Add pprof profiling endpoint on main HTTP port under /pprof

[shawnburke]

Summary

Exposes Go's standard net/http/pprof handlers on the main HTTP port (HTTP_PORT / DefaultHttpPort) under /pprof, so operators can collect heap dumps, CPU profiles, and goroutine stacks from a running agent.

Gated behind a new ENABLE_PPROF env flag (default off), mirroring the existing EnableApiProxy pattern. Routes register only when the flag is set — pprof exposes sensitive runtime data (raw memory, goroutine stacks) and the main HTTP port has no auth on any route today.

Changes

• agent/config/config.go — new EnablePprof bool field, parsed from ENABLE_PPROF ("true"/"1", default false); shown in Print() when enabled.
• agent/server/http/pprof_handler.go (new) — a RegisterableHandler (same pattern as metricsHandler) that mounts a /pprof subrouter wiring the standard pprof entry points (/, /cmdline, /profile, /symbol, /trace) plus named profiles (heap, goroutine, allocs, block, mutex, threadcreate). Logs an info line when enabled.
• agent/server/main_http_server.go — conditional registration: if config.EnablePprof { ... }.
• agent/server/http/pprof_handler_test.go (new) — httptest-based coverage of the index page and heap profile.
• .vscode/launch.json — sets ENABLE_PPROF=true for the local debug config.

Usage

Start the agent with ENABLE_PPROF=true, then:

• curl http://localhost:$HTTP_PORT/pprof/ — profile index
• go tool pprof http://localhost:$HTTP_PORT/pprof/heap — memory profile
• go tool pprof http://localhost:$HTTP_PORT/pprof/profile?seconds=5 — CPU profile

Testing

• go build ./... — compiles
• go test ./server/http/... ./config/... — passes

Security note

Since the main HTTP port has no auth on any route, keep ENABLE_PPROF off in environments where the port is publicly reachable.

🤖 Generated with Claude Code