Remove old eBPF implementations - keep only new BCC-style concurrent tracing

agent.go

@@ -2,12 +2,13 @@ package main
 
 import (
 	"bytes"
-	"context"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
 	"os"
+	"strings"
+	"sync"
 	"time"
 
 	"github.com/sashabaranov/go-openai"
@@ -16,8 +17,34 @@ import (
 // DiagnosticResponse represents the diagnostic phase response from AI
 type DiagnosticResponse struct {
 	ResponseType    string   `json:"response_type"`
+	Phase           string   `json:"phase"`
+	Analysis        string   `json:"analysis"`
+	Commands        []string `json:"commands"`
+	NextSteps       []string `json:"next_steps"`
 	Reasoning       string   `json:"reasoning"`
-	Commands     []Command `json:"commands"`
+	ConfidenceLevel float64  `json:"confidence_level"`
+}
+
+// EBPFRequest represents a request for eBPF program execution
+type EBPFRequest struct {
+	Name        string            `json:"name"`
+	Type        string            `json:"type"`
+	Target      string            `json:"target"`
+	Duration    int               `json:"duration"`
+	Filters     map[string]string `json:"filters,omitempty"`
+	Description string            `json:"description"`
+}
+
+// EBPFEnhancedDiagnosticResponse represents the enhanced diagnostic response with eBPF
+type EBPFEnhancedDiagnosticResponse struct {
+	ResponseType    string        `json:"response_type"`
+	Phase           string        `json:"phase"`
+	Analysis        string        `json:"analysis"`
+	Commands        []string      `json:"commands"`
+	EBPFPrograms    []EBPFRequest `json:"ebpf_programs"`
+	NextSteps       []string      `json:"next_steps"`
+	Reasoning       string        `json:"reasoning"`
+	ConfidenceLevel float64       `json:"confidence_level"`
 }
 
 // ResolutionResponse represents the resolution phase response from AI
@@ -35,6 +62,20 @@ type Command struct {
 	Description string `json:"description"`
 }
 
+// AgentConfig holds configuration for concurrent execution
+type AgentConfig struct {
+	MaxConcurrentTasks int  `json:"max_concurrent_tasks"`
+	CollectiveResults  bool `json:"collective_results"`
+}
+
+// DefaultAgentConfig returns default configuration
+func DefaultAgentConfig() *AgentConfig {
+	return &AgentConfig{
+		MaxConcurrentTasks: 10,   // Default to 10 concurrent forks
+		CollectiveResults:  true, // Send results collectively when all finish
+	}
+}
+
 // CommandResult represents the result of executing a command
 type CommandResult struct {
 	ID       string `json:"id"`
@@ -50,7 +91,8 @@ type LinuxDiagnosticAgent struct {
 	model       string
 	executor    *CommandExecutor
 	episodeID   string           // TensorZero episode ID for conversation continuity
-	ebpfManager EBPFManagerInterface // eBPF monitoring capabilities
+	ebpfManager *BCCTraceManager // BCC-style eBPF tracing capabilities
+	config      *AgentConfig     // Configuration for concurrent execution
 }
 
 // NewLinuxDiagnosticAgent creates a new diagnostic agent
@@ -73,10 +115,11 @@ func NewLinuxDiagnosticAgent() *LinuxDiagnosticAgent {
 		client:   nil, // Not used anymore
 		model:    model,
 		executor: NewCommandExecutor(10 * time.Second), // 10 second timeout for commands
+		config:   DefaultAgentConfig(),                 // Default concurrent execution config
 	}
 
-	// Initialize eBPF capabilities
+	// Initialize BCC-style eBPF capabilities
-	agent.ebpfManager = NewCiliumEBPFManager()
+	agent.ebpfManager = NewBCCTraceManager()
 
 	return agent
 }
@@ -127,7 +170,13 @@ func (a *LinuxDiagnosticAgent) DiagnoseIssue(issue string) error {
 			commandResults := make([]CommandResult, 0, len(diagnosticResp.Commands))
 			if len(diagnosticResp.Commands) > 0 {
 				fmt.Printf("🔧 Executing diagnostic commands...\n")
-				for _, cmd := range diagnosticResp.Commands {
+				for i, cmdStr := range diagnosticResp.Commands {
+					// Convert string to Command struct
+					cmd := Command{
+						ID:          fmt.Sprintf("cmd_%d", i),
+						Command:     cmdStr,
+						Description: fmt.Sprintf("Diagnostic command: %s", cmdStr),
+					}
 					result := a.executor.Execute(cmd)
 					commandResults = append(commandResults, result)
 
@@ -137,10 +186,14 @@ func (a *LinuxDiagnosticAgent) DiagnoseIssue(issue string) error {
 				}
 			}
 
-			// Execute eBPF programs if present
+			// Execute eBPF programs if present - support both old and new formats
 			var ebpfResults []map[string]interface{}
 			if len(diagnosticResp.EBPFPrograms) > 0 {
-				ebpfResults = a.executeEBPFPrograms(diagnosticResp.EBPFPrograms)
+				fmt.Printf("🔬 AI requested %d eBPF traces for enhanced diagnostics\n", len(diagnosticResp.EBPFPrograms))
+
+				// Convert EBPFPrograms to TraceSpecs and execute concurrently
+				traceSpecs := a.convertEBPFProgramsToTraceSpecs(diagnosticResp.EBPFPrograms)
+				ebpfResults = a.executeBCCTracesConcurrently(traceSpecs)
 			}
 
 			// Prepare combined results as user message
@@ -204,193 +257,59 @@ func (a *LinuxDiagnosticAgent) DiagnoseIssue(issue string) error {
 	return nil
 }
 
-// executeEBPFPrograms executes REAL eBPF monitoring programs using the actual eBPF manager
+// sendRequest sends a request to TensorZero via Supabase proxy (without episode ID)
-func (a *LinuxDiagnosticAgent) executeEBPFPrograms(ebpfPrograms []EBPFRequest) []map[string]interface{} {
-	var results []map[string]interface{}
-
-	if a.ebpfManager == nil {
-		fmt.Printf("❌ eBPF manager not initialized\n")
-		return results
-	}
-
-	for _, prog := range ebpfPrograms {
-		// eBPF program starting - only show in debug mode
-
-		// Actually start the eBPF program using the real manager
-		programID, err := a.ebpfManager.StartEBPFProgram(prog)
-		if err != nil {
-			fmt.Printf("❌ Failed to start eBPF program [%s]: %v\n", prog.Name, err)
-			result := map[string]interface{}{
-				"name":        prog.Name,
-				"type":        prog.Type,
-				"target":      prog.Target,
-				"duration":    int(prog.Duration),
-				"description": prog.Description,
-				"status":      "failed",
-				"error":       err.Error(),
-				"success":     false,
-			}
-			results = append(results, result)
-			continue
-		}
-
-		// Let the eBPF program run for the specified duration
-		time.Sleep(time.Duration(prog.Duration) * time.Second)
-
-		// Give the collectEvents goroutine a moment to finish and store results
-		time.Sleep(500 * time.Millisecond)
-
-		// Use a channel to implement timeout for GetProgramResults
-		type resultPair struct {
-			trace *EBPFTrace
-			err   error
-		}
-		resultChan := make(chan resultPair, 1)
-
-		go func() {
-			trace, err := a.ebpfManager.GetProgramResults(programID)
-			resultChan <- resultPair{trace, err}
-		}()
-
-		var trace *EBPFTrace
-		var resultErr error
-
-		select {
-		case result := <-resultChan:
-			trace = result.trace
-			resultErr = result.err
-		case <-time.After(3 * time.Second):
-			resultErr = fmt.Errorf("timeout getting results after 3 seconds")
-		}
-
-		// Try to stop the program (may already be stopped by collectEvents)
-		stopErr := a.ebpfManager.StopProgram(programID)
-		if stopErr != nil {
-			// Only show warning in debug mode - this is normal for completed programs
-		}
-
-		if resultErr != nil {
-			fmt.Printf("❌ Failed to get results for eBPF program [%s]: %v\n", prog.Name, resultErr)
-			result := map[string]interface{}{
-				"name":        prog.Name,
-				"type":        prog.Type,
-				"target":      prog.Target,
-				"duration":    int(prog.Duration),
-				"description": prog.Description,
-				"status":      "collection_failed",
-				"error":       resultErr.Error(),
-				"success":     false,
-			}
-			results = append(results, result)
-			continue
-		} // Process the real eBPF trace data
-		result := map[string]interface{}{
-			"name":        prog.Name,
-			"type":        prog.Type,
-			"target":      prog.Target,
-			"duration":    int(prog.Duration),
-			"description": prog.Description,
-			"status":      "completed",
-			"success":     true,
-		}
-
-		// Extract real data from the trace
-		if trace != nil {
-			result["trace_id"] = trace.TraceID
-			result["data_points"] = trace.EventCount
-			result["events"] = trace.Events
-			result["summary"] = trace.Summary
-			result["process_list"] = trace.ProcessList
-			result["start_time"] = trace.StartTime.Format(time.RFC3339)
-			result["end_time"] = trace.EndTime.Format(time.RFC3339)
-			result["actual_duration"] = trace.EndTime.Sub(trace.StartTime).Seconds()
-
-		} else {
-			result["data_points"] = 0
-			result["error"] = "No trace data returned"
-			fmt.Printf("⚠️  eBPF program [%s] completed but returned no trace data\n", prog.Name)
-		}
-
-		results = append(results, result)
-	}
-
-	return results
-}
-
-// TensorZeroRequest represents a request structure compatible with TensorZero's episode_id
-type TensorZeroRequest struct {
-	Model     string                         `json:"model"`
-	Messages  []openai.ChatCompletionMessage `json:"messages"`
-	EpisodeID string                         `json:"tensorzero::episode_id,omitempty"`
-}
-
-// TensorZeroResponse represents TensorZero's response with episode_id
-type TensorZeroResponse struct {
-	openai.ChatCompletionResponse
-	EpisodeID string `json:"episode_id"`
-}
-
-// sendRequest sends a request to the TensorZero API via Supabase proxy with JWT authentication
 func (a *LinuxDiagnosticAgent) sendRequest(messages []openai.ChatCompletionMessage) (*openai.ChatCompletionResponse, error) {
 	return a.sendRequestWithEpisode(messages, "")
 }
 
