const removeIds=new Set(older.map(node=>node.id));
     const foldId=`viewer:folded:${type}`;
     for(const node of older)canonicalId.set(node.id,foldId);
     foldedNodeCount+=older.length;
-    folds.push({id:foldId,type,name:`${older.length} earlier ${type.replace(/_/g,' ')}${older.length===1?'':'s'}`,first_seen:older.reduce((value,node)=>earlier(value,node.first_seen),null),last_seen:older.reduce((value,node)=>later(value,node.last_seen),null),attributes:{viewer_folded:true,viewer_folded_type:type,viewer_folded_count:older.length,viewer_folded_members:older.map(node=>({id:node.id,name:node.name||node.id,first_seen:node.first_seen||null,last_seen:node.last_seen||null}))}});
-    for(let index=nodes.length-1;index>=0;index--)if(!keep.has(nodes[index].id)&&String(nodes[index].type||'')===type)nodes.splice(index,1);
+    const foldedType=type==='filesystem'?'file_cluster':type,foldedName=type==='filesystem'?`${older.length} earlier files / directories`:`${older.length} earlier ${type.replace(/_/g,' ')}${older.length===1?'':'s'}`;
+    const activities=[...new Set(older.map(node=>node?.attributes?.viewer_file_activity).filter(Boolean))];
+    folds.push({id:foldId,type:foldedType,name:foldedName,first_seen:older.reduce((value,node)=>earlier(value,node.first_seen),null),last_seen:older.reduce((value,node)=>later(value,node.last_seen),null),attributes:{viewer_folded:true,viewer_folded_type:type,viewer_folded_count:older.length,viewer_file_activity:type==='filesystem'?(activities.length===1?activities[0]:'mixed'):undefined,viewer_folded_members:older.map(node=>({id:node.id,type:node.type,name:node.name||node.id,activity:node?.attributes?.viewer_file_activity||null,first_seen:node.first_seen||null,last_seen:node.last_seen||null}))}});
+    for(let index=nodes.length-1;index>=0;index--)if(removeIds.has(nodes[index].id))nodes.splice(index,1);
   }
   nodes.push(...folds);
 
@@ -280,7 +304,7 @@ function execweaveDashboardGraph(data){
   const incident=new Set();for(const edge of edges){incident.add(edge.source);incident.add(edge.target)}
   visibleNodes=nodes.filter(node=>node.type!=='tool'||incident.has(node.id));
   nodeIds=new Set(visibleNodes.map(node=>node.id));edges=edges.filter(edge=>nodeIds.has(edge.source)&&nodeIds.has(edge.target));
-  return{...data,nodes:visibleNodes,edges,node_count:visibleNodes.length,edge_count:edges.length,dashboard_projection:{hidden_detail_node_count:hiddenDetailIds.size,hidden_internal_staging_node_count:internalStagingIds.size,canonicalized_process_occurrence_count:canonicalizedProcessOccurrenceCount,canonicalized_tool_entity_count:[...toolMembersByRepresentative.values()].reduce((sum,members)=>sum+Math.max(0,members.length-1),0),folded_node_count:foldedNodeCount,collapsed_tool_call_count:invocationMap.size,raw_tool_call_detail_count:allNodes.filter(node=>['tool_call','tool_call_observation'].includes(String(node?.type||''))).length}};
+  return{...data,nodes:visibleNodes,edges,node_count:visibleNodes.length,edge_count:edges.length,dashboard_projection:{hidden_detail_node_count:hiddenDetailIds.size,hidden_internal_staging_node_count:internalStagingIds.size,canonicalized_process_occurrence_count:canonicalizedProcessOccurrenceCount,canonicalized_tool_entity_count:[...toolMembersByRepresentative.values()].reduce((sum,members)=>sum+Math.max(0,members.length-1),0),folded_node_count:foldedNodeCount,collapsed_tool_call_count:invocationMap.size,raw_tool_call_detail_count:allNodes.filter(node=>['tool_call','tool_call_observation'].includes(String(node?.type||''))).length,file_display_mode:fileDisplayMode,hidden_file_observation_node_count:hiddenFileObservationCount}};
 }
 """.strip()
 
