memtaskman 0.1.0__py3-none-any.whl

memtaskman/linux.py

@@ -0,0 +1,198 @@
+"""Linux memory sources: /proc/meminfo, /proc/vmstat, /proc/<pid>/{status,stat,smaps}.
+
+Parsers are pure functions over text so they can be tested on any OS.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import time
+from pathlib import PurePosixPath
+
+from memtaskman.fmt import fmt_bytes
+from memtaskman.model import (
+    CAT_HEAP,
+    CAT_IMAGE,
+    CAT_MAPPED,
+    CAT_OTHER,
+    CAT_SHM,
+    CAT_STACK,
+    DERIVED,
+    MEASURED,
+    Category,
+    FileMapping,
+    Inspection,
+)
+
+
+def parse_kb_table(text: str) -> dict[str, int]:
+    """Parse 'Key:   1234 kB' lines (meminfo, status, smaps) into bytes."""
+    out: dict[str, int] = {}
+    for line in text.splitlines():
+        key, sep, rest = line.partition(":")
+        if not sep:
+            continue
+        parts = rest.split()
+        if not parts or not parts[0].isdigit():
+            continue
+        v = int(parts[0])
+        if len(parts) > 1 and parts[1].lower() == "kb":
+            v *= 1024
+        out[key.strip()] = v
+    return out
+
+
+def parse_vmstat(text: str) -> dict[str, int]:
+    out = {}
+    for line in text.splitlines():
+        k, _, v = line.partition(" ")
+        if v.strip().isdigit():
+            out[k] = int(v)
+    return out
+
+
+def parse_stat_faults(text: str) -> int | None:
+    """minflt + majflt from /proc/<pid>/stat (comm may contain spaces/parens)."""
+    r = text.rfind(")")
+    if r < 0:
+        return None
+    fields = text[r + 2 :].split()
+    # fields[0] is state (field 3); minflt is field 10, majflt field 12.
+    try:
+        return int(fields[7]) + int(fields[9])
+    except (IndexError, ValueError):
+        return None
+
+
+_HEADER = re.compile(r"^([0-9a-f]+)-([0-9a-f]+)\s+(\S+)\s+\S+\s+\S+\s+\d+\s*(.*)$")
+
+
+def parse_smaps(text: str) -> list[dict]:
+    """One dict per mapping: start, end, perms, path, plus kB fields in bytes."""
+    maps: list[dict] = []
+    cur: dict | None = None
+    for line in text.splitlines():
+        m = _HEADER.match(line)
+        if m:
+            cur = {"start": int(m.group(1), 16), "end": int(m.group(2), 16), "perms": m.group(3), "path": m.group(4).strip()}
+            maps.append(cur)
+            continue
+        if cur is None:
+            continue
+        key, sep, rest = line.partition(":")
+        parts = rest.split()
+        if sep and parts and parts[0].isdigit() and len(parts) > 1 and parts[1] == "kB":
+            cur[key.strip()] = int(parts[0]) * 1024
+    return maps
+
+
+def categorize(path: str, perms: str) -> str:
+    if not path or path.startswith("[anon"):
+        return CAT_HEAP
+    if path == "[heap]":
+        return CAT_HEAP
+    if path.startswith("[stack"):
+        return CAT_STACK
+    if path.startswith("["):
+        return CAT_OTHER  # vdso, vvar, vsyscall
+    if path.startswith(("/dev/shm/", "/memfd:", "memfd:", "/SYSV", "/dev/zero")):
+        return CAT_SHM
+    name = PurePosixPath(path).name
+    if "x" in perms or re.search(r"\.so(\.|$)", name):
+        return CAT_IMAGE
+    if path.startswith("/dev/"):
+        return CAT_OTHER
+    return CAT_MAPPED
+
+
+def summarize_smaps(maps: list[dict], top_files: int = 12) -> tuple[list[Category], list[FileMapping]]:
+    cats: dict[str, Category] = {}
+    files: dict[str, FileMapping] = {}
+    for m in maps:
+        cat = categorize(m["path"], m["perms"])
+        c = cats.setdefault(cat, Category(cat, resident=0, resident_shared=0, swapped=0))
