…et_fullname (#1998)

* Initial plan

* Fix get_fullname to use importlib.util.find_spec instead of removed pkgutil.get_loader

pkgutil.get_loader() was removed in Python 3.14, causing subprocess
module execution to fail with "No module named" when subProcess: true.
Replace with importlib.util.find_spec() which is the recommended
replacement and works across all supported Python versions.

Co-authored-by: rchiodo <19672699+rchiodo@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: rchiodo <19672699+rchiodo@users.noreply.github.com>

If a client sends an evaluate command with context=hover and if the
expression fails, the client received an error with the message
"Exception occurred during evaluation"

This wasn't very helpful. This changes the logic to treat `hover` just
like `watch` in the error case to send back `eval_result.result`. That
contains the message of the exception which is typically more useful.

* avoid strong reference to exceptions during unwind

* update cython files

* fix getattr

* remove comment

* avoid side effect from overloaded getattr/setattr

* Generate cython on Windows

* Put back non sys monitoring cython

---------

Co-authored-by: Rich Chiodo false <rchiodo@microsoft.com>

* git subrepo commit (merge) src/debugpy/_vendored/pydevd

subrepo:
  subdir:   "src/debugpy/_vendored/pydevd"
  merged:   "6bacec5b"
upstream:
  origin:   "https://github.com/fabioz/PyDev.Debugger.git"
  branch:   "main"
  commit:   "b5cfeb38"
git-subrepo:
  version:  "0.4.1"
  origin:   "???"
  commit:   "???"

* Fixup generator to not add files in the venv

* Update contributing.md

…rocess adapter fix) (#2012)

* Initial plan

* Fix multi-thread resume when in-process debug adapter is used

Per the DAP spec, a ContinueRequest should resume all threads unless
singleThread=True is explicitly set. Previously, only the out-of-process
adapter path worked correctly (it transformed threadId to '*' before
forwarding to pydevd). With the in-process adapter, the specific threadId
reached pydevd directly but was only used to resume that one thread.

Fix on_continue_request to set thread_id='*' whenever singleThread is not
True, regardless of multi_threads_single_notification. Also update
write_continue test helper and add a regression test.

Fixes: #2009

Co-authored-by: rchiodo <19672699+rchiodo@users.noreply.github.com>

* Use getattr for safe singleThread attribute access in on_continue_request

Most DAP clients omit the optional singleThread field entirely. Using
getattr(arguments, 'singleThread', False) is more defensive than direct
attribute access, guarding against any non-standard arguments objects.

Co-authored-by: rchiodo <19672699+rchiodo@users.noreply.github.com>

* Add timeout failure comment in test; keep intentional TEST SUCEEDED convention

The 'TEST SUCEEDED' misspelling is an intentional convention in the pydevd
test framework (debugger_unittest.py checks stdout for this exact string).
Revert the resource file to preserve the convention while still adding the
explanatory comment requested in the test method.

Co-authored-by: rchiodo <19672699+rchiodo@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: rchiodo <19672699+rchiodo@users.noreply.github.com>

* Add option for ignore all system exit codes

* Change to Pavel's suggestion

* More checking

* Fix whitespace

* Add test for range scenario

* Review feedback

* Fix evaluation of variables from chained exception frames

* Move frame registration into a shared helper function

* Create test for issue

* Trying out a fix

* Fix syntax errors

* Really fix syntax errors

* Prevent invalid scopes request from crashing debug session

If an unmapped or non-numeric frameId is sent in a scopes request,
int() raises a ValueError that terminates the debug session. Wrap the
scope construction in a try/except so that invalid frameIds return an
empty scopes list instead, which is valid per the DAP spec.

* Add logging for invalid scopes requests

Log expected errors (ValueError, TypeError) at info level and
unexpected exceptions with full traceback via pydev_log.exception.

…out (#2027)

When a DAP client sends an `evaluate` request with `context: "repl"` and no
`frameId`, debugpy forces the expression through the exec code path. Previously,
if the expression could be compiled as an eval (e.g. `2 + 2`),
`evaluate_expression` would compute the result but write it to `sys.stdout` and
return `None`. The caller in `internal_evaluate_expression_json` would then send
back `result=""` in the response body. Clients that read the response
body would get nothing, while the actual value was emitted as a DAP output event.

This changes `evaluate_expression` to return the computed result from the
eval-within-exec path instead of printing it. The caller now captures that
return value and includes it in the response body. Pure exec statements (e.g.
`x = 42`) continue to return `None` and produce `result=""` as before.

VS Code is unaffected because it always provides a `frameId`, which routes
through the normal eval path where results already go into the response body.

