windows-exe-decompiler-mcp-server 0.1.0

package/dist/decompiler-worker.js

@@ -0,0 +1,1962 @@
+/**
+ * Decompiler Worker - Ghidra Headless integration
+ *
+ * Implements requirements 8.1-8.6:
+ * - Creates isolated Ghidra project spaces
+ * - Executes Ghidra Headless analysis
+ * - Extracts function lists
+ * - Stores results in database
+ * - Handles timeouts and failures
+ */
+import { spawn } from 'child_process';
+import path from 'path';
+import fs from 'fs';
+import { createHash, randomUUID } from 'crypto';
+import { logger } from './logger.js';
+import { ghidraConfig, createGhidraProject, buildProcessInvocation, } from './ghidra-config.js';
+import { findBestGhidraAnalysis, getGhidraCapabilityStatus, isGhidraCapabilityReady, parseGhidraAnalysisMetadata, } from './ghidra-analysis-status.js';
+import { buildRawCommandLine, decodeProcessStreams, } from './process-output.js';
+export class GhidraProcessError extends Error {
+    errorCode;
+    diagnostics;
+    constructor(message, diagnostics, errorCode) {
+        super(message);
+        this.name = 'GhidraProcessError';
+        this.errorCode = errorCode;
+        this.diagnostics = diagnostics;
+    }
+}
+export class GhidraOutputParseError extends Error {
+    diagnostics;
+    constructor(message, diagnostics) {
+        super(message);
+        this.name = 'GhidraOutputParseError';
+        this.diagnostics = diagnostics;
+    }
+}
+export function getGhidraDiagnostics(error) {
+    if (error instanceof GhidraProcessError || error instanceof GhidraOutputParseError) {
+        return error.diagnostics;
+    }
+    return undefined;
+}
+function truncateDiagnosticText(value, limit = 240) {
+    if (!value) {
+        return null;
+    }
+    const normalized = value.replace(/\0/g, '').trim();
+    if (normalized.length === 0) {
+        return null;
+    }
+    if (normalized.length <= limit) {
+        return normalized;
+    }
+    return `${normalized.slice(0, limit)}...`;
+}
+export function normalizeGhidraError(error, stage) {
+    const diagnostics = getGhidraDiagnostics(error);
+    const message = error instanceof Error ? error.message : String(error);
+    const corpus = [message, diagnostics?.stderr, diagnostics?.stdout, diagnostics?.spawn_error]
+        .filter((item) => typeof item === 'string' && item.length > 0)
+        .join('\n');
+    if (!message && !diagnostics) {
+        return undefined;
+    }
+    const evidence = [
+        diagnostics?.raw_cmd ? `raw_cmd=${diagnostics.raw_cmd}` : '',
+        typeof diagnostics?.exit_code === 'number' ? `exit_code=${diagnostics.exit_code}` : '',
+        diagnostics?.spawn_error ? `spawn_error=${diagnostics.spawn_error}` : '',
+        truncateDiagnosticText(diagnostics?.stderr) ? `stderr=${truncateDiagnosticText(diagnostics?.stderr)}` : '',
+        truncateDiagnosticText(diagnostics?.stdout) ? `stdout=${truncateDiagnosticText(diagnostics?.stdout)}` : '',
+    ].filter((item) => item.length > 0);
+    const withStage = (summary) => stage ? `${stage}: ${summary}` : summary;
+    if (diagnostics?.cancelled || /E_CANCELLED/i.test(corpus)) {
+        return {
+            code: 'cancelled',
+            category: 'user',
+            stage,
+            summary: withStage('Ghidra task was cancelled before completion.'),
+            remediation_hints: [
+                'Re-run the tool if cancellation was accidental.',
+                'Use task.status to confirm whether a queued or running job was cancelled.',
+            ],
+            evidence,
+        };
+    }
+    if (diagnostics?.timed_out || /E_TIMEOUT|timed?\s*out/i.test(corpus)) {
+        return {
+            code: 'timeout',
+            category: 'transient',
+            stage,
+            summary: withStage('Ghidra execution timed out before producing a complete result.'),
+            remediation_hints: [
+                'Increase the timeout for the current tool or queued job.',
+                'Retry after reducing topk/include_xrefs/include_cfg scope if the sample is large.',
+            ],
+            evidence,
+        };
+    }
+    if (/unable to lock project|lockexception/i.test(corpus)) {
+        return {
+            code: 'project_lock',
+            category: 'transient',
+            stage,
+            summary: withStage('Ghidra project lock prevented the script from acquiring the project workspace.'),
+            remediation_hints: [
+                'Wait for the other Ghidra process to release the project lock, then retry.',
+                'Avoid running multiple decompile/CFG/export operations against the same project concurrently.',
+            ],
+            evidence,
+        };
+    }
+    if (/spawn.*EINVAL/i.test(corpus) || /EINVAL/i.test(diagnostics?.spawn_error || '')) {
+        return {
+            code: 'spawn_einval',
+            category: 'configuration',
+            stage,
+            summary: withStage('Ghidra process could not be spawned due to Windows batch/script invocation mismatch (EINVAL).'),
+            remediation_hints: [
+                'Ensure GHIDRA_PATH/GHIDRA_INSTALL_DIR points to a valid Ghidra installation root.',
+                'Prefer launching analyzeHeadless through the configured batch-wrapper path instead of hand-crafted shell quoting.',
+                'Avoid broken quoting or partially expanded PATH entries when Ghidra lives under a path with spaces.',
+            ],
+            evidence,
+        };
+    }
+    if (/Ghidra was not started with PyGhidra|Python is not available/i.test(corpus)) {
+        return {
+            code: 'pyghidra_unavailable',
+            category: 'environment',
+            stage,
+            summary: withStage('PyGhidra is unavailable in the active environment, so Python post-scripts cannot run.'),
+            remediation_hints: [
+                'Use the Java post-script fallback if available.',
