ptop 1.1.0

Linux binaries (amd64 / arm64) with eBPF collectors embedded.
Requires kernel 5.8+ with BTF, and either root or CAP_BPF + CAP_PERFMON.

Integrity verification

sha256sum -c SHA256SUMS

Installation

curl -L https://github.com/trentas/ptop/releases/download/v1.1.0/ptop-1.1.0-linux-amd64.tar.gz | tar xz
sudo install ptop /usr/local/bin/
sudo ptop --pid <PID>

Changelog

Features

• 1ca5536: feat(bpf): add namespace-aware target resolver (@trentas)
• 4a540b1: feat: add ebpf-selftest diagnostic tool (@trentas)

Bug fixes

• 445c80f: fix(bpf): namespace-aware pid filter for cpu collector (@trentas)
• 8766978: fix(bpf): namespace-aware pid filter for futex collector (@trentas)
• c8828a6: fix(bpf): namespace-aware pid filter for io collector (@trentas)
• bd2689b: fix(bpf): namespace-aware pid filter for memory collector (@trentas)
• 7e7a481: fix(bpf): namespace-aware pid filter for network collector (@trentas)
• 0d45e91: fix(bpf): namespace-aware pid filter for syscalls collector (@trentas)
• a679d61: fix(bpf): namespace-aware pid filter for threads collector (@trentas)

Collectors

• 2796ebe: collector: extract reusable Set for source selection + lifecycle (@trentas)
• c1813c0: collector: move internal/collector → pkg/collector (@trentas)

TUI

• 3a90186: tui: F3 network anomalies panel for net errors (#56) (@trentas)
• ecdb176: tui: decouple render from data ingestion + pprof flag (@trentas)
• 3d883d9: tui: detect the inspected process's runtime for the header badge (@trentas)
• 16551af: tui: report the real kernel version in the status bar, drop fake overhead (@trentas)

