kit

dbg.c (115451B)

---

 #include <kit/arch.h>
 #include <kit/compile.h>
 #include <kit/core.h>
 #include <kit/dbg.h>
 #include <kit/disasm.h>
 #include <kit/dwarf.h>
 #include <kit/jit.h>
 #include <kit/link.h>
 #include <kit/object.h>
 #include <stddef.h>
 #include <stdint.h>
 #include <string.h>
 
 #include "backtrace.h"
 #include "cflags.h"
 #include "driver.h"
 #include "hosted.h"
 #include "inputs.h"
 
 /* `kit dbg` — interactive JIT debugger.
  *
  * Mirrors `kit run` for compile flags and argv shape, but instead of
  * calling the entry directly drops into a REPL that drives a
  * KitDebugSession. The session (in libkit) owns the worker thread,
  * signal handlers, breakpoint patcher, and per-arch single-step /
  * displaced-step trampoline. This driver TU only:
  *
  *   - parses argv and turns the source list into a JIT image,
  *   - opens DWARF and a JIT-image view,
  *   - manages a driver-local breakpoint table (id, spec text, enabled
  *     flag) keyed off session-side handles,
  *   - parses LOC strings (file:line, sym[+off], 0xADDR) into addresses
  *     via kit_dwarf_line_to_addr / kit_jit_lookup,
  *   - reads commands from stdin and dispatches,
  *   - renders KitStopInfo into source-level stop messages and the
  *     backtrace via kit_dwarf_unwind_step,
  *   - decodes `p name` via kit_dwarf_var_at + kit_dwarf_loc_read.
  *
  * Forwarding Ctrl-C: while a session call is in flight the driver
  * installs a SIGINT handler that calls kit_dbg_session_interrupt; on
  * return it restores SIG_DFL so Ctrl-C at the REPL prompt terminates
  * the program. */
 
 #define DBG_TOOL "dbg"
 #define LINE_CAP 1024
 #define WORD_CAP 256
 #define HEX_CAP 8 /* upper bound on per-arch trap-byte save */
 
 /* ============================================================
  * argv parsing (mirrors run.c)
  * ============================================================ */
 
 typedef enum { DBG_ENTRY_FILE, DBG_ENTRY_CMD } DbgEntryKind;
 typedef struct {
   DbgEntryKind kind;
   const char* value; /* argv pointer — no per-entry allocation */
 } DbgScriptEntry;
 
 typedef struct DbgOpts {
   DriverEnv* env;
   KitFrontendRegistry* frontends;
   size_t argv_bound;
 
   int opt_level;
   int debug_info;
   const char* entry;
   const char* sysroot;
   int wants_hosted_libc;
   KitLanguage default_lang;
   int has_default_lang;
 
   DriverHostedPlan hosted;
   DriverCflags cf;
   DriverInputs inputs;
 
   char** prog_argv;
   uint32_t prog_argc;
 
   DbgScriptEntry* script_entries;
   uint32_t nscript_entries;
   uint32_t script_entries_cap;
   int batch_mode;
 } DbgOpts;
 
 void driver_help_dbg(void) {
   driver_printf(
       "%.*s",
       KIT_SLICE_ARG(KIT_SLICE_LIT(
           "kit dbg — interactive JIT debugger\n"
           "\n"
           "USAGE\n"
           "  kit dbg [options] [input.{c,s,wat,wasm} ...] [-- prog-arg ...]\n"
           "\n"
           "DESCRIPTION\n"
           "  Uses `kit run`'s preprocessing, hosted-SDK, and argv shape, but\n"
           "  instead of calling the entry directly drops into a REPL that\n"
           "  drives the JIT session: breakpoints, source-line stepping into or\n"
           "  over calls, instruction stepping, finish, backtrace, registers,\n"
           "  locals/args, variable read/write, and raw memory examine. -g is\n"
           "  forced on so source lines and\n"
           "  variable locations are available at runtime.\n"
           "  Current debugger support is limited to Darwin/Linux aarch64\n"
           "  hosts.\n"
           "\n"
           "  Anything after `--` is passed to the JITed program as argv.\n"
           "  With no input files, dbg starts an empty JIT session; append "
           "code\n"
           "  with `jit` or evaluate expressions directly from the REPL.\n"
           "\n"
           "COMPILE OPTIONS\n"
           "  -O0 -O1 -O2       Optimization level; -O2 aliases -O1 "
           "(default -O0)\n"
           "  -g                Emit DWARF (forced on)\n"
           "  -e SYMBOL         Entry symbol (default `main`)\n"
           "  --sysroot DIR, -isysroot DIR\n"
           "                    Hosted SDK/sysroot for headers with -lc\n"
           "  -lc, -l c         Enable hosted libc headers/definitions\n"
           "  -x LANG           Default REPL language: c, asm, wasm/wat\n"
           "  --language LANG   Same as -x\n"
           "  -I DIR            Add quoted-include search path\n"
           "  -isystem DIR      Add system-include search path\n"
           "  -D NAME[=BODY]    Define a macro\n"
           "  -U NAME           Undefine a builtin/predefined macro\n"
           "\n"
           "REPL COMMANDS (also shown by `h` at the prompt)\n"
           "  h, help                      show REPL help\n"
           "  q, quit                      exit (Ctrl-D also works)\n"
           "  r, run                       start fresh execution at entry\n"
           "  c, cont                      continue after a stop\n"
           "  s, step                      step to next source line (into "
           "calls)\n"
           "  si, stepi                    single-step one instruction\n"
           "  n, next                      step to next source line (over "
           "calls)\n"
           "  finish                       run until current frame returns\n"
           "  jit [LANG|NAME] { ... }      compile and append a language "
           "snippet\n"
           "  { ... }                      same as jit { ... }\n"
           "  edit [LANG|NAME]             edit and append a language snippet\n"
           "                               (Ctrl-G edits the current input line "
           "in $EDITOR)\n"
           "                               Set $EDITOR before starting dbg to\n"
           "                               select the editor command.\n"
           "  expr EXPR | expr { ... }     compile and call an expression "
           "thunk\n"
           "  EXPR                         same as expr EXPR\n"
           "                               LANG defaults to the selected "
           "language\n"
           "  jump ADDR                    set PC to ADDR (no resume)\n"
           "  bt, backtrace                print stack trace with arguments\n"
           "  b LOC                        set breakpoint at LOC:\n"
           "                                  0xADDR | sym[+off] | file.c:line\n"
           "  ignore N COUNT               skip the next COUNT hits of bp N\n"
           "  d N, delete N                delete breakpoint N\n"
           "  enable N | disable N         toggle breakpoint N\n"
           "  p NAME                       print variable / global\n"
           "  set NAME VALUE               write VALUE into NAME\n"
           "  x ADDR [count]               examine memory (default 16 bytes)\n"
           "  disasm [ADDR] [count], x/i    disassemble at PC or ADDR\n"
           "  list FILE:LINE | l FILE:LINE source listing around FILE:LINE\n"
           "  info b                       list breakpoints\n"
           "  info reg, info registers     dump registers\n"
           "  info locals | info args      list locals / args at current PC\n"
           "  info functions [PATTERN]     list JIT functions matching PATTERN\n"
           "  info variables [PATTERN]     list JIT globals  matching PATTERN\n")));
   driver_printf(
       "%.*s",
       KIT_SLICE_ARG(KIT_SLICE_LIT(
           "\n"
           "BATCH / SCRIPTING\n"
           "  --script FILE     execute debugger commands from FILE "
           "(repeatable)\n"
           "  --command CMD     execute CMD as if typed at the REPL "
           "(repeatable)\n"
           "  -c CMD            same as --command\n"
           "  --batch           non-interactive: suppress banner, exit after\n"
           "                    --script / --command sources drain; exit 1 on\n"
           "                    any command error\n"
           "  Each script command must fit on one line. Missing, unreadable,\n"
           "  overlong, or malformed explicit scripts return status 1 without\n"
           "  falling through to an interactive prompt.\n"
           "\n"
           "SIGNALS\n"
           "  Ctrl-C is forwarded into the running session as an interrupt; at\n"
           "  the REPL prompt it terminates the program normally.\n"
           "\n"
           "GETTING HELP\n"
           "  -h, --help                   Show this help and exit (this is "
           "the\n"
           "                               command-line help; once the REPL is\n"
           "                               running, type `h` for REPL "
           "commands)\n"
           "  --version                    Show Kit version and exit\n"
           "\n"
           "EXAMPLES\n"
           "  # Interactive source debugging (supported host above).\n"
           "  kit dbg -O0 program.c -- arg1\n"
           "  # At the prompt: b main, r, n, p value, bt, q\n"
           "\n"
           "  # Deterministic batch session.\n"
           "  printf '%s\\n' 'b main' 'r' 'bt' 'q' > commands.dbg\n"
           "  kit dbg --batch --script commands.dbg program.c\n"
           "\n"
           "  # Hosted headers on macOS require Kit's printed SDK.\n"
           "  SDK=\"$(kit cc -print-sysroot)\"\n"
           "  kit dbg -lc --sysroot \"$SDK\" hosted.c\n"
           "\n"
           "EXIT CODES\n"
           "  0   clean exit       1   compile/link/command error       2   "
           "bad "
           "usage\n")));
 }
 
 static int dbg_alloc_arrays(DbgOpts* o, int argc) {
   size_t bound = (size_t)argc;
   o->argv_bound = bound;
   o->prog_argv = driver_alloc_zeroed(o->env, bound * sizeof(*o->prog_argv));
   if (!o->prog_argv) {
     driver_errf(DBG_TOOL, "out of memory");
     return 1;
   }
   if (driver_inputs_init(&o->inputs, o->env, DBG_TOOL, argc) != 0) return 1;
   o->inputs.frontends = o->frontends;
   if (driver_cflags_init(
           &o->cf, o->env,
           argc + DRIVER_HOSTED_MAX_INCLUDES + DRIVER_HOSTED_MAX_DEFINES) != 0) {
     driver_errf(DBG_TOOL, "out of memory");
     return 1;
   }
   return 0;
 }
 
 static int dbg_apply_hosted_profile(DbgOpts* o) {
   DriverHostedRequest req;
   uint32_t i;
   if (!o->wants_hosted_libc) return 0;
   {
     DriverHostedRequest z = {0};
     req = z;
   }
   req.env = o->env;
   req.tool = DBG_TOOL;
   req.target = driver_host_target();
   req.sysroot = o->sysroot;
   req.static_link = 0;
   req.link_inputs = 0;
   if (driver_hosted_resolve(&req, &o->hosted) != 0) return 1;
   for (i = 0; i < o->hosted.nsystem_includes; ++i) {
     o->cf.system_include_dirs[o->cf.nsystem_include_dirs++] =
         o->hosted.system_includes[i];
   }
   for (i = 0; i < o->hosted.ndefines; ++i) {
     o->cf.defines[o->cf.ndefines++] = o->hosted.defines[i];
   }
   return 0;
 }
 
 static int dbg_parse_language_name(DbgOpts* o, const char* name,
                                    KitLanguage* out) {
   KitLanguage lang;
   if (!name || !*name || !out) return 0;
   lang = kit_frontend_registry_language_for_name(o->frontends, name);
   if (lang == KIT_LANG_UNKNOWN) return 0;
   *out = lang;
   return 1;
 }
 
 static int dbg_set_default_language(DbgOpts* o, const char* name) {
   KitLanguage lang = KIT_LANG_AUTO;
   if (!dbg_parse_language_name(o, name, &lang)) {
     driver_errf(DBG_TOOL, "unsupported language: %.*s",
                 KIT_SLICE_ARG(kit_slice_cstr(name)));
     return 1;
   }
   o->default_lang = lang;
   o->has_default_lang = 1;
   return 0;
 }
 
 static int dbg_script_entry_push(DbgOpts* o, DbgEntryKind kind,
                                  const char* value) {
   if (o->nscript_entries >= o->script_entries_cap) {
     uint32_t nc = o->script_entries_cap ? o->script_entries_cap * 2 : 4;
     size_t old_sz = (size_t)o->script_entries_cap * sizeof(DbgScriptEntry);
     size_t new_sz = (size_t)nc * sizeof(DbgScriptEntry);
     DbgScriptEntry* nb =
         o->env->heap->realloc(o->env->heap, o->script_entries, old_sz, new_sz,
                               _Alignof(DbgScriptEntry));
     if (!nb) {
       driver_errf(DBG_TOOL, "out of memory");
       return 1;
     }
     o->script_entries = nb;
     o->script_entries_cap = nc;
   }
   o->script_entries[o->nscript_entries].kind = kind;
   o->script_entries[o->nscript_entries].value = value;
   o->nscript_entries++;
   return 0;
 }
 
 static int dbg_parse(int argc, char** argv, DbgOpts* o) {
   int i;
   int after_dash_dash = 0;
   if (dbg_alloc_arrays(o, argc) != 0) return 1;
 
   for (i = 1; i < argc; ++i) {
     const char* a = argv[i];
 
     if (after_dash_dash) {
       o->prog_argv[o->prog_argc++] = argv[i];
       continue;
     }
     if (driver_streq(a, "--")) {
       after_dash_dash = 1;
       continue;
     }
 
     {
       int r =
           driver_cflags_try_consume(&o->cf, o->env, DBG_TOOL, argc, argv, &i);
       if (r < 0) return 1;
       if (r > 0) continue;
     }
 
     if (driver_streq(a, "-g")) {
       o->debug_info = 1;
       continue;
     }
     if (driver_streq(a, "-O0")) {
       o->opt_level = 0;
       continue;
     }
     if (driver_streq(a, "-O1")) {
       o->opt_level = 1;
       continue;
     }
     if (driver_streq(a, "-O2")) {
       o->opt_level = 1;
       continue;
     }
 
     if (driver_streq(a, "--sysroot") || driver_streq(a, "-isysroot")) {
       if (++i >= argc) {
         driver_errf(DBG_TOOL, "%.*s requires an argument",
                     KIT_SLICE_ARG(kit_slice_cstr(a)));
         return 1;
       }
       o->sysroot = argv[i];
       continue;
     }
     if (driver_strneq(a, "--sysroot=", 10)) {
       o->sysroot = a + 10;
       continue;
     }
     if (driver_streq(a, "-lc")) {
       o->wants_hosted_libc = 1;
       continue;
     }
     if (driver_streq(a, "-l")) {
       if (++i >= argc) {
         driver_errf(DBG_TOOL, "-l requires an argument");
         return 1;
       }
       if (!driver_streq(argv[i], "c")) {
         driver_errf(DBG_TOOL, "unsupported hosted library for JIT: -l%.*s",
                     KIT_SLICE_ARG(kit_slice_cstr(argv[i])));
         return 1;
       }
       o->wants_hosted_libc = 1;
       continue;
     }
     if (driver_strneq(a, "-l", 2)) {
       if (!driver_streq(a + 2, "c")) {
         driver_errf(DBG_TOOL, "unsupported hosted library for JIT: %.*s",
                     KIT_SLICE_ARG(kit_slice_cstr(a)));
         return 1;
       }
       o->wants_hosted_libc = 1;
       continue;
     }
 
     if (driver_streq(a, "-e")) {
       if (++i >= argc) {
         driver_errf(DBG_TOOL, "-e requires an argument");
         return 1;
       }
       o->entry = argv[i];
       continue;
     }
 
     if (driver_streq(a, "-x") || driver_streq(a, "--language") ||
         driver_streq(a, "--lang")) {
       if (++i >= argc) {
         driver_errf(DBG_TOOL, "%.*s requires an argument",
                     KIT_SLICE_ARG(kit_slice_cstr(a)));
         return 1;
       }
       if (dbg_set_default_language(o, argv[i]) != 0) return 1;
       continue;
     }
     if (driver_strneq(a, "--language=", 11)) {
       if (dbg_set_default_language(o, a + 11) != 0) return 1;
       continue;
     }
     if (driver_strneq(a, "--lang=", 7)) {
       if (dbg_set_default_language(o, a + 7) != 0) return 1;
       continue;
     }
 
     if (driver_streq(a, "--script")) {
       if (++i >= argc) {
         driver_errf(DBG_TOOL, "--script requires a FILE argument");
         return 1;
       }
       if (dbg_script_entry_push(o, DBG_ENTRY_FILE, argv[i]) != 0) return 1;
       continue;
     }
     if (driver_streq(a, "--command") || driver_streq(a, "-c")) {
       if (++i >= argc) {
         driver_errf(DBG_TOOL, "%.*s requires a CMD argument",
                     KIT_SLICE_ARG(kit_slice_cstr(a)));
         return 1;
       }
       if (dbg_script_entry_push(o, DBG_ENTRY_CMD, argv[i]) != 0) return 1;
       continue;
     }
     if (driver_streq(a, "--batch")) {
       o->batch_mode = 1;
       continue;
     }
 
     if (a[0] == '-' && a[1] != '\0') {
       driver_errf(DBG_TOOL, "unknown flag: %.*s",
                   KIT_SLICE_ARG(kit_slice_cstr(a)));
       return 1;
     }
 