+                'Install/configure the Python environment bundled for PyGhidra if Python post-scripts are required.',
+            ],
+            evidence,
+        };
+    }
+    if (/require is not defined/i.test(corpus)) {
+        return {
+            code: 'script_runtime_require_undefined',
+            category: 'script_output',
+            stage,
+            summary: withStage('The Ghidra-side script used a runtime that does not support require().'),
+            remediation_hints: [
+                'Do not use Node-style require() inside Ghidra post-scripts.',
+                'Port the script to Java/Ghidra APIs or bundle dependencies explicitly for the target runtime.',
+            ],
+            evidence,
+        };
+    }
+    if (/No JSON output found/i.test(corpus)) {
+        return {
+            code: 'missing_json_output',
+            category: 'script_output',
+            stage,
+            summary: withStage('The Ghidra script exited without emitting the expected JSON payload.'),
+            remediation_hints: [
+                'Inspect stderr/stdout snippets to see whether the post-script crashed before printing JSON.',
+                'Check for project-lock, PyGhidra, or script-runtime errors in the attached diagnostics.',
+            ],
+            evidence,
+        };
+    }
+    if (diagnostics?.spawn_error || error instanceof GhidraProcessError && error.errorCode === 'E_SPAWN') {
+        return {
+            code: 'spawn_failure',
+            category: 'environment',
+            stage,
+            summary: withStage('The Ghidra process failed to start.'),
+            remediation_hints: [
+                'Verify the configured analyzeHeadless executable exists and is executable.',
+                'Check PATH/GHIDRA_PATH/GHIDRA_INSTALL_DIR and Windows shell quoting for the current installation path.',
+            ],
+            evidence,
+        };
+    }
+    if (diagnostics && diagnostics.exit_code !== null && diagnostics.exit_code !== 0) {
+        return {
+            code: 'ghidra_process_failure',
+            category: 'process',
+            stage,
+            summary: withStage('Ghidra exited with a non-zero status.'),
+            remediation_hints: [
+                'Inspect stderr and raw_cmd to identify the failing post-script or analyzeHeadless phase.',
+                'Retry with ghidra.health or a narrower tool scope if the failure is isolated to one capability.',
+            ],
+            evidence,
+        };
+    }
+    return {
+        code: 'unknown',
+        category: 'process',
+        stage,
+        summary: withStage('Ghidra reported an unclassified failure.'),
+        remediation_hints: [
+            'Inspect the attached diagnostics and retry with ghidra.health for an end-to-end probe.',
+        ],
+        evidence,
+    };
+}
+/**
+ * Decompiler Worker class
+ * Manages Ghidra Headless execution and result processing
+ */
+export class DecompilerWorker {
+    database;
+    workspaceManager;
+    constructor(database, workspaceManager) {
+        this.database = database;
+        this.workspaceManager = workspaceManager;
+    }
+    async delay(ms) {
+        await new Promise((resolve) => setTimeout(resolve, ms));
+    }
+    isProjectLockFailure(error) {
+        const diagnostics = getGhidraDiagnostics(error);
+        const corpus = [
+            error instanceof Error ? error.message : String(error),
+            diagnostics?.stdout,
+            diagnostics?.stderr,
+            diagnostics?.spawn_error,
+        ]
+            .filter((value) => typeof value === 'string' && value.length > 0)
+            .join('\n');
+        return /unable to lock project|lockexception/i.test(corpus);
+    }
+    async runWithProjectLockRetry(operationLabel, operation, context, attempts = 5, initialDelayMs = 1500) {
+        let delayMs = initialDelayMs;
+        let lastError;
+        for (let attempt = 1; attempt <= attempts; attempt += 1) {
+            try {
+                return await operation();
+            }
+            catch (error) {
+                lastError = error;
+                if (!this.isProjectLockFailure(error) || attempt >= attempts) {
+                    throw error;
+                }
+                logger.warn({
+                    ...context,
+                    attempt,
+                    attempts,
+                    retry_delay_ms: delayMs,
+                    error: error instanceof Error ? error.message : String(error),
+                }, `${operationLabel} hit a transient Ghidra project lock; retrying`);
+                await this.delay(delayMs);
+                delayMs *= 2;
+            }
+        }
+        throw lastError instanceof Error ? lastError : new Error(`${operationLabel} failed`);
+    }
+    /**
+     * Resolve sample file path in workspace/original.
+     * Prefer legacy "sample.exe" name, then fall back to first regular file.
+     */
+    resolveSamplePath(originalDir) {
+        const legacyPath = path.join(originalDir, 'sample.exe');
+        if (fs.existsSync(legacyPath)) {
+            return legacyPath;
+        }
+        if (!fs.existsSync(originalDir)) {
+            throw new Error(`Sample directory not found: ${originalDir}`);
+        }
+        const files = fs
+            .readdirSync(originalDir, { withFileTypes: true })
+            .filter(entry => entry.isFile())
+            .map(entry => entry.name)
+            .sort((a, b) => a.localeCompare(b));
+        if (files.length === 0) {
+            throw new Error(`Sample file not found in workspace: ${originalDir}`);
+        }
+        return path.join(originalDir, files[0]);
+    }
+    /**
+     * Spawn Ghidra process with Windows batch-script compatibility.
+     * On Windows, spawning .bat/.cmd directly can throw EINVAL; route through
+     * buildProcessInvocation() so batch scripts run via explicit cmd.exe quoting.
