where-the-f-did-you-come-from.sh

#!/bin/bash

echo "🔍 LSOF DETECTIVE MODE"
echo "Watching for .clinerules-architect files and immediately identifying the creator..."
echo ""

WATCH_DIR="/home/delorenj/code"
FILENAME=".clinerules-architect"

inotifywait -m -r --format '%w%f' -e create "$WATCH_DIR" | while read FILE; do
  if [[ "$(basename "$FILE")" == "$FILENAME" ]]; then
    echo "🚨 FILE CREATED: $FILE"
    notify-send "New .clinerules-architect file" "$FILE" --icon=dialog-information
    paplay /usr/share/sounds/freedesktop/stereo/complete.oga 2>/dev/null || true
    # Get process info using lsof
    sleep 0.1 # Give the process a moment to finish creating the file
    CULPRIT=$(sudo lsof "$FILE" 2>/dev/null | tail -n +2 | awk '{print $2, $1}')

    if [[ -n "$CULPRIT" ]]; then
      PID=$(echo "$CULPRIT" | awk '{print $1}')
      PROC=$(echo "$CULPRIT" | awk '{print $2}')
      EXE=$(readlink -f /proc/$PID/exe 2>/dev/null || echo "unknown")
      CMD=$(cat /proc/$PID/cmdline 2>/dev/null | tr '\0' ' ' || echo "unknown")

      echo "🕵️ CULPRIT IDENTIFIED:"
      echo "   Process: $PROC (PID: $PID)"
      echo "   Executable: $EXE"
      echo "   Command: $CMD"
      echo "   Parent Process: $(ps -o ppid= -p $PID | tr -d ' ')"
      echo ""
    else
      echo "⚠️  Process already exited, checking recent file modifications..."
      # Fallback: check recent processes that touched the directory
      sudo sysdig -p "%proc.name %proc.exepath" "fd.name contains \"$FILENAME\"" 2>/dev/null | tail -5
    fi
  fi
done