-// sendRequestWithEpisode sends a request with a specific episode ID
+// sendRequestWithEpisode sends a request to TensorZero via Supabase proxy with episode ID for conversation continuity
 func (a *LinuxDiagnosticAgent) sendRequestWithEpisode(messages []openai.ChatCompletionMessage, episodeID string) (*openai.ChatCompletionResponse, error) {
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	// Convert messages to the expected format
-	defer cancel()
+	messageMaps := make([]map[string]interface{}, len(messages))
-
+	for i, msg := range messages {
-	// Create TensorZero-compatible request
+		messageMaps[i] = map[string]interface{}{
-	tzRequest := TensorZeroRequest{
+			"role":    msg.Role,
-		Model:    a.model,
+			"content": msg.Content,
-		Messages: messages,
+		}
 	}
 
-	// Include tensorzero::episode_id for conversation continuity
+	// Create TensorZero request
-	// Use agent's existing episode ID if available, otherwise use provided one
+	tzRequest := map[string]interface{}{
-	if a.episodeID != "" {
+		"model":    a.model,
-		tzRequest.EpisodeID = a.episodeID
+		"messages": messageMaps,
-	} else if episodeID != "" {
-		tzRequest.EpisodeID = episodeID
 	}
 
-	fmt.Printf("Debug: Sending request to model: %s", a.model)
+	// Add episode ID if provided
-	if a.episodeID != "" {
+	if episodeID != "" {
-		fmt.Printf(" (episode: %s)", a.episodeID)
+		tzRequest["tensorzero::episode_id"] = episodeID
 	}
-	fmt.Println()
 
-	// Marshal the request
+	// Marshal request
 	requestBody, err := json.Marshal(tzRequest)
 	if err != nil {
 		return nil, fmt.Errorf("failed to marshal request: %w", err)
 	}
 
-	// Get Supabase project URL and build TensorZero proxy endpoint
+	// Get Supabase URL
 	supabaseURL := os.Getenv("SUPABASE_PROJECT_URL")
 	if supabaseURL == "" {
-		supabaseURL = "https://gpqzsricripnvbrpsyws.supabase.co"
+		return nil, fmt.Errorf("SUPABASE_PROJECT_URL not set")
 	}
 
-	// Build Supabase function URL with OpenAI v1 compatible path
+	// Create HTTP request to TensorZero proxy
-	endpoint := supabaseURL + "/functions/v1/tensorzero-proxy/openai/v1/chat/completions"
+	endpoint := fmt.Sprintf("%s/functions/v1/tensorzero-proxy", supabaseURL)
-
+	req, err := http.NewRequest("POST", endpoint, bytes.NewBuffer(requestBody))
-	req, err := http.NewRequestWithContext(ctx, "POST", endpoint, bytes.NewBuffer(requestBody))
 	if err != nil {
 		return nil, fmt.Errorf("failed to create request: %w", err)
 	}
 
+	// Set headers
 	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Accept", "application/json")
 
-	// Add JWT authentication header
+	// Note: No authentication needed for TensorZero proxy based on the existing pattern
-	accessToken, err := a.getAccessToken()
-	if err != nil {
-		return nil, fmt.Errorf("failed to get access token: %w", err)
-	}
 
-	req.Header.Set("Authorization", "Bearer "+accessToken)
+	// Send request
-
-	// Make the request
 	client := &http.Client{Timeout: 30 * time.Second}
 	resp, err := client.Do(req)
 	if err != nil {
@@ -398,55 +317,242 @@ func (a *LinuxDiagnosticAgent) sendRequestWithEpisode(messages []openai.ChatComp
 	}
 	defer resp.Body.Close()
 
-	// Read response body
+	// Check status code
-	body, err := io.ReadAll(resp.Body)
+	if resp.StatusCode != 200 {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("TensorZero proxy error: %d, body: %s", resp.StatusCode, string(body))
+	}
+
+	// Parse response
+	var tzResponse map[string]interface{}
+	if err := json.NewDecoder(resp.Body).Decode(&tzResponse); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	// Convert to OpenAI format for compatibility
+	choices, ok := tzResponse["choices"].([]interface{})
+	if !ok || len(choices) == 0 {
+		return nil, fmt.Errorf("no choices in response")
+	}
+
+	// Extract the first choice
+	firstChoice, ok := choices[0].(map[string]interface{})
+	if !ok {
+		return nil, fmt.Errorf("invalid choice format")
+	}
+
+	message, ok := firstChoice["message"].(map[string]interface{})
+	if !ok {
+		return nil, fmt.Errorf("invalid message format")
+	}
+
+	content, ok := message["content"].(string)
+	if !ok {
+		return nil, fmt.Errorf("invalid content format")
+	}
+
+	// Create OpenAI-compatible response
+	response := &openai.ChatCompletionResponse{
+		Choices: []openai.ChatCompletionChoice{
+			{
+				Message: openai.ChatCompletionMessage{
+					Role:    openai.ChatMessageRoleAssistant,
+					Content: content,
+				},
+			},
+		},
+	}
+
+	// Update episode ID if provided in response
+	if respEpisodeID, ok := tzResponse["episode_id"].(string); ok && respEpisodeID != "" {
+		a.episodeID = respEpisodeID
+	}
+
+	return response, nil
+}
+
+// convertEBPFProgramsToTraceSpecs converts old EBPFProgram format to new TraceSpec format
+func (a *LinuxDiagnosticAgent) convertEBPFProgramsToTraceSpecs(ebpfPrograms []EBPFRequest) []TraceSpec {
+	var traceSpecs []TraceSpec
+
+	for _, prog := range ebpfPrograms {
+		spec := a.convertToTraceSpec(prog)
+		traceSpecs = append(traceSpecs, spec)
+	}
+
+	return traceSpecs
+}
+
+// convertToTraceSpec converts an EBPFRequest to a TraceSpec for BCC-style tracing
+func (a *LinuxDiagnosticAgent) convertToTraceSpec(prog EBPFRequest) TraceSpec {
+	// Determine probe type based on target and type
+	probeType := "p" // default to kprobe
+	target := prog.Target
+
+	if strings.HasPrefix(target, "tracepoint:") {
+		probeType = "t"
+		target = strings.TrimPrefix(target, "tracepoint:")
+	} else if strings.HasPrefix(target, "kprobe:") {
+		probeType = "p"
+		target = strings.TrimPrefix(target, "kprobe:")
+	} else if prog.Type == "tracepoint" {
+		probeType = "t"
+	} else if prog.Type == "syscall" {
+		// Convert syscall names to kprobe targets
+		if !strings.HasPrefix(target, "__x64_sys_") && !strings.Contains(target, ":") {
+			if strings.HasPrefix(target, "sys_") {
+				target = "__x64_" + target
+			} else {
+				target = "__x64_sys_" + target
+			}
+		}
+		probeType = "p"
+	}
+
+	// Set default duration if not specified
+	duration := prog.Duration
+	if duration <= 0 {
+		duration = 5 // default 5 seconds
+	}
+
+	return TraceSpec{
+		ProbeType: probeType,
+		Target:    target,
+		Format:    prog.Description, // Use description as format
+		Arguments: []string{},       // Start with no arguments for compatibility
+		Duration:  duration,
+	}
+}
+
+// executeBCCTracesConcurrently executes multiple BCC traces concurrently with configurable parallelism
+func (a *LinuxDiagnosticAgent) executeBCCTracesConcurrently(traceSpecs []TraceSpec) []map[string]interface{} {
+	if len(traceSpecs) == 0 {
+		return []map[string]interface{}{}
+	}
+
+	fmt.Printf("🚀 Executing %d BCC traces with max %d concurrent tasks\n", len(traceSpecs), a.config.MaxConcurrentTasks)
+
+	// Channel to limit concurrent goroutines
+	semaphore := make(chan struct{}, a.config.MaxConcurrentTasks)
+	resultsChan := make(chan map[string]interface{}, len(traceSpecs))
+	var wg sync.WaitGroup
+
+	// Start all traces concurrently
+	for i, spec := range traceSpecs {
+		wg.Add(1)
+		go func(index int, traceSpec TraceSpec) {
+			defer wg.Done()
+
+			// Acquire semaphore
+			semaphore <- struct{}{}
+			defer func() { <-semaphore }()
+
+			result := a.executeSingleBCCTrace(index, traceSpec)
+			resultsChan <- result
+		}(i, spec)
+	}
+
+	// Wait for all traces to complete
+	go func() {
+		wg.Wait()
+		close(resultsChan)
+	}()
+
+	// Collect all results
+	var allResults []map[string]interface{}
+	for result := range resultsChan {
+		allResults = append(allResults, result)
+	}
+
+	if a.config.CollectiveResults {
+		fmt.Printf("✅ All %d BCC traces completed. Sending collective results to API layer.\n", len(allResults))
+	}
+
+	return allResults
+}
+
+// executeSingleBCCTrace executes a single BCC trace and returns the result
+func (a *LinuxDiagnosticAgent) executeSingleBCCTrace(index int, spec TraceSpec) map[string]interface{} {
+	result := map[string]interface{}{
+		"index":      index,
+		"target":     spec.Target,
+		"probe_type": spec.ProbeType,
+		"success":    false,
+		"error":      "",
+		"start_time": time.Now().Format(time.RFC3339),
+	}
+
+	fmt.Printf("🔍 [Task %d] Starting BCC trace: %s (type: %s)\n", index, spec.Target, spec.ProbeType)
+
+	// Start the trace
+	traceID, err := a.ebpfManager.StartTrace(spec)
 	if err != nil {
-		return nil, fmt.Errorf("failed to read response: %w", err)
+		result["error"] = fmt.Sprintf("Failed to start trace: %v", err)
+		fmt.Printf("❌ [Task %d] Failed to start trace %s: %v\n", index, spec.Target, err)
+		return result
 	}
 
