Skip to content

Conversation

@unclesp1d3r
Copy link
Member

Summary

  • Implements Ticket 1 of the procmond epic - Write-Ahead Log and EventBus Connector integration
  • Adds EventBusConnector with daemoneye-eventbus client integration for reliable event delivery
  • Adds event type persistence in WAL for correct topic routing during replay
  • Implements automatic reconnection with exponential backoff (100ms initial, 30s max, 2x multiplier)
  • Adds backpressure signaling (70% activation, 50% release thresholds)
  • Adds replay_entries() for recovering full WAL entries with metadata
  • Implements 10MB in-memory event buffer with overflow protection

Design

The WAL integration ensures crash-recoverable event delivery:

  1. Events are written to WAL with sequence numbers and event types
  2. If connected, events are published to the broker immediately
  3. On disconnect, events are buffered in memory (up to 10MB)
  4. On reconnect, WAL is replayed with proper sequence tracking

Test plan

  • All 85 unit tests pass
  • EventBusConnector tests verify buffering, backpressure, and WAL persistence
  • WAL tests verify event type persistence and replay_entries functionality
  • Clippy passes with zero warnings

🤖 Generated with Claude Code

Copilot AI review requested due to automatic review settings January 29, 2026 03:05
@dosubot dosubot bot added the size:XL This PR changes 500-999 lines, ignoring generated files. label Jan 29, 2026
@dosubot
Copy link

dosubot bot commented Jan 29, 2026

Related Documentation

Checked 21 published document(s) in 0 knowledge base(s). No updates required.

How did I do? Any feedback?  Join Discord

@coderabbitai
Copy link

coderabbitai bot commented Jan 29, 2026

Caution

Review failed

Failed to post review comments

Summary by CodeRabbit

  • New Features

    • Durable Write-Ahead Log (WAL) and reliable EventBus connector for persisted event delivery
    • Health subsystem with wait-for-healthy utilities and richer service health states
    • Enhanced macOS collection: entitlements, code-signing and bundle metadata support
  • Improvements

    • Switched serialization for internal messaging to a more compact format
    • Safer process-collection logic, overflow guards, and backpressure handling
    • Extensive documentation and specs for procmond flows and testing
  • Infrastructure

    • Tooling consolidation via mise; CI workflows and Rust toolchain updated

✏️ Tip: You can customize this high-level summary in your review settings.

Walkthrough

Adds a durable Write‑Ahead Log and WAL-backed EventBusConnector, migrates workspace serialization from bincode to postcard, expands procmond process‑collection surface (WAL, connector, macOS enhancements), introduces an agent health utility, and updates CI/tooling, manifests, and test/lint allowances.

Changes

Cohort / File(s) Summary
WAL subsystem
procmond/src/wal.rs
New public WAL API: append/write_with_type, rotation, CRC checks, length‑prefixed entries, replay, mark_published, WAL file discovery, and many unit tests.
EventBus connector
procmond/src/event_bus_connector.rs, procmond/src/lib.rs
New public EventBusConnector: WAL-integrated durable publish, 10MB in‑memory buffer, backpressure signalling, reconnection/backoff, WAL replay/drain; re-exported types.
Serialization migration (workspace)
Cargo.toml, collector-core/Cargo.toml, daemoneye-eventbus/Cargo.toml, daemoneye-eventbus/src/*, collector-core/src/*, */tests/*, */benches/*
Replaced bincode with postcard across manifests and code; updated (de)serialization call sites, tests, and benches to postcard::to_allocvec / postcard::from_bytes.
Eventbus & RPC runtime
daemoneye-eventbus/src/*, collector-core/src/*, daemoneye-eventbus/tests/*, collector-core/tests/*
Switched RPC/message (de)serialization to postcard; adjusted handlers, error paths, and test scaffolding; updated documented Message construction in RPC examples.
Procmond features & API surface
procmond/src/*, procmond/examples/*, procmond/benches/*, procmond/tests/*
Added event_bus_connector and wal modules, many public types and re‑exports, enums marked #[non_exhaustive], const ctors, macOS collector enhancements (entitlements, code signing, bundle info), and extensive tests.
Agent health utility & adoption
daemoneye-agent/src/health.rs, daemoneye-agent/src/{broker_manager,ipc_server,lib,main}.rs
New HealthState trait and wait_for_healthy helper; multiple components implement HealthState and health-check flows updated to use it.
CI/tooling & manifests
mise.toml, .github/workflows/*, .vscode/settings.json, justfile, .serena/project.yml
Added mise.toml; consolidated GitHub workflows to jdx/mise-action and checkout@v6; VSCode interpreter/tool paths; justfile now routes via mise_exec; changed project_name case.
Tests & lint allowances
procmond/tests/*, daemoneye-agent/tests/*, */examples/*, */benches/*
Widespread crate/module-level #![allow(...)] and #[allow(...)] added to tests/examples/benches; many tests adjusted for postcard and new APIs.
Docs & specs
spec/procmond/*, .claude/commands/*, daemoneye-eventbus/docs/*
Large spec/design additions for Procmond (epics, tech plans, tickets), small AI command template edits, and RPC docs updated for postcard and Message usage.
Miscellaneous code adjustments
daemoneye-lib/src/models/rule.rs, various crates
SELECT-only SQL match simplified, ownership/formatting and small control‑flow refinements, const ctor and signature tweaks, dependency reshuffles across crates.

