[PR #3417] [MERGED] fix(test): honor Ghidra startup budgets in Windows verification #5730

New issue

Closed

opened 2026-10-31 01:08:59 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:08:59 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/3417
Author: @N0zoM1z0
Created: 10/14/2026
Status: ✅ Merged
Merged: 10/14/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/windows-ghidra-byte-coverage-2903

📝 Commits (10+)

143781d fix(test): honor Ghidra startup budgets in file-offset verification
4e713e6 fix(test): preserve selected startup budgets in direct Ghidra verification
0630ef2 chore: sync latest main for Windows verification
f231828 test(ghidra): cover verifier timeout budgets
67b28eb Merge remote-tracking branch 'origin/main' into fix/windows-ghidra-byte-coverage-2903
245ea2a Merge remote-tracking branch 'origin/main' into fix/windows-ghidra-byte-coverage-2903
e32a685 fix(test): preserve Ghidra MCP request budgets
4bb211c Merge remote-tracking branch 'origin/main' into fix/windows-ghidra-byte-coverage-2903
37d0b91 Merge remote-tracking branch 'origin/main' into fix/windows-ghidra-byte-coverage-2903
1991f20 Merge remote-tracking branch 'origin/main' into fix/windows-ghidra-byte-coverage-2903

📊 Changes

6 files changed (+181 additions, -20 deletions)

View changed files

➕ scripts/lib/ghidra-verifier-timeouts.d.mts (+33 -0)
➕ scripts/lib/ghidra-verifier-timeouts.mjs (+31 -0)
➕ scripts/lib/real-ghidra-file-offsets.d.mts (+16 -0)
📝 scripts/lib/real-ghidra-file-offsets.mjs (+24 -20)
📝 scripts/verify-real-ghidra-windows.mjs (+3 -0)
➕ tests/boundary/providers/ghidra/ghidraVerifierTimeouts.test.ts (+74 -0)

📄 Description

Summary

Fixes the remaining Windows Ghidra verifier deadline mismatch from #2903. Main already restored the missing search_bytes coverage; this PR makes the real verifier honor the caller-selected Ghidra startup budget across direct startup, MCP initialization, every MCP tool call, and the existing file-offset CLI operations.

Cold file-offset workflows previously had three independent deadline representations. Ghidra startup could legitimately outlast the helper's fixed 240-second request deadline, and the MCP SDK initialization handshake still used its 60-second default even after later tool requests received the extended budget.

Change and scope

The verifier now resolves one policy through the production configuration parser before target I/O or allocation:

direct GhidraClient startup receives the selected startup timeout;
public MCP initialization and every tool call share startup + 240s request options;
both existing CLI subprocesses use that same combined timeout;
combined values beyond Node's signed timer range fail before reading the target.

The MCP operation binding also removes direct-call branches that had bypassed the shared request budget. Default production deadlines, analysis settings, queries, assertions, CLI/MCP schemas, Evidence, provider capabilities, package metadata, and installer behavior are unchanged. This is verifier-only code and adds no authority.

Validation

Pinned Node 24.18.0/npm 11.16.0: focused timeout ownership tests pass 4/4. They cover a selected 600,000 ms startup budget, the exact 2,147,483,647 ms timer limit, one-millisecond overflow before target access, and exact forwarding into MCP initialization plus every tool call.
npm run check:fast and the focused 4/4 tests pass after the latest normal merge from main (efbc486b9).
Exact head 1991f20fcf19a9e745503dc294707cda11350351: all 37 checks pass, including source tests, 5/5 shards, Portable, Windows capability/package, three native package baselines, Apple E2E, Greptile, and CI required. The first browser lane attempt hit a transient CDP target-navigation error; the same base passed its concurrent scheduled browser lane and the failed-only rerun passed without a code change.
Real ordinary-user Windows 11, Ghidra 12.1.4/JDK 21, controlled public x64 and x86 PE DLL fixtures. The complete workflows at head 4bb211c8 pass all 26 read-only operations, bounded wildcard/mask byte-search coverage, file-offset MCP and two CLI paths, invalid/unmapped/header cases, source immutability, and cleanup:
- x64: 2,029.76 s; 798.22 s sampled process-family CPU; 2,029.03 MiB peak native Job commit; 1,090.83 MiB sampled peak working set; minimum host free memory 8,164.69 MiB; Job0.
- x86: 2,511.81 s; 1,716.84 s sampled CPU; 2,025.93 MiB peak Job commit; 963.55 MiB sampled peak working set; minimum host free memory 8,504.15 MiB; Job0.
- Both used two logical CPUs, BelowNormal priority, Node/Java 768 MiB limits, a 3 GiB enclosing Job limit, and a caller-selected 900,000 ms startup budget. Sampling at two-second intervals can miss short-lived children. Whole-agent token use was not measured, and these are not speedup claims.