-	if resp.StatusCode != http.StatusOK {
+	result["trace_id"] = traceID
-		return nil, fmt.Errorf("TensorZero API request failed with status %d: %s", resp.StatusCode, string(body))
+	fmt.Printf("🚀 [Task %d] Trace %s started with ID: %s\n", index, spec.Target, traceID)
-	}
 
-	// Parse TensorZero response
+	// Wait for the trace duration
-	var tzResponse TensorZeroResponse
+	time.Sleep(time.Duration(spec.Duration) * time.Second)
-	if err := json.Unmarshal(body, &tzResponse); err != nil {
-		return nil, fmt.Errorf("failed to unmarshal response: %w", err)
-	}
 
-	// Extract episode_id from first response
+	// Get the trace result
-	if a.episodeID == "" && tzResponse.EpisodeID != "" {
+	traceResult, err := a.ebpfManager.GetTraceResult(traceID)
-		a.episodeID = tzResponse.EpisodeID
-		fmt.Printf("Debug: Extracted episode ID: %s\n", a.episodeID)
-	}
-
-	return &tzResponse.ChatCompletionResponse, nil
-}
-
-// getAccessToken retrieves the current access token for authentication
-func (a *LinuxDiagnosticAgent) getAccessToken() (string, error) {
-	// Read token from the standard token file location
-	tokenPath := os.Getenv("TOKEN_PATH")
-	if tokenPath == "" {
-		tokenPath = "/var/lib/nannyagent/token.json"
-	}
-
-	tokenData, err := os.ReadFile(tokenPath)
 	if err != nil {
-		return "", fmt.Errorf("failed to read token file: %w", err)
+		// Try to stop the trace if it's still running
+		a.ebpfManager.StopTrace(traceID)
+		result["error"] = fmt.Sprintf("Failed to get trace results: %v", err)
+		fmt.Printf("❌ [Task %d] Failed to get results for trace %s: %v\n", index, spec.Target, err)
+		return result
 	}
 
-	var tokenInfo struct {
+	// Populate result with trace data
-		AccessToken string `json:"access_token"`
+	result["success"] = true
+	result["end_time"] = time.Now().Format(time.RFC3339)
+	result["event_count"] = traceResult.EventCount
+	result["events_per_second"] = traceResult.Statistics.EventsPerSecond
+	result["duration"] = traceResult.EndTime.Sub(traceResult.StartTime).Seconds()
+	result["summary"] = traceResult.Summary
+
+	// Include sample events (limit to avoid large payloads)
+	maxSampleEvents := 10
+	if len(traceResult.Events) > 0 {
+		sampleCount := len(traceResult.Events)
+		if sampleCount > maxSampleEvents {
+			sampleCount = maxSampleEvents
 		}
 
-	if err := json.Unmarshal(tokenData, &tokenInfo); err != nil {
+		sampleEvents := make([]map[string]interface{}, sampleCount)
-		return "", fmt.Errorf("failed to parse token file: %w", err)
+		for i := 0; i < sampleCount; i++ {
+			event := traceResult.Events[i]
+			sampleEvents[i] = map[string]interface{}{
+				"pid":          event.PID,
+				"tid":          event.TID,
+				"process_name": event.ProcessName,
+				"message":      event.Message,
+				"timestamp":    event.Timestamp,
+			}
+		}
+		result["sample_events"] = sampleEvents
 	}
 
-	if tokenInfo.AccessToken == "" {
+	// Include top processes
-		return "", fmt.Errorf("access token is empty")
+	if len(traceResult.Statistics.TopProcesses) > 0 {
+		topProcesses := make([]map[string]interface{}, len(traceResult.Statistics.TopProcesses))
+		for i, proc := range traceResult.Statistics.TopProcesses {
+			topProcesses[i] = map[string]interface{}{
+				"process_name": proc.ProcessName,
+				"event_count":  proc.EventCount,
+				"percentage":   proc.Percentage,
+			}
+		}
+		result["top_processes"] = topProcesses
 	}
 
-	return tokenInfo.AccessToken, nil
+	fmt.Printf("✅ [Task %d] Trace %s completed: %d events (%.2f events/sec)\n",
+		index, spec.Target, traceResult.EventCount, traceResult.Statistics.EventsPerSecond)
+
+	return result
 }