Sequence Diagram(s)

sequenceDiagram
    participant App as Producer
    participant WAL as Write‑Ahead Log
    participant Buf as In‑Memory Buffer
    participant Connector as EventBusConnector
    participant Broker as Broker

    App->>WAL: write(event)
    WAL-->>App: seq_id

    alt Connector connected
        App->>Connector: publish(event, seq_id)
        Connector->>Broker: send_event
        Broker-->>Connector: ack
        Connector->>WAL: mark_published(seq_id)
        WAL-->>WAL: remove_published_files()
    else Connector disconnected
        App->>Buf: buffer(event, seq_id)
        Buf->>Buf: check_size()
        Buf-->>App: backpressure_signal if threshold crossed
    end

    loop reconnect & recovery
        Connector->>Broker: reconnect_attempt (with backoff)
        Broker-->>Connector: connected
        Connector->>WAL: replay_unpublished()
        loop replay entries
            Connector->>Broker: publish(entry)
            Broker-->>Connector: ack
            Connector->>WAL: mark_published(entry.seq)
        end
        Connector->>Buf: drain_buffer()
        Connector->>WAL: mark_published(drained.seq)
    end
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related PRs

Suggested labels

size:XXL

Poem

🐰 I nibble at the WAL by night,

postcards fold the data tight.
Buffers hum until the broker sings,
sequences saved on silver strings.
Hop — the connector guards the light.

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately and concisely summarizes the main change: implementing WAL and EventBus connector integration for procmond, which is the primary focus of this large changeset.
Description check ✅ Passed The description is well-organized and directly related to the changeset, covering the implementation of EventBusConnector, WAL integration, design rationale, and test validation results.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing touches
  • 📝 Generate docstrings
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch 39-featprocmond-implement-cross-platform-process-enumeration-with-enhanced-metadata-collection

Comment @coderabbitai help to get the list of available commands and usage tips.

@dosubot dosubot bot added integration Related to integration testing and component integration process-monitoring Process monitoring and enumeration features procmond Issues related to the process monitoring daemon labels Jan 29, 2026
@qltysh
Copy link
Contributor

qltysh bot commented Jan 29, 2026

❌ 1 blocking issue (82 total)

Tool Category Rule Count
rustfmt Style Incorrect formatting, autoformat by running qlty fmt. 1
markdownlint Style Emphasis used instead of a heading 63
qlty Duplication Found 26 lines of identical code in 2 locations (mass = 67) 3
qlty Structure High total complexity (count = 65) 2
qlty Duplication Found 24 lines of similar code in 2 locations (mass = 98) 10
qlty Structure Function with high complexity (count = 18): replay_wal 1
qlty Structure Function with many returns (count = 8): is_system_process 1
markdownlint Style Fenced code blocks should have a language specified 1

@qltysh one-click actions:

  • Auto-fix formatting (qlty fmt && git push)

"WAL replay completed"
);

Ok(replayed.saturating_add(buffer_flushed))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Function with high complexity (count = 18): replay_wal [qlty:function-complexity]

assert_eq!(events.len(), 5);
}
}
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

High total complexity (count = 75) [qlty:file-complexity]

@coderabbitai coderabbitai bot added configuration Configuration management and settings documentation Improvements or additions to documentation size:XXL This PR changes 1000+ lines, ignoring generated files. labels Jan 29, 2026
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Implements procmond’s crash-recoverable event delivery by integrating a Write-Ahead Log (WAL) and an EventBus connector, along with supporting infrastructure updates across the workspace.