+        size = m.get("Size", m["end"] - m["start"])
+        rss = m.get("Rss", 0)
+        c.mapped += size
+        c.resident += rss
+        c.resident_shared += m.get("Shared_Clean", 0) + m.get("Shared_Dirty", 0)
+        c.swapped += m.get("Swap", 0)
+        c.regions += 1
+        if cat in (CAT_IMAGE, CAT_MAPPED, CAT_SHM) and m["path"]:
+            f = files.setdefault(m["path"], FileMapping(m["path"], "image" if cat == CAT_IMAGE else "mapped", 0, 0))
+            f.mapped += size
+            f.resident += rss
+    top = sorted(files.values(), key=lambda f: f.resident or 0, reverse=True)[:top_files]
+    return list(cats.values()), top
+
+
+# --------------------------------------------------------------------------- live readers
+
+
+def _read(path: str) -> str | None:
+    try:
+        with open(path, encoding="utf-8", errors="replace") as f:
+            return f.read()
+    except OSError:
+        return None
+
+
+def meminfo() -> dict[str, int]:
+    return parse_kb_table(_read("/proc/meminfo") or "")
+
+
+def vmstat() -> dict[str, int]:
+    return parse_vmstat(_read("/proc/vmstat") or "")
+
+
+def proc_status(pid: int) -> dict[str, int]:
+    return parse_kb_table(_read(f"/proc/{pid}/status") or "")
+
+
+def proc_faults(pid: int) -> int | None:
+    t = _read(f"/proc/{pid}/stat")
+    return parse_stat_faults(t) if t else None
+
+
+def rollup(pid: int) -> tuple[int, int] | None:
+    """(PSS, USS) from /proc/<pid>/smaps_rollup, or None when unreadable."""
+    r = parse_kb_table(_read(f"/proc/{pid}/smaps_rollup") or "")
+    if "Pss" not in r:
+        return None
+    return r["Pss"], r.get("Private_Clean", 0) + r.get("Private_Dirty", 0)
+
+
+def mapped_paths(pid: int) -> list[str] | None:
+    t = _read(f"/proc/{pid}/maps")
+    if t is None:
+        return None
+    names = set()
+    for line in t.splitlines():
+        parts = line.split(None, 5)
+        if len(parts) == 6 and parts[5].startswith("/"):
+            names.add(PurePosixPath(parts[5].strip()).name)
+    return sorted(names)
+
+
+def inspect(pid: int, name: str, *, top_files: int = 12) -> Inspection:
+    t0 = time.perf_counter()
+    ins = Inspection(pid=pid, name=name)
+    text = _read(f"/proc/{pid}/smaps")
+    if text is None:
+        ins.error = "cannot read smaps: process exited, or owned by another user (run with sudo)"
+        return ins
+    maps = parse_smaps(text)
+    ins.categories, ins.top_files = summarize_smaps(maps, top_files)
+    ins.evidence.append((MEASURED, f"{len(maps)} mappings from /proc/{pid}/smaps"))
+    r = rollup(pid)
+    if r:
+        ins.evidence.append((MEASURED, f"PSS {fmt_bytes(r[0])}: resident with shared pages split between sharers"))
+        ins.evidence.append((MEASURED, f"USS {fmt_bytes(r[1])}: freed if this process exits"))
+    ins.evidence.append((DERIVED, "categories assigned from mapping names and permissions"))
+    ins.elapsed = time.perf_counter() - t0
+    return ins
+
+
+def is_linux() -> bool:
+    return os.path.exists("/proc/meminfo")

memtaskman/model.py

@@ -0,0 +1,136 @@
+"""Plain data types shared by collectors, the UI and reports.
+
+Every number is in bytes (or events per second for *_ps fields). ``None`` means
+"this platform/privilege level could not measure it" and is never silently
+turned into zero.
+"""
+
+from __future__ import annotations
+
+from dataclasses import asdict, dataclass, field
+from typing import Any
+
+# Evidence levels, strongest first. Shown next to every inspector claim.
