[PR #4148] feat(radare2): prototype transports and analyst capabilities #6088

Open
opened 2026-10-31 01:11:46 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4148
Author: @trufae
Created: 10/15/2026
Status: 🔄 Open

Base: main ← Head: feat/radare2-transport-proposal


📝 Commits (10+)

  • 437c481 feat(radare2): prototype local r2pipe2 transports
  • fbcccb4 docs(radare2): review provider gaps and reuse typed r2mcp tools
  • 77d25bb fix(radare2): preserve exact JSON numbers in transport prototype
  • c99e55a perf(radare2): benchmark complete analyst tasks
  • 946a3b2 docs(radare2): derive workflow defaults from benchmark results
  • a0d5fe2 feat(radare2): prototype CFG types and value-flow operations
  • 279c627 feat(radare2): verify referenced bytes in analyst prototype
  • 6d22e23 docs(radare2): compare completed SQLite capability workflows
  • d0bea13 test(radare2): verify shared contracts with retained sessions
  • 9007f6a fix(radare2): preserve transport failures and interrupt blocked writes

📊 Changes

35 files changed (+21463 additions, -0 deletions)

View changed files

➕ docs/radare2-proposal.md (+412 -0)
📝 docs/reverse-engineering-tools.md (+6 -0)
➕ experiments/radare2-transports/BENCHMARK.md (+511 -0)
➕ experiments/radare2-transports/CAPABILITIES.md (+169 -0)
➕ experiments/radare2-transports/CAPABILITY-BENCHMARK.md (+207 -0)
➕ experiments/radare2-transports/IDA-PARITY.md (+149 -0)
➕ experiments/radare2-transports/README.md (+180 -0)
➕ experiments/radare2-transports/analysis-deadline.test.mjs (+56 -0)
➕ experiments/radare2-transports/analysis-flow.mjs (+116 -0)
➕ experiments/radare2-transports/analysis-server.mjs (+204 -0)
➕ experiments/radare2-transports/analysis-values.mjs (+228 -0)
➕ experiments/radare2-transports/analysis-values.test.mjs (+105 -0)
➕ experiments/radare2-transports/analysis-view.mjs (+78 -0)
➕ experiments/radare2-transports/analysis.mjs (+412 -0)
➕ experiments/radare2-transports/benchmark-2026-10-15.json (+5955 -0)
➕ experiments/radare2-transports/benchmark-ownership.mjs (+126 -0)
➕ experiments/radare2-transports/benchmark.mjs (+222 -0)
➕ experiments/radare2-transports/benchmark.py (+516 -0)
➕ experiments/radare2-transports/benchmark_test.py (+722 -0)
➕ experiments/radare2-transports/capability-benchmark-2026-10-15.json (+5472 -0)

...and 15 more files

📄 Description

Summary

Isolated radare2 transport and analyst prototype for exec, r2pipe2, caller-owned HTTP/iaito and r2mcp. It preserves native replies, status, logs and lossless numbers, and explores CFG, types, verified byte reads, ESIL and r2ghidra value dependencies. No production provider is registered or packaged.

Related: #2711 and #3521. This work is complementary and does not block #3521. Maintainer scope approval remains pending.

Latest follow-up

The two latest October 27 findings are fixed in separate commits on feat/radare2-transport-proposal:

  • 20c24d89e: failed file-close composition previously discarded typed operation errors. The cleanup envelope now retains the exact typed primary through the shared error algebra and binds its failed-close lease. A real file append plus injected close denial verifies cleanup_incomplete until retry and retryable artifact_changed afterwards, including through a consumer wrapper.
  • bfdb1ea5a: benchmark exceptions previously skipped agent summary writing. One summary finalizer now saves available digests and observations on success, nonzero exit, limits and cancellation; a pending cleanup owner leaves the final digest explicitly unknown. Summary failures never replace the original trial exception or retained owner.

The five older open threads were rechecked against their existing fixes: failed benchmark exits save resources and stop trials; agent digest mismatches save both identities and stop trials; custom environment values are runtime-only in saved settings; target hashing validates descriptor metadata; cross-read ESIL mismatches project as retryable artifact_changed. The earlier cancellation and documentation-link fixes remain in the branch.

No directly related code cleanup is deferred. This remains an isolated prototype; maintainer scope approval is pending.

Validation

Current October 27 follow-up on Linux x64, Node 24.22.1/npm 11.16.0; Python 3.12/psutil 7.2.2:

  • Focused JavaScript suites (native bytes, ESIL, analysis deadlines, value flow and high p-code): 35 passed, one skipped. Native radare2 execution was unavailable; the skipped ESIL test and real-provider behavior were not verified.
  • Python benchmark boundary checks: 3/3 passed. The expanded agent-summary check covers ten scenarios: unchanged/changed successful targets, nonzero exit, resource limit, cancellation, pending cleanup, truncated output, missing output, missing final target and failed summary persistence. Trial execution/ownership is simulated in these checks; they verify the exact original exception remains retained and no next trial starts on failure.
  • npm run docs:check (nine README tests), npm run check:fast, Python syntax checks and git diff --check: passed. Build/check telemetry was disabled. Published commit trees match the locally checked trees.
  • The full real-process Python lifecycle suite was not rerun: prior attempts in this environment failed at helper procps inspection with fatal library error, lookup self. Native-provider/lifecycle and hosted CI success are not established by these boundary checks.
  • No new performance benchmark or real-provider verifier was run. The runtime build and dependency installation passed during the preceding October 27 follow-up; this follow-up changes only the isolated experiment and its documentation.