Changes:

  • Added/extended procmond event durability + delivery mechanics (WAL + broker connector, buffering/backpressure, replay).
  • Migrated EventBus/RPC/task/message serialization across daemoneye-eventbus + collector-core from bincode to postcard.
  • Updated specs/ticket docs and adjusted tests/benchmarks/lints to align with the new architecture and stricter workspace linting.

Reviewed changes

Copilot reviewed 73 out of 74 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
spec/procmond/tickets/Validate_Performance_and_Optimize.md Adds perf validation/optimization ticket details for the epic.
spec/procmond/tickets/Validate_FreeBSD_Platform_Support.md Adds FreeBSD validation ticket details and expectations.
spec/procmond/tickets/Implement_Write-Ahead_Log_and_Event_Bus_Connector.md Documents WAL + connector requirements/acceptance criteria.
spec/procmond/tickets/Implement_Security_Hardening_and_Data_Sanitization.md Adds security hardening/sanitization ticket details.
spec/procmond/tickets/Implement_RPC_Service_and_Registration_Manager_(procmond).md Adds RPC/registration/heartbeat ticket details.
spec/procmond/tickets/Implement_Comprehensive_Test_Suite.md Adds comprehensive testing strategy ticket details.
spec/procmond/tickets/Implement_Agent_Loading_State_and_Heartbeat_Detection.md Adds agent loading/heartbeat detection ticket details.
spec/procmond/tickets/Implement_Actor_Pattern_and_Startup_Coordination.md Adds actor/startup coordination ticket details.
spec/procmond/specs/Epic_Brief__Complete_Procmond_Implementation.md Adds/updates epic brief content for overall procmond plan.
spec/procmond/specs/Core_Flows__Procmond_Process_Monitoring.md Adds/updates detailed operational flows and failure handling.
spec/procmond/index.md Updates ticket index/status to reflect current epic progress.
procmond/tests/property_based_process_tests.rs Updates test docs + adds lint overrides for property-based tests.
procmond/tests/process_enumeration_edge_cases.rs Updates test docs + adds lint overrides for edge-case tests.
procmond/tests/privilege_management_tests.rs Updates test docs + adds lint overrides; adjusts privilege detection helper.
procmond/tests/os_compatibility_tests.rs Updates docs + lint overrides for OS compatibility tests.
procmond/tests/os_compatibility_comprehensive_tests.rs Updates docs + lint overrides for comprehensive OS tests.
procmond/tests/macos_integration_tests.rs Adds lint overrides and doc cleanup for macOS integration tests.
procmond/tests/macos_enhanced_integration_tests.rs Adds lint overrides and doc cleanup for enhanced macOS tests.
procmond/tests/linux_integration_tests.rs Doc tweak + lint overrides for Linux integration tests.
procmond/tests/lifecycle_integration_tests.rs Doc tweaks + lint overrides for lifecycle integration tests.
procmond/tests/integration_tests.rs Doc tweaks + lint overrides for integration tests.
procmond/tests/cross_platform_integration_tests.rs Doc tweaks + lint overrides for cross-platform integration tests.
procmond/src/process_collector.rs Makes error types non-exhaustive; hardens conversions/overflow handling; refactors iteration.
procmond/src/monitor_collector.rs Refactors timer strings, backpressure/circuit breaker bookkeeping, and constructor signature.
procmond/src/main.rs Improves error formatting and replaces stdout prints with structured logging in places.
procmond/src/macos_collector.rs Makes error enum non-exhaustive; refactors conversions; adds/adjusts lint attributes.
procmond/src/lifecycle.rs Makes enums non-exhaustive; refactors stats math/overflow handling; minor API tweaks.
procmond/src/lib.rs Exposes new modules/exports; refines task handling error formatting and timestamp conversions.
procmond/src/event_source.rs Refactors batching/backpressure logic, stats updates, and logging; adds defensive checks.