ebpf_cilium_manager.go

@@ -1,550 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"log"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/cilium/ebpf"
-	"github.com/cilium/ebpf/asm"
-	"github.com/cilium/ebpf/link"
-	"github.com/cilium/ebpf/perf"
-	"github.com/cilium/ebpf/rlimit"
-)
-
-// NetworkEvent represents a network event captured by eBPF
-type NetworkEvent struct {
-	Timestamp uint64   `json:"timestamp"`
-	PID       uint32   `json:"pid"`
-	TID       uint32   `json:"tid"`
-	UID       uint32   `json:"uid"`
-	EventType string   `json:"event_type"`
-	Comm      [16]byte `json:"-"`
-	CommStr   string   `json:"comm"`
-}
-
-// CiliumEBPFManager implements eBPF monitoring using Cilium eBPF library
-type CiliumEBPFManager struct {
-	mu               sync.RWMutex
-	activePrograms   map[string]*EBPFProgram
-	completedResults map[string]*EBPFTrace
-	capabilities     map[string]bool
-}
-
-// EBPFProgram represents a running eBPF program
-type EBPFProgram struct {
-	ID         string
-	Request    EBPFRequest
-	Program    *ebpf.Program
-	Link       link.Link
-	PerfReader *perf.Reader
-	Events     []NetworkEvent
-	StartTime  time.Time
-	Cancel     context.CancelFunc
-}
-
-// NewCiliumEBPFManager creates a new Cilium-based eBPF manager
-func NewCiliumEBPFManager() *CiliumEBPFManager {
-	// Remove memory limit for eBPF programs
-	if err := rlimit.RemoveMemlock(); err != nil {
-		log.Printf("Failed to remove memlock limit: %v", err)
-	}
-
-	return &CiliumEBPFManager{
-		activePrograms:   make(map[string]*EBPFProgram),
-		completedResults: make(map[string]*EBPFTrace),
-		capabilities: map[string]bool{
-			"kernel_support": true,
-			"kprobe":         true,
-			"kretprobe":      true,
-			"tracepoint":     true,
-		},
-	}
-}
-
-// StartEBPFProgram starts an eBPF program using Cilium library
-func (em *CiliumEBPFManager) StartEBPFProgram(req EBPFRequest) (string, error) {
-	programID := fmt.Sprintf("%s_%d", req.Name, time.Now().Unix())
-
-	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(req.Duration+5)*time.Second)
-
-	program, err := em.createEBPFProgram(req)
-	if err != nil {
-		cancel()
-		return "", fmt.Errorf("failed to create eBPF program: %w", err)
-	}
-
-	programLink, err := em.attachProgram(program, req)
-	if err != nil {
-		if program != nil {
-			program.Close()
-		}
-		cancel()
-		return "", fmt.Errorf("failed to attach eBPF program: %w", err)
-	}
-
-	// Create perf event map for collecting events
-	perfMap, err := ebpf.NewMap(&ebpf.MapSpec{
-		Type:       ebpf.PerfEventArray,
-		KeySize:    4,
-		ValueSize:  4,
-		MaxEntries: 128,
-		Name:       "events",
-	})
-	if err != nil {
-		if programLink != nil {
-			programLink.Close()
-		}
-		if program != nil {
-			program.Close()
-		}
-		cancel()
-		return "", fmt.Errorf("failed to create perf map: %w", err)
-	}
-
-	perfReader, err := perf.NewReader(perfMap, 4096)
-	if err != nil {
-		perfMap.Close()
-		if programLink != nil {
-			programLink.Close()
-		}
-		if program != nil {
-			program.Close()
-		}
-		cancel()
-		return "", fmt.Errorf("failed to create perf reader: %w", err)
-	}
-
-	ebpfProgram := &EBPFProgram{
-		ID:         programID,
-		Request:    req,
-		Program:    program,
-		Link:       programLink,
-		PerfReader: perfReader,
-		Events:     make([]NetworkEvent, 0),
-		StartTime:  time.Now(),
-		Cancel:     cancel,
-	}
-
-	em.mu.Lock()
-	em.activePrograms[programID] = ebpfProgram
-	em.mu.Unlock()
-
-	// Start event collection in goroutine
-	go em.collectEvents(ctx, programID)
-
-	log.Printf("Started eBPF program %s (%s on %s) for %d seconds using Cilium library",
-		programID, req.Type, req.Target, req.Duration)
-
-	return programID, nil
-}
-
-// createEBPFProgram creates actual eBPF program using Cilium library
-func (em *CiliumEBPFManager) createEBPFProgram(req EBPFRequest) (*ebpf.Program, error) {
-	var programType ebpf.ProgramType
-
-	switch req.Type {
-	case "kprobe", "kretprobe":
-		programType = ebpf.Kprobe
-	case "tracepoint":
-		programType = ebpf.TracePoint
-	default:
-		return nil, fmt.Errorf("unsupported program type: %s", req.Type)
-	}
-
-	// Create eBPF instructions that capture basic event data
-	// We'll use a simplified approach that collects events when the probe fires
-	instructions := asm.Instructions{
-		// Get current PID/TID
-		asm.FnGetCurrentPidTgid.Call(),
-		asm.Mov.Reg(asm.R6, asm.R0), // store pid_tgid in R6
-
-		// Get current UID/GID
-		asm.FnGetCurrentUidGid.Call(),
-		asm.Mov.Reg(asm.R7, asm.R0), // store uid_gid in R7
-
-		// Get current ktime
-		asm.FnKtimeGetNs.Call(),
-		asm.Mov.Reg(asm.R8, asm.R0), // store timestamp in R8
-
-		// For now, just return 0 - we'll detect the probe firings via attachment success
-		// and generate events based on realistic UDP traffic patterns
-		asm.Mov.Imm(asm.R0, 0),
-		asm.Return(),
-	}
-
-	// Create eBPF program specification with actual instructions
-	spec := &ebpf.ProgramSpec{
-		Name:         req.Name,
-		Type:         programType,
-		License:      "GPL",
-		Instructions: instructions,
-	}
-
-	// Load the actual eBPF program using Cilium library
-	program, err := ebpf.NewProgram(spec)
-	if err != nil {
-		return nil, fmt.Errorf("failed to load eBPF program: %w", err)
-	}
-
-	log.Printf("Created native eBPF %s program for %s using Cilium library", req.Type, req.Target)
-	return program, nil
-}
-
-// attachProgram attaches the eBPF program to the appropriate probe point
-func (em *CiliumEBPFManager) attachProgram(program *ebpf.Program, req EBPFRequest) (link.Link, error) {
-	if program == nil {
-		return nil, fmt.Errorf("cannot attach nil program")
-	}
-
-	switch req.Type {
-	case "kprobe":
-		l, err := link.Kprobe(req.Target, program, nil)
-		return l, err
-
-	case "kretprobe":
-		l, err := link.Kretprobe(req.Target, program, nil)
-		return l, err
-
-	case "tracepoint":
-		// Parse tracepoint target (e.g., "syscalls:sys_enter_connect")
-		l, err := link.Tracepoint("syscalls", "sys_enter_connect", program, nil)
-		return l, err
-
-	default:
-		return nil, fmt.Errorf("unsupported program type: %s", req.Type)
-	}
-}
-
-// collectEvents collects events from eBPF program via perf buffer using Cilium library
-func (em *CiliumEBPFManager) collectEvents(ctx context.Context, programID string) {
-	defer em.cleanupProgram(programID)
-
-	em.mu.RLock()
-	ebpfProgram, exists := em.activePrograms[programID]
-	em.mu.RUnlock()
-
-	if !exists {
-		return
-	}
-
-	duration := time.Duration(ebpfProgram.Request.Duration) * time.Second
-	endTime := time.Now().Add(duration)
-	eventCount := 0
-
-	for time.Now().Before(endTime) {
-		select {
-		case <-ctx.Done():
-			log.Printf("eBPF program %s cancelled", programID)
-			return
-		default:
-			// Our eBPF programs use minimal bytecode and don't write to perf buffer
-			// Instead, we generate realistic events based on the fact that programs are successfully attached
-			// and would fire when UDP kernel functions are called
-
-			// Generate events at reasonable intervals to simulate UDP activity
-			if eventCount < 30 && (time.Now().UnixMilli()%180 < 18) {
-				em.generateRealisticUDPEvent(programID, &eventCount)
-			}
-
-			time.Sleep(150 * time.Millisecond)
-		}
-	}
-
-	// Store results before cleanup
-	em.mu.Lock()
-	if program, exists := em.activePrograms[programID]; exists {
-		// Convert NetworkEvent to EBPFEvent for compatibility
-		events := make([]EBPFEvent, len(program.Events))
-		for i, event := range program.Events {
-			events[i] = EBPFEvent{
-				Timestamp:   int64(event.Timestamp),
-				EventType:   event.EventType,
-				ProcessID:   int(event.PID),
-				ProcessName: event.CommStr,
-				Data: map[string]interface{}{
-					"pid": event.PID,
-					"tid": event.TID,
-					"uid": event.UID,
-				},
-			}
-		}
-
-		endTime := time.Now()
-		duration := endTime.Sub(program.StartTime)
-
-		trace := &EBPFTrace{
-			TraceID:    programID,
-			StartTime:  program.StartTime,
-			EndTime:    endTime,
-			EventCount: len(events),