@@ -310,7 +334,7 @@ _LIVE_SET_SNAPSHOT_CLEAN = "function setSnapshot(data){const signature=`${data.n
 _LIVE_APPLY_DELTA_CLEAN = "function applyDelta(update){if(update.live_payload_compact){updateStats(update);enterProtectiveMode(update);return}const rawNodes=new Map((graph.nodes||[]).map(n=>[n.id,n])),rawEdges=new Map((graph.edges||[]).map(e=>[edgeId(e),e]));for(const node of [...(update.nodes_added||[]),...(update.nodes_updated||[])])if(node?.id)rawNodes.set(node.id,node);for(const edge of [...(update.edges_added||[]),...(update.edges_updated||[])])rawEdges.set(edgeId(edge),edge);graph={...graph,event_count:update.event_count,node_count:update.node_count,edge_count:update.edge_count,nodes:[...rawNodes.values()],edges:[...rawEdges.values()]};const display=execweaveDashboardGraph(graph);updateStats({...update,node_count:display.node_count,edge_count:display.edge_count});if(!withinRenderBudget(display)){enterProtectiveMode(display);return}if(protectedMode)leaveProtectiveMode();nodeById=new Map((display.nodes||[]).map(n=>[n.id,n]));edgeById=new Map((display.edges||[]).map(e=>[edgeId(e),e]));rebuildAdjacency();renderSnapshot();seedActivities();const sortedEdges=[...edgeById.values()].sort((a,b)=>String(a.last_seen||'').localeCompare(String(b.last_seen||''))),sortedNodes=[...nodeById.values()].sort((a,b)=>String(a.last_seen||'').localeCompare(String(b.last_seen||''))),lastEdge=sortedEdges.length?sortedEdges[sortedEdges.length-1]:null,lastNode=sortedNodes.length?sortedNodes[sortedNodes.length-1]:null;markLatest(lastEdge?.target||lastNode?.id||null,lastEdge?edgeId(lastEdge):null);scheduleCamera(false);if(!hasFitted&&positions.size){fit(false);hasFitted=true}}"
 
 _LIVE_CORE_EXPORT = "window.__execweaveCore={getActivities:()=>activities.slice(),getGraph:()=>graph,getPositions:()=>new Map(positions),selectEdge,selectNode,focusNode,markLatest,setCameraMode};"
-_LIVE_CORE_EXPORT_CLEAN = "window.__execweaveCore={getActivities:()=>activities.slice(),getGraph:()=>graph,getDisplayGraph:()=>({...graph,nodes:[...nodeById.values()],edges:[...edgeById.values()],node_count:nodeById.size,edge_count:edgeById.size}),getPositions:()=>new Map(positions),selectEdge,selectNode,focusNode,markLatest,setCameraMode};"
+_LIVE_CORE_EXPORT_CLEAN = "const execweaveFileGraphFilter=document.getElementById('file-graph-filter');globalThis.__execweaveFileDisplayMode=execweaveFileGraphFilter?.value||'changed';if(execweaveFileGraphFilter)execweaveFileGraphFilter.addEventListener('change',()=>{globalThis.__execweaveFileDisplayMode=execweaveFileGraphFilter.value||'changed';setSnapshot(graph)});window.__execweaveCore={getActivities:()=>activities.slice(),getGraph:()=>graph,getDisplayGraph:()=>({...graph,nodes:[...nodeById.values()],edges:[...edgeById.values()],node_count:nodeById.size,edge_count:edgeById.size}),getPositions:()=>new Map(positions),selectEdge,selectNode,focusNode,markLatest,setCameraMode};"
 