procmond/examples/process_collector_usage.rs Doc tweaks + lint overrides in the example.
procmond/benches/process_collector_benchmarks.rs Doc tweaks + lint overrides for benchmarks.
procmond/Cargo.toml Adds eventbus dependency, updates lints to workspace config, adjusts deps.
mise.toml Adds mise toolchain configuration (rust/protoc/etc).
daemoneye-lib/src/models/rule.rs Simplifies statement validation logic and future-proofs enum matching.
daemoneye-eventbus/tests/rpc_integration_tests.rs Switches RPC serialization test cases to postcard.
daemoneye-eventbus/src/task_distribution.rs Switches task serialization to postcard.
daemoneye-eventbus/src/rpc.rs Switches RPC request/response serialization to postcard.
daemoneye-eventbus/src/message.rs Switches message serialization/deserialization to postcard.
daemoneye-eventbus/src/client.rs Switches client-side event serialization to postcard.
daemoneye-eventbus/src/broker.rs Switches broker-side decode/encode paths to postcard.
daemoneye-eventbus/benches/throughput.rs Updates serialization benchmarks to postcard.
daemoneye-eventbus/Cargo.toml Replaces bincode dependency with postcard.
daemoneye-cli/tests/cli.rs Minor formatting update in test error output.
daemoneye-cli/src/main.rs Adds lint override for intentional stdout printing; minor doc tweak.
daemoneye-cli/Cargo.toml Cleans up dependencies; adopts workspace lints.
daemoneye-agent/tests/rpc_lifecycle_integration.rs Adds lint overrides for integration tests.
daemoneye-agent/tests/rpc_collector_management_integration.rs Adds lint overrides for integration tests.
daemoneye-agent/tests/dual_protocol_integration.rs Adds lint overrides for integration tests.
daemoneye-agent/tests/cli.rs Adds lint overrides for CLI test.
daemoneye-agent/tests/broker_integration.rs Adds lint overrides for broker integration tests.
daemoneye-agent/src/main.rs Refactors logging/printing, minor robustness improvements in loop counters and formatting.
daemoneye-agent/src/lib.rs Docstring backtick/wording tweaks.
daemoneye-agent/src/ipc_server.rs Makes health enum non-exhaustive; refactors state updates and error strings.
daemoneye-agent/src/collector_registry.rs Makes error enum non-exhaustive; small refactors/ownership cleanups.
daemoneye-agent/src/broker_manager.rs Makes health enum non-exhaustive; refactors state transitions and string handling.
daemoneye-agent/examples/dual_protocol_demo.rs Adds lint overrides in example.
daemoneye-agent/Cargo.toml Cleans up dependencies; adopts workspace lints.
collector-core/tests/rpc_server_integration.rs Switches RPC serialization to postcard in tests.
collector-core/tests/daemoneye_eventbus_ipc_integration.rs Switches event serialization to postcard in tests.
collector-core/src/task_distributor.rs Switches distribution payload serialization to postcard.
collector-core/src/rpc_services.rs Switches RPC service serialization to postcard.
collector-core/Cargo.toml Replaces bincode with postcard; removes now-unused deps.
Cargo.toml Updates workspace dependencies/versions and centralizes workspace lints.
.vscode/settings.json Adds ruff/python interpreter configuration to workspace settings.
.serena/project.yml Updates supported language list/comments and project_name.
.claude/commands/review-tests.md Adds/updates Claude command docs for reviewing tests.
.claude/commands/review-simplicity.md Normalizes formatting/content for simplification review command.
.claude/commands/review-performance.md Normalizes formatting/content for performance review command.
.claude/commands/review-dependencies.md Normalizes formatting/content for dependency review command.
.claude/commands/review-architecture.md Normalizes formatting/content for architecture review command.