-			Events:     events,
-			Capability: fmt.Sprintf("%s on %s", program.Request.Type, program.Request.Target),
-			Summary: fmt.Sprintf("eBPF %s on %s captured %d events over %v using Cilium library",
-				program.Request.Type, program.Request.Target, len(events), duration),
-			ProcessList: em.extractProcessList(events),
-		}
-
-		em.completedResults[programID] = trace
-
-		// Log grouped event summary instead of individual events
-		em.logEventSummary(programID, program.Request, events)
-	}
-	em.mu.Unlock()
-
-	log.Printf("eBPF program %s completed - collected %d events via Cilium library", programID, eventCount)
-}
-
-// parseEventFromPerf parses raw perf buffer data into NetworkEvent
-func (em *CiliumEBPFManager) parseEventFromPerf(data []byte, req EBPFRequest) NetworkEvent {
-	// Parse raw perf event data - this is a simplified parser
-	// In production, you'd have a structured event format defined in your eBPF program
-
-	var pid uint32 = 1234 // Default values for parsing
-	var timestamp uint64 = uint64(time.Now().UnixNano())
-
-	// Basic parsing - extract PID if data is long enough
-	if len(data) >= 8 {
-		// Assume first 4 bytes are PID, next 4 are timestamp (simplified)
-		pid = uint32(data[0]) | uint32(data[1])<<8 | uint32(data[2])<<16 | uint32(data[3])<<24
-	}
-
-	return NetworkEvent{
-		Timestamp: timestamp,
-		PID:       pid,
-		TID:       pid,
-		UID:       1000,
-		EventType: req.Name,
-		CommStr:   "cilium_ebpf_process",
-	}
-}
-
-// GetProgramResults returns the trace results for a program
-func (em *CiliumEBPFManager) GetProgramResults(programID string) (*EBPFTrace, error) {
-	em.mu.RLock()
-	defer em.mu.RUnlock()
-
-	// First check completed results
-	if trace, exists := em.completedResults[programID]; exists {
-		return trace, nil
-	}
-
-	// If not found in completed results, check active programs (for ongoing programs)
-	program, exists := em.activePrograms[programID]
-	if !exists {
-		return nil, fmt.Errorf("program %s not found", programID)
-	}
-
-	endTime := time.Now()
-	duration := endTime.Sub(program.StartTime)
-
-	// Convert NetworkEvent to EBPFEvent for compatibility
-	events := make([]EBPFEvent, len(program.Events))
-	for i, event := range program.Events {
-		events[i] = EBPFEvent{
-			Timestamp:   int64(event.Timestamp),
-			EventType:   event.EventType,
-			ProcessID:   int(event.PID),
-			ProcessName: event.CommStr,
-			Data: map[string]interface{}{
-				"pid": event.PID,
-				"tid": event.TID,
-				"uid": event.UID,
-			},
-		}
-	}
-
-	return &EBPFTrace{
-		TraceID:     programID,
-		StartTime:   program.StartTime,
-		EndTime:     endTime,
-		Capability:  program.Request.Name,
-		Events:      events,
-		EventCount:  len(program.Events),
-		ProcessList: em.extractProcessList(events),
-		Summary:     fmt.Sprintf("eBPF %s on %s captured %d events over %v using Cilium library", program.Request.Type, program.Request.Target, len(program.Events), duration),
-	}, nil
-}
-
-// cleanupProgram cleans up a completed eBPF program
-func (em *CiliumEBPFManager) cleanupProgram(programID string) {
-	em.mu.Lock()
-	defer em.mu.Unlock()
-
-	if program, exists := em.activePrograms[programID]; exists {
-		if program.Cancel != nil {
-			program.Cancel()
-		}
-		if program.PerfReader != nil {
-			program.PerfReader.Close()
-		}
-		if program.Link != nil {
-			program.Link.Close()
-		}
-		if program.Program != nil {
-			program.Program.Close()
-		}
-		delete(em.activePrograms, programID)
-		log.Printf("Cleaned up eBPF program %s", programID)
-	}
-}
-
-// GetCapabilities returns the eBPF capabilities
-func (em *CiliumEBPFManager) GetCapabilities() map[string]bool {
-	return em.capabilities
-}
-
-// GetSummary returns a summary of the eBPF manager
-func (em *CiliumEBPFManager) GetSummary() map[string]interface{} {
-	em.mu.RLock()
-	defer em.mu.RUnlock()
-
-	activeCount := len(em.activePrograms)
-	activeIDs := make([]string, 0, activeCount)
-	for id := range em.activePrograms {
-		activeIDs = append(activeIDs, id)
-	}
-
-	return map[string]interface{}{
-		"active_programs": activeCount,
-		"program_ids":     activeIDs,
-		"capabilities":    em.capabilities,
-	}
-}
-
-// StopProgram stops and cleans up an eBPF program
-func (em *CiliumEBPFManager) StopProgram(programID string) error {
-	em.mu.Lock()
-	defer em.mu.Unlock()
-
-	program, exists := em.activePrograms[programID]
-	if !exists {
-		return fmt.Errorf("program %s not found", programID)
-	}
-
-	if program.Cancel != nil {
-		program.Cancel()
-	}
-
-	em.cleanupProgram(programID)
-	return nil
-}
-
-// ListActivePrograms returns a list of active program IDs
-func (em *CiliumEBPFManager) ListActivePrograms() []string {
-	em.mu.RLock()
-	defer em.mu.RUnlock()
-
-	ids := make([]string, 0, len(em.activePrograms))
-	for id := range em.activePrograms {
-		ids = append(ids, id)
-	}
-	return ids
-}
-
-// generateRealisticUDPEvent generates a realistic UDP event when eBPF probes fire
-func (em *CiliumEBPFManager) generateRealisticUDPEvent(programID string, eventCount *int) {
-	em.mu.RLock()
-	ebpfProgram, exists := em.activePrograms[programID]
-	em.mu.RUnlock()
-
-	if !exists {
-		return
-	}
-
-	// Use process data from actual UDP-using processes on the system
-	processes := []struct {
-		pid              uint32
-		name             string
-		expectedActivity string
-	}{
-		{1460, "avahi-daemon", "mDNS announcements"},
-		{1954, "dnsmasq", "DNS resolution"},
-		{4746, "firefox", "WebRTC/DNS queries"},
-		{1926, "tailscaled", "VPN keepalives"},
-		{1589, "NetworkManager", "DHCP renewal"},
-	}
-
-	// Select process based on the target probe to make it realistic
-	var selectedProc struct {
-		pid              uint32
-		name             string
-		expectedActivity string
-	}
-	switch ebpfProgram.Request.Target {
-	case "udp_sendmsg":
-		// More likely to catch outbound traffic from these processes
-		selectedProc = processes[*eventCount%3] // avahi, dnsmasq, firefox
-	case "udp_recvmsg":
-		// More likely to catch inbound traffic responses
-		selectedProc = processes[(*eventCount+1)%len(processes)]
-	default:
-		selectedProc = processes[*eventCount%len(processes)]
-	}
-
-	event := NetworkEvent{
-		Timestamp: uint64(time.Now().UnixNano()),
-		PID:       selectedProc.pid,
-		TID:       selectedProc.pid,
-		UID:       1000,
-		EventType: ebpfProgram.Request.Name,
-		CommStr:   selectedProc.name,
-	}
-
-	em.mu.Lock()
-	if prog, exists := em.activePrograms[programID]; exists {
-		prog.Events = append(prog.Events, event)
-		*eventCount++
-	}
-	em.mu.Unlock()
-}
-
-// extractProcessList extracts unique process names from eBPF events
-func (em *CiliumEBPFManager) extractProcessList(events []EBPFEvent) []string {
-	processSet := make(map[string]bool)
-	for _, event := range events {
-		if event.ProcessName != "" {
-			processSet[event.ProcessName] = true
-		}
-	}
-
-	processes := make([]string, 0, len(processSet))
-	for process := range processSet {
-		processes = append(processes, process)
-	}
-	return processes
-}
-
-// logEventSummary logs a grouped summary of eBPF events instead of individual events
-func (em *CiliumEBPFManager) logEventSummary(programID string, request EBPFRequest, events []EBPFEvent) {
-	if len(events) == 0 {
-		log.Printf("eBPF program %s (%s on %s) completed with 0 events", programID, request.Type, request.Target)
-		return
-	}
-
-	// Group events by process
-	processCounts := make(map[string]int)
-	for _, event := range events {
-		key := fmt.Sprintf("%s (PID %d)", event.ProcessName, event.ProcessID)
-		processCounts[key]++
-	}
-
-	// Create summary message
-	var summary strings.Builder
-	summary.WriteString(fmt.Sprintf("eBPF program %s (%s on %s) completed with %d events: ",
-		programID, request.Type, request.Target, len(events)))
-
-	i := 0
-	for process, count := range processCounts {
-		if i > 0 {
-			summary.WriteString(", ")
-		}
-		summary.WriteString(fmt.Sprintf("%s×%d", process, count))
-		i++
-	}
-
-	log.Printf(summary.String())
-}

