memtaskman 0.1.0__py3-none-any.whl

memtaskman/win32.py

@@ -0,0 +1,390 @@
+"""Windows memory sources via ctypes (no extra dependencies).
+
+* PDH ``\\Memory\\*`` counters: standby / modified / free lists, pools, fault rates.
+* ``GetPerformanceInfo``: commit charge and limit.
+* ``VirtualQueryEx`` walk: committed bytes per region type (image / mapped / private).
+* ``QueryWorkingSet``: which of those pages are resident right now, and shared or not.
+* ``EnumProcessModulesEx``: loaded DLL names for runtime identification.
+
+Everything degrades to ``None`` when access is denied (elevated or protected
+processes when running unelevated).
+"""
+
+from __future__ import annotations
+
+import bisect
+import ctypes
+import mmap
+import os
+import string
+import sys
+import time
+from ctypes import wintypes as wt
+
+from memtaskman.model import (
+    CAT_HEAP,
+    CAT_IMAGE,
+    CAT_MAPPED,
+    CAT_SHM,
+    CAT_STACK,
+    DERIVED,
+    MEASURED,
+    Category,
+    FileMapping,
+    Inspection,
+)
+
+assert sys.platform == "win32"
+
+kernel32 = ctypes.WinDLL("kernel32", use_last_error=True)
+pdh = ctypes.WinDLL("pdh")
+
+PAGE_SIZE = mmap.PAGESIZE
+
+PROCESS_QUERY_INFORMATION = 0x0400
+PROCESS_QUERY_LIMITED_INFORMATION = 0x1000
+PROCESS_VM_READ = 0x0010
+MEM_COMMIT = 0x1000
+MEM_RESERVE = 0x2000
+MEM_IMAGE = 0x1000000
+MEM_MAPPED = 0x40000
+MEM_PRIVATE = 0x20000
+PAGE_GUARD = 0x100
+ERROR_BAD_LENGTH = 24
+LIST_MODULES_ALL = 0x03
+
+kernel32.OpenProcess.restype = wt.HANDLE
+kernel32.OpenProcess.argtypes = [wt.DWORD, wt.BOOL, wt.DWORD]
+kernel32.CloseHandle.argtypes = [wt.HANDLE]
+
+
+class MEMORY_BASIC_INFORMATION(ctypes.Structure):
+    _fields_ = [
+        ("BaseAddress", ctypes.c_void_p),
+        ("AllocationBase", ctypes.c_void_p),
+        ("AllocationProtect", wt.DWORD),
+        ("PartitionId", wt.WORD),
+        ("RegionSize", ctypes.c_size_t),
+        ("State", wt.DWORD),
+        ("Protect", wt.DWORD),
+        ("Type", wt.DWORD),
+    ]
+
+
+kernel32.VirtualQueryEx.restype = ctypes.c_size_t
+kernel32.VirtualQueryEx.argtypes = [wt.HANDLE, ctypes.c_void_p, ctypes.POINTER(MEMORY_BASIC_INFORMATION), ctypes.c_size_t]
+kernel32.K32GetMappedFileNameW.restype = wt.DWORD
+kernel32.K32GetMappedFileNameW.argtypes = [wt.HANDLE, ctypes.c_void_p, wt.LPWSTR, wt.DWORD]
+kernel32.K32QueryWorkingSet.restype = wt.BOOL
+kernel32.K32QueryWorkingSet.argtypes = [wt.HANDLE, ctypes.c_void_p, wt.DWORD]
+kernel32.K32EnumProcessModulesEx.restype = wt.BOOL
+kernel32.K32EnumProcessModulesEx.argtypes = [wt.HANDLE, ctypes.POINTER(wt.HMODULE), wt.DWORD, ctypes.POINTER(wt.DWORD), wt.DWORD]
+kernel32.K32GetModuleBaseNameW.restype = wt.DWORD
+kernel32.K32GetModuleBaseNameW.argtypes = [wt.HANDLE, wt.HMODULE, wt.LPWSTR, wt.DWORD]
+kernel32.QueryDosDeviceW.restype = wt.DWORD
+kernel32.QueryDosDeviceW.argtypes = [wt.LPCWSTR, wt.LPWSTR, wt.DWORD]
+
+
+class PERFORMANCE_INFORMATION(ctypes.Structure):
+    _fields_ = [
+        ("cb", wt.DWORD),
+        ("CommitTotal", ctypes.c_size_t),
+        ("CommitLimit", ctypes.c_size_t),
+        ("CommitPeak", ctypes.c_size_t),