…lawfinder-cython-read-loop

Fix TSA #2816219: suppress Flawfinder false positive on Cython read-loop iterator (_pydevd_sys_monitoring_cython.c)

…oop iterator (#2032)

Flawfinder's buffer/read rule (CWE-120, CWE-20) fires whenever an
identifier named "read" appears inside a loop, assuming it refers to the
POSIX read() syscall. The Cython 3.x ModuleStateLookup boilerplate in
__Pyx_State_ConvertFromInterpIdAsIndex uses "read" as the name of a
pointer iterator that walks data->table, bounded by
end = read + data->count. There is no syscall and no unbounded buffer
access -- this is a false positive.

Add an inline /* Flawfinder: ignore */ annotation to the flagged line in
the Cython-generated pydevd_cython.c and extend the existing
post-processing block in setup_pydevd_cython.py so the annotation is
re-applied automatically whenever Cython regenerates the .c files.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…oop iterator (#2030)

Flawfinder's buffer/read rule (CWE-120, CWE-20) fires whenever an
identifier named "read" appears inside a loop, assuming it refers to the
POSIX read() syscall. The Cython 3.x ModuleStateLookup boilerplate in
__Pyx_State_ConvertFromInterpIdAsIndex uses "read" as the name of a
pointer iterator that walks data->table, bounded by
end = read + data->count. There is no syscall and no unbounded buffer
access -- this is a false positive.

Add an inline /* Flawfinder: ignore */ annotation to the flagged line in
the Cython-generated pydevd_frame_evaluator.c and extend the existing
post-processing block in setup_pydevd_cython.py so the annotation is
re-applied automatically whenever Cython regenerates the .c files.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…PAIRS_8 memcpy (#2028)

* Fix TSA #2816216: suppress Flawfinder false positive on Cython DIGIT_PAIRS_8 memcpy

Flawfinder's buffer/memcpy rule (CWE-120) fires on any memcpy() call by
default. The flagged call sits inside the Cython 3.x integer formatter
__Pyx____Pyx_PyUnicode_From_int (case 'o'):

    memcpy(dpos, DIGIT_PAIRS_8 + digit_pos * 2, 2);

It is provably safe:
* dpos points into the stack buffer `digits[sizeof(int)*3+2]` (14 bytes
  for a 32-bit int); `dpos -= 2` immediately precedes the copy and the
  enclosing do/while loop iterates at most ceil(log_64(max_int)) times,
  so dpos always stays >= digits.
* DIGIT_PAIRS_8 is a 128-byte compile-time constant table containing the
  64 two-character octal digit pairs "00".."77". `digit_pos = abs(remaining
  % 64)`, so `digit_pos * 2` ranges over [0, 126] and reads 2 bytes from
  offset [0, 127] -- within the table.
* The size argument is the compile-time constant 2.

Add an inline /* Flawfinder: ignore */ annotation on the flagged line in
the Cython-generated pydevd_cython.c and extend the existing
post-processing block in setup_pydevd_cython.py so the annotation is
re-applied automatically whenever Cython regenerates the .c files.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix SyntaxError: add missing closing paren on DIGIT_PAIRS_8 .replace() call

Same merge-from-main artifact as #2029: the closing ')' of the new

DIGIT_PAIRS_8 '.replace(...)' call was dropped when the 'read<end'

'.replace(...)' block was spliced in, leaving the second call's args

being parsed as continued positional args to the first.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…Unicode memcpy (#2029)

* Fix TSA #2816217: suppress Flawfinder false positive on Cython JoinPyUnicode memcpy

Flawfinder's buffer/memcpy rule (CWE-120) fires on any memcpy() call by
default. The flagged call sits inside the Cython 3.x string-join helper
__Pyx_PyUnicode_Join:

    memcpy((char *)result_udata + (char_pos << kind_shift),
           udata,
           (size_t) (ulength << kind_shift));

It is provably safe:
* result_uval was just allocated via PyUnicode_New(result_ulength, max_char)
  and result_udata = PyUnicode_DATA(result_uval) points into that buffer.
* The immediately preceding check
      (PY_SSIZE_T_MAX >> kind_shift) - ulength < char_pos
  guards against char_pos+ulength overflow before the memcpy executes.
* result_ulength is computed by the caller as the sum of input lengths,
  so char_pos + ulength <= result_ulength after each iteration. The byte
  count `ulength << kind_shift` is bounded by the allocated buffer.

Add an inline /* Flawfinder: ignore */ annotation on the flagged line in
the Cython-generated _pydevd_sys_monitoring_cython.c and extend the
existing post-processing block in setup_pydevd_cython.py so the annotation
is re-applied automatically whenever Cython regenerates the .c files.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix SyntaxError: add missing closing paren on JoinPyUnicode .replace() call

The merge from main inadvertently dropped the closing ')' of the new

JoinPyUnicode '.replace(...)' call, so the subsequent 'read<end'

'.replace(...)' block was being parsed as continued arguments. Add the

missing ')' (and a blank line) to separate the two calls cleanly.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>