+     */
+    spawnGhidraProcess(invocation, cwd) {
+        return spawn(invocation.command, invocation.args, {
+            cwd,
+            env: {
+                ...process.env,
+            },
+            windowsHide: true,
+            windowsVerbatimArguments: invocation.windowsVerbatimArguments === true,
+        });
+    }
+    buildProcessDiagnostics(invocation, cwd, decoded, exitCode, signal, timedOut, cancelled, spawnError) {
+        return {
+            raw_cmd: buildRawCommandLine(invocation.command, invocation.args),
+            command: invocation.command,
+            args: [...invocation.args],
+            cwd,
+            exit_code: exitCode,
+            signal,
+            timed_out: timedOut,
+            cancelled,
+            stdout: decoded.stdout.text,
+            stderr: decoded.stderr.text,
+            stdout_encoding: decoded.stdout.encoding,
+            stderr_encoding: decoded.stderr.encoding,
+            spawn_error: spawnError,
+        };
+    }
+    async runGhidraCommand(command, args, cwd, timeoutMs, abortSignal, timeoutMessage, failureMessage) {
+        const invocation = buildProcessInvocation(command, args);
+        return new Promise((resolve, reject) => {
+            if (abortSignal?.aborted) {
+                const diagnostics = this.buildProcessDiagnostics(invocation, cwd, decodeProcessStreams(Buffer.alloc(0), Buffer.alloc(0)), null, null, false, true);
+                reject(new GhidraProcessError('E_CANCELLED: Ghidra command cancelled before process start', diagnostics, 'E_CANCELLED'));
+                return;
+            }
+            const stdoutChunks = [];
+            const stderrChunks = [];
+            let timedOut = false;
+            let cancelled = false;
+            let settled = false;
+            const childProcess = this.spawnGhidraProcess(invocation, cwd);
+            let onAbort;
+            const settle = (fn) => {
+                if (settled) {
+                    return;
+                }
+                settled = true;
+                if (abortSignal && onAbort) {
+                    abortSignal.removeEventListener('abort', onAbort);
+                }
+                fn();
+            };
+            const timeoutTimer = setTimeout(() => {
+                timedOut = true;
+                childProcess.kill('SIGTERM');
+                // Force kill after 5 seconds if still running
+                setTimeout(() => {
+                    if (!childProcess.killed) {
+                        childProcess.kill('SIGKILL');
+                    }
+                }, 5000);
+            }, timeoutMs);
+            onAbort = () => {
+                cancelled = true;
+                childProcess.kill('SIGTERM');
+                setTimeout(() => {
+                    if (!childProcess.killed) {
+                        childProcess.kill('SIGKILL');
+                    }
+                }, 5000);
+            };
+            if (abortSignal) {
+                abortSignal.addEventListener('abort', onAbort);
+            }
+            childProcess.stdout?.on('data', (data) => {
+                stdoutChunks.push(Buffer.from(data));
+            });
+            childProcess.stderr?.on('data', (data) => {
+                stderrChunks.push(Buffer.from(data));
+            });
+            childProcess.on('close', (code, signal) => {
+                settle(() => {
+                    clearTimeout(timeoutTimer);
+                    const decoded = decodeProcessStreams(Buffer.concat(stdoutChunks), Buffer.concat(stderrChunks));
+                    const diagnostics = this.buildProcessDiagnostics(invocation, cwd, decoded, code, signal, timedOut, cancelled);
+                    if (timedOut) {
+                        reject(new GhidraProcessError(timeoutMessage, diagnostics, 'E_TIMEOUT'));
+                        return;
+                    }
+                    if (cancelled) {
+                        reject(new GhidraProcessError('E_CANCELLED: Ghidra command cancelled by user', diagnostics, 'E_CANCELLED'));
+                        return;
+                    }
+                    if (code !== 0) {
+                        reject(new GhidraProcessError(`${failureMessage} with exit code ${code}`, diagnostics, 'E_GHIDRA_PROCESS'));
+                        return;
+                    }
+                    resolve({
+                        stdout: decoded.stdout.text,
+                        stderr: decoded.stderr.text,
+                        diagnostics,
+                    });
+                });
+            });
+            childProcess.on('error', (error) => {
+                settle(() => {
+                    clearTimeout(timeoutTimer);
+                    const decoded = decodeProcessStreams(Buffer.concat(stdoutChunks), Buffer.concat(stderrChunks));
+                    const diagnostics = this.buildProcessDiagnostics(invocation, cwd, decoded, null, null, timedOut, cancelled, error.message);
+                    reject(new GhidraProcessError(`Failed to spawn Ghidra process: ${error.message}`, diagnostics, 'E_SPAWN'));
+                });
+            });
+        });
+    }
+    buildAnalyzeBaseArgs(projectPath, projectKey) {
+        return [projectPath, projectKey];
+    }
+    buildAnalysisArgs(projectPath, projectKey, samplePath, options) {
+        const timeout = options.timeout || 300000; // Default 5 minutes
+        const maxCpu = options.maxCpu || '4';
+        return [
+            ...this.buildAnalyzeBaseArgs(projectPath, projectKey),
+            '-import',
+            samplePath,
+            '-max-cpu',
+            maxCpu,
+            '-analysisTimeoutPerFile',
+            String(Math.floor(timeout / 1000)),
+        ];
+    }
+    buildExtractFunctionsArgs(projectPath, projectKey, samplePath, scriptName) {
+        return [
+            ...this.buildAnalyzeBaseArgs(projectPath, projectKey),
+            '-process',
+            path.basename(samplePath),
+            '-scriptPath',
+            ghidraConfig.scriptsDir,
+            '-postScript',
+            scriptName,
+            '-noanalysis',
+        ];
+    }
+    async executeMainAnalysis(projectPath, projectKey, samplePath, options) {
+        const timeout = options.timeout || 300000; // Default 5 minutes
+        const command = ghidraConfig.analyzeHeadlessPath;
+        const args = this.buildAnalysisArgs(projectPath, projectKey, samplePath, options);
+        logger.debug({
+            command,
+            args,
+            timeout,
+        }, 'Executing Ghidra Headless analysis phase');
+        try {
+            return await this.runGhidraCommand(command, args, projectPath, timeout, options.abortSignal, `E_TIMEOUT: Ghidra analysis exceeded timeout of ${timeout}ms`, 'Ghidra analysis failed');
+        }
+        catch (error) {
+            if (error instanceof GhidraProcessError) {
+                logger.error({
+                    error_code: error.errorCode,
+                    raw_cmd: error.diagnostics.raw_cmd,
+                    exit_code: error.diagnostics.exit_code,
+                    timed_out: error.diagnostics.timed_out,
+                    stderr: error.diagnostics.stderr.substring(0, 1000),
+                    stderr_encoding: error.diagnostics.stderr_encoding,
+                }, 'Ghidra analysis phase execution failed');
+            }
+            throw error;
+        }
+    }
+    async executeFunctionExtractionScript(projectPath, projectKey, samplePath, scriptName, timeoutMs) {
+        const command = ghidraConfig.analyzeHeadlessPath;
+        const args = this.buildExtractFunctionsArgs(projectPath, projectKey, samplePath, scriptName);
+        logger.debug({
+            command,
+            args,
+            timeout: timeoutMs,
+            script: scriptName,
+        }, 'Executing Ghidra function extraction post-script');
+        return this.runGhidraCommand(command, args, projectPath, timeoutMs, undefined, `E_TIMEOUT: Function extraction (${scriptName}) exceeded timeout of ${timeoutMs}ms`, `Function extraction (${scriptName}) failed`);
+    }
+    async tryExtractFunctionsWithFallback(projectPath, projectKey, samplePath, timeoutMs) {
+        const warnings = [];
+        const attempts = [];
+        const primaryScript = 'ExtractFunctions.java';
+        const fallbackScript = 'ExtractFunctions.py';
+        const runAndParse = async (scriptName) => {
+            let output;
+            try {
+                output = await this.executeFunctionExtractionScript(projectPath, projectKey, samplePath, scriptName, timeoutMs);
+            }
+            catch (error) {
+                const diagnostics = error instanceof GhidraProcessError || error instanceof GhidraOutputParseError
+                    ? error.diagnostics
+                    : undefined;
+                attempts.push({
+                    script: scriptName,
+                    diagnostics,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                throw error;
+            }
+            try {
+                const parsed = this.parseGhidraOutput(output.stdout, output.stderr, output.diagnostics);
+                attempts.push({
+                    script: scriptName,
+                    stdout: output.stdout,
+                    stderr: output.stderr,
+                    diagnostics: output.diagnostics,
+                });
+                return parsed;