+        ("PhysicalTotal", ctypes.c_size_t),
+        ("PhysicalAvailable", ctypes.c_size_t),
+        ("SystemCache", ctypes.c_size_t),
+        ("KernelTotal", ctypes.c_size_t),
+        ("KernelPaged", ctypes.c_size_t),
+        ("KernelNonpaged", ctypes.c_size_t),
+        ("PageSize", ctypes.c_size_t),
+        ("HandleCount", wt.DWORD),
+        ("ProcessCount", wt.DWORD),
+        ("ThreadCount", wt.DWORD),
+    ]
+
+
+kernel32.K32GetPerformanceInfo.restype = wt.BOOL
+kernel32.K32GetPerformanceInfo.argtypes = [ctypes.POINTER(PERFORMANCE_INFORMATION), wt.DWORD]
+
+
+def performance_info() -> dict[str, int] | None:
+    pi = PERFORMANCE_INFORMATION()
+    pi.cb = ctypes.sizeof(pi)
+    if not kernel32.K32GetPerformanceInfo(ctypes.byref(pi), pi.cb):
+        return None
+    ps = pi.PageSize
+    return {
+        "commit_total": pi.CommitTotal * ps,
+        "commit_limit": pi.CommitLimit * ps,
+        "commit_peak": pi.CommitPeak * ps,
+        "physical_total": pi.PhysicalTotal * ps,
+        "physical_available": pi.PhysicalAvailable * ps,
+        "system_cache": pi.SystemCache * ps,
+        "kernel_paged": pi.KernelPaged * ps,
+        "kernel_nonpaged": pi.KernelNonpaged * ps,
+    }
+
+
+# --------------------------------------------------------------------------- PDH
+
+
+class _PdhValue(ctypes.Union):
+    _fields_ = [("longValue", ctypes.c_long), ("doubleValue", ctypes.c_double), ("largeValue", ctypes.c_longlong)]
+
+
+class PDH_FMT_COUNTERVALUE(ctypes.Structure):
+    _fields_ = [("CStatus", wt.DWORD), ("u", _PdhValue)]
+
+
+PDH_FMT_DOUBLE = 0x00000200
+PDH_FMT_NOCAP100 = 0x00008000
+pdh.PdhOpenQueryW.restype = ctypes.c_long
+pdh.PdhOpenQueryW.argtypes = [wt.LPCWSTR, ctypes.c_size_t, ctypes.POINTER(wt.HANDLE)]
+pdh.PdhAddEnglishCounterW.restype = ctypes.c_long
+pdh.PdhAddEnglishCounterW.argtypes = [wt.HANDLE, wt.LPCWSTR, ctypes.c_size_t, ctypes.POINTER(wt.HANDLE)]
+pdh.PdhCollectQueryData.restype = ctypes.c_long
+pdh.PdhCollectQueryData.argtypes = [wt.HANDLE]
+pdh.PdhGetFormattedCounterValue.restype = ctypes.c_long
+pdh.PdhGetFormattedCounterValue.argtypes = [wt.HANDLE, wt.DWORD, ctypes.POINTER(wt.DWORD), ctypes.POINTER(PDH_FMT_COUNTERVALUE)]
+pdh.PdhCloseQuery.argtypes = [wt.HANDLE]
+
+MEMORY_COUNTERS = {
+    "standby_core": r"\Memory\Standby Cache Core Bytes",
+    "standby_normal": r"\Memory\Standby Cache Normal Priority Bytes",
+    "standby_reserve": r"\Memory\Standby Cache Reserve Bytes",
+    "modified": r"\Memory\Modified Page List Bytes",
+    "free_zero": r"\Memory\Free & Zero Page List Bytes",
+    "cache": r"\Memory\Cache Bytes",
+    "pool_paged": r"\Memory\Pool Paged Bytes",
+    "pool_nonpaged": r"\Memory\Pool Nonpaged Bytes",
+    "driver_resident": r"\Memory\System Driver Resident Bytes",
+    "code_resident": r"\Memory\System Code Resident Bytes",
+    "page_faults_ps": r"\Memory\Page Faults/sec",
+    "pages_input_ps": r"\Memory\Pages Input/sec",
+    "pages_output_ps": r"\Memory\Pages Output/sec",
+    "pagefile_pct": r"\Paging File(_Total)\% Usage",
+}
+
+
+class PdhQuery:
+    """A small wrapper that keeps one PDH query open across samples."""