+MEASURED = "measured"  # read straight from an OS counter
+DERIVED = "derived"  # computed by us from OS data (e.g. page-by-page working-set walk)
+IDENTIFIED = "identified"  # runtime recognised from loaded modules / executable
+HINT = "hint"  # configuration from the command line; a limit, not usage
+
+
+@dataclass
+class SystemMemory:
+    total: int
+    available: int
+    used: int  # total - available
+    free: int | None = None  # free + zeroed pages (Win) / MemFree (Linux)
+    standby: int | None = None  # Windows standby list (cache that is instantly reclaimable)
+    modified: int | None = None  # Windows modified list (dirty, must be written before reuse)
+    cached: int | None = None  # file cache (Win system cache WS / Linux Cached+Buffers)
+    compressed: int | None = None  # Windows compression store WS / Linux zswap pool
+    commit_used: int | None = None
+    commit_limit: int | None = None
+    swap_total: int | None = None
+    swap_used: int | None = None
+    kernel_paged: int | None = None  # Win paged pool / Linux reclaimable slab
+    kernel_nonpaged: int | None = None  # Win nonpaged pool / Linux unreclaimable slab
+    page_faults_ps: float | None = None
+    hard_faults_ps: float | None = None  # pages read from disk per second
+    extra: dict[str, int] = field(default_factory=dict)  # platform-specific labelled values
+    source: str = "psutil"
+
+    def to_dict(self) -> dict[str, Any]:
+        return asdict(self)
+
+
+@dataclass
+class ProcessMem:
+    pid: int
+    name: str
+    ppid: int
+    create_time: float
+    resident: int  # working set (Win) / RSS (Linux, macOS)
+    private: int | None  # private commit (Win) / anonymous resident (Linux) / None
+    shared: int | None = None  # resident file-backed + shmem (Linux)
+    swapped: int | None = None  # VmSwap (Linux)
+    pss: int | None = None  # proportional set size: shared pages split between sharers (Linux)
+    uss: int | None = None  # unique set size: freed if the process exits (Linux)
+    peak: int | None = None  # peak working set / VmHWM
+    paged_pool: int | None = None  # Windows kernel pool charged to the process
+    nonpaged_pool: int | None = None
+    faults_ps: float | None = None
+    growth_ps: float | None = None  # smoothed private-bytes growth rate, B/s
+    runtime: str | None = None
+    runtime_detail: str | None = None
+    count: int = 1  # >1 when this row aggregates several processes (group-by-app view)
+
+    @property
+    def key(self) -> tuple[int, float]:
+        return (self.pid, self.create_time)
+
+    def to_dict(self) -> dict[str, Any]:
+        return asdict(self)
+
+
+@dataclass
+class Snapshot:
+    time: float
+    platform: str
+    system: SystemMemory | None
+    processes: list[ProcessMem]
+    private_label: str = "Private"  # what "private" means on this platform
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "version": 1,
+            "time": self.time,
+            "platform": self.platform,
+            "private_label": self.private_label,
+            "system": self.system.to_dict() if self.system else None,
+            "processes": [p.to_dict() for p in self.processes],
+        }
+
+
+@dataclass
+class Category:
+    """One slice of a process's address space."""
+
+    name: str
+    mapped: int = 0  # committed (Win) / mapped size (Linux)
+    resident: int | None = None
+    resident_shared: int | None = None
+    swapped: int | None = None
+    regions: int = 0
+
+
+@dataclass
+class FileMapping:
+    path: str
+    kind: str  # "image" or "mapped"
+    mapped: int = 0
+    resident: int | None = None
+
+
+@dataclass
+class Inspection:
+    pid: int
+    name: str
+    categories: list[Category] = field(default_factory=list)
+    top_files: list[FileMapping] = field(default_factory=list)
+    reserved: int | None = None  # address space reserved but not committed (Win)
+    evidence: list[tuple[str, str]] = field(default_factory=list)  # (level, text)
+    cmdline: list[str] = field(default_factory=list)
+    error: str | None = None
+    elapsed: float = 0.0
+
+    def to_dict(self) -> dict[str, Any]:
+        return asdict(self)
+
+
+# Fixed category names so Windows and Linux line up in the UI.
