Skip to content

feat(v2.0): Multi-session, Manifest Parsing, and Rust Filtering#59

Merged
m96-chan merged 5 commits into
mainfrom
feat/v2.0-multi-session
Dec 11, 2025
Merged

feat(v2.0): Multi-session, Manifest Parsing, and Rust Filtering#59
m96-chan merged 5 commits into
mainfrom
feat/v2.0-multi-session

Conversation

@m96-chan
Copy link
Copy Markdown
Owner

Summary

This PR implements three major v2.0.0 features using TDD approach:

New Components

  1. MultiSession (multi_session.py)

    • Manage multiple ETW sessions (Kernel + User) simultaneously
    • Unified event queue aggregating events from all sessions
    • Thread-safe event collection
    • Context manager support
  2. Manifest Parsing (manifest.py)

    • ManifestParser: Parse manifests from registry or files (.man, .mof)
    • ProviderManifest: Container for provider metadata and event definitions
    • EventDefinition / FieldDefinition: Type-safe event schema
    • TypedEventFactory: Generate dataclass wrappers from definitions
    • ManifestCache: Singleton cache for efficient manifest reuse
  3. RustEventFilter (rust_filter.py)

    • High-performance filter specification for Rust-side evaluation
    • Support for event IDs, levels, keywords, PIDs, property filters
    • Regex pattern matching on properties
    • Filter combination operators (&, |, ~)
    • Serialization for Rust consumption

Test Coverage

  • 64 new tests across all three features
  • All tests pass

Test plan

  • Run pytest tests/test_multi_session.py tests/test_manifest_events.py tests/test_rust_filtering.py -v
  • All 64 tests pass
  • Lint checks pass (ruff check)
  • CI passes all checks

Closes #48, #55, #56

🤖 Generated with Claude Code

m96-chan and others added 5 commits December 11, 2025 14:58
, #55, #56)

- MultiSession: Manage multiple ETW sessions with unified event delivery (#48)
- ManifestParser: Parse ETW provider manifests for typed events (#55)
- RustEventFilter: High-performance event filtering for Rust-side evaluation (#56)
- TypedEventFactory: Generate dataclass wrappers from event definitions

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Use --no-index flag to prevent uv from looking up PyPI when installing
the locally-built wheel. This avoids version conflicts with the released
package on PyPI.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add diagnostic output to identify which wheel is being installed.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Match wheel filename with Python version (cp39, cp310, etc.) to ensure
correct wheel is installed for each Python version in matrix test.
The previous 'python -c' was using system Python instead of the venv
Python, causing wrong wheel selection for Python 3.10/3.11/3.12.
@m96-chan m96-chan merged commit e977240 into main Dec 11, 2025
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat: Multi-session / Multi-provider concurrent subscription

1 participant