+            }
+            catch (parseError) {
+                const parseMessage = parseError instanceof Error ? parseError.message : String(parseError);
+                const diagnostics = parseError instanceof GhidraOutputParseError
+                    ? parseError.diagnostics
+                    : output.diagnostics;
+                attempts.push({
+                    script: scriptName,
+                    stdout: output.stdout,
+                    stderr: output.stderr,
+                    diagnostics,
+                    parse_error: parseMessage,
+                    error: parseMessage,
+                });
+                throw parseError;
+            }
+        };
+        const scriptOrder = [primaryScript, fallbackScript];
+        for (const scriptName of scriptOrder) {
+            try {
+                const parsed = await runAndParse(scriptName);
+                if (!parsed) {
+                    continue;
+                }
+                if (scriptName === fallbackScript) {
+                    warnings.push(`${primaryScript} failed in current Ghidra runtime. ` +
+                        `Falling back to ${fallbackScript}.`);
+                }
+                return {
+                    output: parsed,
+                    warnings,
+                    scriptUsed: scriptName,
+                    attempts,
+                };
+            }
+            catch (scriptError) {
+                const reason = scriptError instanceof Error ? scriptError.message : String(scriptError);
+                if (scriptName === primaryScript) {
+                    warnings.push(`${primaryScript} failed in current Ghidra runtime. ` +
+                        `Falling back to ${fallbackScript}.`);
+                    continue;
+                }
+                warnings.push(`Function extraction failed with ${scriptName}: ${reason}`);
+            }
+        }
+        const fallbackAttempt = attempts.find((item) => item.script === fallbackScript);
+        if (fallbackAttempt?.error) {
+            warnings.push(`Fallback ${fallbackScript} extraction failed: ${fallbackAttempt.error}`);
+        }
+        return {
+            warnings,
+            attempts,
+        };
+    }
+    selectProbeTarget(functions) {
+        const preferred = functions.find((item) => item.is_entry_point && !item.is_external) ||
+            functions.find((item) => !item.is_external && !item.is_thunk) ||
+            functions.find((item) => !item.is_external) ||
+            functions[0];
+        return preferred?.address;
+    }
+    buildCapabilityReadyStatus(target, warnings) {
+        return {
+            available: true,
+            status: 'ready',
+            target,
+            checked_at: new Date().toISOString(),
+            warnings: warnings && warnings.length > 0 ? warnings : undefined,
+        };
+    }
+    buildCapabilityFailureStatus(capability, target, error) {
+        const diagnostics = getGhidraDiagnostics(error);
+        const message = error instanceof Error ? error.message : String(error);
+        const warnings = [];
+        if (diagnostics?.stderr) {
+            warnings.push(this.buildOutputSnippet(diagnostics.stderr, 600));
+        }
+        else if (diagnostics?.stdout) {
+            warnings.push(this.buildOutputSnippet(diagnostics.stdout, 600));
+        }
+        return {
+            available: false,
+            status: 'degraded',
+            reason: capability === 'decompile'
+                ? `Decompile probe failed: ${message}`
+                : `CFG probe failed: ${message}`,
+            target,
+            checked_at: new Date().toISOString(),
+            warnings: warnings.length > 0 ? warnings : undefined,
+            details: diagnostics
+                ? {
+                    raw_cmd: diagnostics.raw_cmd,
+                    exit_code: diagnostics.exit_code,
+                    timed_out: diagnostics.timed_out,
+                    cancelled: diagnostics.cancelled,
+                    spawn_error: diagnostics.spawn_error,
+                }
+                : undefined,
+        };
+    }
+    async probeCapability(capability, projectPath, projectKey, samplePath, target, timeoutMs) {
+        try {
+            const output = capability === 'decompile'
+                ? await this.executeDecompileScript(projectPath, projectKey, samplePath, target, false, timeoutMs)
+                : await this.executeCFGScript(projectPath, projectKey, samplePath, target, timeoutMs);
+            if (capability === 'decompile') {
+                const parsed = this.parseDecompileOutput(output.stdout, output.stderr);
+                if ('error' in parsed) {
+                    throw new Error(parsed.error);
+                }
+            }
+            else {
+                const parsed = this.parseCFGOutput(output.stdout, output.stderr);
+                if ('error' in parsed) {
+                    throw new Error(parsed.error);
+                }
+            }
+            return {
+                status: this.buildCapabilityReadyStatus(target),
+                output,
+            };
+        }
+        catch (error) {
+            return {
+                status: this.buildCapabilityFailureStatus(capability, target, error),
+            };
+        }
+    }
+    resolveAnalysisProject(analysis) {
+        const metadata = parseGhidraAnalysisMetadata(analysis.output_json);
+        const projectPath = typeof metadata.project_path === 'string' ? metadata.project_path : '';
+        const projectKey = typeof metadata.project_key === 'string' ? metadata.project_key : '';
+        if (!projectPath || !projectKey) {
+            throw new Error(`Ghidra analysis ${analysis.id} has no reusable project metadata for downstream scripts.`);
+        }
+        return {
+            analysis,
+            projectPath,
+            projectKey,
+        };
+    }
+    resolveGhidraAnalysisForCapability(sampleId, capability) {
+        const analyses = this.database.findAnalysesBySample(sampleId);
+        const selected = findBestGhidraAnalysis(analyses, capability);
+        if (!selected) {
+            const capabilityLabel = capability === 'function_index'
+                ? 'function index'
+                : capability === 'decompile'
+                    ? 'decompile'
+                    : 'cfg';
+            throw new Error(`No Ghidra analysis with ${capabilityLabel} readiness found for sample: ${sampleId}. Please run ghidra.analyze first.`);
+        }
+        const readiness = getGhidraCapabilityStatus(selected, capability);
+        if (!isGhidraCapabilityReady(selected, capability)) {
+            const reason = readiness.reason ? ` ${readiness.reason}` : '';
+            throw new Error(`Ghidra ${capability} is not ready for sample: ${sampleId}.${reason}`.trim());
+        }
+        const project = this.resolveAnalysisProject(selected);
+        return {
+            ...project,
+            readiness,
+        };
+    }
+    /**
+     * Analyze a sample with Ghidra Headless
+     *
+     * Requirements: 8.1, 8.2, 8.3, 8.4, 8.5, 8.6
+     *
+     * @param sampleId - Sample identifier
+     * @param options - Ghidra analysis options
+     * @returns Analysis result with function count and project path
+     */
+    async analyze(sampleId, options = {}) {
+        // Check if Ghidra is configured
+        if (!ghidraConfig.isValid) {
+            throw new Error('Ghidra is not properly configured. Please set GHIDRA_PATH or GHIDRA_INSTALL_DIR environment variable.');
+        }
+        const startTime = Date.now();
+        // 1. Create analysis record (Requirement 8.2)
+        const analysisId = options.analysisId || randomUUID();
+        this.database.insertAnalysis({
+            id: analysisId,
+            sample_id: sampleId,
+            stage: 'ghidra',
+            backend: 'ghidra',
+            status: 'running',
+            started_at: new Date().toISOString(),
+            finished_at: null,
+            output_json: null,
+            metrics_json: null
+        });
+        logger.info({
+            analysisId,
+            sampleId,
+            options
+        }, 'Starting Ghidra analysis');
+        try {
+            // 2. Get sample information
+            const sample = this.database.findSample(sampleId);
+            if (!sample) {
+                throw new Error(`Sample not found: ${sampleId}`);
+            }
+            // 3. Get workspace paths
+            const workspace = await this.workspaceManager.getWorkspace(sampleId);
+            const samplePath = this.resolveSamplePath(workspace.original);
+            // Verify sample file exists
+            if (!fs.existsSync(samplePath)) {
+                throw new Error(`Sample file not found: ${samplePath}`);
+            }
+            // 4. Create isolated Ghidra project space (Requirement 8.1, 8.7)
+            const { projectPath, projectKey } = createGhidraProject(workspace.ghidra, options.projectKey);
+            logger.debug({
+                projectPath,
+                projectKey,
+                sampleId
+            }, 'Created Ghidra project');
+            // 5. Execute main Ghidra analysis/import phase
+            await this.executeMainAnalysis(projectPath, projectKey, samplePath, options);
+            // 6. Execute post-processing function extraction with fallback chain.