     {
       int r = driver_inputs_classify(&o->inputs, a);
       if (r < 0) return 1;
       if (r == 0) {
         driver_errf(DBG_TOOL, "input does not have a recognized suffix: %.*s",
                     KIT_SLICE_ARG(kit_slice_cstr(a)));
         return 1;
       }
     }
   }
 
   if (dbg_apply_hosted_profile(o) != 0) return 1;
   if (!o->entry) o->entry = "main";
   if (!o->debug_info) {
     /* Without -g there are no source lines or variable locations to
      * read at runtime; force it on so `b file:line` and `p name`
      * have something to look at. The user can always re-run without
      * if they want to inspect optimized code at the asm level. */
     o->debug_info = 1;
   }
   return 0;
 }
 
 static void dbg_options_release(DbgOpts* o) {
   size_t bound = o->argv_bound;
   driver_hosted_plan_fini(o->env, &o->hosted);
   driver_inputs_release(&o->inputs);
   driver_cflags_fini(&o->cf, o->env);
   driver_free(o->env, o->prog_argv, bound * sizeof(*o->prog_argv));
   if (o->script_entries)
     driver_free(o->env, o->script_entries,
                 (size_t)o->script_entries_cap * sizeof(DbgScriptEntry));
   if (o->frontends) kit_frontend_registry_free(o->frontends);
 }
 
 /* Compile every C source through a compiler owned by the caller and JIT-link
  * the result. Compiler ownership stays with the caller so DWARF lookups
  * during the REPL session can run against the live compiler. */
 static int dbg_compile_and_jit(DbgOpts* o, KitCompiler* compiler,
                                const KitJitHost* host, KitJit** out_jit) {
   KitCCompileOptions copts;
   const char* link_entry = driver_inputs_count(&o->inputs) ? o->entry : NULL;
   {
     KitCCompileOptions z = {0};
     copts = z;
   }
   KitPreprocessOptions pp;
   copts.code.opt_level = o->opt_level;
   copts.code.debug_info = o->debug_info;
   driver_cflags_fill_pp(&o->cf, &pp);
   return driver_inputs_compile_and_jit(&o->inputs, compiler, host, &copts, &pp,
                                        link_entry, driver_dlsym_resolver, NULL,
                                        out_jit);
 }
 
 static void dbg_fill_compile_options(DbgOpts* o, KitCCompileOptions* copts,
                                      KitPreprocessOptions* pp) {
   {
     KitCCompileOptions z = {0};
     *copts = z;
   }
   copts->code.opt_level = o->opt_level;
   copts->code.debug_info = o->debug_info;
   driver_cflags_fill_pp(&o->cf, pp);
 }
 
 /* ============================================================
  * Breakpoint table (driver-side)
  * ============================================================
  * Each entry pairs a session-side handle (assigned by libkit) with
  * driver-side bookkeeping: a stable integer id we expose to the user, the
  * spec text the user gave us, and a flag that lets us cheaply re-arm
  * temp-disabled breakpoints. */
 
 typedef enum BpKind {
   BP_ADDR,
   BP_SYM,
   BP_LINE,
 } BpKind;
 
 typedef struct Bp {
   int id; /* user-facing handle, 1.. */
   int enabled;
   BpKind kind;
   char* spec; /* heap-owned NUL-terminated copy */
   size_t spec_size;
   uint64_t addr;
   uint64_t skip_count; /* silent skips before the first stop  */
   uint64_t max_hits;   /* 0 = unlimited                       */
   uint32_t session_id; /* libkit handle; 0 when disarmed */
 } Bp;
 
 typedef struct DbgSource {
   char* name;
   size_t name_size;
   uint8_t* data;
   size_t data_size;
   size_t len;
 } DbgSource;
 
 /* ============================================================
  * Session-scoped state
  * ============================================================ */
 
 typedef struct DbgState {
   DriverEnv* env;
   KitCompiler* compiler;
   KitContext ctx;
   KitCCompileOptions copts;
   KitPreprocessOptions pp; /* preprocessor settings for REPL compiles */
   KitJit* jit;
   KitDebugSession* session;
   const KitObjFile* view;
   KitDebugInfo* dwarf;
   KitWriter* fmt_writer; /* lazily-created stdout writer for kit_dbg_value_format */
   void* entry_addr;
   const char* entry_name;
   KitLanguage default_jit_lang;
   const char* default_jit_name;
   /* Backing storage for default_jit_name (built from the canonical frontend
    * extension), kept stable for the session's lifetime. */
   char default_jit_name_buf[32];
   KitCompileSession** compile_sessions;
   uint32_t ncompile_sessions;
   uint32_t compile_sessions_cap;
   DbgSource* sources;
   uint32_t nsources;
   uint32_t sources_cap;
   int prog_argc;
   char** prog_argv;
 
   Bp* bps;
   uint32_t nbps;
   uint32_t bps_cap;
   int next_bp_id;
   uint64_t
       expr_counter; /* user-visible $N; advances only on a successful expr */
   uint64_t expr_attempt; /* unique thunk-symbol id; advances every attempt */
   uint64_t source_counter;
 
   int has_stop;
   KitStopInfo last_stop;
   uint64_t jit_counter;
   DriverLineHistory line_history;
 
   DbgScriptEntry* script_entries; /* transferred from DbgOpts */
   uint32_t nscript_entries;
   int batch_mode;
   int error_count;
   int script_failed;
 } DbgState;
 
 /* Like driver_errf but increments s->error_count so --batch can propagate
  * command failures to the exit code. */
 #define dbg_errf(s, ...) \
   (driver_errf(DBG_TOOL, __VA_ARGS__), (void)((s)->error_count++))
 
 #define DBG_LIST_CTX 5 /* lines printed before/after the target */
 
 /* SIGINT trampoline. The handler in env.c calls our cb with this state;
  * we forward into the session. kit_dbg_session_interrupt is documented
  * async-signal-safe. */
 static void dbg_on_sigint(void* user) {
   DbgState* s = (DbgState*)user;
   if (s && s->session) kit_dbg_session_interrupt(s->session);
 }
 
 /* PC-space translation between the JIT runtime address space (where
  * SIGTRAP fires and where the debugger installs breakpoints) and the
  * image-relative vaddr space DWARF was authored in.  Every DWARF call
  * that takes a PC consumes an image vaddr, and every DWARF result
  * that names a code address is image-relative — translate at the
  * boundary.  Fallback is pass-through so out-of-image PCs (e.g.
  * stops inside libc on a future multi-input setup) don't return 0
  * and silently degrade lookups. */
 static uint64_t dbg_pc_rt_to_img(DbgState* s, uint64_t rt) {
   uint64_t v = kit_jit_runtime_to_image(s->jit, rt);
   return v ? v : rt;
 }
 static uint64_t dbg_pc_img_to_rt(DbgState* s, uint64_t img) {
   uint64_t v = kit_jit_image_to_runtime(s->jit, img);
   return v ? v : img;
 }
 /* ============================================================
  * Tiny driver-local string utilities
  * ============================================================
  * The driver TU may use plain libc <string.h>/<ctype.h> per the project
  * rules (no syscalls). We avoid pulling in libc here only because the
  * existing driver shims cover everything we need. */
 
 static int dbg_isspace(int c) {
   return c == ' ' || c == '\t' || c == '\r' || c == '\n';
 }
 static int dbg_isdigit(int c) { return c >= '0' && c <= '9'; }
 static int dbg_isxdigit(int c) {
   return dbg_isdigit(c) || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F');
 }
 
 static int dbg_xval(int c) {
   if (dbg_isdigit(c)) return c - '0';
   if (c >= 'a' && c <= 'f') return c - 'a' + 10;
   return c - 'A' + 10;
 }
 
 static char* dbg_dup(DriverEnv* env, const char* s, size_t n,
                      size_t* size_out) {
   char* p = driver_alloc(env, n + 1);
   if (!p) return NULL;
   driver_memcpy(p, s, n);
   p[n] = '\0';
   if (size_out) *size_out = n + 1;
   return p;
 }
 
 /* Parse a 0x-prefixed hex literal or a decimal literal into *out. Returns
  * the number of characters consumed, or 0 on failure. */
 static size_t dbg_parse_uint(const char* s, uint64_t* out) {
   size_t i = 0;
   uint64_t v = 0;
   if (s[0] == '0' && (s[1] == 'x' || s[1] == 'X')) {
     i = 2;
     if (!dbg_isxdigit((unsigned char)s[i])) return 0;
     for (; dbg_isxdigit((unsigned char)s[i]); ++i) {
       v = (v << 4) | (uint64_t)dbg_xval((unsigned char)s[i]);
     }
   } else {
     if (!dbg_isdigit((unsigned char)s[0])) return 0;
     for (; dbg_isdigit((unsigned char)s[i]); ++i) {
       v = v * 10 + (uint64_t)(s[i] - '0');
     }
   }
   *out = v;
   return i;
 }
 
 static size_t dbg_u64_dec(char* dst, size_t cap, uint64_t v);
 
 /* ============================================================
  * Breakpoint table operations
  * ============================================================ */
 
 static Bp* dbg_bp_grow(DbgState* s) {
   uint32_t nc;
   size_t old_size, new_size;
   Bp* nb;
   if (s->nbps < s->bps_cap) return &s->bps[s->nbps];
 
   nc = s->bps_cap ? s->bps_cap * 2 : 8;
   old_size = (size_t)s->bps_cap * sizeof(Bp);
   new_size = (size_t)nc * sizeof(Bp);
   nb = s->env->heap->realloc(s->env->heap, s->bps, old_size, new_size,
                              _Alignof(Bp));
   if (!nb) {
     dbg_errf(s, "out of memory growing breakpoint table");
     return NULL;
   }
   /* Zero the freshly grown tail so future driver_free walks it cleanly. */
   {
     char* z = (char*)nb + old_size;
     size_t n = new_size - old_size;
     size_t j;
     for (j = 0; j < n; ++j) z[j] = 0;
   }
   s->bps = nb;
   s->bps_cap = nc;
   return &s->bps[s->nbps];
 }
 
 static Bp* dbg_bp_find(DbgState* s, int id) {
   uint32_t i;
   for (i = 0; i < s->nbps; ++i) {
     if (s->bps[i].id == id) return &s->bps[i];
   }
   return NULL;
 }
 
 static void dbg_bp_release(DbgState* s, Bp* b) {
   if (b->session_id) {
     kit_dbg_session_breakpoint_clear(s->session, b->session_id);
     b->session_id = 0;
   }
   if (b->spec) {
     driver_free(s->env, b->spec, b->spec_size);
     b->spec = NULL;
     b->spec_size = 0;
   }
 }
 
 static int dbg_bp_remove(DbgState* s, int id) {
   uint32_t i;
   for (i = 0; i < s->nbps; ++i) {
     if (s->bps[i].id == id) {
       dbg_bp_release(s, &s->bps[i]);
       /* Shift tail down to keep the array dense; ids stay stable. */
       {
         uint32_t j;
         for (j = i + 1; j < s->nbps; ++j) s->bps[j - 1] = s->bps[j];
       }
       s->nbps--;
       {
         Bp z = {0};
         s->bps[s->nbps] = z;
       }
       return 0;
     }
   }
   return 1;
 }
 
 static void dbg_bps_release_all(DbgState* s) {
   uint32_t i;
   for (i = 0; i < s->nbps; ++i) dbg_bp_release(s, &s->bps[i]);
   if (s->bps) {
     driver_free(s->env, s->bps, (size_t)s->bps_cap * sizeof(Bp));
     s->bps = NULL;
     s->bps_cap = 0;
     s->nbps = 0;
   }
 }
 
 static void dbg_compile_sessions_release(DbgState* s) {
   uint32_t i;
   for (i = 0; i < s->ncompile_sessions; ++i) {
     kit_compile_session_free(s->compile_sessions[i]);
     s->compile_sessions[i] = NULL;
   }
   if (s->compile_sessions) {
     driver_free(s->env, s->compile_sessions,
                 (size_t)s->compile_sessions_cap *
                     sizeof(*s->compile_sessions));
     s->compile_sessions = NULL;
   }
   s->ncompile_sessions = 0;
   s->compile_sessions_cap = 0;
 }
 
 static void dbg_sources_release_all(DbgState* s) {
   uint32_t i;
   for (i = 0; i < s->nsources; ++i) {
     DbgSource* src = &s->sources[i];
     if (src->name) driver_free(s->env, src->name, src->name_size);
     if (src->data) driver_free(s->env, src->data, src->data_size);
   }
   if (s->sources) {
     driver_free(s->env, s->sources,
                 (size_t)s->sources_cap * sizeof(*s->sources));
     s->sources = NULL;
   }
   s->nsources = 0;
   s->sources_cap = 0;
 }
 
 /* ============================================================
  * LOC parser
  * ============================================================
  * Resolves a user-supplied location specification into a single address
  * within the JIT image:
  *
  *   0xADDR              raw address
  *   sym[+0xN | +N]      symbol via kit_jit_lookup, optional offset
  *   file.c:LINE         DWARF lookup
  *
  * Returns 0 on success, 1 on parse / resolution failure (already
  * reported via driver_errf). */
 
 static int dbg_resolve_loc(DbgState* s, const char* spec, BpKind* kind_out,
                            uint64_t* addr_out) {
   /* file:line — uniquely identifiable by a colon NOT preceded by + and
    * followed by digits. We require the suffix after ':' to be all
    * digits so we don't confuse, say, hypothetical `func:42` (which
    * isn't a thing in C). */
   const char* colon = driver_strchr(spec, ':');
   if (colon && dbg_isdigit((unsigned char)colon[1])) {
     size_t file_n = (size_t)(colon - spec);
     char* file;
     uint64_t line64;
     size_t used;
     size_t file_size;
     uint64_t pc;
 
     if (file_n == 0) {
       dbg_errf(s, "empty file in '%.*s'", KIT_SLICE_ARG(kit_slice_cstr(spec)));
       return 1;
     }
     file = dbg_dup(s->env, spec, file_n, &file_size);
     if (!file) {
       dbg_errf(s, "out of memory");
       return 1;
     }
     used = dbg_parse_uint(colon + 1, &line64);
     if (!used || colon[1 + used] != '\0') {
       dbg_errf(s, "expected file.c:LINE, got '%.*s'",
                KIT_SLICE_ARG(kit_slice_cstr(spec)));
       driver_free(s->env, file, file_size);
       return 1;
     }
     if (!s->dwarf) {
       dbg_errf(s, "no DWARF: cannot resolve %.*s",
                KIT_SLICE_ARG(kit_slice_cstr(spec)));
       driver_free(s->env, file, file_size);
       return 1;
     }
     {
       KitStatus rc = kit_dwarf_line_to_addr(s->dwarf, kit_slice_cstr(file),
                                             (uint32_t)line64, &pc);
       if (rc == KIT_NOT_FOUND) {
         dbg_errf(s, "no line %u in %.*s", (uint32_t)line64,
                  KIT_SLICE_ARG(kit_slice_cstr(file)));
         driver_free(s->env, file, file_size);
         return 1;
       }
       if (rc == KIT_AMBIGUOUS) {
         KitDwarfLineMatch cands[8];
         uint32_t n = 0;
         uint32_t k;
         kit_dwarf_line_to_addr_all(s->dwarf, kit_slice_cstr(file),
                                    (uint32_t)line64, cands, 8u, &n);
         dbg_errf(s, "ambiguous: %.*s:%u matches %u files",
                  KIT_SLICE_ARG(kit_slice_cstr(file)), (uint32_t)line64,
                  (unsigned)n);
         for (k = 0; k < n && k < 8u; ++k) {
           dbg_errf(s, "  %.*s (0x%llx)", KIT_SLICE_ARG(cands[k].file),
                    (unsigned long long)cands[k].pc);
         }
         if (n > 8u) dbg_errf(s, "  ... and %u more", n - 8u);
         dbg_errf(s, "use a longer path suffix (e.g. b dir/%.*s:%u)",
                  KIT_SLICE_ARG(kit_slice_cstr(file)), (uint32_t)line64);
         driver_free(s->env, file, file_size);
         return 1;
       }
       if (rc != KIT_OK) {
         dbg_errf(s, "no line entry for %.*s",
                  KIT_SLICE_ARG(kit_slice_cstr(spec)));
         driver_free(s->env, file, file_size);
         return 1;
       }
     }
     driver_free(s->env, file, file_size);
     *kind_out = BP_LINE;
     *addr_out = dbg_pc_img_to_rt(s, pc);
     return 0;
   }
 