Other

• 89366d6: Fix formatting in README.md (@trentas)
• e3d27d6: Merge pull request #50 from trentas/fix/ebpf-pidns (@trentas)
• fd63032: Merge pull request #62 from trentas/macos-net-tx-rx (@trentas)
• 6b51b53: Merge pull request #65 from trentas/feat/collector-set-foundation (@trentas)
• 3820de5: Merge pull request #67 from trentas/feat/proto-schema (@trentas)
• b891abe: Merge pull request #68 from trentas/feat/pkg-collector (@trentas)
• 3a791c0: Merge pull request #69 from trentas/feat/serve-grpc (@trentas)
• 88b4287: Merge pull request #70 from trentas/feat/serve-sinks (@trentas)
• 3641b5a: Merge pull request #73 from trentas/feat/heap-malloc-pairing (@trentas)
• 99be88c: Merge pull request #74 from trentas/feat/heap-tui (@trentas)
• 2611130: Merge pull request #75 from trentas/feat/symbol (@trentas)
• 1f6adc1: Merge pull request #76 from trentas/feat/symbol-heap (@trentas)
• 74acf8e: Merge pull request #77 from trentas/feat/symbol-stream (@trentas)
• 0b84483: Merge pull request #78 from trentas/feat/net-errors (@trentas)
• 2ddad95: Merge pull request #79 from trentas/feat/net-errors-tui (@trentas)
• 6290853: Merge pull request #80 from trentas/feat/fs-semantics (@trentas)
• 94d1bc2: Merge pull request #81 from trentas/feat/signals (@trentas)
• b71bfbd: Merge pull request #82 from trentas/feat/tls-payload (@trentas)
• 47aa942: Merge pull request #83 from trentas/feat/proc-context (@trentas)
• f0e93d0: Merge pull request #84 from trentas/feat/proc-lineage (@trentas)
• d9c16f2: Merge pull request #85 from trentas/feat/security-events (@trentas)
• 368f63e: Merge pull request #86 from trentas/docs/refresh-after-epic-52 (@trentas)
• 17ae215: Merge pull request #87 from trentas/feat/threads-offcpu (@trentas)
• d8c5381: Merge pull request #88 from trentas/perf/tui-render-decouple (@trentas)
• 59ddb84: context: capture namespace/cgroup + uid/gid execution context (#60) (@trentas)
• ae6b9fd: docs(bpf): document threads root2ns/prune design decisions (@trentas)
• 4f92a28: docs(bpf): refresh stale cpu.bpf.c header comment (@trentas)
• 12102ef: docs(bpf): refresh stale syscalls.bpf.c map comment (@trentas)
• 9d5f6c2: heap: F1 live-heap panel — sparkline + top call sites + leak (#53) (@trentas)
• 157533b: heap: libc malloc/free pairing, live-heap + leak signal (#53) (@trentas)
• d3a5da0: io: capture filesystem semantics — denials, deletes, renames (#57) (@trentas)
• efa3db5: lineage: capture exec lineage (fork/exec/exit) via sched tracepoints (#60) (@trentas)
• bd2c8e7: macos: add Tier 1 port via libproc + Mach (closes #22) (@trentas)
• 5c1a35e: macos: audit cleanup — dead code, iowait bias, collector tests (@trentas)
• 815b83d: macos: fix F3 connection ordering and stop lying in the chrome (@trentas)
• f998d87: macos: surface socket Tx/Rx and add F3 TX/RX column (@trentas)
• 726c311: make: add install / install-ebpf / uninstall targets (@trentas)
• b8d94fb: network: capture RST/retransmit errors on the event stream (#56) (@trentas)
• c411241: proc.bpf.c: fix sched_process_fork field offsets (__data_loc comm) (@trentas)
• 6aa1325: refactor(ebpfselftest): run() pattern so tracer Close() always runs (@trentas)
• b5ef3e3: security: capture runtime PROT_EXEC mappings + LSM denials (#59) (@trentas)
• fdefd38: serve: StackRef on heap events + ResolveStack RPC (#54) (@trentas)
• 41a626b: serve: headless ptop --serve gRPC event stream server (@trentas)
• fcd47fe: serve: integration test for backpressure StreamMeta over gRPC (@trentas)
• 35de8b9: serve: rename service EventStream → EventStreamService (buf lint) (@trentas)
• 517ab62: serve: sink abstraction + JSONL export; close #51 (@trentas)
• 6f269ee: signal: capture signals delivered to the target, with origin (#58) (@trentas)
• 930b962: streampb: event stream protobuf schema + buf codegen (@trentas)
• 3a59a73: symbol: ELF/gosym symbolization core (pkg/symbol) (#54) (@trentas)
• 6947985: symbol: resolve heap call sites to func (file:line) (#54) (@trentas)
• ed4dea6: test(bpf): assert targetFilter field offsets (@trentas)
• 71cdd34: threads: surface per-thread off-CPU% in F4 (#61) (@trentas)
• 3a8adf6: tls: capture pre-encryption payload via libssl uprobes (#55) (@trentas)

ptop 1.0.0

Linux binaries (amd64 / arm64) with eBPF collectors embedded.
Requires kernel 5.8+ with BTF, and either root or CAP_BPF + CAP_PERFMON.

Integrity verification

sha256sum -c SHA256SUMS

Installation

curl -L https://github.com/trentas/ptop/releases/download/v1.0.0/ptop-1.0.0-linux-amd64.tar.gz | tar xz
sudo install ptop /usr/local/bin/
sudo ptop --pid <PID>

Changelog

Other

• 0466d25: initial commit (Fabio Wakim Trentini trentas@gmail.com)

xray 0.1.0

Binários cross-compiled para Linux (amd64/arm64) e macOS (amd64/arm64).