+            // If extraction fails but main analysis succeeded, persist partial_success.
+            const extraction = await this.tryExtractFunctionsWithFallback(projectPath, projectKey, samplePath, options.timeout || 300000);
+            const analysisOutput = extraction.output;
+            const extractionWarnings = extraction.warnings || [];
+            const extractionAttempts = extraction.attempts || [];
+            const probeTarget = analysisOutput
+                ? this.selectProbeTarget(analysisOutput.functions)
+                : undefined;
+            let decompileProbe;
+            let cfgProbe;
+            if (analysisOutput) {
+                // 7. Store functions to database (Requirement 8.4)
+                await this.storeFunctions(sampleId, analysisOutput.functions);
+                // 8. Store analysis artifact
+                const artifactId = randomUUID();
+                const artifactPath = `ghidra/functions_${projectKey}.json`;
+                const artifactFullPath = path.join(workspace.root, artifactPath);
+                // Ensure directory exists
+                const artifactDir = path.dirname(artifactFullPath);
+                if (!fs.existsSync(artifactDir)) {
+                    fs.mkdirSync(artifactDir, { recursive: true });
+                }
+                // Write artifact
+                fs.writeFileSync(artifactFullPath, JSON.stringify(analysisOutput, null, 2));
+                // Compute artifact SHA256
+                const artifactSha256 = createHash('sha256')
+                    .update(JSON.stringify(analysisOutput))
+                    .digest('hex');
+                // Insert artifact record
+                this.database.insertArtifact({
+                    id: artifactId,
+                    sample_id: sampleId,
+                    type: 'ghidra_functions',
+                    path: artifactPath,
+                    sha256: artifactSha256,
+                    mime: 'application/json',
+                    created_at: new Date().toISOString()
+                });
+                if (probeTarget) {
+                    const probeTimeoutMs = Math.max(5000, Math.min(15000, Math.floor((options.timeout || 300000) / 6)));
+                    decompileProbe = await this.probeCapability('decompile', projectPath, projectKey, samplePath, probeTarget, probeTimeoutMs);
+                    cfgProbe = await this.probeCapability('cfg', projectPath, projectKey, samplePath, probeTarget, probeTimeoutMs);
+                }
+            }
+            // 9. Update analysis status
+            const elapsedMs = Date.now() - startTime;
+            const status = analysisOutput ? 'done' : 'partial_success';
+            const functionCount = analysisOutput?.function_count || 0;
+            const functionIndexReady = Boolean(analysisOutput && functionCount > 0);
+            const readiness = {
+                function_index: {
+                    available: functionIndexReady,
+                    status: functionIndexReady ? 'ready' : 'missing',
+                    checked_at: new Date().toISOString(),
+                    warnings: extractionWarnings.length > 0 ? extractionWarnings : undefined,
+                },
+                decompile: functionIndexReady
+                    ? decompileProbe?.status ||
+                        {
+                            available: false,
+                            status: 'missing',
+                            reason: 'No decompile probe target was available from extracted functions.',
+                            checked_at: new Date().toISOString(),
+                        }
+                    : {
+                        available: false,
+                        status: 'missing',
+                        reason: 'Function index is unavailable, so decompile readiness was not probed.',
+                        checked_at: new Date().toISOString(),
+                    },
+                cfg: functionIndexReady
+                    ? cfgProbe?.status ||
+                        {
+                            available: false,
+                            status: 'missing',
+                            reason: 'No CFG probe target was available from extracted functions.',
+                            checked_at: new Date().toISOString(),
+                        }
+                    : {
+                        available: false,
+                        status: 'missing',
+                        reason: 'Function index is unavailable, so CFG readiness was not probed.',
+                        checked_at: new Date().toISOString(),
+                    },
+            };
+            this.database.updateAnalysis(analysisId, {
+                status,
+                finished_at: new Date().toISOString(),
+                output_json: JSON.stringify({
+                    function_count: functionCount,
+                    project_path: projectPath,
+                    project_key: projectKey,
+                    readiness,
+                    function_extraction: {
+                        status: analysisOutput ? 'success' : 'failed',
+                        script_used: extraction.scriptUsed,
+                        warnings: extractionWarnings,
+                        attempts: extractionAttempts,
+                    },
+                    end_to_end_probe: {
+                        target: probeTarget,
+                        decompile: decompileProbe?.status,
+                        cfg: cfgProbe?.status,
+                        checked_at: new Date().toISOString(),
+                    },
+                }),
+                metrics_json: JSON.stringify({
+                    elapsed_ms: elapsedMs,
+                    function_count: functionCount
+                })
+            });
+            if (status === 'done') {
+                logger.info({
+                    analysisId,
+                    sampleId,
+                    functionCount,
+                    elapsedMs,
+                    function_extraction_script: extraction.scriptUsed,
+                    readiness,
+                }, 'Ghidra analysis completed successfully');
+            }
+            else {
+                logger.warn({
+                    analysisId,
+                    sampleId,
+                    elapsedMs,
+                    function_extraction_warnings: extractionWarnings,
+                    readiness,
+                }, 'Ghidra analysis completed with partial_success (function extraction failed)');
+            }
+            return {
+                analysisId,
+                backend: 'ghidra',
+                functionCount,
+                projectPath,
+                status,
+                warnings: extractionWarnings.length > 0 ? extractionWarnings : undefined,
+                readiness,
+            };
+        }
+        catch (error) {
+            // Handle failure (Requirement 8.5, 8.6)
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            const diagnostics = getGhidraDiagnostics(error);