+CAT_IMAGE = "Images (exe/dll/.so)"
+CAT_MAPPED = "Mapped files"
+CAT_SHM = "Shared memory"
+CAT_HEAP = "Private (heap/anon)"
+CAT_STACK = "Stacks"
+CAT_OTHER = "Other"
+CATEGORY_ORDER = [CAT_HEAP, CAT_STACK, CAT_IMAGE, CAT_MAPPED, CAT_SHM, CAT_OTHER]

memtaskman/report.py

@@ -0,0 +1,85 @@
+"""Plain-text and JSON output for --once / --json / inspect."""
+
+from __future__ import annotations
+
+import json
+
+from memtaskman.fmt import fmt_bytes, fmt_count_rate, fmt_rate, pct
+from memtaskman.model import Inspection, Snapshot, SystemMemory
+
+
+def system_lines(sm: SystemMemory) -> list[str]:
+    lines = []
+    up = pct(sm.used, sm.total)
+    lines.append(f"RAM      {fmt_bytes(sm.used)} / {fmt_bytes(sm.total)} used ({up:.0f}%), {fmt_bytes(sm.available)} available")
+    parts = []
+    if sm.modified is not None:
+        parts.append(f"modified {fmt_bytes(sm.modified)}")
+    if sm.standby is not None:
+        parts.append(f"standby {fmt_bytes(sm.standby)}")
+    if sm.free is not None:
+        parts.append(f"free {fmt_bytes(sm.free)}")
+    if sm.cached is not None:
+        parts.append(f"file cache {fmt_bytes(sm.cached)}")
+    if sm.compressed is not None:
+        parts.append(f"compressed {fmt_bytes(sm.compressed)}")
+    if parts:
+        lines.append("         " + ", ".join(parts))
+    if sm.commit_used is not None and sm.commit_limit:
+        lines.append(f"Commit   {fmt_bytes(sm.commit_used)} / {fmt_bytes(sm.commit_limit)} ({pct(sm.commit_used, sm.commit_limit):.0f}%)")
+    if sm.swap_total:
+        lines.append(f"Swap     {fmt_bytes(sm.swap_used)} / {fmt_bytes(sm.swap_total)}")
+    if sm.kernel_paged is not None:
+        lines.append(f"Kernel   paged/reclaimable {fmt_bytes(sm.kernel_paged)}, nonpaged/unreclaimable {fmt_bytes(sm.kernel_nonpaged)}")
+    if sm.page_faults_ps is not None:
+        lines.append(f"Faults   {fmt_count_rate(sm.page_faults_ps)}/s, hard {fmt_count_rate(sm.hard_faults_ps)}/s")
+    for k, v in sm.extra.items():
+        lines.append(f"         {k}: {fmt_bytes(v)}")
+    return lines
+
+
+def render_text(snap: Snapshot, *, top: int | None = 25) -> str:
+    out: list[str] = []
+    if snap.system:
+        out += system_lines(snap.system)
+        out.append("")
+    procs = sorted(snap.processes, key=lambda p: p.resident, reverse=True)
+    if top:
+        procs = procs[:top]
+    pl = snap.private_label
+    has_pss = any(p.pss is not None for p in procs)
+    pss_h = f" {'PSS':>9}" if has_pss else ""
+    out.append(f"{'PID':>7}  {'Name':<28} {'Resident':>9}{pss_h} {pl:>9} {'Growth':>10} {'Faults/s':>8}  Runtime")
+    for p in procs:
+        rt = f"{p.runtime or ''} {p.runtime_detail or ''}".strip()
+        pss = f" {fmt_bytes(p.pss):>9}" if has_pss else ""
+        out.append(
+            f"{p.pid:>7}  {p.name[:28]:<28} {fmt_bytes(p.resident):>9}{pss} {fmt_bytes(p.private):>9} "
+            f"{fmt_rate(p.growth_ps):>10} {fmt_count_rate(p.faults_ps):>8}  {rt}"
+        )
+    return "\n".join(out)
+
+
+def render_inspection(ins: Inspection) -> str:
+    out = [f"{ins.name} (pid {ins.pid})"]
+    if ins.error:
+        out.append(f"  error: {ins.error}")
+    if ins.categories:
+        out.append(f"  {'Category':<22} {'Mapped':>9} {'Resident':>9} {'Shared':>9}")
+        for c in ins.categories:
+            out.append(f"  {c.name:<22} {fmt_bytes(c.mapped):>9} {fmt_bytes(c.resident):>9} {fmt_bytes(c.resident_shared):>9}")
+        if ins.reserved:
+            out.append(f"  {'Reserved (uncommitted)':<22} {fmt_bytes(ins.reserved):>9}")
+    if ins.top_files:
+        out.append("  Top files:")
+        for f in ins.top_files:
+            out.append(f"    {fmt_bytes(f.resident):>9} res {fmt_bytes(f.mapped):>9} map  {f.path}")
+    for level, text in ins.evidence:
+        out.append(f"  [{level}] {text}")
+    if ins.cmdline:
+        out.append("  cmd: " + " ".join(ins.cmdline)[:400])
+    return "\n".join(out)
+
+
+def to_json(obj) -> str:
+    return json.dumps(obj.to_dict() if hasattr(obj, "to_dict") else obj, indent=2)

memtaskman/runtime.py

@@ -0,0 +1,224 @@
+"""Identify what kind of runtime owns a process, from evidence only.
+
+Pure functions: input is the executable name, loaded module basenames and the
+command line; output is a label plus evidence lines. Nothing here touches the OS,
+so it is fully unit-testable.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+from pathlib import PurePath
+from typing import Iterable
+
+from memtaskman.fmt import fmt_bytes, parse_size
+from memtaskman.model import HINT, IDENTIFIED, MEASURED
+
+
+@dataclass
+class RuntimeInfo:
+    name: str
+    detail: str = ""
+    evidence: list[tuple[str, str]] = field(default_factory=list)
+
+    @property
+    def label(self) -> str:
+        return f"{self.name} {self.detail}".strip()
+
+
+_BROWSERS = {
+    "chrome": "Chrome",
+    "msedge": "Edge",
+    "msedgewebview2": "WebView2",
+    "brave": "Brave",
+    "opera": "Opera",
+    "vivaldi": "Vivaldi",
+    "chromium": "Chromium",
+    "arc": "Arc",
+}
+
+_VM_HOSTS = {
+    "vmmem": "Hyper-V / WSL2 guest RAM",
+    "vmmemwsl": "WSL2 guest RAM",
+    "vmwp": "Hyper-V worker",
+    "qemu-system-x86_64": "QEMU guest RAM",
+    "qemu-system-aarch64": "QEMU guest RAM",
+    "vmware-vmx": "VMware guest RAM",
+    "virtualboxvm": "VirtualBox guest RAM",
+}
+
+_DATABASES = {
+    "sqlservr": "SQL Server",
+    "postgres": "PostgreSQL",
+    "mysqld": "MySQL",
+    "mariadbd": "MariaDB",
+    "redis-server": "Redis",
+    "mongod": "MongoDB",
+    "memcached": "memcached",
+    "clickhouse": "ClickHouse",
+    "elasticsearch": "Elasticsearch",
+}
+
+_LLM = {
+    "ollama": "Ollama",
+    "ollama_llama_server": "Ollama",
+    "llama-server": "llama.cpp",
+    "llama-cli": "llama.cpp",
+    "lm studio": "LM Studio",
+    "lms": "LM Studio",
+    "foundry": "Foundry Local",
+    "vllm": "vLLM",
+}
+
+
+def stem(name: str) -> str:
+    """Lowercase basename without a trailing .exe."""
+    base = PurePath(name.replace("\\", "/")).name.lower()
+    return base[:-4] if base.endswith(".exe") else base
+
+
+def _flag(cmdline: list[str], *names: str) -> str | None:
+    """Value of --name=value / --name value / -Xname style flags."""