   /* 0xADDR or decimal address. */
   if ((spec[0] == '0' && (spec[1] == 'x' || spec[1] == 'X')) ||
       dbg_isdigit((unsigned char)spec[0])) {
     uint64_t v;
     size_t used = dbg_parse_uint(spec, &v);
     if (!used || spec[used] != '\0') {
       dbg_errf(s, "trailing junk in address '%.*s'",
                KIT_SLICE_ARG(kit_slice_cstr(spec)));
       return 1;
     }
     *kind_out = BP_ADDR;
     *addr_out = v;
     return 0;
   }
 
   /* sym[+off] */
   {
     const char* plus = driver_strchr(spec, '+');
     size_t name_n = plus ? (size_t)(plus - spec) : driver_strlen(spec);
     char* name;
     size_t name_size;
     void* resolved;
     uint64_t off = 0;
 
     if (name_n == 0) {
       dbg_errf(s, "empty symbol in '%.*s'",
                KIT_SLICE_ARG(kit_slice_cstr(spec)));
       return 1;
     }
     name = dbg_dup(s->env, spec, name_n, &name_size);
     if (!name) {
       dbg_errf(s, "out of memory");
       return 1;
     }
     resolved = kit_jit_lookup(s->jit, kit_slice_cstr(name));
     if (!resolved) {
       dbg_errf(s, "symbol not found: %.*s",
                KIT_SLICE_ARG(kit_slice_cstr(name)));
       driver_free(s->env, name, name_size);
       return 1;
     }
     driver_free(s->env, name, name_size);
 
     if (plus) {
       size_t used = dbg_parse_uint(plus + 1, &off);
       if (!used || plus[1 + used] != '\0') {
         dbg_errf(s, "bad offset in '%.*s'",
                  KIT_SLICE_ARG(kit_slice_cstr(spec)));
         return 1;
       }
     }
 
     *kind_out = BP_SYM;
     /* Object-pointer to integer cast: implementation-defined in
      * standard C, defined as the address on every host where a JIT
      * runs. */
     {
       union {
         void* p;
         uint64_t u;
       } cv;
       cv.p = resolved;
       *addr_out = cv.u + off;
     }
     return 0;
   }
 }
 
 /* ============================================================
  * Stop rendering
  * ============================================================ */
 
 static void dbg_print_pc(DbgState* s, uint64_t pc) {
   KitSlice sym = KIT_SLICE_NULL;
   uint64_t off = 0;
   KitSlice file = KIT_SLICE_NULL;
   uint32_t line = 0;
   uint32_t col = 0;
 
   driver_printf("0x%llx", (unsigned long long)pc);
   if (kit_jit_addr_to_sym(s->jit, pc, &sym, &off) == KIT_OK && sym.s) {
     if (off)
       driver_printf(" <%.*s+0x%llx>", KIT_SLICE_ARG(sym),
                     (unsigned long long)off);
     else
       driver_printf(" <%.*s>", KIT_SLICE_ARG(sym));
   }
   if (s->dwarf &&
       kit_dwarf_addr_to_line(s->dwarf, dbg_pc_rt_to_img(s, pc), &file, &line,
                              &col) == KIT_OK &&
       file.s) {
     driver_printf(" at %.*s:%u", KIT_SLICE_ARG(file), line);
     if (col) driver_printf(":%u", col);
   }
 }
 
 static void dbg_print_source_listing(DbgState* s, KitSlice file, uint32_t line,
                                      uint64_t pc, int report_errors);
 
 static KitSlice dbg_step_stop_label(KitStopReason reason) {
   switch (reason) {
     case KIT_STOP_REASON_STEP_INSN:
       return KIT_SLICE_LIT("Single-step complete at ");
     case KIT_STOP_REASON_STEP_LINE:
       return KIT_SLICE_LIT("Step complete at ");
     case KIT_STOP_REASON_NEXT_LINE:
       return KIT_SLICE_LIT("Next complete at ");
     case KIT_STOP_REASON_STEP_OUT:
       return KIT_SLICE_LIT("Finish complete at ");
     case KIT_STOP_REASON_UNKNOWN:
     case KIT_STOP_REASON_USER_BREAKPOINT:
     case KIT_STOP_REASON_SIGNAL:
     case KIT_STOP_REASON_TRAP:
     case KIT_STOP_REASON_INTERRUPT:
     case KIT_STOP_REASON_EXIT:
       break;
   }
   return KIT_SLICE_LIT("Internal breakpoint hit at ");
 }
 
 static void dbg_cmd_bt(DbgState* s);
 
 static void dbg_render_stop(DbgState* s, const KitStopInfo* st) {
   KitSlice file = {0};
   uint32_t line = 0;
   uint32_t col = 0;
   int has_source = 0;
 
   if (st->kind != KIT_STOP_EXIT && s->dwarf &&
       kit_dwarf_addr_to_line(s->dwarf, dbg_pc_rt_to_img(s, st->regs.pc), &file,
                              &line, &col) == KIT_OK &&
       file.s) {
     has_source = 1;
   }
 
   switch (st->kind) {
     case KIT_STOP_BREAKPOINT: {
       Bp* b = NULL;
       uint32_t i;
       for (i = 0; i < s->nbps; ++i) {
         if (s->bps[i].session_id == st->bp_id) {
           b = &s->bps[i];
           break;
         }
       }
       if (b)
         driver_printf("Breakpoint %d (%.*s) hit at ", b->id,
                       KIT_SLICE_ARG(kit_slice_cstr(b->spec)));
       else {
         KitSlice label = dbg_step_stop_label(st->reason);
         driver_printf("%.*s", KIT_SLICE_ARG(label));
       }
       dbg_print_pc(s, st->regs.pc);
       driver_printf("\n");
       break;
     }
     case KIT_STOP_SIGNAL:
       if (st->reason == KIT_STOP_REASON_TRAP)
         driver_printf("Stopped on trap signal %d at ", st->signal);
       else
         driver_printf("Stopped on signal %d at ", st->signal);
       dbg_print_pc(s, st->regs.pc);
       driver_printf("\n");
       /* A fault/trap is a crash, not a planned stop: print the backtrace
        * automatically (the user would type `bt` next anyway). Breakpoints and
        * step completions are separate stop kinds, so this only fires on a real
        * signal or __builtin_trap/assert. */
       if (s->dwarf) dbg_cmd_bt(s);
       break;
     case KIT_STOP_INTERRUPT:
       driver_printf("Interrupted at ");
       dbg_print_pc(s, st->regs.pc);
       driver_printf("\n");
       break;
     case KIT_STOP_EXIT:
       driver_printf("Program exited with code %d\n", st->exit_code);
       break;
   }
   if (has_source)
     dbg_print_source_listing(s, file, line, dbg_pc_rt_to_img(s, st->regs.pc),
                              0);
 }
 
 /* ============================================================
  * Run / continue / step
  * ============================================================
  * Both `r` and `c` flow through the same wrapper: install SIGINT, drive
  * the session (call or resume), restore SIGINT, render the stop. The
  * dbg owns no signal-handling complexity itself — that's the session's
  * job. */
 
 typedef enum DbgRunMode {
   RUN_FRESH,     /* r       — _call from entry         */
   RUN_CONTINUE,  /* c       — _resume(continue)        */
   RUN_STEP_INSN, /* si      — _resume(step_insn)       */
   RUN_STEP_LINE, /* s       — _resume(step_line)       */
   RUN_NEXT_LINE, /* n       — _resume(next_line)       */
   RUN_STEP_OUT,  /* finish  — _resume(step_out)        */
 } DbgRunMode;
 
 static int dbg_drive(DbgState* s, DbgRunMode mode) {
   KitStatus rc;
 
   if (mode == RUN_FRESH && s->has_stop) {
     /* The previous session is dead (entry returned or signal landed).
      * Start a new one. Try to abort it first in case it's parked in a fault. */
     if (s->session) {
       kit_dbg_session_resume(s->session, KIT_RESUME_ABORT, NULL);
     }
     s->has_stop = 0;
   } else if (mode != RUN_FRESH && !s->has_stop) {
     dbg_errf(s, "no program is running; use 'r' to start");
     return 1;
   }
 
   if (mode == RUN_FRESH && !s->entry_addr) {
     if (!s->entry_name || !*s->entry_name) {
       dbg_errf(s, "no entry symbol configured");
       return 1;
     }
     s->entry_addr = kit_jit_lookup(s->jit, kit_slice_cstr(s->entry_name));
     if (!s->entry_addr) {
       dbg_errf(s, "entry symbol not found: %.*s",
                KIT_SLICE_ARG(kit_slice_cstr(s->entry_name)));
       return 1;
     }
   }
 
   if (driver_install_sigint(dbg_on_sigint, s) != 0) {
     dbg_errf(s, "failed to install SIGINT handler");
     return 1;
   }
 
   if (mode == RUN_FRESH) {
     rc = kit_dbg_session_call(s->session, s->entry_addr, KIT_ENTRY_INT_ARGV,
                               s->prog_argc, s->prog_argv, &s->last_stop);
   } else {
     KitResumeMode rm = KIT_RESUME_CONTINUE;
     switch (mode) {
       case RUN_STEP_INSN:
         rm = KIT_RESUME_STEP_INSN;
         break;
       case RUN_STEP_LINE:
         rm = KIT_RESUME_STEP_LINE;
         break;
       case RUN_NEXT_LINE:
         rm = KIT_RESUME_NEXT_LINE;
         break;
       case RUN_STEP_OUT:
         rm = KIT_RESUME_STEP_OUT;
         break;
       case RUN_CONTINUE:
         rm = KIT_RESUME_CONTINUE;
         break;
       case RUN_FRESH:
         break; /* unreachable */
     }
     rc = kit_dbg_session_resume(s->session, rm, &s->last_stop);
   }
 
   driver_restore_sigint();
 
   if (rc != KIT_OK) {
     driver_errf(
         DBG_TOOL,
         "session %.*s failed (st=%d) — "
         "JIT session implementation pending",
         KIT_SLICE_ARG(kit_slice_cstr(mode == RUN_FRESH ? "call" : "resume")),
         (int)rc);
     return 1;
   }
 
   s->has_stop = 1;
   dbg_render_stop(s, &s->last_stop);
   if (s->last_stop.kind == KIT_STOP_EXIT) s->has_stop = 0;
   return 0;
 }
 
 /* Render a materialized debugger value to stdout via the public formatter.
  * The stdout writer shares libc's stdout buffer with driver_printf, so a
  * "name = " prefix and the value text interleave in call order. */
 static void dbg_emit_value(DbgState* s, const KitDebugValue* v, int indent) {
   KitDebugFormatOptions fo = {.indent = (uint32_t)indent};
   if (!s->fmt_writer) s->fmt_writer = driver_stdout_writer(s->env);
   if (s->fmt_writer) kit_dbg_value_format(s->session, v, s->fmt_writer, &fo);
 }
 static char* dbg_take_word(char* line, char** word_out);
 
 /* ============================================================
  * Backtrace
  * ============================================================
  * Renders one line per frame:
  *   #N 0xPC <sym+off> in func (arg1=val1, arg2=val2) at file:line
  * Parameter rendering uses kit_dwarf_param_iter_* against the frame's
  * PC and the unwound register snapshot. Inlined frames are flagged. */
 
 static void dbg_cmd_bt(DbgState* s) {
   KitDebugBacktrace* bt = NULL;
   uint32_t i, n;
 
   if (!s->has_stop) {
     dbg_errf(s, "no program is stopped");
     return;
   }
   if (!s->dwarf) {
     dbg_errf(s, "no DWARF: backtrace unavailable");
     return;
   }
   if (kit_dbg_backtrace_new(s->session, NULL, &bt) != KIT_OK) {
     dbg_errf(s, "backtrace unavailable");
     return;
   }
 
   n = kit_dbg_backtrace_count(bt);
   for (i = 0; i < n; ++i) {
     KitDebugFrame f;
     if (kit_dbg_backtrace_frame(bt, i, &f) != KIT_OK) break;
 
     driver_printf("#%-2d 0x%llx", (int)i, (unsigned long long)f.pc);
     if (f.sym.s) {
       if (f.sym_offset)
         driver_printf(" <%.*s+0x%llx>", KIT_SLICE_ARG(f.sym),
                       (unsigned long long)f.sym_offset);
       else
         driver_printf(" <%.*s>", KIT_SLICE_ARG(f.sym));
     }
 
     /* DWARF subprogram name + argument values for this frame. Args come from
      * the session's symbolic layer against the frame's own register snapshot. */
     if (f.func.s) {
       KitDebugVarIter* it = NULL;
       KitSlice an;
       KitDebugValue av;
       int first = 1;
       driver_printf(" in %.*s%.*s (", KIT_SLICE_ARG(f.func),
                     KIT_SLICE_ARG(f.inlined ? KIT_SLICE_LIT(" [inlined]")
                                             : KIT_SLICE_NULL));
       if (kit_dbg_vars_new(s->session, &f.regs, KIT_DVRM_ARG, &it) == KIT_OK) {
         for (;;) {
           KitIterResult r = kit_dbg_vars_next(it, &an, &av);
           if (r != KIT_ITER_ITEM) break;
           if (!first) driver_printf(", ");
           driver_printf("%.*s=",
                         KIT_SLICE_ARG(an.s ? an : KIT_SLICE_LIT("?")));
           if (av.bytes)
             dbg_emit_value(s, &av, 0);
           else
             driver_printf("?");
           first = 0;
         }
         kit_dbg_vars_free(it);
       }
       driver_printf(")");
     }
 
     if (f.file.s) {
       driver_printf(" at %.*s:%u", KIT_SLICE_ARG(f.file), f.line);
       if (f.col) driver_printf(":%u", f.col);
     } else {
       driver_printf(" [no debug info for this frame]");
     }
     driver_printf("\n");
   }
   kit_dbg_backtrace_free(bt);
 }
 
 
 /* ============================================================
  * `p name`
  * ============================================================ */
 
 static void dbg_cmd_print(DbgState* s, const char* name) {
   KitSlice nm = kit_slice_cstr(name);
   KitDebugValue val;
   KitStatus rc;
 
   if (!s->has_stop) {
     dbg_errf(s, "no program is stopped");
     return;
   }
 
   rc = kit_dbg_var_read(s->session, NULL, nm, &val);
   if (rc == KIT_OK) {
     if (val.type) {
       driver_printf("%.*s = ", KIT_SLICE_ARG(nm));
       dbg_emit_value(s, &val, 0);
       driver_printf("\n");
     } else {
       /* Resolved a JIT global symbol but no DWARF type — show its address. */
       uint64_t addr = 0;
       kit_dbg_value_as_u64(&val, &addr);
       driver_printf("%.*s = 0x%llx (no DWARF type info)\n", KIT_SLICE_ARG(nm),
                     (unsigned long long)addr);
     }
     return;
   }
   if (rc == KIT_NOT_FOUND) {
     dbg_errf(s, "no variable or symbol named '%.*s'", KIT_SLICE_ARG(nm));
     return;
   }
   dbg_errf(s, "could not read %.*s", KIT_SLICE_ARG(nm));
 }
 
 /* ============================================================
  * `set NAME VALUE`
  * ============================================================
  * Writes a 64-bit value into a variable. Routes to write_mem for
  * frame-relative and global locations, set_regs for register-resident
  * variables. v1 supports integer/pointer scalars only — float and
  * aggregate writes are out of scope. */
 
 static void dbg_cmd_set(DbgState* s, const char* name, uint64_t value) {
   KitSlice nm = kit_slice_cstr(name);
   KitStatus rc;
 
   if (!s->has_stop) {
     dbg_errf(s, "no program is stopped");
     return;
   }
   rc = kit_dbg_var_write_u64(s->session, NULL, nm, value);
   switch (rc) {
     case KIT_OK:
       /* Refresh the cached stop registers so a register write is visible to
        * subsequent reads. */
       kit_dbg_session_get_regs(s->session, &s->last_stop.regs);
       return;
     case KIT_NOT_FOUND:
       dbg_errf(s, "no variable named '%.*s'", KIT_SLICE_ARG(nm));
       return;
     case KIT_UNSUPPORTED:
       dbg_errf(s, "cannot set '%.*s': location is a DWARF expression",
                KIT_SLICE_ARG(nm));
       return;
     default:
       dbg_errf(s, "memory write failed");
       return;
   }
 }
 