ebpf_integration_modern.go

@@ -1,341 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"log"
-	"time"
-
-	"github.com/sashabaranov/go-openai"
-)
-
-// EBPFEnhancedDiagnosticResponse represents an AI response that includes eBPF program requests
-type EBPFEnhancedDiagnosticResponse struct {
-	ResponseType string        `json:"response_type"`
-	Reasoning    string        `json:"reasoning"`
-	Commands     []Command     `json:"commands"`
-	EBPFPrograms []EBPFRequest `json:"ebpf_programs,omitempty"`
-	Description  string        `json:"description,omitempty"`
-}
-
-// DiagnoseWithEBPF performs diagnosis using both regular commands and eBPF monitoring
-func (a *LinuxDiagnosticAgent) DiagnoseWithEBPF(issue string) error {
-	fmt.Printf("Diagnosing issue with eBPF monitoring: %s\n", issue)
-	fmt.Println("Gathering system information and eBPF capabilities...")
-
-	// Gather system information
-	systemInfo := GatherSystemInfo()
-
-	// Get eBPF capabilities if manager is available
-	var ebpfInfo string
-	if a.ebpfManager != nil {
-		capabilities := a.ebpfManager.GetCapabilities()
-		summary := a.ebpfManager.GetSummary()
-
-		commonPrograms := "\nCommon eBPF programs available: 3 programs including UDP monitoring, TCP monitoring, and syscall tracing via Cilium eBPF library"
-
-		ebpfInfo = fmt.Sprintf(`
-eBPF MONITORING CAPABILITIES:
-- Available capabilities: %v  
-- Manager status: %v%s
-
-eBPF USAGE INSTRUCTIONS:
-You can request eBPF monitoring by including "ebpf_programs" in your diagnostic response:
-{
-  "response_type": "diagnostic", 
-  "reasoning": "Need to trace system calls to debug the issue",
-  "commands": [...regular commands...],
-  "ebpf_programs": [
-    {
-      "name": "syscall_monitor",
-      "type": "tracepoint", 
-      "target": "syscalls/sys_enter_openat",
-      "duration": 15,
-      "filters": {"comm": "process_name"},
-      "description": "Monitor file open operations"
-    }
-  ]
-}
-
-Available eBPF program types:
-- tracepoint: Monitor kernel tracepoints (e.g., "syscalls/sys_enter_openat", "sched/sched_process_exec")
-- kprobe: Monitor kernel function entry (e.g., "tcp_connect", "vfs_read") 
-- kretprobe: Monitor kernel function return (e.g., "tcp_connect", "vfs_write")
-
-Common targets:
-- syscalls/sys_enter_openat (file operations)
-- syscalls/sys_enter_execve (process execution) 
-- tcp_connect, tcp_sendmsg (network activity)
-- vfs_read, vfs_write (file I/O)
-`, capabilities, summary, commonPrograms)
-	} else {
-		ebpfInfo = "\neBPF monitoring not available on this system"
-	}
-
-	// Create enhanced system prompt
-	initialPrompt := FormatSystemInfoForPrompt(systemInfo) + ebpfInfo +
-		fmt.Sprintf("\nISSUE DESCRIPTION: %s", issue)
-
-	// Start conversation
-	messages := []openai.ChatCompletionMessage{
-		{
-			Role:    openai.ChatMessageRoleUser,
-			Content: initialPrompt,
-		},
-	}
-
-	for {
-		// Send request to AI
-		response, err := a.sendRequest(messages)
-		if err != nil {
-			return fmt.Errorf("failed to send request: %w", err)
-		}
-
-		if len(response.Choices) == 0 {
-			return fmt.Errorf("no choices in response")
-		}
-
-		content := response.Choices[0].Message.Content
-		fmt.Printf("\nAI Response:\n%s\n", content)
-
-		// Try to parse as eBPF-enhanced diagnostic response
-		var ebpfResp EBPFEnhancedDiagnosticResponse
-		if err := json.Unmarshal([]byte(content), &ebpfResp); err == nil && ebpfResp.ResponseType == "diagnostic" {
-			fmt.Printf("\nReasoning: %s\n", ebpfResp.Reasoning)
-
-			// Execute both regular commands and eBPF programs
-			result, err := a.executeWithEBPFPrograms(ebpfResp)
-			if err != nil {
-				return fmt.Errorf("failed to execute with eBPF: %w", err)
-			}
-
-			// Add results to conversation
-			resultsJSON, err := json.MarshalIndent(result, "", "  ")
-			if err != nil {
-				return fmt.Errorf("failed to marshal results: %w", err)
-			}
-
-			messages = append(messages, openai.ChatCompletionMessage{
-				Role:    openai.ChatMessageRoleAssistant,
-				Content: content,
-			})
-			messages = append(messages, openai.ChatCompletionMessage{
-				Role:    openai.ChatMessageRoleUser,
-				Content: string(resultsJSON),
-			})
-
-			continue
-		}
-
-		// Try to parse as regular diagnostic response
-		var diagnosticResp DiagnosticResponse
-		if err := json.Unmarshal([]byte(content), &diagnosticResp); err == nil && diagnosticResp.ResponseType == "diagnostic" {
-			fmt.Printf("\nReasoning: %s\n", diagnosticResp.Reasoning)
-
-			if len(diagnosticResp.Commands) == 0 {
-				fmt.Println("No commands to execute")
-				break
-			}
-
-			// Execute regular commands only
-			commandResults := make([]CommandResult, 0, len(diagnosticResp.Commands))
-			for _, cmd := range diagnosticResp.Commands {
-				fmt.Printf("\nExecuting command '%s': %s\n", cmd.ID, cmd.Command)
-				result := a.executor.Execute(cmd)
-				commandResults = append(commandResults, result)
-
-				fmt.Printf("Output:\n%s\n", result.Output)
-				if result.Error != "" {
-					fmt.Printf("Error: %s\n", result.Error)
-				}
-			}
-
-			// Add results to conversation
-			resultsJSON, err := json.MarshalIndent(commandResults, "", "  ")
-			if err != nil {
-				return fmt.Errorf("failed to marshal results: %w", err)
-			}
-
-			messages = append(messages, openai.ChatCompletionMessage{
-				Role:    openai.ChatMessageRoleAssistant,
-				Content: content,
-			})
-			messages = append(messages, openai.ChatCompletionMessage{
-				Role:    openai.ChatMessageRoleUser,
-				Content: string(resultsJSON),
-			})
-
-			continue
-		}
-
-		// Try to parse as resolution response
-		var resolutionResp ResolutionResponse
-		if err := json.Unmarshal([]byte(content), &resolutionResp); err == nil && resolutionResp.ResponseType == "resolution" {
-			fmt.Printf("\n=== DIAGNOSIS COMPLETE ===\n")
-			fmt.Printf("Root Cause: %s\n", resolutionResp.RootCause)
-			fmt.Printf("Resolution Plan: %s\n", resolutionResp.ResolutionPlan)
-			fmt.Printf("Confidence: %s\n", resolutionResp.Confidence)
-
-			// Show any active eBPF programs
-			if a.ebpfManager != nil {
-				activePrograms := a.ebpfManager.ListActivePrograms()
-				if len(activePrograms) > 0 {
-					fmt.Printf("\n=== eBPF MONITORING SUMMARY ===\n")
-					for _, programID := range activePrograms {
-						if trace, err := a.ebpfManager.GetProgramResults(programID); err == nil {
-							fmt.Printf("Program %s: %s\n", programID, trace.Summary)
-						}
-					}
-				}
-			}
-
-			break
-		}
-
-		// Unknown response format
-		fmt.Printf("Unexpected response format:\n%s\n", content)
-		break
-	}
-
-	return nil
-}
-
-// executeWithEBPFPrograms executes regular commands alongside eBPF programs
-func (a *LinuxDiagnosticAgent) executeWithEBPFPrograms(resp EBPFEnhancedDiagnosticResponse) (map[string]interface{}, error) {
-	result := map[string]interface{}{
-		"command_results": make([]CommandResult, 0),
-		"ebpf_results":    make(map[string]*EBPFTrace),
-	}
-
-	var ebpfProgramIDs []string
-
-	// Debug: Check if eBPF programs were requested
-	fmt.Printf("DEBUG: AI requested %d eBPF programs\n", len(resp.EBPFPrograms))
-	if a.ebpfManager == nil {
-		fmt.Printf("DEBUG: eBPF manager is nil\n")
-	} else {
-		fmt.Printf("DEBUG: eBPF manager available, capabilities: %v\n", a.ebpfManager.GetCapabilities())
-	}
-
-	// Start eBPF programs if requested and available
-	if len(resp.EBPFPrograms) > 0 && a.ebpfManager != nil {
-		fmt.Printf("Starting %d eBPF monitoring programs...\n", len(resp.EBPFPrograms))
-
-		for _, program := range resp.EBPFPrograms {
-			programID, err := a.ebpfManager.StartEBPFProgram(program)
-			if err != nil {
-				log.Printf("Failed to start eBPF program %s: %v", program.Name, err)
-				continue
-			}
-			ebpfProgramIDs = append(ebpfProgramIDs, programID)
-			fmt.Printf("Started eBPF program: %s (%s on %s)\n", programID, program.Type, program.Target)
-		}
-
-		// Give eBPF programs time to start
-		time.Sleep(200 * time.Millisecond)
-	}
-
-	// Execute regular commands
-	commandResults := make([]CommandResult, 0, len(resp.Commands))
-	for _, cmd := range resp.Commands {
-		fmt.Printf("\nExecuting command '%s': %s\n", cmd.ID, cmd.Command)
-		cmdResult := a.executor.Execute(cmd)
-		commandResults = append(commandResults, cmdResult)
-
-		fmt.Printf("Output:\n%s\n", cmdResult.Output)
-		if cmdResult.Error != "" {
-			fmt.Printf("Error: %s\n", cmdResult.Error)
-		}
-	}
-
-	result["command_results"] = commandResults
-
-	// If no eBPF programs were requested but we have eBPF capability and this seems network-related,
-	// automatically start UDP monitoring
-	if len(ebpfProgramIDs) == 0 && a.ebpfManager != nil && len(resp.EBPFPrograms) == 0 {
-		fmt.Printf("No eBPF programs requested by AI - starting default UDP monitoring...\n")
-
-		defaultUDPPrograms := []EBPFRequest{
-			{
-				Name:        "udp_sendmsg_auto",
-				Type:        "kprobe",
-				Target:      "udp_sendmsg",
-				Duration:    10,
-				Description: "Monitor UDP send operations",
-			},
-			{
-				Name:        "udp_recvmsg_auto",
-				Type:        "kprobe",
-				Target:      "udp_recvmsg",
-				Duration:    10,
-				Description: "Monitor UDP receive operations",
-			},
-		}
-
-		for _, program := range defaultUDPPrograms {
-			programID, err := a.ebpfManager.StartEBPFProgram(program)
-			if err != nil {
-				log.Printf("Failed to start default eBPF program %s: %v", program.Name, err)
-				continue
-			}
-			ebpfProgramIDs = append(ebpfProgramIDs, programID)
-			fmt.Printf("Started default eBPF program: %s (%s on %s)\n", programID, program.Type, program.Target)
-		}
-	}
-
-	// Wait for eBPF programs to complete and collect results
-	if len(ebpfProgramIDs) > 0 {
-		fmt.Printf("Waiting for %d eBPF programs to complete...\n", len(ebpfProgramIDs))
-
-		// Wait for the longest duration + buffer
-		maxDuration := 0
-		for _, program := range resp.EBPFPrograms {
-			if program.Duration > maxDuration {
-				maxDuration = program.Duration
-			}
-		}
-
-		waitTime := time.Duration(maxDuration+2) * time.Second
-		if waitTime < 5*time.Second {
-			waitTime = 5 * time.Second
-		}
-
-		time.Sleep(waitTime)
-
-		// Collect results
-		ebpfResults := make(map[string]*EBPFTrace)
-		for _, programID := range ebpfProgramIDs {
-			if trace, err := a.ebpfManager.GetProgramResults(programID); err == nil {
-				ebpfResults[programID] = trace
-				fmt.Printf("Collected eBPF results from %s: %d events\n", programID, trace.EventCount)
-			} else {
-				log.Printf("Failed to get results from eBPF program %s: %v", programID, err)
-			}
-		}
-
-		result["ebpf_results"] = ebpfResults
-	}
-
-	return result, nil
-}
-
-// GetEBPFCapabilitiesPrompt returns eBPF capabilities formatted for AI prompts
-func (a *LinuxDiagnosticAgent) GetEBPFCapabilitiesPrompt() string {
-	if a.ebpfManager == nil {
-		return "eBPF monitoring not available"
-	}
-
-	capabilities := a.ebpfManager.GetCapabilities()
-	summary := a.ebpfManager.GetSummary()
-
-	return fmt.Sprintf(`
-eBPF MONITORING SYSTEM STATUS:
-- Capabilities: %v
-- Manager Status: %v
-
-INTEGRATION INSTRUCTIONS:
-To request eBPF monitoring, include "ebpf_programs" array in diagnostic responses.
-Each program should specify type (tracepoint/kprobe/kretprobe), target, and duration.
-eBPF programs will run in parallel with regular diagnostic commands.
-`, capabilities, summary)
-}

ebpf_interface.go

@@ -1,4 +0,0 @@
-package main
-
-// This file intentionally left minimal to avoid compilation order issues
-// The EBPFManagerInterface is defined in ebpf_simple_manager.go

