# SPDX-License-Identifier: GPL-3.0-or-later
"""The execve event — one process-execution observed by the kernel probe."""
from __future__ import annotations

import os
from dataclasses import dataclass, field


@dataclass(frozen=True)
class ExecEvent:
    """A single ``execve``, as seen at the moment of execution.

    Captured by the eBPF probe (so it exists even for processes that exit before
    a poll). ``parent_comm`` is the caller; ``filename`` is the program being
    executed; ``argv`` is as much of the argument vector as the probe captured.
    """

    pid: int
    ppid: int
    uid: int
    parent_comm: str
    filename: str
    argv: tuple[str, ...] = field(default_factory=tuple)

    @property
    def exec_comm(self) -> str:
        """Basename of the executed program (its post-exec ``comm``)."""
        return os.path.basename(self.filename)

    @property
    def argv_str(self) -> str:
        """Full command line for regex matching (filename + captured args)."""
        return " ".join((self.filename, *self.argv)).strip()

    def to_dict(self) -> dict:
        return {
            "pid": self.pid,
            "ppid": self.ppid,
            "uid": self.uid,
            "parent_comm": self.parent_comm,
            "filename": self.filename,
            "argv": list(self.argv),
        }