 /* ============================================================
  * `jump ADDR`
  * ============================================================
  * Move PC without resuming. The session validates that the new PC lies
  * within the JIT image. */
 
 static void dbg_cmd_jump(DbgState* s, uint64_t pc) {
   KitUnwindFrame fr;
   if (!s->has_stop) {
     dbg_errf(s, "no program is stopped");
     return;
   }
   fr = s->last_stop.regs;
   fr.pc = pc;
   if (kit_dbg_session_set_regs(s->session, &fr) != 0) {
     dbg_errf(s, "jump failed (pc 0x%llx outside image?)",
              (unsigned long long)pc);
     return;
   }
   s->last_stop.regs = fr;
   driver_printf("PC set to 0x%llx\n", (unsigned long long)pc);
 }
 
 /* ============================================================
  * `info locals` / `info args` / `info reg`
  * ============================================================ */
 
 static void dbg_cmd_info_vars(DbgState* s, uint32_t mask, const char* label) {
   KitDebugVarIter* it = NULL;
   KitSlice nm;
   KitDebugValue val;
   int printed = 0;
 
   if (!s->has_stop) {
     dbg_errf(s, "no program is stopped");
     return;
   }
   if (!s->dwarf) {
     dbg_errf(s, "no DWARF: %.*s unavailable",
              KIT_SLICE_ARG(kit_slice_cstr(label)));
     return;
   }
 
   if (kit_dbg_vars_new(s->session, NULL, mask, &it) != KIT_OK) {
     driver_printf("No %.*s.\n", KIT_SLICE_ARG(kit_slice_cstr(label)));
     return;
   }
   for (;;) {
     KitIterResult r = kit_dbg_vars_next(it, &nm, &val);
     if (r != KIT_ITER_ITEM) break;
     printed = 1;
     if (!val.bytes) {
       driver_printf("  %.*s = <unreadable>\n", KIT_SLICE_ARG(nm));
       continue;
     }
     driver_printf("  %.*s = ", KIT_SLICE_ARG(nm));
     dbg_emit_value(s, &val, 1);
     driver_printf("\n");
   }
   kit_dbg_vars_free(it);
   if (!printed)
     driver_printf("No %.*s.\n", KIT_SLICE_ARG(kit_slice_cstr(label)));
 }
 
 static void dbg_cmd_info_reg(DbgState* s) {
   KitArchKind arch = driver_host_target().arch;
   uint32_t n = kit_arch_register_count(arch);
   uint32_t i;
 
   if (!s->has_stop) {
     dbg_errf(s, "no program is stopped");
     return;
   }
   if (n == 0) {
     dbg_errf(s, "no register table for this arch");
     return;
   }
   driver_printf("pc     0x%016llx\n", (unsigned long long)s->last_stop.regs.pc);
   driver_printf("cfa    0x%016llx\n",
                 (unsigned long long)s->last_stop.regs.cfa);
   for (i = 0; i < n; ++i) {
     KitArchReg r;
     if (kit_arch_register_at(arch, i, &r) != KIT_OK) continue;
     if (r.dwarf_idx >= 32) continue; /* outside KitUnwindFrame.regs */
     driver_printf("%-6.*s 0x%016llx\n", KIT_SLICE_ARG(r.name),
                   (unsigned long long)s->last_stop.regs.regs[r.dwarf_idx]);
   }
 }
 
 /* ============================================================
  * `info functions [PATTERN]` / `info variables [PATTERN]`
  * ============================================================ */
 
 /* Tiny glob matcher: '*' matches any run, '?' matches any single byte.
  * NULL pattern matches every name. */
 static int dbg_glob(const char* pat, const char* s) {
   if (!pat) return 1;
   while (*pat && *s) {
     if (*pat == '*') {
       if (pat[1] == '\0') return 1;
       while (*s) {
         if (dbg_glob(pat + 1, s)) return 1;
         ++s;
       }
       return dbg_glob(pat + 1, s);
     }
     if (*pat != '?' && *pat != *s) return 0;
     ++pat;
     ++s;
   }
   while (*pat == '*') ++pat;
   return *pat == '\0' && *s == '\0';
 }
 
 static void dbg_cmd_info_syms(DbgState* s, KitSymKind want,
                               const char* pattern) {
   KitJitSymIter* it = NULL;
   KitJitSym sym;
   int printed = 0;
 
   if (kit_jit_sym_iter_new(s->jit, &it) != KIT_OK) {
     dbg_errf(s, "symbol enumeration unavailable");
     return;
   }
   for (;;) {
     KitIterResult r = kit_jit_sym_iter_next(it, &sym);
     if (r != KIT_ITER_ITEM) break;
     if (sym.kind != want) continue;
     if (pattern && !dbg_glob(pattern, sym.name.s)) continue;
     driver_printf("0x%016llx  %.*s\n", (unsigned long long)sym.addr,
                   KIT_SLICE_ARG(sym.name));
     printed = 1;
   }
   kit_jit_sym_iter_free(it);
   if (!printed) driver_printf("(none)\n");
 }
 
 static int dbg_refresh_dwarf(DbgState* s) {
   if (s->dwarf) {
     kit_dwarf_free(s->dwarf);
     s->dwarf = NULL;
   }
   s->view = kit_jit_view(s->jit);
   if (s->view) {
     if (kit_dwarf_open(&s->ctx, s->view, &s->dwarf) != KIT_OK) s->dwarf = NULL;
     if (s->dwarf && s->session) {
       kit_dbg_session_attach_dwarf(s->session, s->dwarf);
     }
   } else if (s->session) {
     kit_dbg_session_attach_dwarf(s->session, NULL);
   }
   return 0;
 }
 
 static int dbg_buf_append(DbgState* s, char** buf, size_t* len, size_t* cap,
                           const char* src, size_t n) {
   if (*len + n + 1u > *cap) {
     size_t nc = *cap ? *cap * 2u : 1024u;
     char* nb;
     while (nc < *len + n + 1u) nc *= 2u;
     nb = (char*)s->env->heap->realloc(s->env->heap, *buf, *cap, nc,
                                       _Alignof(char));
     if (!nb) return 1;
     *buf = nb;
     *cap = nc;
   }
   driver_memcpy(*buf + *len, src, n);
   *len += n;
   (*buf)[*len] = '\0';
   return 0;
 }
 
 static DbgSource* dbg_source_find(DbgState* s, KitSlice name) {
   uint32_t i;
   if (!s || !name.s || !name.len) return NULL;
   for (i = 0; i < s->nsources; ++i) {
     DbgSource* src = &s->sources[i];
     if (src->name && src->name_size == name.len + 1u &&
         memcmp(src->name, name.s, name.len) == 0) {
       return src;
     }
   }
   return NULL;
 }
 
 static DbgSource* dbg_source_grow(DbgState* s) {
   uint32_t nc;
   size_t old_size, new_size;
   DbgSource* ns;
   if (s->nsources < s->sources_cap) return &s->sources[s->nsources];
 
   nc = s->sources_cap ? s->sources_cap * 2 : 8;
   old_size = (size_t)s->sources_cap * sizeof(*s->sources);
   new_size = (size_t)nc * sizeof(*s->sources);
   ns = (DbgSource*)s->env->heap->realloc(s->env->heap, s->sources, old_size,
                                          new_size, _Alignof(DbgSource));
   if (!ns) return NULL;
   {
     char* z = (char*)ns + old_size;
     size_t n = new_size - old_size;
     size_t j;
     for (j = 0; j < n; ++j) z[j] = 0;
   }
   s->sources = ns;
   s->sources_cap = nc;
   return &s->sources[s->nsources];
 }
 
 static int dbg_source_intern_name(DbgState* s, KitSlice name,
                                   const char** out) {
   DbgSource* src;
   size_t name_size;
   char* name_copy;
   if (out) *out = NULL;
   if (!s || !name.s || !name.len) return 1;
 
   src = dbg_source_find(s, name);
   if (src) {
     if (out) *out = src->name;
     return 0;
   }
 
   name_copy = dbg_dup(s->env, name.s, name.len, &name_size);
   if (!name_copy) return 1;
   src = dbg_source_grow(s);
   if (!src) {
     driver_free(s->env, name_copy, name_size);
     return 1;
   }
   src->name = name_copy;
   src->name_size = name_size;
   s->nsources++;
   if (out) *out = src->name;
   return 0;
 }
 
 static int dbg_source_cache_put(DbgState* s, KitSlice name, const char* data,
                                 size_t len) {
   DbgSource* src;
   uint8_t* data_copy;
   size_t data_size = len ? len : 1u;
   if (!s || !name.s || !name.len || !data) return 1;
 
   data_copy = (uint8_t*)driver_alloc(s->env, data_size);
   if (!data_copy) return 1;
   if (len) driver_memcpy(data_copy, data, len);
 
   src = dbg_source_find(s, name);
   if (!src) {
     if (dbg_source_intern_name(s, name, NULL) != 0) {
       driver_free(s->env, data_copy, data_size);
       return 1;
     }
     src = dbg_source_find(s, name);
     if (!src) {
       driver_free(s->env, data_copy, data_size);
       return 1;
     }
   }
   if (src->data) {
     driver_free(s->env, src->data, src->data_size);
   }
 
   src->data = data_copy;
   src->data_size = data_size;
   src->len = len;
   return 0;
 }
 
 static int dbg_brace_delta(const char* p) {
   int d = 0;
   while (*p) {
     if (*p == '{')
       ++d;
     else if (*p == '}')
       --d;
     ++p;
   }
   return d;
 }
 
 /* Caller buffer sizes for the REPL filename builders below. ".<ext>" and
  * "<dbg-jit.<ext>>" with the canonical frontend extension comfortably fit. */
 #define DBG_JIT_SUFFIX_CAP 16
 #define DBG_JIT_NAME_CAP 32
 /* DbgState.default_jit_name_buf must match DBG_JIT_NAME_CAP (it is sized with a
  * literal because it precedes this macro in the file). */
 _Static_assert(sizeof(((DbgState*)0)->default_jit_name_buf) == DBG_JIT_NAME_CAP,
                "default_jit_name_buf must equal DBG_JIT_NAME_CAP");
 
 /* Canonical language name for the JIT REPL (kit_language_name with a "c"
  * fallback so C and any unnamed/out-of-range language render as "c", matching
  * the former hardcoded default). The result is borrowed static storage. */
 static const char* dbg_jit_language_name(KitCompiler* c, KitLanguage lang) {
   const char* name = kit_language_name(c, lang);
   return name ? name : "c";
 }
 
 /* Append NUL-terminated `s` into `buf[cap]` starting at `*pos`, advancing
  * `*pos`. Truncates rather than overflowing; the result is always
  * NUL-terminated when cap > 0. (dbg.c builds strings with driver_* helpers
  * rather than stdio.) */
 static void dbg_str_append(char* buf, size_t cap, size_t* pos, const char* s) {
   size_t n = driver_strlen(s);
   size_t room;
   if (*pos >= cap) return;
   room = cap - 1u - *pos; /* leave space for NUL */
   if (n > room) n = room;
   driver_memcpy(buf + *pos, s, n);
   *pos += n;
   buf[*pos] = '\0';
 }
 
 /* Build the dotted file suffix (e.g. ".toy") for `lang` into `buf`, defaulting
  * to ".c" for C and any unnamed/out-of-range language. The canonical bare
  * extension is the single source of truth (kit_language_default_extension);
  * the leading "." is tool presentation. Returns `buf`. */
 static const char* dbg_jit_language_suffix(KitCompiler* c, KitLanguage lang,
                                            char* buf, size_t cap) {
   const char* ext = kit_language_default_extension(c, lang);
   size_t pos = 0;
   if (lang == KIT_LANG_C || !ext) ext = "c";
   if (cap > 0) buf[0] = '\0';
   dbg_str_append(buf, cap, &pos, ".");
   dbg_str_append(buf, cap, &pos, ext);
   return buf;
 }
 
 /* Build the default synthesized REPL source name (e.g. "<dbg-jit.toy>") for
  * `lang` into `buf`, derived from the canonical suffix. Returns `buf`. */
 static const char* dbg_jit_default_name(KitCompiler* c, KitLanguage lang,
                                         char* buf, size_t cap) {
   char suffix[DBG_JIT_SUFFIX_CAP];
   size_t pos = 0;
   dbg_jit_language_suffix(c, lang, suffix, sizeof suffix);
   if (cap > 0) buf[0] = '\0';
   dbg_str_append(buf, cap, &pos, "<dbg-jit");
   dbg_str_append(buf, cap, &pos, suffix);
   dbg_str_append(buf, cap, &pos, ">");
   return buf;
 }
 
 static int dbg_jit_uses_default_name(KitCompiler* c, KitLanguage lang,
                                      const char* input_name) {
   char def[DBG_JIT_NAME_CAP];
   return !input_name || driver_streq(input_name, dbg_jit_default_name(
                                                      c, lang, def, sizeof def));
 }
 
 static int dbg_make_repl_source_name(KitCompiler* c, KitLanguage lang,
                                      uint64_t id, char* out, size_t cap) {
   const char* prefix = "<dbg-jit-";
   char suffix_buf[DBG_JIT_SUFFIX_CAP];
   const char* suffix =
       dbg_jit_language_suffix(c, lang, suffix_buf, sizeof suffix_buf);
   char num[32];
   size_t prefix_len = driver_strlen(prefix);
   size_t suffix_len = driver_strlen(suffix);
   size_t num_len = dbg_u64_dec(num, sizeof(num), id);
   size_t need;
   if (!num_len) return 1;
   need = prefix_len + num_len + suffix_len + 2u;
   if (need > cap) return 1;
   driver_memcpy(out, prefix, prefix_len);
   driver_memcpy(out + prefix_len, num, num_len);
   driver_memcpy(out + prefix_len + num_len, suffix, suffix_len);
   out[prefix_len + num_len + suffix_len] = '>';
   out[prefix_len + num_len + suffix_len + 1u] = '\0';
   return 0;
 }
 
 /* Resolve a `jit`/`:language` tag to a language and a display source name.
  *
  * `tag` is either a frontend `-x` spelling (c/toy/asm/s/wasm/wat) or, for the
  * `jit` command, a `name.ext` filename. Empty/NULL selects the session default.
  * `name_buf`/`name_cap` back the canonical synthesized name for the resolved
  * cases. On return `*name_out` points to a string the caller must keep alive
  * (intern) UNLESS it equals `s->default_jit_name`, which DbgState already owns.
  * The storage cases:
  *   - resolved by name: `*name_out` is the canonical "<dbg-jit.EXT>" written
  *     into `name_buf` (single source of truth via dbg_jit_default_name);
  *   - resolved by path (the `name.ext` fallback): `*name_out` is the raw `tag`,
  *     so the resolver is never handed a language name as a path. */
 static KitLanguage dbg_jit_language_for_tag(DbgState* s, const char* tag,
                                             char* name_buf, size_t name_cap,
                                             const char** name_out) {
   KitLanguage lang;
   if (!tag || !*tag) {
     if (name_out) *name_out = s->default_jit_name;
     return s->default_jit_lang;
   }
   lang = kit_language_for_name(s->compiler, tag);
   if (lang != KIT_LANG_UNKNOWN) {
     dbg_jit_default_name(s->compiler, lang, name_buf, name_cap);
     if (name_out) *name_out = name_buf;
     return lang;
   }
   /* Unknown name: treat `tag` as a `name.ext` filename and resolve by
    * extension (kit_language_for_name does not consult extensions). */
   if (name_out) *name_out = tag;
   return kit_language_for_path(s->compiler, tag);
 }
 
 static KitStatus dbg_compile_sessions_reserve(DbgState* s, KitLanguage lang) {
   KitCompileSession** nb;
   uint32_t want;
   uint32_t ncap;
   uint32_t i;
   size_t old_sz;
   size_t new_sz;
 
   if (!s || lang == KIT_LANG_UNKNOWN || lang == KIT_LANG_AUTO)
     return KIT_INVALID;
   if (lang == UINT32_MAX) return KIT_INVALID;
   want = lang + 1u;
   if (want <= s->compile_sessions_cap) return KIT_OK;
   ncap = s->compile_sessions_cap ? s->compile_sessions_cap : 8u;
   while (ncap < want) {
     if (ncap > UINT32_MAX / 2u) {
       ncap = want;
       break;
     }
     ncap *= 2u;
   }
   if ((size_t)ncap > SIZE_MAX / sizeof(*s->compile_sessions))
     return KIT_NOMEM;
   old_sz = (size_t)s->compile_sessions_cap * sizeof(*s->compile_sessions);
   new_sz = (size_t)ncap * sizeof(*s->compile_sessions);
   nb = (KitCompileSession**)s->env->heap->realloc(
       s->env->heap, s->compile_sessions, old_sz, new_sz,
       _Alignof(KitCompileSession*));
   if (!nb) return KIT_NOMEM;
   for (i = s->compile_sessions_cap; i < ncap; ++i) nb[i] = NULL;
   s->compile_sessions = nb;
   s->compile_sessions_cap = ncap;
   return KIT_OK;
 }
 
