3 files changed, 48 insertions, 28 deletions
diff --git a/internal/generate/bpfhandler.go b/internal/generate/bpfhandler.go
index 3d76ac4..cf9a0c9 100644
--- a/internal/generate/bpfhandler.go
+++ b/internal/generate/bpfhandler.go
@@ -133,29 +133,10 @@ func generateExtra(tp GeneratedTracepoint, isEnter bool) string {
 	return ""
 }
 
+// eventStructName returns the C struct name for a TracepointKind. The mapping
+// is driven by kindRegistry so adding a new kind only requires a registry entry.
 func eventStructName(kind TracepointKind) string {
-	switch kind {
-	case KindFd:
-		return "fd_event"
-	case KindOpen:
-		return "open_event"
-	case KindPathname:
-		return "path_event"
-	case KindName:
-		return "name_event"
-	case KindRet:
-		return "ret_event"
-	case KindFcntl:
-		return "fcntl_event"
-	case KindNull:
-		return "null_event"
-	case KindDup3:
-		return "dup3_event"
-	case KindOpenByHandleAt:
-		return "open_by_handle_at_event"
-	default:
-		return "unknown_event"
-	}
+	return lookupKind(kind).structName
 }
 
 func eventTypeConstant(kind TracepointKind, isEnter bool) string {
diff --git a/internal/generate/codegen.go b/internal/generate/codegen.go
index 1c7a9b3..e3ec0ef 100644
--- a/internal/generate/codegen.go
+++ b/internal/generate/codegen.go
@@ -131,13 +131,11 @@ func classifySyscall(sc Syscall) ([]GeneratedTracepoint, string) {
 	return result, ""
 }
 
+// isEnterRejected reports whether kind must not appear on a syscall-enter
+// tracepoint. The answer comes from the kindRegistry so no switch statement
+// needs updating when a new TracepointKind is added.
 func isEnterRejected(kind TracepointKind) bool {
-	switch kind {
-	case KindFd, KindName, KindOpen, KindPathname, KindFcntl, KindNull, KindDup3, KindOpenByHandleAt:
-		return false
-	default:
-		return true
-	}
+	return !lookupKind(kind).enterAccepted
 }
 
 func syscallFormatNames(sc Syscall) []string {
diff --git a/internal/generate/kindregistry.go b/internal/generate/kindregistry.go
new file mode 100644
index 0000000..86b77aa
--- /dev/null
+++ b/internal/generate/kindregistry.go
@@ -0,0 +1,41 @@
+package generate
+
+// kindMeta holds static metadata for a TracepointKind. Adding a new kind
+// only requires registering an entry here — no switch statements need to be
+// updated elsewhere (Open/Closed Principle).
+type kindMeta struct {
+	// structName is the C struct name used in generated BPF handlers, e.g. "fd_event".
+	structName string
+	// enterAccepted reports whether this kind is valid for a syscall-enter tracepoint.
+	// Kinds that are exit-only (e.g. KindRet) must not appear on enter.
+	enterAccepted bool
+}
+
+// kindRegistry maps every known TracepointKind to its static metadata.
+// To add a new syscall classification, add a single entry here; the rest of
+// the code (isEnterRejected, eventStructName, eventTypeConstant) picks it up
+// automatically via lookupKind.
+var kindRegistry = map[TracepointKind]kindMeta{
+	KindFd:             {structName: "fd_event", enterAccepted: true},
+	KindOpen:           {structName: "open_event", enterAccepted: true},
+	KindPathname:       {structName: "path_event", enterAccepted: true},
+	KindName:           {structName: "name_event", enterAccepted: true},
+	KindRet:            {structName: "ret_event", enterAccepted: false},
+	KindFcntl:          {structName: "fcntl_event", enterAccepted: true},
+	KindNull:           {structName: "null_event", enterAccepted: true},
+	KindDup3:           {structName: "dup3_event", enterAccepted: true},
+	KindOpenByHandleAt: {structName: "open_by_handle_at_event", enterAccepted: true},
+	// KindNone is intentionally absent: it represents "unclassified" and is
+	// never enter-accepted. lookupKind returns the zero kindMeta (enterAccepted=false)
+	// for any unregistered kind, so KindNone is implicitly rejected.
+}
+
+// lookupKind returns the metadata for kind. If kind is not registered (e.g.
+// KindNone or an unknown value), it returns a zero kindMeta whose structName
+// is "unknown_event" and enterAccepted is false.
+func lookupKind(kind TracepointKind) kindMeta {
+	if m, ok := kindRegistry[kind]; ok {
+		return m
+	}
+	return kindMeta{structName: "unknown_event", enterAccepted: false}
+}