 _LIVE_NOOP_STATS = "else if(data.kind==='noop'){liveSequence=Number(data.sequence)||liveSequence;updateStats(data);}"
 _LIVE_NOOP_STATS_CLEAN = "else if(data.kind==='noop'){liveSequence=Number(data.sequence)||liveSequence;updateStats(protectedMode?data:{...data,node_count:nodeById.size,edge_count:edgeById.size});}"
@@ -338,6 +362,11 @@ def inject_standalone_dashboard_clean(html: str) -> str:
 
 def inject_live_dashboard_clean(html: str) -> str:
     """Simplify only the browser canvas; the live JSON protocol remains unchanged."""
+    control_seam = '<div class="panel-spacer"></div>\n    <div class="segmented" aria-label="Camera mode">'
+    control = '<div class="panel-spacer"></div>\n    <label class="graph-file-filter" title="Choose which file and directory nodes appear in the graph"><span>Files</span><select id="file-graph-filter"><option value="changed" selected>Changed only</option><option value="all">All observed</option><option value="hide">Hidden</option></select></label>\n    <div class="segmented" aria-label="Camera mode">'
+    if html.count(control_seam) != 1:
+        raise RuntimeError("file graph filter control seam changed")
+    html = html.replace(control_seam, control, 1)
     marker = "function renderSnapshot(){"
     if "function execweaveDashboardGraph(data){" not in html and marker in html:
         html = html.replace(marker, _DASHBOARD_JS + "\n" + marker, 1)

execweave-0.8.15/tests/test_d003_fast_reparent.py

@@ -0,0 +1,134 @@
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+import psutil
+import pytest
+
+from execweave.collector import RuntimeCollector
+from execweave.sink import JsonlSink
+
+
+_SLEEP = "import time; time.sleep(60)"
+
+
+def _live_pid(pid: int) -> bool:
+    try:
+        process = psutil.Process(pid)
+        return process.is_running() and process.status() != psutil.STATUS_ZOMBIE
+    except (psutil.NoSuchProcess, psutil.ZombieProcess):
+        return False
+
+
+def _wait_for(predicate, *, timeout: float = 5.0) -> None:
+    deadline = time.monotonic() + timeout
+    while time.monotonic() < deadline:
+        if predicate():
+            return
+        time.sleep(0.01)
+    raise AssertionError("fast-reparent fixture did not reach its handshake")
+
+
+def _collector(tmp_path: Path) -> RuntimeCollector:
+    return RuntimeCollector(
+        session_id="d003-fast-reparent",
+        sink=JsonlSink(tmp_path / "events.jsonl"),
+        watch_root=tmp_path,
+        poll_interval=0.02,
+        collect_filesystem=False,
+        collect_network=False,
+    )
+
+
+def _detaching_command(pid_file: Path) -> list[str]:
+    code = (
+        "import subprocess,sys; "
+        "child=subprocess.Popen([sys.executable,'-c','import time; time.sleep(60)'], "
+        "start_new_session=True); "
+        "open(sys.argv[1],'w',encoding='utf-8').write(str(child.pid))"
+    )
+    return [sys.executable, "-c", code, str(pid_file)]
+
+
+def _miss_short_lived_tree(
+    monkeypatch: pytest.MonkeyPatch,
+    collector: RuntimeCollector,
+    pid_file: Path,
+) -> None:
+    def miss_tree(root: psutil.Process) -> None:
+        _wait_for(pid_file.exists)
+        # Deliberately simulate the polling blind spot from issue #9: the launcher
+        # exits after spawning a detached child before a descendant sample lands.
+        time.sleep(0.05)
+
+    monkeypatch.setattr(collector, "_sample_process_tree", miss_tree)
+
+
+def _non_linux_guard() -> bool:
+    if sys.platform.startswith("linux"):
+        return False
+    # Fast detached-child recovery in this regression is a Linux subreaper path.
+    # On other platforms the implementation must remain disabled rather than
+    # silently attempting Linux prctl semantics.
+    assert RuntimeCollector._linux_child_subreaper_state() is None
+    assert RuntimeCollector._set_linux_child_subreaper(True) is False
+    return True
+
+
+def test_run_cleans_detached_child_even_when_polling_never_observed_it(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    if _non_linux_guard():
+        return
+
+    collector = _collector(tmp_path)
+    pid_file = tmp_path / "detached.pid"
+    sentinel = subprocess.Popen([sys.executable, "-c", _SLEEP])
+    try:
+        _miss_short_lived_tree(monkeypatch, collector, pid_file)
+        assert collector.run(_detaching_command(pid_file)) == 0
+        child_pid = int(pid_file.read_text(encoding="utf-8"))
+        _wait_for(lambda: not _live_pid(child_pid))
+        assert _live_pid(sentinel.pid), "cleanup killed a pre-existing unrelated child"
+
+        finished = json.loads((tmp_path / "events.jsonl").read_text().splitlines()[-1])
+        assert finished["event_type"] == "session.finished"
+        assert finished["attributes"]["workload_alive_after_cleanup"] is False
+    finally:
+        if _live_pid(sentinel.pid):
+            sentinel.kill()
+        sentinel.wait(timeout=5)
+
+
+def test_fast_detached_survivor_is_reported_if_cleanup_does_not_terminate_it(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    if _non_linux_guard():
+        return
+
+    collector = _collector(tmp_path)
+    pid_file = tmp_path / "detached.pid"
+    _miss_short_lived_tree(monkeypatch, collector, pid_file)
+    monkeypatch.setattr(collector, "_terminate_process_tree", lambda process, *, owned=None: None)
+
+    child_pid: int | None = None
+    try:
+        assert collector.run(_detaching_command(pid_file)) == 0
+        child_pid = int(pid_file.read_text(encoding="utf-8"))
+        assert _live_pid(child_pid)
+        finished = json.loads((tmp_path / "events.jsonl").read_text().splitlines()[-1])
+        assert finished["attributes"]["workload_alive_after_cleanup"] is True
+    finally:
+        if child_pid is not None and _live_pid(child_pid):
+            process = psutil.Process(child_pid)
+            process.kill()
+            try:
+                process.wait(timeout=5)
+            except psutil.TimeoutExpired:
+                pass