 static KitStatus dbg_compile_session_for(DbgState* s, KitLanguage lang,
                                          KitCompileSession** out) {
   KitCompileSessionOptions sopts;
   KitStatus st;
 
   if (!s || !out || lang == KIT_LANG_UNKNOWN || lang == KIT_LANG_AUTO)
     return KIT_INVALID;
   *out = NULL;
   st = dbg_compile_sessions_reserve(s, lang);
   if (st != KIT_OK) return st;
   if (s->compile_sessions[lang]) {
     *out = s->compile_sessions[lang];
     return KIT_OK;
   }
   {
     KitCompileSessionOptions z = {0};
     sopts = z;
   }
   sopts.lang = lang;
   sopts.compile.code = s->copts.code;
   sopts.compile.diagnostics = s->copts.diagnostics;
   sopts.compile.preprocess = s->pp;
   st = kit_compile_session_new(s->compiler, &sopts, &s->compile_sessions[lang]);
   if (st != KIT_OK) return st;
   if (s->ncompile_sessions < lang + 1u) s->ncompile_sessions = lang + 1u;
   *out = s->compile_sessions[lang];
   return KIT_OK;
 }
 
 static int dbg_jit_compile_append_ex(DbgState* s, KitLanguage lang,
                                      const char* input_name, const char* src,
                                      size_t len,
                                      KitFrontendInputKind input_kind,
                                      const char* repl_entry_name) {
   KitSourceInput sin;
   KitCompileSession* session = NULL;
   KitObjBuilder* ob = NULL;
   KitStatus st;
   char generated_name[96];
   char default_name[DBG_JIT_NAME_CAP];
   const char* effective_name =
       input_name ? input_name
                  : dbg_jit_default_name(s->compiler, lang, default_name,
                                         sizeof default_name);
   uint64_t source_id = s->source_counter + 1u;
   int generated_source_name = 0;
 
   s->jit_counter++;
   if (input_kind == KIT_FRONTEND_INPUT_REPL_TOPLEVEL &&
       dbg_jit_uses_default_name(s->compiler, lang, input_name)) {
     if (dbg_make_repl_source_name(s->compiler, lang, source_id, generated_name,
                                   sizeof(generated_name)) != 0) {
       dbg_errf(s, "repl source name overflow");
       return 1;
     }
     if (dbg_source_intern_name(s, kit_slice_cstr(generated_name),
                                &effective_name) != 0) {
       dbg_errf(s, "out of memory naming repl source");
       return 1;
     }
     generated_source_name = 1;
   }
   memset(&sin, 0, sizeof(sin));
   sin.name = kit_slice_cstr(effective_name);
   sin.bytes.data = (const uint8_t*)src;
   sin.bytes.len = len;
   sin.lang = lang;
   sin.input_kind = input_kind;
   sin.repl_entry_name = kit_slice_cstr(repl_entry_name);
   st = dbg_compile_session_for(s, lang, &session);
   /* Stage the compile: on success the frontend's durable declarations are left
    * pending so we only commit them once the object has actually been published
    * into the JIT image. A failed compile is already rolled back internally. */
   if (st == KIT_OK) st = kit_compile_session_stage(session, &sin, &ob);
   if (st != KIT_OK || !ob) {
     if (ob) kit_obj_builder_free(ob);
     dbg_errf(s, "jit compile failed");
     return 1;
   }
   {
     KitLinkSessionOptions lopts = {0};
     KitLinkSession* link = NULL;
     KitJitPublishOptions popts = {0};
     KitJitPublishResult pres;
     lopts.output_kind = KIT_LINK_OUTPUT_RELOCATABLE;
     st = kit_link_session_new(s->compiler, &lopts, &link);
     if (st == KIT_OK) st = kit_link_session_add_obj(link, ob);
     popts.kind = KIT_JIT_PUBLISH_APPEND_OBJECTS;
     popts.link = link;
     if (st == KIT_OK) st = kit_jit_publish(s->jit, &popts, &pres);
     kit_link_session_free(link);
   }
   if (st != KIT_OK) {
     /* Publish rejected the object (e.g. a duplicate global). Roll back the
      * staged declarations so the frontend never advertises a symbol the JIT
      * image does not have. */
     kit_compile_session_abort(session);
     dbg_errf(s, "jit append failed");
     return 1;
   }
   /* Published: make the staged declarations durable. */
   kit_compile_session_commit(session);
   if (generated_source_name) s->source_counter = source_id;
   {
     /* Cache the verbatim toplevel text only for frontends that re-read
      * earlier toplevel source on later compiles (toy today), per the
      * frontend's static capability rather than a hard-coded language. */
     KitFrontendCaps caps = {0};
     int cache_source = kit_frontend_caps(s->compiler, lang, &caps) == KIT_OK &&
                        caps.cache_repl_toplevel_source;
     if (cache_source && input_kind == KIT_FRONTEND_INPUT_REPL_TOPLEVEL &&
         dbg_source_cache_put(s, sin.name, src, len) != 0) {
       dbg_errf(s, "out of memory caching source for list");
     }
   }
   dbg_refresh_dwarf(s);
   return 0;
 }
 
 static int dbg_jit_compile_append(DbgState* s, KitLanguage lang,
                                   const char* input_name, const char* src,
                                   size_t len) {
   return dbg_jit_compile_append_ex(s, lang, input_name, src, len,
                                    KIT_FRONTEND_INPUT_REPL_TOPLEVEL, NULL);
 }
 
 static int dbg_parse_jit_lang_arg(DbgState* s, const char* rest,
                                   KitLanguage* lang_out,
                                   const char** input_name_out,
                                   const char** after_out) {
   const char* p = rest;
   const char* input_name = NULL;
   KitLanguage lang;
 
   while (*p && dbg_isspace((unsigned char)*p)) ++p;
   if (*p && *p != '{') {
     const char* tag = p;
     size_t tag_n;
     char tag_buf[64];
     char name_buf[DBG_JIT_NAME_CAP];
     while (*p && !dbg_isspace((unsigned char)*p) && *p != '{') ++p;
     tag_n = (size_t)(p - tag);
     if (tag_n == 0 || tag_n >= sizeof(tag_buf)) {
       dbg_errf(s, "language/name is too long");
       return 1;
     }
     driver_memcpy(tag_buf, tag, tag_n);
     tag_buf[tag_n] = '\0';
     lang = dbg_jit_language_for_tag(s, tag_buf, name_buf, sizeof name_buf,
                                     &input_name);
     /* `input_name` points into stack storage (name_buf or tag_buf) here, never
      * the session default, so it must be interned to outlive this frame. */
     if (dbg_source_intern_name(s, kit_slice_cstr(input_name), &input_name) !=
         0) {
       dbg_errf(s, "out of memory naming repl source");
       return 1;
     }
     while (*p && dbg_isspace((unsigned char)*p)) ++p;
   } else {
     lang = dbg_jit_language_for_tag(s, NULL, NULL, 0, &input_name);
   }
 
   *lang_out = lang;
   *input_name_out = input_name;
   *after_out = p;
   return 0;
 }
 
 static void dbg_cmd_jit(DbgState* s, const char* rest) {
   char* src = NULL;
   size_t len = 0, cap = 0;
   const char* p;
   const char* input_name;
   KitLanguage lang;
   int depth;
 
   if (dbg_parse_jit_lang_arg(s, rest, &lang, &input_name, &p) != 0) return;
   if (*p != '{') {
     dbg_errf(s, "usage: jit [c|asm|name.ext] { ... }");
     return;
   }
   ++p;
   depth = 1 + dbg_brace_delta(p);
   {
     const char* end = p + driver_strlen(p);
     if (depth <= 0) {
       while (end > p && end[-1] != '}') --end;
       if (end > p) --end;
     }
     if (dbg_buf_append(s, &src, &len, &cap, p, (size_t)(end - p)) != 0)
       goto oom;
     if (dbg_buf_append(s, &src, &len, &cap, "\n", 1) != 0) goto oom;
   }
   while (depth > 0) {
     char line[LINE_CAP];
     int n;
     driver_printf("     > ");
     driver_flush_stdout();
     n = driver_read_line(line, sizeof(line));
     if (n <= 0) {
       dbg_errf(s, "unterminated jit block");
       goto out;
     }
     depth += dbg_brace_delta(line);
     if (depth <= 0) {
       char* close = line;
       while (*close && *close != '}') ++close;
       if (dbg_buf_append(s, &src, &len, &cap, line, (size_t)(close - line)) !=
           0)
         goto oom;
       if (dbg_buf_append(s, &src, &len, &cap, "\n", 1) != 0) goto oom;
       break;
     }
     if (dbg_buf_append(s, &src, &len, &cap, line, driver_strlen(line)) != 0)
       goto oom;
     if (dbg_buf_append(s, &src, &len, &cap, "\n", 1) != 0) goto oom;
   }
 
   (void)dbg_jit_compile_append(s, lang, input_name, src, len);
   goto out;
 
 oom:
   dbg_errf(s, "out of memory");
 out:
   if (src) driver_free(s->env, src, cap);
 }
 
 static void dbg_cmd_edit(DbgState* s, const char* rest) {
   KitLanguage lang;
   const char* input_name;
   const char* p;
   uint8_t* src = NULL;
   size_t len = 0;
   char suffix[DBG_JIT_SUFFIX_CAP];
 
   if (dbg_parse_jit_lang_arg(s, rest, &lang, &input_name, &p) != 0) return;
   if (*p) {
     dbg_errf(s, "usage: edit [c|asm|name.ext]");
     return;
   }
   if (!driver_edit_temp(
           s->env,
           dbg_jit_language_suffix(s->compiler, lang, suffix, sizeof suffix),
           NULL, 0, &src, &len)) {
     dbg_errf(s, "editor failed");
     return;
   }
   if (len == 0) {
     dbg_errf(s, "empty editor buffer; nothing appended");
     goto out;
   }
   (void)dbg_jit_compile_append(s, lang, input_name, (const char*)src, len);
 
 out:
   driver_free(s->env, src, len);
 }
 
 static void dbg_cmd_language(DbgState* s, const char* rest) {
   char tmp[WORD_CAP];
   const char* p = rest;
   size_t n = 0;
   KitLanguage lang;
 
   while (*p && dbg_isspace((unsigned char)*p)) ++p;
   while (p[n] && !dbg_isspace((unsigned char)p[n])) ++n;
   if (n == 0) {
     const KitPreprocessOptions* pp = &s->pp;
     KitCompileSession* cached =
         s->default_jit_lang < s->ncompile_sessions
             ? s->compile_sessions[s->default_jit_lang]
             : NULL;
     driver_printf("Language: %.*s\n",
                   KIT_SLICE_ARG(kit_slice_cstr(dbg_jit_language_name(
                       s->compiler, s->default_jit_lang))));
     driver_printf(
         "Language options: input=%.*s opt=-O%d debug=%.*s includes=%u "
         "system-includes=%u defines=%u undefines=%u session=%.*s\n",
         KIT_SLICE_ARG(kit_slice_cstr(s->default_jit_name)),
         s->copts.code.opt_level,
         KIT_SLICE_ARG(kit_slice_cstr(s->copts.code.debug_info ? "on" : "off")),
         (unsigned)pp->ninclude_dirs, (unsigned)pp->nsystem_include_dirs,
         (unsigned)pp->ndefines, (unsigned)pp->nundefines,
         KIT_SLICE_ARG(kit_slice_cstr(cached ? "cached" : "not-created")));
     return;
   }
   if (n >= sizeof(tmp)) {
     dbg_errf(s, "usage: :language c|asm|wat|wasm");
     return;
   }
   driver_memcpy(tmp, p, n);
   tmp[n] = '\0';
   /* `:language` only needs the resolved language; the display name is
    * recomputed below from dbg_jit_default_name, so no name buffer is requested.
    */
   lang = dbg_jit_language_for_tag(s, tmp, NULL, 0, NULL);
   if (lang == KIT_LANG_UNKNOWN) {
     dbg_errf(s, "unsupported language: %.*s",
              KIT_SLICE_ARG(kit_slice_cstr(tmp)));
     return;
   }
   s->default_jit_lang = lang;
   s->default_jit_name =
       dbg_jit_default_name(s->compiler, lang, s->default_jit_name_buf,
                            sizeof s->default_jit_name_buf);
   driver_printf(
       "Language: %.*s\n",
       KIT_SLICE_ARG(kit_slice_cstr(dbg_jit_language_name(s->compiler, lang))));
 }
 
 static size_t dbg_u64_dec(char* dst, size_t cap, uint64_t v) {
   char tmp[32];
   size_t n = 0;
   size_t i;
   if (!dst || cap == 0) return 0;
   if (v == 0) {
     if (cap < 2u) return 0;
     dst[0] = '0';
     dst[1] = '\0';
     return 1;
   }
   while (v && n < sizeof(tmp)) {
     tmp[n++] = (char)('0' + (v % 10u));
     v /= 10u;
   }
   if (n + 1u > cap) return 0;
   for (i = 0; i < n; ++i) dst[i] = tmp[n - 1u - i];
   dst[n] = '\0';
   return n;
 }
 
 static int dbg_call_u64_entry(DbgState* s, void* entry, const uint64_t* args,
                               uint32_t nargs, uint64_t* ret_out) {
   uint64_t ret = 0;
   KitStopInfo stop;
 
   if (driver_install_sigint(dbg_on_sigint, s) != 0) {
     dbg_errf(s, "failed to install SIGINT handler");
     return 1;
   }
   if (kit_dbg_session_call_u64(s->session, entry, args, nargs, &ret, &stop) !=
       KIT_OK) {
     driver_restore_sigint();
     dbg_errf(s, "call failed (debuggee must be idle or exited)");
     return 1;
   }
   driver_restore_sigint();
   s->last_stop = stop;
   s->has_stop = (stop.kind != KIT_STOP_EXIT);
   if (ret_out) *ret_out = ret;
   if (stop.kind != KIT_STOP_EXIT) {
     s->has_stop = 1;
     dbg_render_stop(s, &stop);
     return 2;
   }
   return 0;
 }
 
 static void dbg_cmd_expr(DbgState* s, const char* expr) {
   char* body = NULL;
   size_t body_len = 0, body_cap = 0;
   char num[32];
   char name[64];
   size_t num_len;
   size_t prefix_len;
   void* entry;
   uint64_t ret = 0;
   uint64_t attempt;
   uint64_t id;
   int is_block = 0;
 
   while (*expr && dbg_isspace((unsigned char)*expr)) ++expr;
   if (!*expr) {
     dbg_errf(s, "usage: expr EXPR | expr { STATEMENTS }");
     return;
   }
 
   if (*expr == '{') {
     const char* p = expr + 1;
     int depth = 1 + dbg_brace_delta(p);
     const char* end = p + driver_strlen(p);
     is_block = 1;
     if (depth <= 0) {
       while (end > p && end[-1] != '}') --end;
       if (end > p) --end;
     }
     if (dbg_buf_append(s, &body, &body_len, &body_cap, p, (size_t)(end - p)) !=
         0)
       goto oom;
     if (dbg_buf_append(s, &body, &body_len, &body_cap, "\n", 1) != 0) goto oom;
     while (depth > 0) {
       char line[LINE_CAP];
       int n;
       driver_printf("expr > ");
       driver_flush_stdout();
       n = driver_read_line(line, sizeof(line));
       if (n <= 0) {
         dbg_errf(s, "unterminated expr block");
         goto out;
       }
       depth += dbg_brace_delta(line);
       if (depth <= 0) {
         char* close = line;
         while (*close && *close != '}') ++close;
         if (dbg_buf_append(s, &body, &body_len, &body_cap, line,
                            (size_t)(close - line)) != 0)
           goto oom;
         if (dbg_buf_append(s, &body, &body_len, &body_cap, "\n", 1) != 0)
           goto oom;
         break;
       }
       if (dbg_buf_append(s, &body, &body_len, &body_cap, line,
                          driver_strlen(line)) != 0)
         goto oom;
       if (dbg_buf_append(s, &body, &body_len, &body_cap, "\n", 1) != 0)
         goto oom;
     }
   }
 