Comment on lines +449 to +455
/// # Backoff Strategy
///
/// - Initial delay: 100ms
/// - Maximum delay: 30 seconds
/// - Multiplier: 2x per attempt
/// - Jitter: ±10%
async fn try_reconnect(&mut self) -> EventBusConnectorResult<bool> {
Copy link

Copilot AI Jan 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The backoff docs claim a jitter of ±10%, but the implementation only computes delay_ms as min(MIN_BACKOFF_MS * 2^attempt, MAX_BACKOFF_MS) with no jitter applied. Either implement jitter (to avoid thundering herd reconnects) or update the doc comment to match the actual behavior.

Copilot uses AI. Check for mistakes.
unclesp1d3r and others added 7 commits January 28, 2026 23:05
Add enhanced process enumeration with platform-specific collectors, crash-safe WAL, and migrate IPC serialization to postcard for smaller payloads; update dependencies and tighten lints to improve reliability and performance.
Updated the review command markdown files to clarify instructions, add steps for making refactoring changes, and emphasize running `just ci-check` after changes. Added a new review-tests.md file to standardize test coverage review. Improved formatting and detail for clarity and consistency across all review command files.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
Expanded the list of supported language servers in the project configuration, adding languages such as fsharp, groovy, pascal, powershell, and toml. Updated the project name from 'DaemonEye' to 'daemoneye' for consistency.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
Introduces detailed specification, epic brief, and technical planning documents for the complete implementation of procmond. These documents cover user flows, architectural decisions, platform support, security, performance, testing, and integration with daemoneye-agent.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
Implements Ticket 1 of the procmond epic - Write-Ahead Log and
EventBus Connector integration for reliable event delivery.

Key changes:
- Add EventBusConnector with daemoneye-eventbus client integration
- Add event type persistence in WAL for correct topic routing on replay
- Implement automatic reconnection with exponential backoff
- Add backpressure signaling (70% activation, 50% release thresholds)
- Add replay_entries() for recovering full WAL entries with metadata
- Implement 10MB in-memory event buffer with overflow protection

The WAL integration ensures crash-recoverable event delivery:
1. Events are written to WAL with sequence numbers and event types
2. If connected, events are published to the broker
3. On disconnect, events are buffered in memory
4. On reconnect, WAL is replayed with proper sequence tracking

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@unclesp1d3r unclesp1d3r force-pushed the 39-featprocmond-implement-cross-platform-process-enumeration-with-enhanced-metadata-collection branch from 8df8a29 to 6cca7b4 Compare January 29, 2026 04:05
@dosubot dosubot bot added size:XL This PR changes 500-999 lines, ignoring generated files. and removed size:XL This PR changes 500-999 lines, ignoring generated files. size:XXL This PR changes 1000+ lines, ignoring generated files. labels Jan 29, 2026
Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
…flows

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
"WAL replay completed"
);

Ok(replayed.saturating_add(buffer_flushed))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Function with high complexity (count = 18): replay_wal [qlty:function-complexity]

assert_eq!(events.len(), 5);
}
}
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

High total complexity (count = 61) [qlty:file-complexity]

} else {
None
};
// TODO: Implement start time parsing from /proc/[pid]/stat jiffies
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

// TODO: Implement start time parsing from /proc/[pid]/stat jiffies [ripgrep:TODO]

.await
.map_err(|e| ProcessCollectionError::SystemEnumerationFailed {
message: format!("Process enumeration task failed: {}", e),
message: format!("Process enumeration task failed: {e}"),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 20 lines of similar code in 2 locations (mass = 85) [qlty:similar-code]

.await
.map_err(|e| ProcessCollectionError::SystemEnumerationFailed {
message: format!("Process lookup task failed: {}", e),
message: format!("Process lookup task failed: {e}"),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 20 lines of similar code in 2 locations (mass = 85) [qlty:similar-code]

- **Implementation**: Events persisted to disk before buffering, replayed on restart if procmond crashes
- **Risk Mitigation**: Bounded buffer size, WAL rotation to prevent disk exhaustion, backpressure when buffer full

**Trade-off 3: Privilege Model**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

- **Rationale**: procmond needs persistent elevated access; agent has larger attack surface (network connectivity)
- **Risk Mitigation**: procmond has no network access, minimal attack surface, runs as child process (isolated)