ebpf_simple_manager.go

@@ -1,387 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"log"
-	"os"
-	"os/exec"
-	"strings"
-	"sync"
-	"time"
-)
-
-// EBPFEvent represents an event captured by eBPF programs
-type EBPFEvent struct {
-	Timestamp   int64                  `json:"timestamp"`
-	EventType   string                 `json:"event_type"`
-	ProcessID   int                    `json:"process_id"`
-	ProcessName string                 `json:"process_name"`
-	UserID      int                    `json:"user_id"`
-	Data        map[string]interface{} `json:"data"`
-}
-
-// EBPFTrace represents a collection of eBPF events for a specific investigation
-type EBPFTrace struct {
-	TraceID     string      `json:"trace_id"`
-	StartTime   time.Time   `json:"start_time"`
-	EndTime     time.Time   `json:"end_time"`
-	Capability  string      `json:"capability"`
-	Events      []EBPFEvent `json:"events"`
-	Summary     string      `json:"summary"`
-	EventCount  int         `json:"event_count"`
-	ProcessList []string    `json:"process_list"`
-}
-
-// EBPFRequest represents a request to run eBPF monitoring
-type EBPFRequest struct {
-	Name        string            `json:"name"`
-	Type        string            `json:"type"`     // "tracepoint", "kprobe", "kretprobe"
-	Target      string            `json:"target"`   // tracepoint path or function name
-	Duration    int               `json:"duration"` // seconds
-	Filters     map[string]string `json:"filters,omitempty"`
-	Description string            `json:"description"`
-}
-
-// EBPFManagerInterface defines the interface for eBPF managers
-type EBPFManagerInterface interface {
-	GetCapabilities() map[string]bool
-	GetSummary() map[string]interface{}
-	StartEBPFProgram(req EBPFRequest) (string, error)
-	GetProgramResults(programID string) (*EBPFTrace, error)
-	StopProgram(programID string) error
-	ListActivePrograms() []string
-}
-
-// SimpleEBPFManager implements basic eBPF functionality using bpftrace
-type SimpleEBPFManager struct {
-	programs       map[string]*RunningProgram
-	programsLock   sync.RWMutex
-	capabilities   map[string]bool
-	programCounter int
-}
-
-// RunningProgram represents an active eBPF program
-type RunningProgram struct {
-	ID        string
-	Request   EBPFRequest
-	Process   *exec.Cmd
-	Events    []EBPFEvent
-	StartTime time.Time
-	Cancel    context.CancelFunc
-}
-
-// NewSimpleEBPFManager creates a new simple eBPF manager
-func NewSimpleEBPFManager() *SimpleEBPFManager {
-	manager := &SimpleEBPFManager{
-		programs:     make(map[string]*RunningProgram),
-		capabilities: make(map[string]bool),
-	}
-
-	// Test capabilities
-	manager.testCapabilities()
-	return manager
-}
-
-// testCapabilities checks what eBPF capabilities are available
-func (em *SimpleEBPFManager) testCapabilities() {
-	// Test if bpftrace is available
-	if _, err := exec.LookPath("bpftrace"); err == nil {
-		em.capabilities["bpftrace"] = true
-	}
-
-	// Test root privileges (required for eBPF)
-	em.capabilities["root_access"] = os.Geteuid() == 0
-
-	// Test kernel version (simplified check)
-	cmd := exec.Command("uname", "-r")
-	output, err := cmd.Output()
-	if err == nil {
-		version := strings.TrimSpace(string(output))
-		em.capabilities["kernel_ebpf"] = strings.Contains(version, "4.") || strings.Contains(version, "5.") || strings.Contains(version, "6.")
-	} else {
-		em.capabilities["kernel_ebpf"] = false
-	}
-
-	log.Printf("eBPF capabilities: %+v", em.capabilities)
-}
-
-// GetCapabilities returns the available eBPF capabilities
-func (em *SimpleEBPFManager) GetCapabilities() map[string]bool {
-	em.programsLock.RLock()
-	defer em.programsLock.RUnlock()
-
-	caps := make(map[string]bool)
-	for k, v := range em.capabilities {
-		caps[k] = v
-	}
-	return caps
-}
-
-// GetSummary returns a summary of the eBPF manager state
-func (em *SimpleEBPFManager) GetSummary() map[string]interface{} {
-	em.programsLock.RLock()
-	defer em.programsLock.RUnlock()
-
-	return map[string]interface{}{
-		"capabilities":    em.capabilities,
-		"active_programs": len(em.programs),
-		"program_ids":     em.ListActivePrograms(),
-	}
-}
-
-// StartEBPFProgram starts a new eBPF monitoring program
-func (em *SimpleEBPFManager) StartEBPFProgram(req EBPFRequest) (string, error) {
-	if !em.capabilities["bpftrace"] {
-		return "", fmt.Errorf("bpftrace not available")
-	}
-
-	if !em.capabilities["root_access"] {
-		return "", fmt.Errorf("root access required for eBPF programs")
-	}
-
-	em.programsLock.Lock()
-	defer em.programsLock.Unlock()
-
-	// Generate program ID
-	em.programCounter++
-	programID := fmt.Sprintf("prog_%d", em.programCounter)
-
-	// Create bpftrace script
-	script, err := em.generateBpftraceScript(req)
-	if err != nil {
-		return "", fmt.Errorf("failed to generate script: %w", err)
-	}
-
-	// Start bpftrace process
-	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(req.Duration)*time.Second)
-	cmd := exec.CommandContext(ctx, "bpftrace", "-e", script)
-
-	program := &RunningProgram{
-		ID:        programID,
-		Request:   req,
-		Process:   cmd,
-		Events:    []EBPFEvent{},
-		StartTime: time.Now(),
-		Cancel:    cancel,
-	}
-
-	// Start the program
-	if err := cmd.Start(); err != nil {
-		cancel()
-		return "", fmt.Errorf("failed to start bpftrace: %w", err)
-	}
-
-	em.programs[programID] = program
-
-	// Monitor the program in a goroutine
-	go em.monitorProgram(programID)
-
-	log.Printf("Started eBPF program %s for %s", programID, req.Name)
-	return programID, nil
-}
-
-// generateBpftraceScript creates a bpftrace script based on the request
-func (em *SimpleEBPFManager) generateBpftraceScript(req EBPFRequest) (string, error) {
-	switch req.Type {
-	case "network":
-		return `
-BEGIN {
-	printf("Starting network monitoring...\n");
-}
-
-tracepoint:syscalls:sys_enter_connect,
-tracepoint:syscalls:sys_enter_accept,
-tracepoint:syscalls:sys_enter_recvfrom,
-tracepoint:syscalls:sys_enter_sendto {
-	printf("NETWORK|%d|%s|%d|%s\n", nsecs, probe, pid, comm);
-}
-
-END {
-	printf("Network monitoring completed\n");
-}`, nil
-
-	case "process":
-		return `
-BEGIN {
-	printf("Starting process monitoring...\n");
-}
-
-tracepoint:syscalls:sys_enter_execve,
-tracepoint:syscalls:sys_enter_fork,
-tracepoint:syscalls:sys_enter_clone {
-	printf("PROCESS|%d|%s|%d|%s\n", nsecs, probe, pid, comm);
-}
-
-END {
-	printf("Process monitoring completed\n");
-}`, nil
-
-	case "file":
-		return `
-BEGIN {
-	printf("Starting file monitoring...\n");
-}
-
-tracepoint:syscalls:sys_enter_open,
-tracepoint:syscalls:sys_enter_openat,
-tracepoint:syscalls:sys_enter_read,
-tracepoint:syscalls:sys_enter_write {
-	printf("FILE|%d|%s|%d|%s\n", nsecs, probe, pid, comm);
-}
-
-END {
-	printf("File monitoring completed\n");
-}`, nil
-
-	default:
-		return "", fmt.Errorf("unsupported eBPF program type: %s", req.Type)
-	}
-}
-
-// monitorProgram monitors a running eBPF program and collects events
-func (em *SimpleEBPFManager) monitorProgram(programID string) {
-	em.programsLock.Lock()
-	program, exists := em.programs[programID]
-	if !exists {
-		em.programsLock.Unlock()
-		return
-	}
-	em.programsLock.Unlock()
-
-	// Wait for the program to complete
-	err := program.Process.Wait()
-
-	// Clean up
-	program.Cancel()
-
-	em.programsLock.Lock()
-	if err != nil {
-		log.Printf("eBPF program %s completed with error: %v", programID, err)
-	} else {
-		log.Printf("eBPF program %s completed successfully", programID)
-	}
-
-	// Parse output and generate events (simplified for demo)
-	// In a real implementation, you would parse the bpftrace output
-	program.Events = []EBPFEvent{
-		{
-			Timestamp:   time.Now().Unix(),
-			EventType:   program.Request.Type,
-			ProcessID:   0,
-			ProcessName: "example",
-			UserID:      0,
-			Data: map[string]interface{}{
-				"description": "Sample eBPF event",
-				"program_id":  programID,
-			},
-		},
-	}
-	em.programsLock.Unlock()
-
-	log.Printf("Generated %d events for program %s", len(program.Events), programID)
-}
-
-// GetProgramResults returns the results of a completed program
-func (em *SimpleEBPFManager) GetProgramResults(programID string) (*EBPFTrace, error) {
-	em.programsLock.RLock()
-	defer em.programsLock.RUnlock()
-
-	program, exists := em.programs[programID]
-	if !exists {
-		return nil, fmt.Errorf("program %s not found", programID)
-	}
-
-	// Check if program is still running
-	if program.Process.ProcessState == nil {
-		return nil, fmt.Errorf("program %s is still running", programID)
-	}
-
-	events := make([]EBPFEvent, len(program.Events))
-	copy(events, program.Events)
-
-	processes := make([]string, 0)
-	processMap := make(map[string]bool)
-	for _, event := range events {
-		if !processMap[event.ProcessName] {
-			processes = append(processes, event.ProcessName)
-			processMap[event.ProcessName] = true
-		}
-	}
-
-	trace := &EBPFTrace{
-		TraceID:     programID,
-		StartTime:   program.StartTime,
-		EndTime:     time.Now(),
-		Capability:  program.Request.Type,
-		Events:      events,
-		EventCount:  len(events),
-		ProcessList: processes,
-		Summary:     fmt.Sprintf("Collected %d events for %s monitoring", len(events), program.Request.Type),
-	}
-
-	return trace, nil
-}
-
-// StopProgram stops a running eBPF program
-func (em *SimpleEBPFManager) StopProgram(programID string) error {
-	em.programsLock.Lock()
-	defer em.programsLock.Unlock()
-
-	program, exists := em.programs[programID]
-	if !exists {
-		return fmt.Errorf("program %s not found", programID)
-	}
-
-	// Cancel the context and kill the process
-	program.Cancel()
-	if program.Process.Process != nil {
-		program.Process.Process.Kill()
-	}
-
-	delete(em.programs, programID)
-	log.Printf("Stopped eBPF program %s", programID)
-	return nil
-}
-
-// ListActivePrograms returns a list of active program IDs
-func (em *SimpleEBPFManager) ListActivePrograms() []string {
-	em.programsLock.RLock()
-	defer em.programsLock.RUnlock()
-
-	programs := make([]string, 0, len(em.programs))
-	for id := range em.programs {
-		programs = append(programs, id)
-	}
-	return programs
-}
-
-// GetCommonEBPFRequests returns predefined eBPF programs for common use cases
-func (em *SimpleEBPFManager) GetCommonEBPFRequests() []EBPFRequest {
-	return []EBPFRequest{
-		{
-			Name:        "network_activity",
-			Type:        "network",
-			Target:      "syscalls:sys_enter_connect,sys_enter_accept,sys_enter_recvfrom,sys_enter_sendto",
-			Duration:    30,
-			Description: "Monitor network connections and data transfers",
-		},
-		{
-			Name:        "process_activity",
-			Type:        "process",
-			Target:      "syscalls:sys_enter_execve,sys_enter_fork,sys_enter_clone",
-			Duration:    30,
-			Description: "Monitor process creation and execution",
-		},
-		{
-			Name:        "file_access",
-			Type:        "file",
-			Target:      "syscalls:sys_enter_open,sys_enter_openat,sys_enter_read,sys_enter_write",
-			Duration:    30,
-			Description: "Monitor file system access and I/O operations",
-		},
-	}
-}
-
-// Helper functions - using system_info.go functions
-// isRoot and checkKernelVersion are available from system_info.go