   /* The thunk symbol name uses a monotonic per-attempt counter so each
    * compiled thunk gets a unique linkage name even across failed attempts.
    * The user-visible result number ($N) is a separate counter advanced only
    * after a full success (compile + publish + call), so a failed snippet does
    * not consume a result number. */
   attempt = ++s->expr_attempt;
   num_len = dbg_u64_dec(num, sizeof(num), attempt);
   if (!num_len) {
     dbg_errf(s, "expression counter overflow");
     goto out;
   }
   prefix_len = driver_strlen("__kit_dbg_expr_");
   if (prefix_len + num_len + 1u > sizeof(name)) {
     dbg_errf(s, "expression symbol too long");
     goto out;
   }
   driver_memcpy(name, "__kit_dbg_expr_", prefix_len);
   driver_memcpy(name + prefix_len, num, num_len + 1u);
 
   {
     const char* src = is_block ? body : expr;
     size_t len = is_block ? body_len : driver_strlen(expr);
     KitFrontendInputKind kind =
         is_block ? KIT_FRONTEND_INPUT_REPL_BLOCK : KIT_FRONTEND_INPUT_REPL_EXPR;
     /* s->default_jit_name mirrors dbg_jit_default_name(s->default_jit_lang),
      * kept in sync wherever default_jit_lang is set. */
     if (dbg_jit_compile_append_ex(s, s->default_jit_lang, s->default_jit_name,
                                   src, len, kind, name) != 0) {
       goto out;
     }
   }
 
   entry = kit_jit_lookup(s->jit, kit_slice_cstr(name));
   if (!entry) {
     dbg_errf(s, "expression thunk not found: %.*s",
              KIT_SLICE_ARG(kit_slice_cstr(name)));
     goto out;
   }
   if (dbg_call_u64_entry(s, entry, NULL, 0, &ret) == 0) {
     id = ++s->expr_counter;
     driver_printf("$%llu = %llu (0x%llx)\n", (unsigned long long)id,
                   (unsigned long long)ret, (unsigned long long)ret);
   }
   goto out;
 
 oom:
   dbg_errf(s, "out of memory");
 out:
   if (body) driver_free(s->env, body, body_cap);
 }
 
 /* ============================================================
  * `x ADDR [count]`
  * ============================================================
  * Examine memory: reads `count` bytes (default 16) at `addr` from the
  * worker's address space and prints them as 16-byte rows. */
 
 static void dbg_cmd_examine(DbgState* s, uint64_t addr, size_t count) {
   uint8_t buf[256];
   size_t remaining = count;
 
   if (!s->has_stop) {
     dbg_errf(s, "no program is stopped");
     return;
   }
 
   while (remaining) {
     size_t chunk = remaining > sizeof(buf) ? sizeof(buf) : remaining;
     size_t i;
     if (kit_dbg_session_read_mem(s->session, addr, buf, chunk) != KIT_OK) {
       dbg_errf(s, "read failed at 0x%llx", (unsigned long long)addr);
       return;
     }
     for (i = 0; i < chunk; i += 16) {
       size_t j;
       size_t row = chunk - i < 16 ? chunk - i : 16;
       driver_printf("0x%llx:", (unsigned long long)(addr + i));
       for (j = 0; j < row; ++j) driver_printf(" %02x", buf[i + j]);
       driver_printf("\n");
     }
     addr += chunk;
     remaining -= chunk;
   }
 }
 
 /* ============================================================
  * `disasm [ADDR] [count]`, `x/i [ADDR] [count]`
  * ============================================================
  * Decode a small instruction window from the stopped program. Without an
  * address, starts at the stopped PC; count is in instructions. */
 
 static void dbg_cmd_disasm(DbgState* s, uint64_t addr, size_t count) {
   KitDisasmIter* it = NULL;
   size_t shown = 0;
 
   if (!s->has_stop) {
     dbg_errf(s, "no program is stopped");
     return;
   }
   if (count == 0) count = 8;
   if (count > 32) {
     dbg_errf(s, "disasm count too large");
     return;
   }
   if (kit_dbg_disasm_new(s->session, addr, (uint32_t)count, &it) != KIT_OK) {
     dbg_errf(s, "read failed at 0x%llx", (unsigned long long)addr);
     return;
   }
   while (shown < count) {
     KitInsn insn;
     KitIterResult r = kit_disasm_iter_next(it, &insn);
     if (r == KIT_ITER_END) break;
     if (r != KIT_ITER_ITEM) {
       dbg_errf(s, "disassembly failed");
       break;
     }
     driver_printf("0x%llx: %-8.*s", (unsigned long long)insn.vaddr,
                   KIT_SLICE_ARG(insn.mnemonic));
     if (insn.operands.len) driver_printf(" %.*s", KIT_SLICE_ARG(insn.operands));
     if (insn.annotation.len)
       driver_printf(" %.*s", KIT_SLICE_ARG(insn.annotation));
     driver_printf("\n");
     shown++;
   }
   kit_disasm_iter_free(it);
 }
 
 /* ============================================================
  * Source listing
  * ============================================================
  * Print a context window of source lines centered on `file:line`.
  *
  * Reads REPL snippets from the debugger's in-memory source cache and normal
  * files from disk via env.file_io.  When neither is available (e.g. the DWARF
  * came from a `.o` / `.a` whose source isn't available here), command-mode
  * reports the DWARF line number alone and source stops silently keep the
  * already-rendered location line. */
 
 static void dbg_print_source_bytes(const uint8_t* data, size_t size,
                                    uint32_t line, int report_errors) {
   static const uint8_t empty[1] = {0};
   uint32_t target = line;
   uint32_t lo = target > DBG_LIST_CTX ? target - DBG_LIST_CTX : 1;
   uint32_t hi = target + DBG_LIST_CTX;
   uint32_t cur = 1;
   const uint8_t* p;
   const uint8_t* end;
   const uint8_t* line_start;
 
   if (!data && size != 0) return;
   if (!data) data = empty;
   p = data;
   end = data + size;
   line_start = p;
 
   while (p <= end) {
     int eol = (p == end) || (*p == '\n');
     if (eol) {
       if (p == end && p == line_start && end > data && end[-1] == '\n') break;
       if (cur >= lo && cur <= hi) {
         size_t len = (size_t)(p - line_start);
         driver_printf(
             "%6u%.*s %.*s\n", cur,
             KIT_SLICE_ARG(kit_slice_cstr(cur == target ? " >" : "  ")),
             (int)len, (const char*)line_start);
       }
       ++cur;
       if (p == end) break;
       line_start = p + 1;
     }
     ++p;
   }
   if (report_errors && cur <= target)
     driver_errf(DBG_TOOL, "file has only %u lines; %u requested", cur - 1u,
                 target);
 }
 
 static void dbg_print_source_listing(DbgState* s, KitSlice file, uint32_t line,
                                      uint64_t pc, int report_errors) {
   char path[1024];
   KitFileData fd;
   const KitFileIO* io;
   DbgSource* cached;
 
   if (!file.s || file.len == 0) {
     if (report_errors) {
       dbg_errf(s, "bad file in '%.*s'", KIT_SLICE_ARG(file));
     }
     return;
   }
 
   cached = dbg_source_find(s, file);
   if (cached && cached->data) {
     dbg_print_source_bytes(cached->data, cached->len, line, report_errors);
     return;
   }
 
   if (file.len >= sizeof(path)) {
     if (report_errors) {
       dbg_errf(s, "bad file in '%.*s'", KIT_SLICE_ARG(file));
     }
     return;
   }
   driver_memcpy(path, file.s, file.len);
   path[file.len] = '\0';
 
   /* Try to read the file via file_io.  On miss, fall back to the
    * DWARF-only summary line per doc/DBG.md §10. */
   io = s->env && s->env->file_io.read_all ? &s->env->file_io : NULL;
   if (!io || io->read_all(io->user, path, &fd) != KIT_OK) {
     if (report_errors) {
       driver_printf("%.*s:%u  [source not available; pc=0x%llx]\n",
                     KIT_SLICE_ARG(kit_slice_cstr(path)), line,
                     (unsigned long long)pc);
     }
     return;
   }
 
   dbg_print_source_bytes(fd.data, fd.size, line, report_errors);
 
   if (io->release) io->release(io->user, &fd);
 }
 
 static void dbg_cmd_list(DbgState* s, const char* spec) {
   const char* colon;
   size_t flen;
   char path[1024];
   uint64_t line_u;
   size_t used;
   uint64_t pc;
   KitSlice file;
 
   if (!s->dwarf) {
     dbg_errf(s, "no DWARF: cannot resolve %.*s",
              KIT_SLICE_ARG(kit_slice_cstr(spec)));
     return;
   }
 
   colon = driver_strchr(spec, ':');
   if (!colon || !dbg_isdigit((unsigned char)colon[1])) {
     dbg_errf(s, "usage: list file:line");
     return;
   }
   flen = (size_t)(colon - spec);
   if (flen == 0 || flen >= sizeof(path)) {
     dbg_errf(s, "bad file in '%.*s'", KIT_SLICE_ARG(kit_slice_cstr(spec)));
     return;
   }
   driver_memcpy(path, spec, flen);
   path[flen] = '\0';
   used = dbg_parse_uint(colon + 1, &line_u);
   if (!used || colon[1 + used] != '\0') {
     dbg_errf(s, "usage: list file:line");
     return;
   }
 
   /* Validate via DWARF first. */
   {
     KitStatus st = kit_dwarf_line_to_addr(s->dwarf, kit_slice_cstr(path),
                                           (uint32_t)line_u, &pc);
     if (st == KIT_NOT_FOUND) {
       dbg_errf(s, "no line %u in %.*s", (uint32_t)line_u,
                KIT_SLICE_ARG(kit_slice_cstr(path)));
       return;
     }
     if (st == KIT_AMBIGUOUS) {
       dbg_errf(s,
                "ambiguous: %.*s:%u matches multiple files; "
                "use a longer path suffix",
                KIT_SLICE_ARG(kit_slice_cstr(path)), (uint32_t)line_u);
       return;
     }
     if (st != KIT_OK) {
       dbg_errf(s, "no line entry for %.*s",
                KIT_SLICE_ARG(kit_slice_cstr(spec)));
       return;
     }
   }
 
   file = kit_slice_cstr(path);
   dbg_print_source_listing(s, file, (uint32_t)line_u, pc, 1);
 }
 
 /* ============================================================
  * `info b`, `b LOC`, `d N`, `enable N` / `disable N`, `ignore N COUNT`
  * ============================================================ */
 
 /* Arm a Bp through the appropriate session entry. The plain breakpoint_set
  * is used when no skip/cap is in effect; otherwise the spec form. The
  * driver does not yet wire conditions, but the spec callback slot is left
  * NULL so this remains forward-compatible. */
 static int dbg_bp_arm(DbgState* s, Bp* b) {
   KitStatus st;
   if (b->skip_count == 0 && b->max_hits == 0) {
     st = kit_dbg_session_breakpoint_set(s->session, b->addr, &b->session_id);
   } else {
     KitBreakpointSpec spec;
     KitBreakpointSpec z = {0};
     spec = z;
     spec.addr = b->addr;
     spec.skip_count = b->skip_count;
     spec.max_hits = b->max_hits;
     st = kit_dbg_session_breakpoint_set_spec(s->session, &spec, &b->session_id);
   }
   return st == KIT_OK ? 0 : 1;
 }
 
 static void dbg_cmd_break(DbgState* s, const char* spec) {
   BpKind kind;
   uint64_t addr;
   Bp* b;
 
   if (!*spec) {
     dbg_errf(s, "usage: b <0xADDR | sym[+off] | file.c:line>");
     return;
   }
   if (dbg_resolve_loc(s, spec, &kind, &addr) != 0) return;
 
   b = dbg_bp_grow(s);
   if (!b) return;
 
   {
     Bp z = {0};
     *b = z;
   }
   b->id = ++s->next_bp_id;
   b->enabled = 1;
   b->kind = kind;
   b->addr = addr;
   b->spec = dbg_dup(s->env, spec, driver_strlen(spec), &b->spec_size);
   if (!b->spec) {
     dbg_errf(s, "out of memory");
     return;
   }
 
   if (dbg_bp_arm(s, b) != 0) {
     dbg_errf(s, "failed to arm breakpoint at 0x%llx", (unsigned long long)addr);
     b->session_id = 0;
     b->enabled = 0;
   }
 
   s->nbps++;
   driver_printf(
       "Breakpoint %d at 0x%llx (%.*s)%.*s\n", b->id, (unsigned long long)addr,
       KIT_SLICE_ARG(kit_slice_cstr(spec)),
       KIT_SLICE_ARG(kit_slice_cstr(b->session_id ? "" : " [disarmed]")));
 }
 
 static void dbg_cmd_info_b(DbgState* s) {
   uint32_t i;
   if (s->nbps == 0) {
     driver_printf("No breakpoints.\n");
     return;
   }
   driver_printf("Num  Enb  Address              Skip   Max    Spec\n");
   for (i = 0; i < s->nbps; ++i) {
     Bp* b = &s->bps[i];
     driver_printf(
         "%-4d %-4s 0x%-18llx %-6llu %-6llu %.*s%.*s\n", b->id,
         b->enabled ? "y" : "n", (unsigned long long)b->addr,
         (unsigned long long)b->skip_count, (unsigned long long)b->max_hits,
         KIT_SLICE_ARG(kit_slice_cstr(b->spec)),
         KIT_SLICE_ARG(kit_slice_cstr(b->session_id ? "" : " [disarmed]")));
   }
 }
 
 static void dbg_cmd_ignore(DbgState* s, int id, uint64_t count) {
   Bp* b = dbg_bp_find(s, id);
   if (!b) {
     dbg_errf(s, "no breakpoint %d", id);
     return;
   }
   if (b->session_id) {
     kit_dbg_session_breakpoint_clear(s->session, b->session_id);
     b->session_id = 0;
   }
   b->skip_count = count;
   if (b->enabled) {
     if (dbg_bp_arm(s, b) != 0) {
       dbg_errf(s, "failed to re-arm breakpoint %d", id);
       return;
     }
   }
   driver_printf("Breakpoint %d will skip the next %llu hits\n", id,
                 (unsigned long long)count);
 }
 
 static void dbg_cmd_delete(DbgState* s, int id) {
   if (dbg_bp_remove(s, id) != 0) {
     dbg_errf(s, "no breakpoint %d", id);
   }
 }
 
 static void dbg_cmd_set_enabled(DbgState* s, int id, int enable) {
   Bp* b = dbg_bp_find(s, id);
   if (!b) {
     dbg_errf(s, "no breakpoint %d", id);
     return;
   }
   if (enable && !b->enabled) {
     if (dbg_bp_arm(s, b) != 0) {
       dbg_errf(s, "failed to re-arm breakpoint %d", id);
       return;
     }
     b->enabled = 1;
   } else if (!enable && b->enabled) {
     if (b->session_id) {
       kit_dbg_session_breakpoint_clear(s->session, b->session_id);
       b->session_id = 0;
     }
     b->enabled = 0;
   }
 }
 
 /* ============================================================
  * Help
  * ============================================================ */
 
 static void dbg_cmd_help(void) {
   driver_printf(
       "%.*s",
       KIT_SLICE_ARG(KIT_SLICE_LIT(
           "Commands (abbrev. shown):\n"
           "  h, help                     show this help\n"
           "  q, quit                     exit (Ctrl-D also works)\n"
           "  :language c|asm|wasm/wat\n"
           "                              select language for jit/expr input\n"
           "  r, run                      start fresh execution at entry\n"
           "  c, cont                     continue after a stop\n"
           "  s, step                     step to next source line (into "
           "calls)\n"
           "  si, stepi                   single-step one instruction\n"
           "  n, next                     step to next source line (over "
           "calls)\n"
           "  finish                      run until current frame returns\n"
           "  jit [LANG|NAME] { ... }     compile and append a language "
           "snippet\n"
           "  { ... }                     same as jit { ... }\n"
           "  edit [LANG|NAME], e [...]   edit and append a language snippet\n"
           "  Ctrl-G                      edit the current input line in "
           "$EDITOR\n"
           "  expr EXPR | expr { ... }    compile and call an expression thunk\n"
           "  EXPR                        same as expr EXPR\n"
           "                              LANG defaults to the selected "
           "language\n"
           "  jump ADDR                   set PC to ADDR (no resume)\n"
           "  bt, backtrace               print stack trace with arguments\n"
           "  b LOC                       set breakpoint at LOC:\n"
           "                                 0xADDR | sym[+off] | file.c:line\n"
           "  ignore N COUNT              skip the next COUNT hits of bp N\n"
           "  d N, delete N               delete breakpoint N\n"
           "  enable N | disable N        toggle breakpoint N\n"
           "  p NAME                      print variable / global\n"
           "  set NAME VALUE              write VALUE into NAME\n"
           "  x ADDR [count]              examine memory (count bytes, default "
           "16)\n"
           "  disasm [ADDR] [count], x/i  disassemble at PC or ADDR\n"
           "  list FILE:LINE, l FILE:LINE source listing around FILE:LINE\n"
           "  info b                      list breakpoints\n"
           "  info reg, info registers    dump registers\n"
           "  info locals                 list locals at current PC\n"
           "  info args                   list args at current PC\n"
           "  info functions [PATTERN]    list JIT functions matching PATTERN\n"
           "  info variables [PATTERN]    list JIT globals  matching "
           "PATTERN\n")));
 }
 
 static KitLanguage dbg_default_language_from_inputs(KitCompiler* c,
                                                     const DbgOpts* o) {
   if (o->has_default_lang) return o->default_lang;
   if (o->inputs.nsources) return kit_language_for_path(c, o->inputs.sources[0]);
   if (o->inputs.nsource_memory) return o->inputs.source_memory[0].lang;
   return KIT_LANG_C;
 }
 
