Module proc_cache 

Proc Connector Process Cache + Process Tree

Two data structures:

• ProcCache: PID → {cmd, user, ppid, tgid} from Exec events (existing)
• PidTree: PID → {ppid, cmd} for ancestor lookups (new, handles Fork/Exec/Exit)

The PidTree is populated from three sources:

1. Startup snapshot: /proc/*/status → seed existing processes
2. Fork events: parent→child relationship (no cmd yet)
3. Exec events: update cmd for the child

Structs

CacheParams

Parameters for process caches (ProcCache and PidTree).

PidNode

A node in the process tree. cmd starts empty (from Fork) and fills on Exec.

ProcInfo

Cached process info: command name, user, ppid, tgid.

Constants

PID_TREE_CAP

Capacity for process tree cache.

PID_TREE_TTL_SECS

TTL for process tree entries.

PROC_CACHE_CAP

Capacity for process info cache. Covers typical active PID ranges with headroom.

PROC_CACHE_TTL_SECS

TTL for process info entries. Exited processes are evicted after this time.

Functions

build_chain

Build a chain string from the process tree. Format: “102|touch|root;101|sh|root;100|openclaw|root;1|systemd|root” Falls back to reading /proc if a PID is not in the tree.

handle_proc_events

Process proc connector events. Handles Exec (update ProcCache + PidTree cmd), Fork (insert PidTree), and Exit (optional, no cleanup needed for correct lookups).

is_descendant

Check if pid is a descendant of any process whose cmd == target_cmd. Walks up the tree via ppid until hitting root (pid=1, pid=0, self-loop, or cycle).

new_cache

Create a new ProcCache with the configured capacity and TTL.

new_cache_with

Create a ProcCache with explicit capacity and TTL overrides.

new_pid_tree

Create a new PidTree with the configured capacity and TTL.

new_pid_tree_with

Create a PidTree with explicit capacity and TTL overrides.

read_proc_start_time_ns

snapshot_process_tree

Snapshot all existing processes from /proc on daemon start. Reads /proc/*/status to seed the tree with current PIDs and their ppid/cmd.

try_create_connector

Type Aliases

PidTree

Shared process tree: PID → parent PID + cmd (bounded, TTL-based eviction).

ProcCache

Shared PID → ProcInfo cache (thread-safe, bounded, TTL-based eviction).