+            const elapsedMs = Date.now() - startTime;
+            logger.error({
+                analysisId,
+                sampleId,
+                error: errorMessage,
+                ghidra_diagnostics: diagnostics,
+                elapsedMs
+            }, 'Ghidra analysis failed');
+            // Update analysis status to failed
+            const cancelled = error instanceof GhidraProcessError && error.errorCode === 'E_CANCELLED';
+            this.database.updateAnalysis(analysisId, {
+                status: cancelled ? 'cancelled' : 'failed',
+                finished_at: new Date().toISOString(),
+                output_json: JSON.stringify({
+                    error: errorMessage,
+                    ghidra_diagnostics: diagnostics
+                }),
+                metrics_json: JSON.stringify({
+                    elapsed_ms: elapsedMs
+                })
+            });
+            throw error;
+        }
+    }
+    /**
+     * List functions from the functions table
+     *
+     * Requirements: 9.1
+     *
+     * @param sampleId - Sample identifier
+     * @param limit - Optional limit on number of functions to return
+     * @returns Array of function information
+     */
+    async listFunctions(sampleId, limit) {
+        logger.debug({ sampleId, limit }, 'Listing functions');
+        // Query functions from database
+        const dbFunctions = this.database.findFunctions(sampleId);
+        if (dbFunctions.length === 0) {
+            logger.warn({ sampleId }, 'No functions found for sample');
+            return [];
+        }
+        // Convert database functions to FunctionInfo format
+        const functionInfos = dbFunctions.map(func => ({
+            name: func.name || 'unknown',
+            address: func.address,
+            size: func.size || 0,
+            callers: func.caller_count || 0,
+            callees: func.callee_count || 0
+        }));
+        // Apply limit if specified
+        if (limit !== undefined && limit > 0) {
+            return functionInfos.slice(0, limit);
+        }
+        logger.info({
+            sampleId,
+            functionCount: functionInfos.length
+        }, 'Functions listed successfully');
+        return functionInfos;
+    }
+    /**
+     * Rank functions by interest score
+     *
+     * Requirements: 9.2, 9.3, 9.4, 9.5, 9.6, 9.7, 9.8
+     *
+     * Scoring rules:
+     * - Large functions (> 1000 bytes): +10 points (Requirement 9.3)
+     * - High caller count (> 10): +5 * log(callers) points (Requirement 9.4)
+     * - Calls sensitive APIs: +15 points (Requirement 9.5)
+     * - Entry point or exported: +20 points (Requirement 9.6)
+     *
+     * @param sampleId - Sample identifier
+     * @param topK - Number of top functions to return (default: 20)
+     * @returns Array of ranked functions with scores and reasons
+     */
+    async rankFunctions(sampleId, topK = 20) {
+        logger.debug({ sampleId, topK }, 'Ranking functions');
+        // 1. Get all functions from database
+        const functions = this.database.findFunctions(sampleId);
+        if (functions.length === 0) {
+            logger.warn({ sampleId }, 'No functions found for ranking');
+            return [];
+        }
+        // 2. Define sensitive APIs (Requirement 9.5)
+        const sensitiveAPIs = [
+            'CreateProcess',
+            'CreateProcessA',
+            'CreateProcessW',
+            'WriteFile',
+            'WriteFileEx',
+            'RegSetValue',
+            'RegSetValueEx',
+            'RegSetValueExA',
+            'RegSetValueExW',
+            'InternetOpen',
+            'InternetOpenA',
+            'InternetOpenW',
+            'InternetConnect',
+            'HttpOpenRequest',
+            'HttpSendRequest',
+            'URLDownloadToFile',
+            'WinExec',
+            'ShellExecute',
+            'ShellExecuteA',
+            'ShellExecuteW',
+            'VirtualAlloc',
+            'VirtualAllocEx',
+            'CreateRemoteThread',
+            'WriteProcessMemory',
+            'SetWindowsHookEx',
+            'GetProcAddress',
+            'LoadLibrary',
+            'LoadLibraryA',
+            'LoadLibraryW'
+        ];
+        const dynamicResolverAPIs = new Set(['GetProcAddress', 'LoadLibrary', 'LoadLibraryA', 'LoadLibraryW']);
+        const dynamicResolverLookup = new Set(Array.from(dynamicResolverAPIs, (item) => item.toLowerCase()));
+        const normalizeApiName = (value) => value.toLowerCase();
+        // 3. Calculate score for each function
+        const rankedFunctions = functions.map(func => {
+            let score = 0.0;
+            const reasons = [];
+            const xrefSummary = [];
+            // Rule 1: Large function (> 1000 bytes) - Requirement 9.3
+            if (func.size && func.size > 1000) {
+                score += 10.0;
+                reasons.push('large_function');
+            }
+            // Rule 2: High caller count (> 10) - Requirement 9.4
+            if (func.caller_count && func.caller_count > 10) {
+                const callerScore = 5.0 * Math.log(func.caller_count);
+                score += callerScore;
+                reasons.push('high_callers');
+            }
+            // Rule 3: Calls sensitive APIs - Requirement 9.5
+            if (func.callees) {
+                try {
+                    const callees = JSON.parse(func.callees);
+                    const matchedAPIs = callees.filter(callee => sensitiveAPIs.some(api => callee.includes(api)));
+                    const normalizedMatched = new Set(matchedAPIs.map(normalizeApiName));
+                    const hasDynamicResolver = Array.from(dynamicResolverAPIs).some((api) => normalizedMatched.has(api.toLowerCase()));
+                    if (matchedAPIs.length > 0) {
+                        score += 15.0;
+                        matchedAPIs.forEach(api => {
+                            reasons.push(`calls_sensitive_api:${api}`);
+                            const provenance = dynamicResolverLookup.has(normalizeApiName(api))
+                                ? 'dynamic_resolution_api'
+                                : hasDynamicResolver
+                                    ? 'dynamic_resolution_helper'
+                                    : 'static_named_call';
+                            const confidence = provenance === 'dynamic_resolution_api'
+                                ? 0.9
+                                : provenance === 'dynamic_resolution_helper'
+                                    ? 0.62
+                                    : 0.78;
+                            const evidence = provenance === 'dynamic_resolution_helper'
+                                ? [
+                                    `callee:${api}`,
+                                    ...matchedAPIs
+                                        .filter((item) => dynamicResolverLookup.has(normalizeApiName(item)))