Verificação de integridade

sha256sum -c SHA256SUMS

Instalação

curl -L https://github.com/trentas/xray/releases/download/v0.1.0/xray-0.1.0-linux-amd64.tar.gz | tar xz
sudo install xray /usr/local/bin/
xray --pid <PID> --no-ebpf

Changelog

Collectors

• c8f6e5f: collector: CPU/threads/memória via /proc (closes #18) (#24) (Fabio Wakim Trentini trentas@gmail.com)
• cf67d8f: collector: FDs reais via /proc — sockets, bytes, eventos (closes #6 #7 #8) (#27) (Fabio Wakim Trentini trentas@gmail.com)
• 94729b4: collector: I/O throughput via /proc//io polling (closes #5) (#26) (Fabio Wakim Trentini trentas@gmail.com)
• f5f5ed9: collector: I/O wait via /proc//stat campo 42 (closes #4) (#25) (Fabio Wakim Trentini trentas@gmail.com)
• 27fbf37: collector: completa tabela syscall names ARM64 (sendmsg, recvmsg, etc) (#47) (Fabio Wakim Trentini trentas@gmail.com)

TUI

• be91508: tui: fix bg residual em right-align cells e JoinHorizontal gaps (#39) (Fabio Wakim Trentini trentas@gmail.com)
• b8da792: tui: fix bg residual em right-align cells e JoinHorizontal gaps (#40) (Fabio Wakim Trentini trentas@gmail.com)
• c44f930: tui: input filter (/) + help overlay (?) (closes #16) (#32) (Fabio Wakim Trentini trentas@gmail.com)
• 3e975cd: tui: padroniza ColorPanel como background em todo conteúdo de panel (#38) (Fabio Wakim Trentini trentas@gmail.com)
• 289f407: tui: real process name from /proc//comm + fix bg gap residual (#41) (Fabio Wakim Trentini trentas@gmail.com)
• d8303ba: tui: scroll no help overlay (↑/↓/PgUp/PgDn) pra terminais 80x24 (#45) (Fabio Wakim Trentini trentas@gmail.com)
• 348d438: tui: snapshot (s) + export (e) JSON (closes #15) (#31) (Fabio Wakim Trentini trentas@gmail.com)
• 551d6fd: tui: visibilidade da source dos collectors (eBPF vs /proc vs mock) (#43) (Fabio Wakim Trentini trentas@gmail.com)

Infra

• c0cae7a: collector+infra: clkTck dinâmico via getconf + lima.yaml ARM dev VM (#35) (Fabio Wakim Trentini trentas@gmail.com)
• f4efff1: infra: GitHub Actions CI (closes #2) (#28) (Fabio Wakim Trentini trentas@gmail.com)
• 2893876: infra: bpf.Available const + startup diagnostic claro (#44) (Fabio Wakim Trentini trentas@gmail.com)
• c6f9fb3: infra: build tags isolando código eBPF (Linux-only) (closes #3) (#29) (Fabio Wakim Trentini trentas@gmail.com)
• 851c26b: infra: capabilities UX + collector status no help (closes #19) (#33) (Fabio Wakim Trentini trentas@gmail.com)
• df7cec7: infra: lima.yaml — bpftool via linux-tools-* (compat 22.04+24.04) (#36) (Fabio Wakim Trentini trentas@gmail.com)
• bad71fb: infra: release tooling (goreleaser + gh release) (closes #20) (#34) (Fabio Wakim Trentini trentas@gmail.com)
• b0bd021: infra: rename module to github.com/trentas/xray (closes #1) (#23) (Fabio Wakim Trentini trentas@gmail.com)

Outros

• 502943e: ebpf: CPU sampling via perf_event @ 100Hz/CPU (#42) (Fabio Wakim Trentini trentas@gmail.com)
• 4a747b3: ebpf: I/O syscall tracking → top files reais + histograma (closes #11) (#46) (Fabio Wakim Trentini trentas@gmail.com)
• aebec96: ebpf: syscalls.bpf.c + loader cilium/ebpf + collector (#37) (Fabio Wakim Trentini trentas@gmail.com)

Esta é uma release sem eBPF embarcado (modo --no-ebpf apenas).
Coletores eBPF estão sendo entregues nas issues #9-#14.