ebpf_test_addon.go

@@ -1,67 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-)
-
-// Standalone test for eBPF integration
-func testEBPFIntegration() {
-	fmt.Println("🔬 eBPF Integration Quick Test")
-	fmt.Println("=============================")
-
-	// Skip privilege checks for testing - show what would happen
-	if os.Geteuid() != 0 {
-		fmt.Println("⚠️  Running as non-root user - showing limited test results")
-		fmt.Println("   In production, this program requires root privileges")
-		fmt.Println("")
-	}
-
-	// Create a basic diagnostic agent
-	agent := NewLinuxDiagnosticAgent()
-
-	// Test eBPF capability detection
-	fmt.Println("1. Checking eBPF Capabilities:")
-
-	// Test if eBPF manager was initialized
-	if agent.ebpfManager == nil {
-		fmt.Println("   ❌ eBPF Manager not initialized")
-		return
-	}
-	fmt.Println("   ✅ eBPF Manager initialized successfully")
-
-	// Test eBPF program suggestions for different categories
-	fmt.Println("2. Testing eBPF Program Categories:")
-
-	// Simulate what would be available for different issue types
-	categories := []string{"NETWORK", "PROCESS", "FILE", "PERFORMANCE"}
-	for _, category := range categories {
-		fmt.Printf("   %s: Available\n", category)
-	}
-
-	// Test simple diagnostic with eBPF
-	fmt.Println("3. Testing eBPF-Enhanced Diagnostics:")
-
-	testIssue := "Process hanging - application stops responding"
-	fmt.Printf("   Issue: %s\n", testIssue)
-
-	// Call the eBPF-enhanced diagnostic (adjusted parameters)
-	result := agent.DiagnoseWithEBPF(testIssue)
-
-	fmt.Printf("   Response received: %s\n", result)
-	fmt.Println()
-
-	fmt.Println("✅ eBPF Integration Test Complete!")
-	fmt.Println("   The agent successfully:")
-	fmt.Println("   - Initialized eBPF manager")
-	fmt.Println("   - Integrated with diagnostic system")
-	fmt.Println("   - Ready for eBPF program execution")
-}
-
-// Add test command to main if run with "test-ebpf" argument
-func init() {
-	if len(os.Args) > 1 && os.Args[1] == "test-ebpf" {
-		testEBPFIntegration()
-		os.Exit(0)
-	}
-}

investigation_server.go

@@ -348,14 +348,19 @@ func (s *InvestigationServer) handleDiagnosticExecution(requestBody map[string]i
 	// Execute all commands
 	commandResults := make([]CommandResult, 0, len(diagnosticResp.Commands))
 
-	for _, cmd := range diagnosticResp.Commands {
+	for i, cmdStr := range diagnosticResp.Commands {
+		// Convert string to Command struct
+		cmd := Command{
+			ID:          fmt.Sprintf("cmd_%d", i),
+			Command:     cmdStr,
+			Description: fmt.Sprintf("Investigation command: %s", cmdStr),
+		}
 		fmt.Printf("⚙️  Executing command '%s': %s\n", cmd.ID, cmd.Command)
 
 		// Use the agent's executor to run the command
 		result := s.agent.executor.Execute(cmd)
 		commandResults = append(commandResults, result)
 
-
 		if result.Error != "" {
 			fmt.Printf("⚠️  Command '%s' had error: %s\n", cmd.ID, result.Error)
 		}
@@ -471,7 +476,6 @@ func (s *InvestigationServer) handlePendingInvestigation(investigation PendingIn
 		return
 	}
 
-
 }
 
 // updateInvestigationStatus updates the status of a pending investigation

main.go

@@ -73,7 +73,6 @@ func checkKernelVersionCompatibility() {
 		os.Exit(1)
 	}
 
-
 }
 
 // checkEBPFSupport validates eBPF subsystem availability
@@ -97,7 +96,6 @@ func checkEBPFSupport() {
 		syscall.Close(int(fd))
 	}
 
-
 }
 
 // runInteractiveDiagnostics starts the interactive diagnostic session

system_info.go

@@ -152,50 +152,3 @@ ISSUE DESCRIPTION:`,
 		info.PrivateIPs,
 		runtime.Version())
 }
-
-// FormatSystemInfoWithEBPFForPrompt formats system information including eBPF capabilities
-func FormatSystemInfoWithEBPFForPrompt(info *SystemInfo, ebpfManager EBPFManagerInterface) string {
-	baseInfo := FormatSystemInfoForPrompt(info)
-
-	if ebpfManager == nil {
-		return baseInfo + "\neBPF CAPABILITIES: Not available\n"
-	}
-
-	capabilities := ebpfManager.GetCapabilities()
-	summary := ebpfManager.GetSummary()
-
-	ebpfInfo := fmt.Sprintf(`
-eBPF MONITORING CAPABILITIES:
-- System Call Tracing: %v
-- Network Activity Tracing: %v
-- Process Monitoring: %v
-- File System Monitoring: %v
-- Performance Monitoring: %v
-- Security Event Monitoring: %v
-
-eBPF INTEGRATION GUIDE:
-To request eBPF monitoring during diagnosis, include these fields in your JSON response:
-{
-  "response_type": "diagnostic",
-  "reasoning": "explanation of why eBPF monitoring is needed",
-  "commands": [regular diagnostic commands],
-  "ebpf_capabilities": ["syscall_trace", "network_trace", "process_trace"],
-  "ebpf_duration_seconds": 15,
-  "ebpf_filters": {"pid": "process_id", "comm": "process_name", "path": "/specific/path"}
-}
-
-Available eBPF capabilities: %v
-eBPF Status: %v
-
-`,
-		capabilities["tracepoint"],
-		capabilities["kprobe"],
-		capabilities["kernel_support"],
-		capabilities["tracepoint"],
-		capabilities["kernel_support"],
-		capabilities["bpftrace_available"],
-		capabilities,
-		summary)
-
-	return baseInfo + ebpfInfo
-}

websocket_client.go

@@ -407,8 +407,9 @@ func (c *WebSocketClient) executeEBPFPrograms(ebpfPrograms []interface{}) []map[
 		})
 	}
 
-	// Execute eBPF programs using the agent's eBPF execution logic
+	// Execute eBPF programs using the agent's new BCC concurrent execution logic
-	return c.agent.executeEBPFPrograms(ebpfRequests)
+	traceSpecs := c.agent.convertEBPFProgramsToTraceSpecs(ebpfRequests)
+	return c.agent.executeBCCTracesConcurrently(traceSpecs)
 }
 
 // executeCommandsFromPayload executes commands from a payload and returns results