+                                        .slice(0, 2)
+                                        .map((item) => `resolver:${item}`),
+                                ]
+                                : [`callee:${api}`];
+                            xrefSummary.push({
+                                api,
+                                provenance,
+                                confidence,
+                                evidence,
+                            });
+                        });
+                    }
+                }
+                catch (error) {
+                    logger.warn({
+                        sampleId,
+                        address: func.address,
+                        error: error instanceof Error ? error.message : String(error)
+                    }, 'Failed to parse callees JSON');
+                }
+            }
+            // Rule 4: Entry point or exported function - Requirement 9.6
+            if (func.is_entry_point === 1 || func.is_exported === 1) {
+                score += 20.0;
+                if (func.is_entry_point === 1) {
+                    reasons.push('entry_point');
+                }
+                if (func.is_exported === 1) {
+                    reasons.push('exported');
+                }
+            }
+            return {
+                address: func.address,
+                name: func.name || 'unknown',
+                score,
+                reasons,
+                xref_summary: xrefSummary.length > 0 ? xrefSummary : undefined,
+            };
+        });
+        // 4. Sort by score descending
+        rankedFunctions.sort((a, b) => b.score - a.score);
+        // 5. Update functions table with scores and tags (Requirement 9.7)
+        for (const rankedFunc of rankedFunctions) {
+            this.database.updateFunction(sampleId, rankedFunc.address, {
+                score: rankedFunc.score,
+                tags: JSON.stringify(rankedFunc.reasons)
+            });
+        }
+        // 6. Return top K functions (Requirement 9.8)
+        const topFunctions = rankedFunctions.slice(0, topK);
+        logger.info({
+            sampleId,
+            totalFunctions: functions.length,
+            topK,
+            topScore: topFunctions[0]?.score || 0
+        }, 'Functions ranked successfully');
+        return topFunctions;
+    }
+    async searchFunctions(sampleId, options) {
+        const apiQuery = options.apiQuery?.trim() || '';
+        const stringQuery = options.stringQuery?.trim() || '';
+        const limit = Math.max(1, options.limit || 20);
+        if (!apiQuery && !stringQuery) {
+            throw new Error('At least one of apiQuery or stringQuery must be provided.');
+        }
+        const sample = this.database.findSample(sampleId);
+        if (!sample) {
+            throw new Error(`Sample not found: ${sampleId}`);
+        }
+        if (!stringQuery) {
+            try {
+                if (ghidraConfig.isValid) {
+                    return await this.searchFunctionsWithGhidra(sampleId, apiQuery, '', limit, options.timeout || 30000);
+                }
+            }
+            catch (error) {
+                logger.warn({
+                    sampleId,
+                    apiQuery,
+                    error: error instanceof Error ? error.message : String(error),
+                }, 'Falling back to function-index API search after Ghidra search failure');
+            }
+            return this.searchFunctionsFromIndex(sampleId, apiQuery, limit);
+        }
+        if (!ghidraConfig.isValid) {
+            throw new Error('Ghidra is required for string-to-function reverse lookup. Please set GHIDRA_PATH or GHIDRA_INSTALL_DIR and run ghidra.analyze first.');
+        }
+        return this.searchFunctionsWithGhidra(sampleId, apiQuery, stringQuery, limit, options.timeout || 30000);
+    }
+    /**
+     * Decompile a specific function
+     *
+     * Requirements: 10.1, 10.2, 10.3, 10.4, 10.5, 10.6
+     *
+     * @param sampleId - Sample identifier
+     * @param addressOrSymbol - Function address (hex string) or symbol name
+     * @param includeXrefs - Whether to include cross-references (default: false)
+     * @param timeout - Timeout in milliseconds (default: 30000)
+     * @returns Decompiled function with pseudocode, callers, callees, and optional xrefs
+     */
+    async decompileFunction(sampleId, addressOrSymbol, includeXrefs = false, timeout = 30000) {
+        // Check if Ghidra is configured
+        if (!ghidraConfig.isValid) {
+            throw new Error('Ghidra is not properly configured. Please set GHIDRA_PATH or GHIDRA_INSTALL_DIR environment variable.');
+        }
+        logger.debug({
+            sampleId,
+            addressOrSymbol,
+            includeXrefs,
+            timeout
+        }, 'Decompiling function');
+        // 1. Validate that the sample has been analyzed
+        const sample = this.database.findSample(sampleId);
+        if (!sample) {
+            throw new Error(`Sample not found: ${sampleId}`);
+        }
+        const resolved = this.resolveGhidraAnalysisForCapability(sampleId, 'decompile');
+        // 2. Get workspace and project paths
+        const workspace = await this.workspaceManager.getWorkspace(sampleId);
+        const samplePath = this.resolveSamplePath(workspace.original);
+        // Verify sample file exists
+        if (!fs.existsSync(samplePath)) {
+            throw new Error(`Sample file not found: ${samplePath}`);
+        }
+        // 3. Reuse the Ghidra project from the capability-ready analysis
+        const { projectPath, projectKey } = resolved;
+        // 4. Execute DecompileFunction.py script
+        try {
+            const result = await this.runWithProjectLockRetry('Function decompilation', async () => {
+                const output = await this.executeDecompileScript(projectPath, projectKey, samplePath, addressOrSymbol, includeXrefs, timeout);
+                const parsed = this.parseDecompileOutput(output.stdout, output.stderr, output.diagnostics);
+                if ('error' in parsed) {
+                    throw parsed.diagnostics
+                        ? new GhidraOutputParseError(parsed.error, parsed.diagnostics)
+                        : new Error(parsed.error);
+                }
+                return parsed;
+            }, {
+                sampleId,
+                addressOrSymbol,
+                includeXrefs,
+            });
+            logger.info({
+                sampleId,
+                function: result.function,
+                address: result.address,
+                pseudocodeLength: result.pseudocode?.length || 0,
+                callerCount: result.callers?.length || 0,
+                calleeCount: result.callees?.length || 0,
+                xrefCount: result.xrefs?.length || 0
+            }, 'Function decompiled successfully');
+            return result;
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            const diagnostics = getGhidraDiagnostics(error);