 /* ============================================================
  * Tokenizer / dispatch
  * ============================================================ */
 
 /* Trim leading whitespace and split off one whitespace-delimited word.
  * Returns the start of the next region (i.e. the rest of the line, with
  * its own leading whitespace skipped). The input buffer is mutated:
  * the byte after the first word is replaced with a NUL. */
 static char* dbg_take_word(char* line, char** word_out) {
   char* p = line;
   char* w;
   while (*p && dbg_isspace((unsigned char)*p)) ++p;
   if (!*p) {
     *word_out = p;
     return p;
   }
   w = p;
   while (*p && !dbg_isspace((unsigned char)*p)) ++p;
   if (*p) {
     *p = '\0';
     ++p;
   }
   while (*p && dbg_isspace((unsigned char)*p)) ++p;
   *word_out = w;
   return p;
 }
 
 static int dbg_dispatch(DbgState* s, char* line) {
   char raw[LINE_CAP];
   size_t raw_len = driver_strlen(line);
   char* cmd;
   char* rest;
 
   if (raw_len >= sizeof(raw)) raw_len = sizeof(raw) - 1u;
   driver_memcpy(raw, line, raw_len);
   raw[raw_len] = '\0';
 
   rest = dbg_take_word(line, &cmd);
 
   if (!*cmd) return 0; /* blank line */
 
   if (driver_streq(cmd, "h") || driver_streq(cmd, "help")) {
     dbg_cmd_help();
     return 0;
   }
   if (driver_streq(cmd, ":language") || driver_streq(cmd, ":lang") ||
       driver_streq(cmd, "language")) {
     dbg_cmd_language(s, rest);
     return 0;
   }
   if (driver_streq(cmd, "q") || driver_streq(cmd, "quit") ||
       driver_streq(cmd, "exit")) {
     return 1; /* signal "exit REPL" */
   }
   if (driver_streq(cmd, "r") || driver_streq(cmd, "run")) {
     dbg_drive(s, RUN_FRESH);
     return 0;
   }
   if (driver_streq(cmd, "abort")) {
     if (s->has_stop && s->session) {
       kit_dbg_session_resume(s->session, KIT_RESUME_ABORT, NULL);
       s->has_stop = 0;
       dbg_errf(s, "execution aborted");
     } else {
       dbg_errf(s, "nothing to abort");
     }
     return 0;
   }
   if (driver_streq(cmd, "c") || driver_streq(cmd, "cont") ||
       driver_streq(cmd, "continue")) {
     dbg_drive(s, RUN_CONTINUE);
     return 0;
   }
   if (driver_streq(cmd, "s") || driver_streq(cmd, "step")) {
     dbg_drive(s, RUN_STEP_LINE);
     return 0;
   }
   if (driver_streq(cmd, "si") || driver_streq(cmd, "stepi")) {
     dbg_drive(s, RUN_STEP_INSN);
     return 0;
   }
   if (driver_streq(cmd, "n") || driver_streq(cmd, "next")) {
     dbg_drive(s, RUN_NEXT_LINE);
     return 0;
   }
   if (driver_streq(cmd, "finish")) {
     dbg_drive(s, RUN_STEP_OUT);
     return 0;
   }
   if (driver_streq(cmd, "jit")) {
     dbg_cmd_jit(s, rest);
     return 0;
   }
   if (driver_streq(cmd, "edit") || driver_streq(cmd, "e")) {
     dbg_cmd_edit(s, rest);
     return 0;
   }
   if (driver_streq(cmd, "expr")) {
     if (!s->session) {
       dbg_errf(s, "no JIT session");
       return 0;
     }
     dbg_cmd_expr(s, rest);
     return 0;
   }
   if (driver_streq(cmd, "bt") || driver_streq(cmd, "backtrace") ||
       driver_streq(cmd, "where")) {
     dbg_cmd_bt(s);
     return 0;
   }
   if (driver_streq(cmd, "b") || driver_streq(cmd, "break")) {
     char* loc;
     dbg_take_word(rest, &loc);
     dbg_cmd_break(s, loc);
     return 0;
   }
   if (driver_streq(cmd, "info")) {
     char* what;
     rest = dbg_take_word(rest, &what);
     if (driver_streq(what, "b") || driver_streq(what, "break") ||
         driver_streq(what, "breakpoints")) {
       dbg_cmd_info_b(s);
     } else if (driver_streq(what, "reg") || driver_streq(what, "registers")) {
       dbg_cmd_info_reg(s);
     } else if (driver_streq(what, "locals")) {
       dbg_cmd_info_vars(s, 1u << KIT_DVR_LOCAL, "locals");
     } else if (driver_streq(what, "args")) {
       dbg_cmd_info_vars(s, 1u << KIT_DVR_ARG, "args");
     } else if (driver_streq(what, "functions") || driver_streq(what, "func")) {
       char* pat;
       dbg_take_word(rest, &pat);
       dbg_cmd_info_syms(s, KIT_SK_FUNC, *pat ? pat : NULL);
     } else if (driver_streq(what, "variables") || driver_streq(what, "var")) {
       char* pat;
       dbg_take_word(rest, &pat);
       dbg_cmd_info_syms(s, KIT_SK_OBJ, *pat ? pat : NULL);
     } else {
       dbg_errf(s, "unknown 'info' subcommand: %.*s",
                KIT_SLICE_ARG(kit_slice_cstr(what)));
     }
     return 0;
   }
   if (driver_streq(cmd, "set")) {
     char* name;
     char* val_s;
     uint64_t v;
     size_t used;
     rest = dbg_take_word(rest, &name);
     if (!*name) {
       dbg_errf(s, "usage: set NAME VALUE");
       return 0;
     }
     /* Accept an optional `=` between name and value: `set x = 5`. */
     if (driver_streq(name, "=")) {
       dbg_errf(s, "usage: set NAME VALUE");
       return 0;
     }
     rest = dbg_take_word(rest, &val_s);
     if (driver_streq(val_s, "=")) {
       rest = dbg_take_word(rest, &val_s);
     }
     if (!*val_s) {
       dbg_errf(s, "usage: set NAME VALUE");
       return 0;
     }
     used = dbg_parse_uint(val_s, &v);
     if (!used || val_s[used] != '\0') {
       dbg_errf(s, "expected integer value, got '%.*s'",
                KIT_SLICE_ARG(kit_slice_cstr(val_s)));
       return 0;
     }
     dbg_cmd_set(s, name, v);
     return 0;
   }
   if (driver_streq(cmd, "jump") || driver_streq(cmd, "j")) {
     char* addr_s;
     uint64_t addr;
     size_t used;
     dbg_take_word(rest, &addr_s);
     if (!*addr_s) {
       dbg_errf(s, "usage: jump ADDR");
       return 0;
     }
     used = dbg_parse_uint(addr_s, &addr);
     if (!used || addr_s[used] != '\0') {
       dbg_errf(s, "bad address '%.*s'", KIT_SLICE_ARG(kit_slice_cstr(addr_s)));
       return 0;
     }
     dbg_cmd_jump(s, addr);
     return 0;
   }
   if (driver_streq(cmd, "ignore")) {
     char* id_s;
     char* cnt_s;
     uint64_t id;
     uint64_t cnt;
     size_t used;
     rest = dbg_take_word(rest, &id_s);
     dbg_take_word(rest, &cnt_s);
     if (!*id_s || !*cnt_s) {
       dbg_errf(s, "usage: ignore N COUNT");
       return 0;
     }
     used = dbg_parse_uint(id_s, &id);
     if (!used || id_s[used] != '\0') {
       dbg_errf(s, "expected breakpoint id");
       return 0;
     }
     used = dbg_parse_uint(cnt_s, &cnt);
     if (!used || cnt_s[used] != '\0') {
       dbg_errf(s, "expected hit count");
       return 0;
     }
     dbg_cmd_ignore(s, (int)id, cnt);
     return 0;
   }
   if (driver_streq(cmd, "d") || driver_streq(cmd, "delete")) {
     char* arg;
     uint64_t id;
     size_t used;
     dbg_take_word(rest, &arg);
     if (!*arg) {
       dbg_errf(s, "usage: d <id>");
       return 0;
     }
     used = dbg_parse_uint(arg, &id);
     if (!used || arg[used] != '\0') {
       dbg_errf(s, "expected breakpoint id");
       return 0;
     }
     dbg_cmd_delete(s, (int)id);
     return 0;
   }
   if (driver_streq(cmd, "enable") || driver_streq(cmd, "disable")) {
     char* arg;
     uint64_t id;
     size_t used;
     dbg_take_word(rest, &arg);
     used = dbg_parse_uint(arg, &id);
     if (!used || arg[used] != '\0') {
       dbg_errf(s, "expected breakpoint id");
       return 0;
     }
     dbg_cmd_set_enabled(s, (int)id, driver_streq(cmd, "enable"));
     return 0;
   }
   if (driver_streq(cmd, "p") || driver_streq(cmd, "print")) {
     char* name;
     dbg_take_word(rest, &name);
     if (!*name) {
       dbg_errf(s, "usage: p <name>");
       return 0;
     }
     dbg_cmd_print(s, name);
     return 0;
   }
   if (driver_streq(cmd, "list") || driver_streq(cmd, "l")) {
     char* loc;
     dbg_take_word(rest, &loc);
     if (!*loc) {
       dbg_errf(s, "usage: list file:line");
       return 0;
     }
     dbg_cmd_list(s, loc);
     return 0;
   }
   if (driver_streq(cmd, "disasm") || driver_streq(cmd, "x/i")) {
     char* addr_s;
     char* count_s;
     uint64_t addr = s->has_stop ? s->last_stop.regs.pc : 0;
     uint64_t count = 8;
     size_t used;
     rest = dbg_take_word(rest, &addr_s);
     if (*addr_s) {
       used = dbg_parse_uint(addr_s, &addr);
       if (!used || addr_s[used] != '\0') {
         dbg_errf(s, "bad address '%.*s'",
                  KIT_SLICE_ARG(kit_slice_cstr(addr_s)));
         return 0;
       }
       dbg_take_word(rest, &count_s);
       if (*count_s) {
         used = dbg_parse_uint(count_s, &count);
         if (!used || count_s[used] != '\0') {
           dbg_errf(s, "bad count '%.*s'",
                    KIT_SLICE_ARG(kit_slice_cstr(count_s)));
           return 0;
         }
       }
     }
     dbg_cmd_disasm(s, addr, (size_t)count);
     return 0;
   }
   if (driver_streq(cmd, "x") || driver_streq(cmd, "examine")) {
     char* addr_s;
     char* count_s;
     uint64_t addr;
     uint64_t count = 16;
     size_t used;
     rest = dbg_take_word(rest, &addr_s);
     if (!*addr_s) {
       dbg_errf(s, "usage: x <addr> [count]");
       return 0;
     }
     used = dbg_parse_uint(addr_s, &addr);
     if (!used || addr_s[used] != '\0') {
       dbg_errf(s, "bad address '%.*s'", KIT_SLICE_ARG(kit_slice_cstr(addr_s)));
       return 0;
     }
     dbg_take_word(rest, &count_s);
     if (*count_s) {
       used = dbg_parse_uint(count_s, &count);
       if (!used || count_s[used] != '\0') {
         dbg_errf(s, "bad count '%.*s'", KIT_SLICE_ARG(kit_slice_cstr(count_s)));
         return 0;
       }
     }
     dbg_cmd_examine(s, addr, (size_t)count);
     return 0;
   }
 
   if (cmd[0] == '{') {
     dbg_cmd_jit(s, raw);
     return 0;
   }
 
   if (s->session) {
     dbg_cmd_expr(s, raw);
   } else {
     dbg_errf(s, "unknown command: %.*s (try 'h')",
              KIT_SLICE_ARG(kit_slice_cstr(cmd)));
   }
   return 0;
 }
 
 /* ============================================================
  * Completion
  * ============================================================ */
 
 static int dbg_slice_has_prefix(KitSlice s, const char* prefix,
                                 size_t prefix_len) {
   return s.len >= prefix_len && memcmp(s.s, prefix, prefix_len) == 0;
 }
 
 static int dbg_cstr_has_prefix(const char* s, const char* prefix,
                                size_t prefix_len) {
   return driver_strlen(s) >= prefix_len && memcmp(s, prefix, prefix_len) == 0;
 }
 
 static int dbg_completion_seen(DriverLineCompletionList* out, const char* text,
                                size_t len) {
   uint32_t i;
   for (i = 0; i < out->count; ++i) {
     if (driver_strlen(out->items[i].text) == len &&
         memcmp(out->items[i].text, text, len) == 0)
       return 1;
   }
   return 0;
 }
 
 static void dbg_completion_add_cstr(DriverLineCompletionList* out,
                                     const char* prefix, size_t prefix_len,
                                     const char* text) {
   size_t len = driver_strlen(text);
   if (!dbg_cstr_has_prefix(text, prefix, prefix_len)) return;
   if (dbg_completion_seen(out, text, len)) return;
   (void)driver_line_completion_add(out, text, len);
 }
 
 static void dbg_completion_add_slice(DriverLineCompletionList* out,
                                      const char* prefix, size_t prefix_len,
                                      KitSlice text) {
   if (!text.s || !dbg_slice_has_prefix(text, prefix, prefix_len)) return;
   if (dbg_completion_seen(out, text.s, text.len)) return;
   (void)driver_line_completion_add(out, text.s, text.len);
 }
 
 static void dbg_completion_add_u64(DriverLineCompletionList* out,
                                    const char* prefix, size_t prefix_len,
                                    uint64_t v) {
   char buf[32];
   size_t n = 0;
   char rev[32];
   size_t r = 0;
   if (v == 0) {
     rev[r++] = '0';
   } else {
     while (v && r < sizeof(rev)) {
       rev[r++] = (char)('0' + (v % 10u));
       v /= 10u;
     }
   }
   while (r > 0 && n + 1u < sizeof(buf)) buf[n++] = rev[--r];
   buf[n] = '\0';
   dbg_completion_add_cstr(out, prefix, prefix_len, buf);
 }
 
 static void dbg_word_bounds(const char* line, size_t cursor, size_t* start,
                             size_t* end) {
   size_t len = driver_strlen(line);
   size_t s = cursor < len ? cursor : len;
   size_t e = s;
   while (s > 0 && !dbg_isspace((unsigned char)line[s - 1])) --s;
   while (e < len && !dbg_isspace((unsigned char)line[e])) ++e;
   *start = s;
   *end = e;
 }
 
 static size_t dbg_read_word_at(const char* line, size_t start, char* out,
                                size_t cap) {
   size_t i = start;
   size_t n = 0;
   while (line[i] && dbg_isspace((unsigned char)line[i])) ++i;
   while (line[i] && !dbg_isspace((unsigned char)line[i])) {
     if (n + 1u < cap) out[n++] = line[i];
     ++i;
   }
   if (cap) out[n] = '\0';
   return n;
 }
 
 static void dbg_complete_commands(DriverLineCompletionList* out,
                                   const char* prefix, size_t prefix_len) {
   static const char* const cmds[] = {
       "help",   "quit",     "exit",      "run",     "cont",  "continue",
       "step",   "stepi",    "next",      "finish",  "jit",   "edit",
       "expr",   "bt",       "backtrace", "where",   "break", "info",
       "ignore", "delete",   "enable",    "disable", "print", "set",
       "jump",   "list",     "disasm",    "x",       "x/i",   ":language",
       ":lang",  "language", "abort",     "h",       "q",     "r",
       "c",      "s",        "si",        "n",       "b",     "d",
       "p",      "l",        "e",
   };
   size_t i;
   for (i = 0; i < sizeof(cmds) / sizeof(cmds[0]); ++i)
     dbg_completion_add_cstr(out, prefix, prefix_len, cmds[i]);
 }
 