+
+    def __init__(self, counters: dict[str, str] = MEMORY_COUNTERS):
+        self.handle = wt.HANDLE()
+        self.counters: dict[str, wt.HANDLE] = {}
+        if pdh.PdhOpenQueryW(None, 0, ctypes.byref(self.handle)) != 0:
+            self.handle = None
+            return
+        for key, path in counters.items():
+            h = wt.HANDLE()
+            if pdh.PdhAddEnglishCounterW(self.handle, path, 0, ctypes.byref(h)) == 0:
+                self.counters[key] = h
+        pdh.PdhCollectQueryData(self.handle)  # prime rate counters
+
+    def sample(self) -> dict[str, float]:
+        out: dict[str, float] = {}
+        if not self.handle or pdh.PdhCollectQueryData(self.handle) != 0:
+            return out
+        val = PDH_FMT_COUNTERVALUE()
+        for key, h in self.counters.items():
+            if pdh.PdhGetFormattedCounterValue(h, PDH_FMT_DOUBLE | PDH_FMT_NOCAP100, None, ctypes.byref(val)) == 0:
+                out[key] = val.u.doubleValue
+        return out
+
+    def close(self) -> None:
+        if self.handle:
+            pdh.PdhCloseQuery(self.handle)
+            self.handle = None
+
+
+# --------------------------------------------------------------------------- processes
+
+
+def _open(pid: int, access: int) -> int | None:
+    h = kernel32.OpenProcess(access, False, pid)
+    return h or None
+
+
+def module_names(pid: int) -> list[str] | None:
+    """Basenames of loaded modules, or None when the process cannot be opened."""
+    h = _open(pid, PROCESS_QUERY_INFORMATION | PROCESS_VM_READ)
+    if not h:
+        return None
+    try:
+        count = 512
+        while True:
+            arr = (wt.HMODULE * count)()
+            needed = wt.DWORD()
+            if not kernel32.K32EnumProcessModulesEx(h, arr, ctypes.sizeof(arr), ctypes.byref(needed), LIST_MODULES_ALL):
+                return None
+            n = needed.value // ctypes.sizeof(wt.HMODULE)
+            if n <= count:
+                break
+            count = n + 64
+        buf = ctypes.create_unicode_buffer(260)
+        names = []
+        for i in range(n):
+            if kernel32.K32GetModuleBaseNameW(h, arr[i], buf, 260):
+                names.append(buf.value)
+        return names
+    finally:
+        kernel32.CloseHandle(h)
+
+
+_device_map: list[tuple[str, str]] | None = None
+
+
+def _dos_devices() -> list[tuple[str, str]]:
+    global _device_map
+    if _device_map is None:
+        m = []
+        buf = ctypes.create_unicode_buffer(1024)
+        for letter in string.ascii_uppercase:
+            if kernel32.QueryDosDeviceW(f"{letter}:", buf, 1024):
+                m.append((buf.value + "\\", f"{letter}:\\"))
+        _device_map = m
+    return _device_map
+
+
+def device_to_dos(path: str) -> str:
+    for dev, drive in _dos_devices():
+        if path.startswith(dev):
+            return drive + path[len(dev):]
+    return path
+
+
+def _walk_regions(h) -> list[tuple[int, int, int, int, int, int]]:
+    """(base, size, state, type, protect, allocation_base) for every region."""
+    regions = []
+    mbi = MEMORY_BASIC_INFORMATION()
+    addr = 0
+    sz = ctypes.sizeof(mbi)
+    limit = 1 << 47 if ctypes.sizeof(ctypes.c_void_p) == 8 else 1 << 31
+    while addr < limit:
+        if not kernel32.VirtualQueryEx(h, ctypes.c_void_p(addr), ctypes.byref(mbi), sz):
+            break
+        base = mbi.BaseAddress or 0
+        size = mbi.RegionSize
+        regions.append((base, size, mbi.State, mbi.Type, mbi.Protect, mbi.AllocationBase or 0))
+        nxt = base + size
+        if nxt <= addr:
+            break
+        addr = nxt
+    return regions
+
+
+def _working_set(h) -> list[int] | None:
+    """Raw PSAPI_WORKING_SET_BLOCK values, or None on failure."""