execweave-0.8.15/tests/test_dashboard_file_activity_filter.py

@@ -0,0 +1,30 @@
+from __future__ import annotations
+
+from execweave.dashboard_shell import DASHBOARD_HTML
+from execweave.viewer_dashboard_clean import _DASHBOARD_JS
+
+
+def test_dashboard_exposes_file_activity_filter_with_changed_default() -> None:
+    assert 'id="file-graph-filter"' in DASHBOARD_HTML
+    assert '<option value="changed" selected>Changed only</option>' in DASHBOARD_HTML
+    assert '<option value="all">All observed</option>' in DASHBOARD_HTML
+    assert '<option value="hide">Hidden</option>' in DASHBOARD_HTML
+    assert "__execweaveFileDisplayMode" in DASHBOARD_HTML
+
+
+def test_dashboard_file_projection_distinguishes_changes_from_scans() -> None:
+    assert "fileMutationEvents=new Set(['filesystem.created','filesystem.modified','filesystem.moved','filesystem.deleted'])" in _DASHBOARD_JS
+    assert "fileDisplayMode==='hide'" in _DASHBOARD_JS
+    assert "fileDisplayMode==='all'" in _DASHBOARD_JS
+    assert "relatedEventTypes=related.flatMap" in _DASHBOARD_JS
+    assert "allEventTypes=[...eventTypes,...relatedEventTypes]" in _DASHBOARD_JS
+    assert "return activity!=='observed'" in _DASHBOARD_JS
+    assert "return'unknown'" in _DASHBOARD_JS
+    assert "hidden_file_observation_node_count" in _DASHBOARD_JS
+
+
+def test_file_and_directory_nodes_share_one_fold_group() -> None:
+    assert "type==='file'||type==='directory'?'filesystem':type" in _DASHBOARD_JS
+    assert "viewer:folded:${type}" in _DASHBOARD_JS
+    assert "earlier files / directories" in _DASHBOARD_JS
+    assert "foldedType=type==='filesystem'?'file_cluster':type" in _DASHBOARD_JS