**Trade-off 4: FreeBSD Support Level**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]


### 4. Technical Constraints

**Platform Constraints**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

- Must respect platform security boundaries (SELinux, AppArmor, SIP, UAC)
- Must use platform-native APIs for process enumeration

**Performance Constraints**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

- Process enumeration \<100ms for 1,000 processes (average)
- Event publishing must handle backpressure gracefully

**Security Constraints**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

@coderabbitai coderabbitai bot added the size:XXL This PR changes 1000+ lines, ignoring generated files. label Jan 29, 2026
@codecov
Copy link

codecov bot commented Jan 29, 2026

- Refactor IpcServerManager::wait_for_healthy to use shared
  health::wait_for_healthy helper, eliminating code duplication
  with BrokerManager
- Fix markdown formatting in Core_Flows spec: proper indentation
  for nested lists (MD007), blank lines around lists (MD032)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@dosubot dosubot bot added size:XL This PR changes 500-999 lines, ignoring generated files. and removed size:XL This PR changes 500-999 lines, ignoring generated files. size:XXL This PR changes 1000+ lines, ignoring generated files. labels Jan 30, 2026

fn service_name() -> &'static str {
"Broker"
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 24 lines of similar code in 2 locations (mass = 98) [qlty:similar-code]


fn service_name() -> &'static str {
"IPC server"
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 24 lines of similar code in 2 locations (mass = 98) [qlty:similar-code]

assert_eq!(metadata.max_sequence, 5, "Max sequence should be 5");
assert_eq!(metadata.entry_count, 5, "Should have 5 entries");
}
}
Copy link
Contributor

@qltysh qltysh bot Jan 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

High total complexity (count = 99) [qlty:file-complexity]

}
```

**Heartbeat Message**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

}
```

**Process Event Message**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]


### 1. New Components

**WriteAheadLog (New)**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

- Handle WAL corruption (skip corrupted entries with CRC32 validation, log warning, continue)
- Track which events have been published (mark for deletion)

**EventBusConnector (New)**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

- Calculate new interval: current_interval * 1.5 (50% increase)
- Release backpressure when buffer drops below 50% (send AdjustInterval with original interval)

**RpcServiceHandler (New)**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

@coderabbitai coderabbitai bot added the size:XXL This PR changes 1000+ lines, ignoring generated files. label Jan 30, 2026
unclesp1d3r and others added 2 commits January 29, 2026 22:44
- Add start_time calculation for Linux collector by parsing starttime
  jiffies from /proc/[pid]/stat and converting using boot time from
  /proc/stat
- Fix /proc/[pid]/stat parsing to handle comm field with spaces by
  finding the last ')' before parsing subsequent fields
- Replace unsafe `as_millis() as u64` casts with `u64::try_from().unwrap_or(u64::MAX)`
  across all collectors for safer overflow handling
- Improve lifecycle tracker cleanup documentation and warning messages
- Remove unused `_platform_name` variable in FallbackProcessCollector

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Critical fixes:
- Add missing boot_time_secs and clock_ticks_per_sec fields to
  LinuxProcessCollector Clone impl
- Change WalError sequence types from u32 to u64 for consistency
  with WalEntry

Important fixes:
- Log reconnection errors at debug level instead of dropping silently
- Log backpressure signal send failures at debug level
- Log WAL file scanning failures during initialization
- Add #[non_exhaustive] to WindowsCollectionError for consistency
- Document shutdown() as best-effort (errors logged but not propagated)

Suggestions implemented:
- Add WAL replay failure count summary with warning when files fail
- Add invalid_start_events counter to LifecycleTrackingStats
- Track and log invalid lifecycle start events

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@dosubot dosubot bot added size:XL This PR changes 500-999 lines, ignoring generated files. and removed size:XL This PR changes 500-999 lines, ignoring generated files. size:XXL This PR changes 1000+ lines, ignoring generated files. labels Jan 30, 2026
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
"WAL replay completed"
);

Ok(replayed.saturating_add(buffer_flushed))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Function with high complexity (count = 18): replay_wal [qlty:function-complexity]

assert_eq!(events.len(), 5);
}
}
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