+    ptr = ctypes.sizeof(ctypes.c_size_t)
+    count = 4096
+    for _ in range(6):
+        buf = (ctypes.c_size_t * (count + 1))()
+        if kernel32.K32QueryWorkingSet(h, buf, ctypes.sizeof(buf)):
+            n = buf[0]
+            return list(buf[1 : 1 + n])
+        if ctypes.get_last_error() != ERROR_BAD_LENGTH:
+            return None
+        count = int(buf[0] * 1.25) + 4096
+    return None
+
+
+def inspect(pid: int, name: str, *, top_files: int = 12) -> Inspection:
+    t0 = time.perf_counter()
+    ins = Inspection(pid=pid, name=name)
+    h = _open(pid, PROCESS_QUERY_INFORMATION | PROCESS_VM_READ)
+    if not h:
+        ins.error = "access denied (run elevated to inspect this process)"
+        return ins
+    try:
+        regions = _walk_regions(h)
+        name_buf = ctypes.create_unicode_buffer(1024)
+        file_of_alloc: dict[int, str | None] = {}
+
+        cats = {c: Category(c) for c in (CAT_HEAP, CAT_STACK, CAT_IMAGE, CAT_MAPPED, CAT_SHM)}
+        files: dict[str, FileMapping] = {}
+        reserved = 0
+        # Committed regions only, in address order, for page attribution.
+        starts: list[int] = []
+        spans: list[tuple[int, str, str | None]] = []  # (end, category, file path)
+
+        # Thread stacks: a private allocation that contains a PAGE_GUARD region.
+        stack_allocs = {ab for (_b, _s, st, ty, pr, ab) in regions if st == MEM_COMMIT and ty == MEM_PRIVATE and pr & PAGE_GUARD}
+
+        for base, size, state, typ, _prot, alloc in regions:
+            if state == MEM_RESERVE:
+                reserved += size
+                continue
+            if state != MEM_COMMIT:
+                continue
+            path = None
+            if typ == MEM_PRIVATE:
+                cat = CAT_STACK if alloc in stack_allocs else CAT_HEAP
+            else:
+                if alloc not in file_of_alloc:
+                    n = kernel32.K32GetMappedFileNameW(h, ctypes.c_void_p(base), name_buf, 1024)
+                    file_of_alloc[alloc] = device_to_dos(name_buf.value) if n else None
+                path = file_of_alloc[alloc]
+                if typ == MEM_IMAGE:
+                    cat = CAT_IMAGE
+                elif path:
+                    cat = CAT_MAPPED
+                else:
+                    cat = CAT_SHM  # pagefile-backed section: shared memory
+            c = cats[cat]
+            c.mapped += size
+            c.regions += 1
+            if path:
+                fm = files.get(path)
+                if fm is None:
+                    fm = files[path] = FileMapping(path, "image" if typ == MEM_IMAGE else "mapped")
+                fm.mapped += size
+            starts.append(base)
+            spans.append((base + size, cat, path))
+
+        ins.reserved = reserved
+        ins.evidence.append((MEASURED, f"{len(regions)} regions walked with VirtualQueryEx"))
+
+        ws = _working_set(h)
+        if ws is not None:
+            for c in cats.values():
+                c.resident = 0
+                c.resident_shared = 0
+            for fm in files.values():
+                fm.resident = 0
+            unattributed = 0
+            for entry in ws:
+                va = (entry >> 12) << 12
+                i = bisect.bisect_right(starts, va) - 1
+                if i < 0 or va >= spans[i][0]:
+                    unattributed += 1
+                    continue
+                _end, cat, path = spans[i]
+                c = cats[cat]
+                c.resident += PAGE_SIZE
+                if entry & 0x100:
+                    c.resident_shared += PAGE_SIZE
+                if path:
+                    files[path].resident += PAGE_SIZE
+            ins.evidence.append((DERIVED, f"{len(ws):,} resident pages attributed via QueryWorkingSet"))
+            if unattributed:
+                ins.evidence.append((DERIVED, f"{unattributed:,} resident pages are page tables / outside user regions"))
+        else:
+            ins.evidence.append((MEASURED, "working set detail unavailable; showing committed sizes only"))
+
+        ins.categories = [c for c in cats.values() if c.mapped]
+        key = (lambda f: f.resident or 0) if ws is not None else (lambda f: f.mapped)
+        ins.top_files = sorted(files.values(), key=key, reverse=True)[:top_files]
+        for f in ins.top_files:
+            f.path = _short_path(f.path)
+    finally:
+        kernel32.CloseHandle(h)
+    ins.elapsed = time.perf_counter() - t0
+    return ins
+
+
+def _short_path(p: str) -> str:
+    win = os.environ.get("SystemRoot", r"C:\Windows")
+    if p.lower().startswith(win.lower()):
+        return "%SystemRoot%" + p[len(win):]
+    return p

memtaskman-0.1.0.dist-info/METADATA

@@ -0,0 +1,186 @@
+Metadata-Version: 2.5
+Name: memtaskman
+Version: 0.1.0
+Summary: An htop for what's inside your RAM, not just how full it is.