Historical October 26 macOS results at b09a30448 remain prior-revision evidence: 64 JavaScript and 18 Python lifecycle tests passed; the installed-provider verifier passed 5/13, with eight failures due to unavailable r2ghidra. Those results were not rerun for this revision.

Evidence and limits

The capability report, SQLite investigations, benchmark report, and shared-session compatibility check retain their historical revisions, measurements and limitations. No new performance or agent investigation benchmark was run.

Observations are not production REA Evidence. Production admission/ledger integration, all-operation public CLI/MCP parity, external-core identity and Linux/Windows provider verification remain unverified. Targets are inspected without execution. Fault injection establishes the tested lifecycle boundaries; forced loss of an evidence owner cannot preserve its private ledger.

Expected effects

  • Read existing files or captured data.
  • Launch or attach to a process.
  • Inject instrumentation or run scripts/code.
  • Change process memory, registers, files, or configuration.
  • Contact network services.
  • Recover protected code or work around protections.
  • Documentation or usability only; no target interaction.

Author readiness

Human owner: @trufae

  • I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
  • I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
  • I declare this PR ready for initial maintainer review.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4148 **Author:** [@trufae](https://github.com/trufae) **Created:** 10/15/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `feat/radare2-transport-proposal` --- ### 📝 Commits (10+) - [`437c481`](https://github.com/morluto/rea/commit/437c4816bd043d657b4cfe7d77be3212cd490e02) feat(radare2): prototype local r2pipe2 transports - [`fbcccb4`](https://github.com/morluto/rea/commit/fbcccb4d09aa9374a63fa0c332c73aa62504349e) docs(radare2): review provider gaps and reuse typed r2mcp tools - [`77d25bb`](https://github.com/morluto/rea/commit/77d25bb9b453d91889e81c0c9c85c40c9ac18e9a) fix(radare2): preserve exact JSON numbers in transport prototype - [`c99e55a`](https://github.com/morluto/rea/commit/c99e55a25ce5e95d6a9e18f0f14641affeadc673) perf(radare2): benchmark complete analyst tasks - [`946a3b2`](https://github.com/morluto/rea/commit/946a3b252b1205ffc9c2d795f1a4046af6d2d7ba) docs(radare2): derive workflow defaults from benchmark results - [`a0d5fe2`](https://github.com/morluto/rea/commit/a0d5fe23e1a0267ca8c3f4dba415623df11264e3) feat(radare2): prototype CFG types and value-flow operations - [`279c627`](https://github.com/morluto/rea/commit/279c627119778049acaf0c4dc803f08febbf0c6c) feat(radare2): verify referenced bytes in analyst prototype - [`6d22e23`](https://github.com/morluto/rea/commit/6d22e231a5d3a35b7ed069bdf03075b5b5ddf362) docs(radare2): compare completed SQLite capability workflows - [`d0bea13`](https://github.com/morluto/rea/commit/d0bea133dbd805386a5d36084a53850c3ba2a2cf) test(radare2): verify shared contracts with retained sessions - [`9007f6a`](https://github.com/morluto/rea/commit/9007f6ababdd8f48921991020c08f6caab72f2a1) fix(radare2): preserve transport failures and interrupt blocked writes ### 📊 Changes **35 files changed** (+21463 additions, -0 deletions) <details> <summary>View changed files</summary> ➕ `docs/radare2-proposal.md` (+412 -0) 📝 `docs/reverse-engineering-tools.md` (+6 -0) ➕ `experiments/radare2-transports/BENCHMARK.md` (+511 -0) ➕ `experiments/radare2-transports/CAPABILITIES.md` (+169 -0) ➕ `experiments/radare2-transports/CAPABILITY-BENCHMARK.md` (+207 -0) ➕ `experiments/radare2-transports/IDA-PARITY.md` (+149 -0) ➕ `experiments/radare2-transports/README.md` (+180 -0) ➕ `experiments/radare2-transports/analysis-deadline.test.mjs` (+56 -0) ➕ `experiments/radare2-transports/analysis-flow.mjs` (+116 -0) ➕ `experiments/radare2-transports/analysis-server.mjs` (+204 -0) ➕ `experiments/radare2-transports/analysis-values.mjs` (+228 -0) ➕ `experiments/radare2-transports/analysis-values.test.mjs` (+105 -0) ➕ `experiments/radare2-transports/analysis-view.mjs` (+78 -0) ➕ `experiments/radare2-transports/analysis.mjs` (+412 -0) ➕ `experiments/radare2-transports/benchmark-2026-10-15.json` (+5955 -0) ➕ `experiments/radare2-transports/benchmark-ownership.mjs` (+126 -0) ➕ `experiments/radare2-transports/benchmark.mjs` (+222 -0) ➕ `experiments/radare2-transports/benchmark.py` (+516 -0) ➕ `experiments/radare2-transports/benchmark_test.py` (+722 -0) ➕ `experiments/radare2-transports/capability-benchmark-2026-10-15.json` (+5472 -0) _...and 15 more files_ </details> ### 📄 Description ## Summary Isolated radare2 transport and analyst prototype for exec, r2pipe2, caller-owned HTTP/iaito and r2mcp. It preserves native replies, status, logs and lossless numbers, and explores CFG, types, verified byte reads, ESIL and r2ghidra value dependencies. No production provider is registered or packaged. Related: #2711 and #3521. This work is complementary and does not block #3521. Maintainer scope approval remains pending. ## Latest follow-up The two latest October 27 findings are fixed in separate commits on `feat/radare2-transport-proposal`: - [`20c24d89e`](https://github.com/trufae/rea/commit/20c24d89ef26dda26ebff609f34321e4d29d66f4): failed file-close composition previously discarded typed operation errors. The cleanup envelope now retains the exact typed primary through the shared error algebra and binds its failed-close lease. A real file append plus injected close denial verifies `cleanup_incomplete` until retry and retryable `artifact_changed` afterwards, including through a consumer wrapper. - [`bfdb1ea5a`](https://github.com/trufae/rea/commit/bfdb1ea5a9e00e996a9d1f732292128d32d0b8c4): benchmark exceptions previously skipped agent summary writing. One summary finalizer now saves available digests and observations on success, nonzero exit, limits and cancellation; a pending cleanup owner leaves the final digest explicitly unknown. Summary failures never replace the original trial exception or retained owner. The five older open threads were rechecked against their existing fixes: failed benchmark exits save resources and stop trials; agent digest mismatches save both identities and stop trials; custom environment values are runtime-only in saved settings; target hashing validates descriptor metadata; cross-read ESIL mismatches project as retryable `artifact_changed`. The earlier cancellation and documentation-link fixes remain in the branch. No directly related code cleanup is deferred. This remains an isolated prototype; maintainer scope approval is pending. ## Validation Current October 27 follow-up on Linux x64, Node 24.22.1/npm 11.16.0; Python 3.12/psutil 7.2.2: - Focused JavaScript suites (native bytes, ESIL, analysis deadlines, value flow and high p-code): **35 passed, one skipped**. Native radare2 execution was unavailable; the skipped ESIL test and real-provider behavior were not verified. - Python benchmark boundary checks: **3/3 passed**. The expanded agent-summary check covers ten scenarios: unchanged/changed successful targets, nonzero exit, resource limit, cancellation, pending cleanup, truncated output, missing output, missing final target and failed summary persistence. Trial execution/ownership is simulated in these checks; they verify the exact original exception remains retained and no next trial starts on failure. - `npm run docs:check` (nine README tests), `npm run check:fast`, Python syntax checks and `git diff --check`: passed. Build/check telemetry was disabled. Published commit trees match the locally checked trees. - The full real-process Python lifecycle suite was not rerun: prior attempts in this environment failed at helper procps inspection with `fatal library error, lookup self`. Native-provider/lifecycle and hosted CI success are not established by these boundary checks. - No new performance benchmark or real-provider verifier was run. The runtime build and dependency installation passed during the preceding October 27 follow-up; this follow-up changes only the isolated experiment and its documentation. Historical October 26 macOS results at `b09a30448` remain prior-revision evidence: 64 JavaScript and 18 Python lifecycle tests passed; the installed-provider verifier passed 5/13, with eight failures due to unavailable r2ghidra. Those results were not rerun for this revision. ## Evidence and limits The [capability report](https://github.com/trufae/rea/blob/feat/radare2-transport-proposal/experiments/radare2-transports/CAPABILITIES.md), [SQLite investigations](https://github.com/trufae/rea/blob/feat/radare2-transport-proposal/experiments/radare2-transports/CAPABILITY-BENCHMARK.md), [benchmark report](https://github.com/trufae/rea/blob/feat/radare2-transport-proposal/experiments/radare2-transports/BENCHMARK.md), and [shared-session compatibility check](https://github.com/trufae/rea/blob/feat/radare2-transport-proposal/experiments/radare2-transports/IDA-PARITY.md) retain their historical revisions, measurements and limitations. No new performance or agent investigation benchmark was run. Observations are not production REA Evidence. Production admission/ledger integration, all-operation public CLI/MCP parity, external-core identity and Linux/Windows provider verification remain unverified. Targets are inspected without execution. Fault injection establishes the tested lifecycle boundaries; forced loss of an evidence owner cannot preserve its private ledger. ## Expected effects - [x] Read existing files or captured data. - [x] Launch or attach to a process. - [x] Inject instrumentation or run scripts/code. - [x] Change process memory, registers, files, or configuration. - [x] Contact network services. - [x] Recover protected code or work around protections. - [x] Documentation or usability only; no target interaction. ## Author readiness Human owner: @trufae - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [ ] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#6088
No description provided.