np. there's a diagram, "Linux bcc/BPF tracing tools" [-1] in the bcc readme [0] that's also in [1] which explains ebpf and bcc and bpftrace.

filetop, dirtop, and vfsstat use bpf to trace the VFS layer. [4]

[-1] "Linux bcc/BPF tracing tools" https://www.brendangregg.com/BPF/bcc_tracing_tools_early2019...

[0] iovisor/bcc: https://github.com/iovisor/bcc

[1] "Linux Extended BPF (eBPF) Tracing Tools", Dtrace book: https://www.brendangregg.com/ebpf.html

If running an AI agent in a container --- with devcontainers and e.g. vscode,

Good container policy prevents granting a container the CAP_SYS_ADMIN capability; the least-privileges thing to do is to grant limited capabilities to the container like CAP_BPF and (CAP_PERFMON, CAP_NET_RAW, CAP_SYS_PTRACE) [,3].

[3] https://medium.com/@techdevguides/using-bpftrace-with-limite...

[4] bpfcc-tools manpages: https://manpages.debian.org/unstable/bpfcc-tools/index.html

though ripgrep wins, vscode fails at monitoring large workspaces due to inotify limits too; so some way to parse fs events from bcc and libdtrace with python would be great

prompt 1: Create a python project named idk dbpftrace with a pyproject.toml and a README and sphinx /docs, with bcc and python-dtrace as dependencies to, then in dbpftrace/,

parse pid and descendents' fs syscall events from bcc (ebpf) or python-dtrace (dtrace), depending on which os we're running

Edit:

Prompt 1B: Create a Go package named dbpftrace with a README and docs,

parse pid and descendents' fs syscall events from bpftrace or dtrace stdout, depending on which os we're running