+Author-email: Yogpod <yogpod332@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Environment :: Console
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Topic :: System :: Monitoring
+Requires-Python: >=3.11
+Requires-Dist: psutil>=5.9
+Requires-Dist: textual>=1.0
+Description-Content-Type: text/markdown
+
+# memtaskman
+
+[![CI](https://github.com/Yogpod/memtaskman/actions/workflows/ci.yml/badge.svg)](https://github.com/Yogpod/memtaskman/actions/workflows/ci.yml)
+
+An `htop` for what's **inside** your RAM, not just how full it is.
+
+Task Manager tells you Chrome uses 5 GB. memtaskman tells you which of those bytes are
+heap, which are DLL code shared with every other process, which are memory-mapped files
+(fonts, caches, model weights), which are thread stacks, and how much is actually resident
+versus merely committed. It also shows *where* the rest of your RAM is: standby cache,
+modified pages, the compression store, kernel pools and commit charge.
+
+Inspired by [gputaskman](https://github.com/shanselman/gputaskman), which does the same for VRAM.
+
+> Early, experimental software. Windows is the primary target, Linux is supported (tested on Ubuntu under WSL2), macOS
+> gets the basic psutil view without the address-space inspector.
+
+## What you get
+
+- **System bar**: RAM split into *In use / Modified / Standby / Free* (Windows) or
+  *In use / Cache / Free* (Linux), plus commit charge and swap/pagefile bars.
+- **Eight history charts**: RAM in use, commit, standby/cache, compressed, swap,
+  kernel pools, page faults/s and hard faults/s. `c` cycles to a single large chart.
+- **System panel**: available memory, modified/dirty, standby/page cache, kernel paged
+  and nonpaged pools (slab on Linux), compression store, driver-resident bytes, commit peak.
+- **Process table**: resident (working set / RSS), private commit (Windows) or anonymous
+  resident (Linux), a smoothed **growth rate** (a steadily positive number is what a leak
+  looks like), page faults/s, kernel pool or swap, and the identified **runtime**.
+  On Linux there is also a **PSS** column (resident memory with shared pages split fairly
+  between the processes sharing them, so the column sums to real RAM use), read from
+  `smaps_rollup` for the visible rows only. Other users' processes show `-` unless you run as root.
+- **Group by app** (`g`): every `chrome.exe`/`brave.exe`/`Discord.exe` summed into one row.
+- **Inspector** for the selected process, built from a page-level walk of its address space:
+
+  | Category            | Meaning                                                           |
+  |---------------------|-------------------------------------------------------------------|
+  | Private (heap/anon) | heaps, GC heaps, JIT code, anonymous mmap — memory only it owns   |
+  | Stacks              | thread stacks                                                     |
+  | Images              | exe / DLL / .so pages, mostly shared with other processes         |
+  | Mapped files        | memory-mapped files: font caches, databases, mmap'd model weights |
+  | Shared memory       | pagefile-backed sections, `/dev/shm`, memfd                       |
+
+  For each: bytes committed/mapped, bytes resident, and how many resident bytes are shared,
+  plus the largest file-backed mappings and the address space that is only reserved.
+
+### Runtime identification
+
+Runtimes are recognised from loaded modules, the executable and the command line, and every
+claim is tagged with how strong the evidence is: **measured** (OS counter), **derived**
+(computed by memtaskman), **identified** (from loaded modules), **hint** (a configured limit
+such as `-Xmx` or `--max-old-space-size`, which is not usage).