The merge through main 75104040d did not change the Ghidra provider, verifier scripts, bridge, configuration, package version, or dependency lock; their hashes match the complete runs. It did change the shared MCP catalog/server implementation, so the affected public file-offset MCP/CLI subworkflow was rerun at 37d0b9112 for both architectures, with all semantic/cleanup assertions passing. The later main commits through efbc486b9 only changed analysis-view, contracts, and Apple keyed-archive code, leaving these inputs unchanged:

x64 helper: 612.92 s; 232.66 s sampled CPU; 2,009.80 MiB peak Job commit; 981.15 MiB sampled working set; Job0.
x86 helper: 542.24 s; 267.56 s sampled CPU; 2,003.98 MiB peak Job commit; 1,317.85 MiB sampled working set; Job0.

The first exact-head x64 run reached the final mapped-header CLI assertion but returned a transient provider_unavailable instead of the expected semantic error. A separately bounded reproduction of that exact public CLI request returned the expected invalid_request with complete mapping diagnostics in 312.74 s and Job0; one evidence-based full rerun then passed. The failed full attempt also ended with Job0. No assertion or resource bound was weakened.

Earlier actual npm-tarball installation and explicit installed-root x64/x86 package workflows passed on a preceding candidate whose runtime behavior is unchanged outside this verifier helper. Whole EXE completion remains independently blocked by #3204; direct byte-search CLI parity, real Hopper, and non-Windows engines are not claimed here. Complete-run receipts and transient diagnostics are under /tmp/rea-windows-e2e-20261013/results/issue2903-final4bb211c8; exact-head helper receipts are under /tmp/rea-windows-e2e-20261013/results/issue2903-final37d0b9112.