+    for i, arg in enumerate(cmdline):
+        for n in names:
+            if arg == n and i + 1 < len(cmdline):
+                return cmdline[i + 1]
+            if arg.startswith(n + "="):
+                return arg[len(n) + 1 :]
+    return None
+
+
+def _has_module(mods: set[str], *patterns: str) -> str | None:
+    for m in mods:
+        for p in patterns:
+            if re.fullmatch(p, m):
+                return m
+    return None
+
+
+def detect(exe: str, modules: Iterable[str] = (), cmdline: Iterable[str] = ()) -> RuntimeInfo | None:
+    name = stem(exe)
+    mods = {m.lower() for m in modules}
+    args = list(cmdline)
+
+    # --- Hypervisors: one process standing in for an entire guest OS ---------------
+    if name in _VM_HOSTS:
+        ev = [(IDENTIFIED, f"{exe} hosts a virtual machine; its memory is the guest's RAM")]
+        if name in {"vmmem", "vmmemwsl"}:
+            ev.append((HINT, "WSL2: cap it with [wsl2] memory=... in %UserProfile%\\.wslconfig"))
+        return RuntimeInfo("VM", _VM_HOSTS[name], ev)
+    if name in {"memory compression", "memcompression"}:
+        return RuntimeInfo("Kernel", "compression store",
+                           [(MEASURED, "Windows keeps compressed pages from all processes here")])
+    if name in {"system", "registry", "secure system", "kernel_task", "kthreadd"}:
+        return RuntimeInfo("Kernel", "", [(IDENTIFIED, "kernel / system process")])
+
+    # --- Browsers & Electron (Chromium multi-process model) -------------------------
+    ptype = _flag(args, "--type")
+    chromium_mod = _has_module(mods, r"chrome_elf\.dll", r"chrome\.dll", r"msedge\.dll", r"libcef\.(dll|so)",
+                               r"msedge_elf\.dll", r"electron.*")
+    if ptype or chromium_mod or name in _BROWSERS:
+        brand = _BROWSERS.get(name)
+        if brand is None:
+            brand = "Electron" if (ptype or chromium_mod) else "Chromium"
+        sub = _flag(args, "--utility-sub-type")
+        detail = ptype or "browser"
+        if detail == "gpu-process":
+            detail = "gpu"
+        if sub:
+            detail += ":" + sub.split(".")[-1].replace("Service", "").lower()
+        ev = [(IDENTIFIED, f"Chromium process type '{ptype or 'browser'}'"
+               + (f" (module {chromium_mod})" if chromium_mod else ""))]
+        js = _flag(args, "--js-flags")
+        if js:
+            m = re.search(r"--max-old-space-size=(\d+)", js)
+            if m:
+                ev.append((HINT, f"V8 heap limit {fmt_bytes(int(m.group(1)) * 1024 * 1024)} (--js-flags)"))
+        if ptype == "renderer":
+            ev.append((HINT, "renderers hold one or more tabs/frames; V8 heap + DOM + images"))
+        return RuntimeInfo(brand, detail, ev)
+
+    # --- Firefox ---------------------------------------------------------------------
+    if name in {"firefox", "librewolf", "waterfox"} or _has_module(mods, r"xul\.dll", r"libxul\.so"):
+        detail = "content" if "-contentproc" in args else "parent"
+        if "-contentproc" in args and args:
+            last = args[-1]
+            if last in {"tab", "gpu", "socket", "rdd", "utility", "gmplugin"}:
+                detail = last
+        return RuntimeInfo("Firefox", detail, [(IDENTIFIED, "Gecko (xul) process")])
+
+    # --- Managed runtimes -------------------------------------------------------------
+    jvm = _has_module(mods, r"jvm\.dll", r"libjvm\.(so|dylib)")
+    if jvm or name in {"java", "javaw"}:
+        ev = [(IDENTIFIED, f"JVM ({jvm or exe})")]
+        for a in args:
+            if a.startswith("-Xmx"):
+                size = parse_size(a[4:])