+
+Recognised: Chromium browsers and their process types (Chrome, Edge, Brave, Opera, Vivaldi,
+WebView2, Electron apps: renderer / gpu / utility:network …), Firefox, Java, .NET and
+.NET Framework (including chocolatey shims), Node.js / Bun / Deno, CPython (version from
+the DLL, PyTorch detection), local LLM servers (Ollama, llama.cpp, LM Studio, vLLM,
+Foundry Local), databases (SQL Server, PostgreSQL, MySQL, Redis, MongoDB …), hypervisor
+hosts (`vmmem`/`vmmemWSL`, QEMU, VMware, VirtualBox) and the Windows compression store.
+
+## Install & run
+
+```bash
+uv tool install .         # from a clone; or: pipx install .
+memtaskman                # or: mtm
+```
+
+Without installing:
+
+```bash
+uv run mtm
+```
+
+Run from an elevated terminal (or as root on Linux) to inspect processes owned by other users
+and services; otherwise those show "access denied" in the inspector but still appear in the table.
+
+## Keys
+
+| Key        | Action                                   |
+|------------|------------------------------------------|
+| ↑ / ↓      | select a process and inspect it          |
+| `s`        | cycle sort: resident, PSS (Linux), private, growth, faults, name, pid |
+| `g`        | group processes by executable            |
+| `a`        | top 50 / all processes                   |
+| `c`        | cycle charts (all, or one metric)        |
+| `m`        | slim mode (table only)                   |
+| `p`        | pause / resume                           |
+| `?`        | explanations of every counter            |
+| `q`        | quit                                     |
+
+## Command line
+
+```text
+mtm                         interactive TUI
+mtm -i 2                    sample every 2 seconds
+mtm --once [--top N|--all]  print a text report and exit
+mtm --json [--top N|--all]  print a JSON snapshot and exit
+mtm --no-system             skip system-wide counters
+mtm inspect PID [--json]    address-space breakdown of one process
+mtm record out.jsonl [-i 5] [-n COUNT] [--all]   append snapshots (JSON Lines)
+mtm diff a.json b.json      what grew, appeared or went away between snapshots
+```
+
+Tip: take both snapshots with `--all` before using `diff`, otherwise processes outside the
+top N look like they appeared or vanished.
+
+## How it measures
+
+| Source | Platform | Used for |
+|--------|----------|----------|
+| PDH `\Memory\*` counters | Windows | standby (3 priorities), modified, free+zero, cache, pools, fault rates |
+| `GetPerformanceInfo` | Windows | commit charge / limit / peak |
+| `GetProcessMemoryInfo` (via psutil) | Windows | working set, private commit, pools, fault counts |
+| `VirtualQueryEx` | Windows | every region: committed vs reserved, image / mapped / private, stacks (guard pages) |
+| `GetMappedFileName` | Windows | which file backs each image/mapped region |
+| `QueryWorkingSet` | Windows | every resident page and its shared bit, attributed back to regions |
+| `EnumProcessModulesEx` | Windows | loaded DLLs for runtime identification |
+| `/proc/meminfo`, `/proc/vmstat` | Linux | cache, dirty, slab, zswap, commit, fault rates |
+| `/proc/<pid>/status`, `stat` | Linux | RssAnon / RssFile / RssShmem, VmSwap, VmHWM, faults |
+| `/proc/<pid>/smaps_rollup` | Linux | PSS and USS (private clean + dirty) for visible rows, refreshed every 2 s at most |
+| `/proc/<pid>/smaps`, `maps` | Linux | per-mapping Rss / Shared / Swap, loaded libraries |
+
+Nothing reads the *contents* of another process's memory; only metadata about its pages.
+
+Caveats:
+
+- Resident totals in group mode double count pages shared between members (DLLs, shared
+  memory). Private totals do not overlap.
+- On Windows, *Private* is commit charge: it can exceed the working set when pages are
+  paged out or compressed.
+- The compression store is reported as the working set of the `MemCompression` process.
+- The inspector walk takes ~0.1-1 s for very large processes; it runs in the background and
+  refreshes every 5 seconds.