Author readiness

Human owner: @N0zoM1z0

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/3417 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/14/2026 **Status:** ✅ Merged **Merged:** 10/14/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/windows-ghidra-byte-coverage-2903` --- ### 📝 Commits (10+) - [`143781d`](https://github.com/morluto/rea/commit/143781d97d151bdea87a4b321d239fe16d6b1f0b) fix(test): honor Ghidra startup budgets in file-offset verification - [`4e713e6`](https://github.com/morluto/rea/commit/4e713e6d84e98f35e9c4f1f87472d1682c8825c6) fix(test): preserve selected startup budgets in direct Ghidra verification - [`0630ef2`](https://github.com/morluto/rea/commit/0630ef250e662d0e8f903626d441288a504958a9) chore: sync latest main for Windows verification - [`f231828`](https://github.com/morluto/rea/commit/f231828103391e0046e8f08b6ff64bf1d477191f) test(ghidra): cover verifier timeout budgets - [`67b28eb`](https://github.com/morluto/rea/commit/67b28ebb63999c28e231b512d498aaca215cf065) Merge remote-tracking branch 'origin/main' into fix/windows-ghidra-byte-coverage-2903 - [`245ea2a`](https://github.com/morluto/rea/commit/245ea2ad88a3c532e8e39a35b5fd09fd5930984f) Merge remote-tracking branch 'origin/main' into fix/windows-ghidra-byte-coverage-2903 - [`e32a685`](https://github.com/morluto/rea/commit/e32a6852ce0186af7ef618d6b5c88d846abdb7ab) fix(test): preserve Ghidra MCP request budgets - [`4bb211c`](https://github.com/morluto/rea/commit/4bb211c81293f77afc070344691e9b6780315aaa) Merge remote-tracking branch 'origin/main' into fix/windows-ghidra-byte-coverage-2903 - [`37d0b91`](https://github.com/morluto/rea/commit/37d0b9112c70c217b915e2b72ffc92b641ff2d7c) Merge remote-tracking branch 'origin/main' into fix/windows-ghidra-byte-coverage-2903 - [`1991f20`](https://github.com/morluto/rea/commit/1991f20fcf19a9e745503dc294707cda11350351) Merge remote-tracking branch 'origin/main' into fix/windows-ghidra-byte-coverage-2903 ### 📊 Changes **6 files changed** (+181 additions, -20 deletions) <details> <summary>View changed files</summary> ➕ `scripts/lib/ghidra-verifier-timeouts.d.mts` (+33 -0) ➕ `scripts/lib/ghidra-verifier-timeouts.mjs` (+31 -0) ➕ `scripts/lib/real-ghidra-file-offsets.d.mts` (+16 -0) 📝 `scripts/lib/real-ghidra-file-offsets.mjs` (+24 -20) 📝 `scripts/verify-real-ghidra-windows.mjs` (+3 -0) ➕ `tests/boundary/providers/ghidra/ghidraVerifierTimeouts.test.ts` (+74 -0) </details> ### 📄 Description ## Summary Fixes the remaining Windows Ghidra verifier deadline mismatch from #2903. Main already restored the missing `search_bytes` coverage; this PR makes the real verifier honor the caller-selected Ghidra startup budget across direct startup, MCP initialization, every MCP tool call, and the existing file-offset CLI operations. Cold file-offset workflows previously had three independent deadline representations. Ghidra startup could legitimately outlast the helper's fixed 240-second request deadline, and the MCP SDK initialization handshake still used its 60-second default even after later tool requests received the extended budget. ## Change and scope The verifier now resolves one policy through the production configuration parser before target I/O or allocation: - direct `GhidraClient` startup receives the selected startup timeout; - public MCP initialization and every tool call share `startup + 240s` request options; - both existing CLI subprocesses use that same combined timeout; - combined values beyond Node's signed timer range fail before reading the target. The MCP operation binding also removes direct-call branches that had bypassed the shared request budget. Default production deadlines, analysis settings, queries, assertions, CLI/MCP schemas, Evidence, provider capabilities, package metadata, and installer behavior are unchanged. This is verifier-only code and adds no authority. ## Validation - Pinned Node 24.18.0/npm 11.16.0: focused timeout ownership tests pass 4/4. They cover a selected 600,000 ms startup budget, the exact 2,147,483,647 ms timer limit, one-millisecond overflow before target access, and exact forwarding into MCP initialization plus every tool call. - `npm run check:fast` and the focused 4/4 tests pass after the latest normal merge from main (`efbc486b9`). - Exact head `1991f20fcf19a9e745503dc294707cda11350351`: all 37 checks pass, including source tests, 5/5 shards, Portable, Windows capability/package, three native package baselines, Apple E2E, Greptile, and `CI required`. The first browser lane attempt hit a transient CDP target-navigation error; the same base passed its concurrent scheduled browser lane and the failed-only rerun passed without a code change. - Real ordinary-user Windows 11, Ghidra 12.1.4/JDK 21, controlled public x64 and x86 PE DLL fixtures. The complete workflows at head `4bb211c8` pass all 26 read-only operations, bounded wildcard/mask byte-search coverage, file-offset MCP and two CLI paths, invalid/unmapped/header cases, source immutability, and cleanup: - x64: 2,029.76 s; 798.22 s sampled process-family CPU; 2,029.03 MiB peak native Job commit; 1,090.83 MiB sampled peak working set; minimum host free memory 8,164.69 MiB; Job0. - x86: 2,511.81 s; 1,716.84 s sampled CPU; 2,025.93 MiB peak Job commit; 963.55 MiB sampled peak working set; minimum host free memory 8,504.15 MiB; Job0. - Both used two logical CPUs, BelowNormal priority, Node/Java 768 MiB limits, a 3 GiB enclosing Job limit, and a caller-selected 900,000 ms startup budget. Sampling at two-second intervals can miss short-lived children. Whole-agent token use was not measured, and these are not speedup claims. The merge through main `75104040d` did not change the Ghidra provider, verifier scripts, bridge, configuration, package version, or dependency lock; their hashes match the complete runs. It did change the shared MCP catalog/server implementation, so the affected public file-offset MCP/CLI subworkflow was rerun at `37d0b9112` for both architectures, with all semantic/cleanup assertions passing. The later main commits through `efbc486b9` only changed analysis-view, contracts, and Apple keyed-archive code, leaving these inputs unchanged: - x64 helper: 612.92 s; 232.66 s sampled CPU; 2,009.80 MiB peak Job commit; 981.15 MiB sampled working set; Job0. - x86 helper: 542.24 s; 267.56 s sampled CPU; 2,003.98 MiB peak Job commit; 1,317.85 MiB sampled working set; Job0. The first exact-head x64 run reached the final mapped-header CLI assertion but returned a transient `provider_unavailable` instead of the expected semantic error. A separately bounded reproduction of that exact public CLI request returned the expected `invalid_request` with complete mapping diagnostics in 312.74 s and Job0; one evidence-based full rerun then passed. The failed full attempt also ended with Job0. No assertion or resource bound was weakened. Earlier actual npm-tarball installation and explicit installed-root x64/x86 package workflows passed on a preceding candidate whose runtime behavior is unchanged outside this verifier helper. Whole EXE completion remains independently blocked by #3204; direct byte-search CLI parity, real Hopper, and non-Windows engines are not claimed here. Complete-run receipts and transient diagnostics are under `/tmp/rea-windows-e2e-20261013/results/issue2903-final4bb211c8`; exact-head helper receipts are under `/tmp/rea-windows-e2e-20261013/results/issue2903-final37d0b9112`. ## Author readiness Human owner: @N0zoM1z0 - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:08:59 +00:00