 static void dbg_complete_info(DriverLineCompletionList* out, const char* prefix,
                               size_t prefix_len) {
   static const char* const words[] = {
       "b",    "break",     "breakpoints", "reg",       "registers", "locals",
       "args", "functions", "func",        "variables", "var",
   };
   size_t i;
   for (i = 0; i < sizeof(words) / sizeof(words[0]); ++i)
     dbg_completion_add_cstr(out, prefix, prefix_len, words[i]);
 }
 
 static void dbg_complete_languages(DriverLineCompletionList* out,
                                    const char* prefix, size_t prefix_len) {
   static const char* const langs[] = {"c", "asm", "wasm", "wat"};
   size_t i;
   for (i = 0; i < sizeof(langs) / sizeof(langs[0]); ++i)
     dbg_completion_add_cstr(out, prefix, prefix_len, langs[i]);
 }
 
 static void dbg_complete_symbols(DbgState* s, DriverLineCompletionList* out,
                                  const char* prefix, size_t prefix_len,
                                  int funcs, int objects) {
   KitJitSymIter* it = NULL;
   KitJitSym sym;
   if (!s->jit || kit_jit_sym_iter_new(s->jit, &it) != KIT_OK) return;
   for (;;) {
     KitIterResult r = kit_jit_sym_iter_next(it, &sym);
     if (r != KIT_ITER_ITEM) break;
     if ((sym.kind == KIT_SK_FUNC && funcs) ||
         (sym.kind == KIT_SK_OBJ && objects))
       dbg_completion_add_slice(out, prefix, prefix_len, sym.name);
   }
   kit_jit_sym_iter_free(it);
 }
 
 static void dbg_complete_locals(DbgState* s, DriverLineCompletionList* out,
                                 const char* prefix, size_t prefix_len) {
   KitDwarfVarIter* it = NULL;
   KitDwarfVar v;
   if (!s->has_stop || !s->dwarf) return;
   if (kit_dwarf_vars_at_new(s->dwarf, dbg_pc_rt_to_img(s, s->last_stop.regs.pc),
                             KIT_DVRM_LOCAL | KIT_DVRM_ARG, &it) != KIT_OK)
     return;
   for (;;) {
     KitIterResult r = kit_dwarf_vars_at_next(it, &v);
     if (r != KIT_ITER_ITEM) break;
     dbg_completion_add_slice(out, prefix, prefix_len, v.name);
   }
   kit_dwarf_vars_at_free(it);
 }
 
 static void dbg_complete_files(DbgState* s, DriverLineCompletionList* out,
                                const char* prefix, size_t prefix_len) {
   KitDwarfCuIter* cui = NULL;
   KitDwarfCu cu;
   if (!s->dwarf) return;
   if (kit_dwarf_cu_iter_new(s->dwarf, &cui) != KIT_OK) return;
   for (;;) {
     KitDwarfLineIter* li = NULL;
     KitDwarfLineRow row;
     KitIterResult cr = kit_dwarf_cu_iter_next(cui, &cu);
     if (cr != KIT_ITER_ITEM) break;
     if (kit_dwarf_line_iter_new(s->dwarf, cu.offset, &li) != KIT_OK) continue;
     for (;;) {
       KitSlice file = KIT_SLICE_NULL;
       KitIterResult lr = kit_dwarf_line_iter_next(li, &row);
       if (lr != KIT_ITER_ITEM) break;
       if (kit_dwarf_line_file(s->dwarf, cu.offset, row.file_index, &file) ==
           KIT_OK)
         dbg_completion_add_slice(out, prefix, prefix_len, file);
     }
     kit_dwarf_line_iter_free(li);
   }
   kit_dwarf_cu_iter_free(cui);
 }
 
 static void dbg_complete_breakpoint_ids(DbgState* s,
                                         DriverLineCompletionList* out,
                                         const char* prefix, size_t prefix_len) {
   uint32_t i;
   for (i = 0; i < s->nbps; ++i)
     dbg_completion_add_u64(out, prefix, prefix_len, (uint64_t)s->bps[i].id);
 }
 
 static void dbg_complete(void* user, const char* line, size_t cursor,
                          DriverLineCompletionList* out) {
   DbgState* s = (DbgState*)user;
   char cmd[WORD_CAP];
   char arg1[WORD_CAP];
   size_t start, end;
   size_t prefix_len;
   const char* prefix;
 
   dbg_word_bounds(line, cursor, &start, &end);
   out->replace_start = start;
   out->replace_end = end;
   prefix = line + start;
   prefix_len = cursor > start ? cursor - start : 0;
 
   dbg_read_word_at(line, 0, cmd, sizeof(cmd));
   if (start == 0 || cmd[0] == '\0') {
     dbg_complete_commands(out, prefix, prefix_len);
     return;
   }
 
   if (driver_streq(cmd, "info")) {
     dbg_read_word_at(line, start == 0 ? 0 : driver_strlen(cmd), arg1,
                      sizeof(arg1));
     if (arg1[0] == '\0' || start <= driver_strlen(cmd) + 1u) {
       dbg_complete_info(out, prefix, prefix_len);
       return;
     }
   }
 
   if (driver_streq(cmd, ":language") || driver_streq(cmd, ":lang") ||
       driver_streq(cmd, "language")) {
     dbg_complete_languages(out, prefix, prefix_len);
     return;
   }
   if (driver_streq(cmd, "jit") || driver_streq(cmd, "edit") ||
       driver_streq(cmd, "e")) {
     dbg_complete_languages(out, prefix, prefix_len);
     dbg_complete_symbols(s, out, prefix, prefix_len, 1, 0);
     return;
   }
   if (driver_streq(cmd, "b") || driver_streq(cmd, "break")) {
     dbg_complete_symbols(s, out, prefix, prefix_len, 1, 0);
     dbg_complete_files(s, out, prefix, prefix_len);
     return;
   }
   if (driver_streq(cmd, "list") || driver_streq(cmd, "l")) {
     dbg_complete_files(s, out, prefix, prefix_len);
     return;
   }
   if (driver_streq(cmd, "p") || driver_streq(cmd, "print") ||
       driver_streq(cmd, "set")) {
     dbg_complete_locals(s, out, prefix, prefix_len);
     dbg_complete_symbols(s, out, prefix, prefix_len, 0, 1);
     return;
   }
   if (driver_streq(cmd, "d") || driver_streq(cmd, "delete") ||
       driver_streq(cmd, "enable") || driver_streq(cmd, "disable") ||
       driver_streq(cmd, "ignore")) {
     dbg_complete_breakpoint_ids(s, out, prefix, prefix_len);
     return;
   }
 
   dbg_complete_locals(s, out, prefix, prefix_len);
   dbg_complete_symbols(s, out, prefix, prefix_len, 1, 1);
 }
 
 /* ============================================================
  * Script source helpers
  * ============================================================ */
 
 typedef enum DbgScriptResult {
   DBG_SCRIPT_CONTINUE = 0,
   DBG_SCRIPT_QUIT,
   DBG_SCRIPT_ERROR,
 } DbgScriptResult;
 
 /* Execute a single command string as if typed at the REPL. */
 static DbgScriptResult dbg_run_script_cmd(DbgState* s, const char* cmd) {
   char line[LINE_CAP];
   size_t n = driver_strlen(cmd);
   int errors = s->error_count;
   int quit;
   if (n >= LINE_CAP) {
     dbg_errf(s, "script command exceeds %u bytes", (unsigned)(LINE_CAP - 1u));
     return DBG_SCRIPT_ERROR;
   }
   driver_memcpy(line, cmd, n);
   line[n] = '\0';
   quit = dbg_dispatch(s, line);
   if (quit) return DBG_SCRIPT_QUIT;
   return s->error_count != errors ? DBG_SCRIPT_ERROR : DBG_SCRIPT_CONTINUE;
 }
 
 /* Execute debugger commands from a file, one per line. */
 static DbgScriptResult dbg_run_script_file(DbgState* s, const char* path) {
   DriverLoad load = {0};
   KitSlice bytes;
   const char* p;
   const char* end;
   char line[LINE_CAP];
   uint64_t line_no = 0;
   if (driver_load_bytes(&s->env->file_io, DBG_TOOL, path, &load, &bytes) != 0) {
     ++s->error_count; /* driver_load_bytes already emitted the diagnostic */
     return DBG_SCRIPT_ERROR;
   }
   p = (const char*)bytes.data;
   end = p + bytes.len;
   while (p < end) {
     const char* nl = p;
     size_t len;
     int errors = s->error_count;
     int quit;
     ++line_no;
     while (nl < end && *nl != '\n') nl++;
     len = (size_t)(nl - p);
     /* Strip trailing carriage return. */
     if (len > 0 && p[len - 1] == '\r') len--;
     if (len >= LINE_CAP) {
       dbg_errf(s, "%s:%llu: script line exceeds %u bytes", path,
                (unsigned long long)line_no, (unsigned)(LINE_CAP - 1u));
       driver_release_bytes(&s->env->file_io, &load);
       return DBG_SCRIPT_ERROR;
     }
     driver_memcpy(line, p, len);
     line[len] = '\0';
     p = (nl < end) ? nl + 1 : end;
     quit = dbg_dispatch(s, line);
     if (quit) {
       driver_release_bytes(&s->env->file_io, &load);
       return DBG_SCRIPT_QUIT;
     }
     if (s->error_count != errors) {
       driver_release_bytes(&s->env->file_io, &load);
       return DBG_SCRIPT_ERROR;
     }
   }
   driver_release_bytes(&s->env->file_io, &load);
   return DBG_SCRIPT_CONTINUE;
 }
 
 /* ============================================================
  * REPL
  * ============================================================ */
 
 static void dbg_repl(DbgState* s) {
   char line[LINE_CAP];
   uint32_t i;
 
   if (!s->batch_mode) driver_printf("kit dbg — 'h' for help, 'q' to quit\n");
 
   /* Phase 1: drain --script / --command sources in order. */
   for (i = 0; i < s->nscript_entries; i++) {
     DbgScriptEntry* e = &s->script_entries[i];
     DbgScriptResult result =
         (e->kind == DBG_ENTRY_FILE) ? dbg_run_script_file(s, e->value)
                                    : dbg_run_script_cmd(s, e->value);
     if (result == DBG_SCRIPT_QUIT) return;
     if (result == DBG_SCRIPT_ERROR) {
       s->script_failed = 1;
       return;
     }
   }
 
   /* Phase 2: in --batch mode, exit without falling through to stdin. */
   if (s->batch_mode) return;
 
   /* Phase 3: interactive loop. */
   for (;;) {
     int n;
     char edit_suffix[DBG_JIT_SUFFIX_CAP];
     /* Ctrl-G edits the typed line in $EDITOR; tag the temp file with the
      * current language's extension so editors highlight it. Recomputed each
      * iteration since `:language` can change the default mid-session. */
     n = driver_read_line_edit(
         s->env, "(kit) ", line, sizeof(line), &s->line_history, dbg_complete, s,
         dbg_jit_language_suffix(s->compiler, s->default_jit_lang, edit_suffix,
                                 sizeof edit_suffix));
     if (n == 0) { /* EOF — Ctrl-D */
       driver_printf("\n");
       return;
     }
     if (n == -1) {
       dbg_errf(s, "stdin read error");
       return;
     }
     if (n == -2) { /* SIGINT during prompt */
       driver_printf("\n");
       continue;
     }
     if (dbg_dispatch(s, line)) return;
   }
 }
 
 /* ============================================================
  * Top-level entry
  * ============================================================ */
 
 static int dbg_init_frontends(DbgOpts* o, const KitContext* ctx,
                               const KitDriverExtension* ext) {
   if (kit_frontend_registry_new(ctx, &o->frontends) != KIT_OK ||
       kit_frontend_registry_add_builtin(o->frontends) != KIT_OK ||
       (ext && ext->register_frontends &&
        ext->register_frontends(o->frontends) != KIT_OK)) {
     driver_errf(DBG_TOOL, "failed to initialize frontend registry");
     return 1;
   }
   return 0;
 }
 
 int driver_dbg_ex(int argc, char** argv, const KitDriverExtension* ext) {
   DriverEnv env;
   DbgOpts o = {0};
   KitCompiler* compiler = NULL;
   KitTarget* target = NULL;
   KitJit* jit = NULL;
   DbgState st = {0};
   KitContext ctx;
   KitJitHost jhost;
   KitDbgHost dhost;
   int rc;
 
   if (driver_argv_wants_help(argc, argv, 1)) {
     driver_help_dbg();
     return 0;
   }
 
   driver_env_init(&env);
   o.env = &env;
   ctx = driver_env_to_context(&env);
 
   if (dbg_init_frontends(&o, &ctx, ext) != 0) {
     dbg_options_release(&o);
     driver_env_fini(&env);
     return 1;
   }
 
   if (dbg_parse(argc, argv, &o) != 0) {
     dbg_options_release(&o);
     driver_env_fini(&env);
     return 2;
   }
 
   jhost = driver_env_to_jit_host(&env);
   dhost = driver_env_to_dbg_host(&env);
   {
     KitTargetOptions topts;
     memset(&topts, 0, sizeof topts);
     topts.spec = driver_host_target();
     if (kit_target_new(&ctx, &topts, &target) != KIT_OK) {
       driver_errf(DBG_TOOL, "failed to initialize compiler");
       kit_target_free(target);
       dbg_options_release(&o);
       driver_env_fini(&env);
       return 1;
     }
     {
       KitCompilerOptions copts;
       memset(&copts, 0, sizeof copts);
       copts.frontends = o.frontends;
       if (kit_compiler_new_ex(target, &ctx, &copts, &compiler) != KIT_OK) {
         driver_errf(DBG_TOOL, "failed to initialize compiler");
         kit_target_free(target);
         dbg_options_release(&o);
         driver_env_fini(&env);
         return 1;
       }
       driver_diag_set_compiler(compiler);
     }
   }
 
   rc = dbg_compile_and_jit(&o, compiler, &jhost, &jit);
   if (rc != 0) {
     driver_compiler_free(compiler);
     kit_target_free(target);
     dbg_options_release(&o);
     driver_env_fini(&env);
     return rc;
   }
 
   st.env = &env;
   st.compiler = compiler;
   st.ctx = ctx;
   dbg_fill_compile_options(&o, &st.copts, &st.pp);
   st.jit = jit;
   st.default_jit_lang = dbg_default_language_from_inputs(compiler, &o);
   st.default_jit_name = dbg_jit_default_name(st.compiler, st.default_jit_lang,
                                              st.default_jit_name_buf,
                                              sizeof st.default_jit_name_buf);
   st.prog_argc = (int)o.prog_argc;
   st.prog_argv = o.prog_argv;
   st.entry_name = o.entry;
   st.script_entries = o.script_entries;
   st.nscript_entries = o.nscript_entries;
   st.batch_mode = o.batch_mode;
 
   if (driver_inputs_count(&o.inputs) != 0) {
     st.entry_addr = kit_jit_lookup(jit, kit_slice_cstr(o.entry));
     if (!st.entry_addr) {
       driver_errf(DBG_TOOL, "entry symbol not found: %.*s",
                   KIT_SLICE_ARG(kit_slice_cstr(o.entry)));
       kit_jit_free(jit);
       driver_compiler_free(compiler);
       kit_target_free(target);
       dbg_options_release(&o);
       driver_env_fini(&env);
       return 1;
     }
   }
 
   if (kit_dbg_session_new(jit, &dhost, &st.session) != KIT_OK) {
     driver_errf(DBG_TOOL,
                 "JIT session not yet implemented in libkit — "
                 "REPL will start in degraded mode (commands will surface "
                 "'session implementation pending' until the lib lands)");
     st.session = NULL;
     /* Keep going so the surrounding driver path is exercised. */
   }
 
   st.view = kit_jit_view(jit);
   if (st.view) {
     if (kit_dwarf_open(&ctx, st.view, &st.dwarf) != KIT_OK) st.dwarf = NULL;
     if (st.dwarf && st.session) {
       kit_dbg_session_attach_dwarf(st.session, st.dwarf);
     }
   }
 
   dbg_repl(&st);
 
   driver_line_history_fini(&env, &st.line_history);
   dbg_bps_release_all(&st);
   dbg_compile_sessions_release(&st);
   dbg_sources_release_all(&st);
   if (st.fmt_writer) st.fmt_writer->close(st.fmt_writer);
   if (st.dwarf) kit_dwarf_free(st.dwarf);
   if (st.session) kit_dbg_session_free(st.session);
   kit_jit_free(jit);
   driver_compiler_free(compiler);
   kit_target_free(target);
   dbg_options_release(&o);
   driver_env_fini(&env);
   return (st.script_failed || (st.batch_mode && st.error_count > 0)) ? 1 : 0;
 }
 
 int driver_dbg(int argc, char** argv) { return driver_dbg_ex(argc, argv, NULL); }