+                ev.append((HINT, f"max heap {fmt_bytes(size)} (-Xmx)" if size else f"max heap {a[4:]} (-Xmx)"))
+            elif a.startswith("-XX:MaxRAMPercentage="):
+                ev.append((HINT, f"max heap {a.split('=', 1)[1]}% of RAM"))
+        main = next((a for a in args if a.endswith(".jar")), "")
+        return RuntimeInfo("Java", PurePath(main.replace("\\", "/")).name if main else "", ev)
+
+    clr = _has_module(mods, r"coreclr\.dll", r"libcoreclr\.(so|dylib)", r"clr\.dll", r"mscorwks\.dll")
+    if clr:
+        flavour = ".NET" if "coreclr" in clr else ".NET Framework"
+        ev = [(IDENTIFIED, f"CLR loaded ({clr}); private bytes include the GC heap")]
+        if _has_module(mods, r"wpfgfx.*\.dll", r"presentationcore.*"):
+            ev.append((IDENTIFIED, "WPF UI"))
+        return RuntimeInfo(flavour, "", ev)
+
+    node = _has_module(mods, r"libnode\.(dll|so.*|dylib)", r"node\.dll")
+    if node or name in {"node", "bun", "deno"}:
+        label = {"bun": "Bun", "deno": "Deno"}.get(name, "Node.js")
+        ev = [(IDENTIFIED, f"{label} ({node or exe})")]
+        v = _flag(args, "--max-old-space-size")
+        if v and v.isdigit():
+            ev.append((HINT, f"V8 heap limit {fmt_bytes(int(v) * 1024 * 1024)}"))
+        script = next((a for a in args[1:] if not a.startswith("-")), "")
+        return RuntimeInfo(label, PurePath(script.replace("\\", "/")).name if script else "", ev)
+
+    py = _has_module(mods, r"python3\d*\.dll", r"libpython3[\d.]*\.(so.*|dylib)")
+    if py or re.fullmatch(r"pythonw?(3(\.\d+)?)?", name):
+        ver = ""
+        if py:
+            m = re.search(r"python(\d)\.?(\d+)", py)
+            if m:
+                ver = f"{m.group(1)}.{m.group(2)}"
+        script = next((a for a in args[1:] if not a.startswith("-")), "")
+        if "-m" in args:
+            i = args.index("-m")
+            if i + 1 < len(args):
+                script = args[i + 1]
+        ev = [(IDENTIFIED, f"CPython {ver}".strip() + (f" ({py})" if py else ""))]
+        if _has_module(mods, r"torch_cpu\.dll", r"libtorch_cpu\.so", r"c10\.dll"):
+            ev.append((IDENTIFIED, "PyTorch loaded (tensors on CPU count as private bytes)"))
+        return RuntimeInfo(f"Python {ver}".strip(), PurePath(script.replace("\\", "/")).name if script else "", ev)
+
+    # --- Local LLM servers (CPU-offloaded weights live in RAM) -------------------------
+    for key, label in _LLM.items():
+        if name == key or name.startswith(key + "-"):
+            ev = [(IDENTIFIED, f"{label} server")]
+            model = _flag(args, "-m", "--model")
+            if model:
+                ev.append((HINT, f"model {PurePath(model.replace(chr(92), '/')).name}"))
+            if _flag(args, "--mlock") is not None or "--mlock" in args:
+                ev.append((HINT, "--mlock: weights pinned in RAM"))
+            if "--no-mmap" in args:
+                ev.append((HINT, "--no-mmap: weights copied into private memory"))
+            else:
+                ev.append((HINT, "weights are usually mmap'd: they appear under Mapped files"))
+            return RuntimeInfo("LLM", label, ev)
+
+    # --- Databases ----------------------------------------------------------------------
+    if name in _DATABASES:
+        ev = [(IDENTIFIED, _DATABASES[name])]
+        mm = _flag(args, "--maxmemory")
+        if mm:
+            ev.append((HINT, f"maxmemory {mm}"))
+        if name == "sqlservr":
+            ev.append((HINT, "SQL Server grows its buffer pool to 'max server memory'"))
+        return RuntimeInfo("DB", _DATABASES[name], ev)
+
+    return None