High total complexity (count = 65) [qlty:file-complexity]

pub invalid_start_events: u64,

/// Average number of processes tracked per update
pub avg_processes_tracked: f64,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 28 lines of similar code in 3 locations (mass = 67) [qlty:similar-code]

.await
.map_err(|e| ProcessCollectionError::SystemEnumerationFailed {
message: format!("Process enumeration task failed: {}", e),
message: format!("Process enumeration task failed: {e}"),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 20 lines of similar code in 2 locations (mass = 85) [qlty:similar-code]

.await
.map_err(|e| ProcessCollectionError::SystemEnumerationFailed {
message: format!("Process lookup task failed: {}", e),
message: format!("Process lookup task failed: {e}"),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 20 lines of similar code in 2 locations (mass = 85) [qlty:similar-code]

- **MonitorCollector trait**: Provides statistics and health check interface
- **ProcessEvent**: Standard event format for process data

**AgentCollectorConfig (New)**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]


### 6. daemoneye-agent Enhancements Required

**Collector Configuration Loading (New)**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

- Spawn collectors in order defined in configuration file
- Pass collector-specific configuration via environment variables or config files

**Loading State Management (New)**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

- Transition command: Broadcast "begin monitoring" to `control.collector.lifecycle` when entering steady state
- Timeout: If collectors don't report ready within timeout (60s default), fail startup with error

**Heartbeat Failure Detection (Enhanced)**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

- Log all recovery actions for operator visibility
- Emit alerts for repeated collector failures (e.g., 3+ restarts in 10 minutes)

**Configuration Push (Enhanced)**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]


fn service_name() -> &'static str {
"Broker"
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 24 lines of similar code in 2 locations (mass = 98) [qlty:similar-code]


fn service_name() -> &'static str {
"IPC server"
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 24 lines of similar code in 2 locations (mass = 98) [qlty:similar-code]

assert_eq!(metadata.max_sequence, 5, "Max sequence should be 5");
assert_eq!(metadata.entry_count, 5, "Should have 5 entries");
}
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

High total complexity (count = 99) [qlty:file-complexity]

clippy::clone_on_ref_ptr,
clippy::as_conversions,
clippy::redundant_clone,
clippy::str_to_string
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 26 lines of similar code in 2 locations (mass = 52) [qlty:similar-code]

clippy::single_match_else,
clippy::clone_on_ref_ptr,
clippy::let_underscore_must_use,
clippy::ignored_unit_patterns
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 26 lines of similar code in 2 locations (mass = 52) [qlty:similar-code]

- **Implementation**: Events persisted to disk before buffering, replayed on restart if procmond crashes
- **Risk Mitigation**: Bounded buffer size, WAL rotation to prevent disk exhaustion, backpressure when buffer full

**Trade-off 3: Privilege Model**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

- **Rationale**: procmond needs persistent elevated access; agent has larger attack surface (network connectivity)
- **Risk Mitigation**: procmond has no network access, minimal attack surface, runs as child process (isolated)

**Trade-off 4: FreeBSD Support Level**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]


### 4. Technical Constraints

**Platform Constraints**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

- Must respect platform security boundaries (SELinux, AppArmor, SIP, UAC)
- Must use platform-native APIs for process enumeration

**Performance Constraints**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

- Process enumeration \<100ms for 1,000 processes (average)
- Event publishing must handle backpressure gracefully

**Security Constraints**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

The rustdoc was interpreting [pid] in `/proc/[pid]/stat` as a link.
Escaped brackets with backslashes to prevent this.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
"WAL replay completed"
);

Ok(replayed.saturating_add(buffer_flushed))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Function with high complexity (count = 18): replay_wal [qlty:function-complexity]

assert_eq!(events.len(), 5);
}
}
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

High total complexity (count = 65) [qlty:file-complexity]

pub invalid_start_events: u64,

/// Average number of processes tracked per update
pub avg_processes_tracked: f64,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 28 lines of similar code in 3 locations (mass = 67) [qlty:similar-code]

.await
.map_err(|e| ProcessCollectionError::SystemEnumerationFailed {
message: format!("Process enumeration task failed: {}", e),
message: format!("Process enumeration task failed: {e}"),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 20 lines of similar code in 2 locations (mass = 85) [qlty:similar-code]