+
+## Development
+
+```bash
+uv sync
+uv run python -m unittest discover -s tests -v   # hardware-independent unit tests
+uv run python tools/smoke.py                      # live check: counters, inspector, TUI, every CLI command
+uv build
+```
+
+CI (`.github/workflows/ci.yml`) runs the unit tests and the smoke test on Windows, Linux and
+macOS with Python 3.11 and 3.14, then builds the wheel and runs it. To release, bump `version`
+in `pyproject.toml`, then push a matching tag (`git tag v0.2.0 && git push main v0.2.0`). The release
+workflow tests, builds, attaches the sdist and wheel to a GitHub release and publishes them
+to PyPI.
+
+Layout:
+
+```
+src/memtaskman/
+  app.py        Textual TUI
+  cli.py        argument parsing, --once / --json / inspect / record / diff
+  collector.py  sampling, growth & fault rates, runtime cache, group-by-app
+  win32.py      ctypes: PDH, GetPerformanceInfo, VirtualQueryEx, QueryWorkingSet, modules
+  linux.py      /proc parsers (pure) and readers
+  runtime.py    runtime identification from modules + command line (pure)
+  model.py      dataclasses shared by everything
+  report.py     text / JSON output
+  diff.py       snapshot comparison
+  fmt.py        byte & rate formatting
+tests/          hardware-independent unit tests
+tools/smoke.py  end-to-end check against the live machine (used by CI)
+```
+
+## License
+
+MIT

memtaskman-0.1.0.dist-info/RECORD

@@ -0,0 +1,17 @@
+memtaskman/__init__.py,sha256=nlqtUOtZtfy___GkpuegJVmpxqMy6-PDSmOAN2DTl_M,102
+memtaskman/__main__.py,sha256=K0PT5TequdVH7TjO-rNWrQ0JuYHjRWxVC83H6R70F80,58
+memtaskman/app.py,sha256=noVQXhdauHuuaAz5m08IH3tO-BJtAQCkC-2r_7kv-SI,22558
+memtaskman/cli.py,sha256=NcWxFzfMNh0oKu1O9-YqZXSJMHNJTh24xRSuFZUDwPk,4871
+memtaskman/collector.py,sha256=xqsiWuWyb1lqjFRmw2Kw__OipblJob_W5-2o2cKgNGo,15350
+memtaskman/diff.py,sha256=CMddnpJbNeF-U3kkOZ4CCDsuNl5PB1lvfbNgZOtUVvM,2380
+memtaskman/fmt.py,sha256=8qGLX-PhVbQRWNk0K15xwIJodbwYx0Nsh-JiZHsSym0,1868
+memtaskman/linux.py,sha256=5T8lNLXqk8FMayxQ9G0RajY8rkcIpbrfG-IVa3c0PXY,6336
+memtaskman/model.py,sha256=fMfF_CEBK4qpepNRBDlY4fEJNPkz642hH1_EqCCEE-Q,4817
+memtaskman/report.py,sha256=UO_tpYwVKE4wjTuDyunci94rdU8Vf4m8Jf00oNInEKI,3677
+memtaskman/runtime.py,sha256=PuqVwXINr8nB4fGfPiDKw65iXL8s_62qrJlDRskNHUA,9227
+memtaskman/win32.py,sha256=2T9BKXdc3WVwew7JKV9kDOOtdbiVgAXflpZFv2hI0Bc,14200
+memtaskman-0.1.0.dist-info/METADATA,sha256=FQRMPNG-tpQgR-i-VUtjBW7XFzXZRYFKyYJ90_HDoFs,9218
+memtaskman-0.1.0.dist-info/WHEEL,sha256=2iZrJkDIkeDh0k9SikKMqFuRP-ua6mb4Ir1AsER4BEw,87
+memtaskman-0.1.0.dist-info/entry_points.txt,sha256=tXi9SJjMmOYxmujVPSwkE9oEefC34flI_WT-uNEh074,77
+memtaskman-0.1.0.dist-info/licenses/LICENSE,sha256=jGvhYSbQYXhJE1EjsyhFCB0o1ygv8GVNGrQ2WEckJm8,1063
+memtaskman-0.1.0.dist-info/RECORD,,

memtaskman-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.33.0
+Root-Is-Purelib: true
+Tag: py3-none-any

memtaskman-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,3 @@
+[console_scripts]
+memtaskman = memtaskman.cli:main
+mtm = memtaskman.cli:main

memtaskman-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Yogpod
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.