.await
.map_err(|e| ProcessCollectionError::SystemEnumerationFailed {
message: format!("Process lookup task failed: {}", e),
message: format!("Process lookup task failed: {e}"),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 20 lines of similar code in 2 locations (mass = 85) [qlty:similar-code]

}
```

**Heartbeat Message**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

}
```

**Process Event Message**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]


### 1. New Components

**WriteAheadLog (New)**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

- Handle WAL corruption (skip corrupted entries with CRC32 validation, log warning, continue)
- Track which events have been published (mark for deletion)

**EventBusConnector (New)**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

- Calculate new interval: current_interval * 1.5 (50% increase)
- Release backpressure when buffer drops below 50% (send AdjustInterval with original interval)

**RpcServiceHandler (New)**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

@coderabbitai coderabbitai bot added the size:XXL This PR changes 1000+ lines, ignoring generated files. label Jan 30, 2026
- Change get_clock_ticks_per_sec to const fn returning u64 directly
  instead of Option<u64> (missing_const_for_fn, unnecessary_wraps)
- Use safe string slicing with .get() to avoid potential panic on
  UTF-8 character boundaries (string_slice)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@dosubot dosubot bot added size:XL This PR changes 500-999 lines, ignoring generated files. and removed size:XL This PR changes 500-999 lines, ignoring generated files. size:XXL This PR changes 1000+ lines, ignoring generated files. labels Jan 30, 2026

fn service_name() -> &'static str {
"Broker"
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 24 lines of similar code in 2 locations (mass = 98) [qlty:similar-code]


fn service_name() -> &'static str {
"IPC server"
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 24 lines of similar code in 2 locations (mass = 98) [qlty:similar-code]

@@ -0,0 +1,1774 @@
//! Write-Ahead Log (WAL) for crash recovery and event persistence.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Incorrect formatting, autoformat by running qlty fmt. [rustfmt:fmt]

assert_eq!(metadata.max_sequence, 5, "Max sequence should be 5");
assert_eq!(metadata.entry_count, 5, "Should have 5 entries");
}
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

High total complexity (count = 99) [qlty:file-complexity]

clippy::clone_on_ref_ptr,
clippy::as_conversions,
clippy::redundant_clone,
clippy::str_to_string
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 26 lines of similar code in 2 locations (mass = 52) [qlty:similar-code]

- **MonitorCollector trait**: Provides statistics and health check interface
- **ProcessEvent**: Standard event format for process data

**AgentCollectorConfig (New)**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]


### 6. daemoneye-agent Enhancements Required

**Collector Configuration Loading (New)**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

- Spawn collectors in order defined in configuration file
- Pass collector-specific configuration via environment variables or config files

**Loading State Management (New)**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

- Transition command: Broadcast "begin monitoring" to `control.collector.lifecycle` when entering steady state
- Timeout: If collectors don't report ready within timeout (60s default), fail startup with error

**Heartbeat Failure Detection (Enhanced)**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

- Log all recovery actions for operator visibility
- Emit alerts for repeated collector failures (e.g., 3+ restarts in 10 minutes)

**Configuration Push (Enhanced)**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Emphasis used instead of a heading [markdownlint:MD036]

@coderabbitai coderabbitai bot added the size:XXL This PR changes 1000+ lines, ignoring generated files. label Jan 30, 2026
@unclesp1d3r unclesp1d3r self-assigned this Jan 30, 2026
@unclesp1d3r unclesp1d3r merged commit 3a90019 into main Jan 30, 2026
20 of 21 checks passed
@unclesp1d3r unclesp1d3r deleted the 39-featprocmond-implement-cross-platform-process-enumeration-with-enhanced-metadata-collection branch January 30, 2026 13:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

configuration Configuration management and settings documentation Improvements or additions to documentation integration Related to integration testing and component integration process-monitoring Process monitoring and enumeration features procmond Issues related to the process monitoring daemon size:XL This PR changes 500-999 lines, ignoring generated files. size:XXL This PR changes 1000+ lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat(procmond): Implement cross-platform process enumeration with enhanced metadata collection

2 participants