+            logger.error({
+                sampleId,
+                addressOrSymbol,
+                error: errorMessage,
+                ghidra_diagnostics: diagnostics
+            }, 'Function decompilation failed');
+            throw error;
+        }
+    }
+    buildOutputSnippet(output, limit = 1200) {
+        const normalized = output.replace(/\0/g, '').trim();
+        if (normalized.length === 0) {
+            return '(empty)';
+        }
+        if (normalized.length <= limit) {
+            return normalized;
+        }
+        const truncated = normalized.slice(0, limit);
+        return `${truncated}... (truncated ${normalized.length - limit} chars)`;
+    }
+    buildSyntheticDiagnostics(stdout, stderr) {
+        return {
+            raw_cmd: 'unknown',
+            command: 'unknown',
+            args: [],
+            cwd: process.cwd(),
+            exit_code: 0,
+            signal: null,
+            timed_out: false,
+            cancelled: false,
+            stdout,
+            stderr,
+            stdout_encoding: 'utf-8',
+            stderr_encoding: 'utf-8',
+        };
+    }
+    buildNoJsonOutputMessage(stage, stdout, stderr, diagnostics) {
+        const rawCommand = diagnostics?.raw_cmd ? `raw_cmd=${diagnostics.raw_cmd}` : undefined;
+        const lockHint = /unable to lock project|lockexception/i.test(`${stdout}\n${stderr}`)
+            ? 'signal_hint=project_lock_detected'
+            : undefined;
+        return [
+            `${stage}: No JSON output found`,
+            rawCommand,
+            lockHint,
+            `stdout_snippet=${this.buildOutputSnippet(stdout)}`,
+            `stderr_snippet=${this.buildOutputSnippet(stderr)}`,
+        ]
+            .filter((value) => Boolean(value))
+            .join(' | ');
+    }
+    normalizeNamedAddressList(raw) {
+        if (!Array.isArray(raw)) {
+            return [];
+        }
+        const normalized = [];
+        const seen = new Set();
+        for (const item of raw) {
+            if (!item || typeof item !== 'object') {
+                continue;
+            }
+            const typed = item;
+            const address = typeof typed.address === 'string' ? typed.address : '';
+            const name = typeof typed.name === 'string' ? typed.name : '';
+            if (!address && !name) {
+                continue;
+            }
+            const key = `${address}|${name}`;
+            if (seen.has(key)) {
+                continue;
+            }
+            seen.add(key);
+            normalized.push({ address, name });
+        }
+        return normalized;
+    }
+    normalizeStringArray(raw) {
+        if (!Array.isArray(raw)) {
+            return [];
+        }
+        return Array.from(new Set(raw.filter((item) => typeof item === 'string' && item.trim().length > 0)));
+    }
+    normalizeFunctionRelationships(raw) {
+        if (!Array.isArray(raw)) {
+            return [];
+        }
+        const normalized = [];
+        const seen = new Set();
+        for (const item of raw) {
+            if (!item || typeof item !== 'object') {
+                continue;
+            }
+            const typed = item;
+            const address = typeof typed.address === 'string' ? typed.address : '';
+            const name = typeof typed.name === 'string' ? typed.name : '';
+            const relationTypes = this.normalizeStringArray(typed.relation_types);
+            const referenceTypes = this.normalizeStringArray(typed.reference_types);
+            const referenceAddresses = this.normalizeStringArray(typed.reference_addresses);
+            const targetAddresses = this.normalizeStringArray(typed.target_addresses);
+            const resolvedBy = typeof typed.resolved_by === 'string' ? typed.resolved_by : undefined;
+            const isExact = typeof typed.is_exact === 'boolean' ? typed.is_exact : undefined;
+            if (!address && !name && relationTypes.length === 0) {
+                continue;
+            }
+            const key = `${address}|${name}|${relationTypes.join(',')}|${referenceTypes.join(',')}`;
+            if (seen.has(key)) {
+                continue;
+            }
+            seen.add(key);
+            normalized.push({
+                address,
+                name,
+                relation_types: relationTypes,
+                reference_types: referenceTypes,
+                reference_addresses: referenceAddresses,
+                target_addresses: targetAddresses.length > 0 ? targetAddresses : undefined,
+                resolved_by: resolvedBy,
+                is_exact: isExact,
+            });
+        }
+        return normalized;
+    }
+    normalizeCrossReferences(raw) {
+        if (!Array.isArray(raw)) {
+            return [];
+        }
+        const normalized = [];
+        for (const item of raw) {
+            if (!item || typeof item !== 'object') {
+                continue;
+            }
+            const typed = item;
+            if (typeof typed.from_address !== 'string' || typeof typed.type !== 'string') {
+                continue;
+            }
+            normalized.push({
+                from_address: typed.from_address,
+                type: typed.type,
+                is_call: Boolean(typed.is_call),
+                is_data: Boolean(typed.is_data),
+                from_function: typeof typed.from_function === 'string' ? typed.from_function : undefined,
+            });
+        }
+        return normalized;
+    }
+    normalizeGhidraFunction(raw) {
+        if (!raw || typeof raw !== 'object') {
+            return null;
+        }
+        const typed = raw;
+        const callers = this.normalizeNamedAddressList(typed.callers);
+        const callees = this.normalizeNamedAddressList(typed.callees);
+        const callerRelationships = this.normalizeFunctionRelationships(typed.caller_relationships);
+        const calleeRelationships = this.normalizeFunctionRelationships(typed.callee_relationships);
+        if (typeof typed.address !== 'string' || typeof typed.name !== 'string') {
+            return null;
+        }
+        return {
+            address: typed.address,
+            name: typed.name,
+            size: Number(typed.size || 0),
+            is_thunk: Boolean(typed.is_thunk),
+            is_external: Boolean(typed.is_external),
+            calling_convention: typeof typed.calling_convention === 'string' ? typed.calling_convention : 'unknown',
+            signature: typeof typed.signature === 'string' ? typed.signature : '',
+            callers,
+            caller_count: Number(typed.caller_count || callers.length || callerRelationships.length || 0),
+            callees,
+            callee_count: Number(typed.callee_count || callees.length || calleeRelationships.length || 0),
+            caller_relationships: callerRelationships.length > 0 ? callerRelationships : undefined,
+            callee_relationships: calleeRelationships.length > 0 ? calleeRelationships : undefined,
+            is_entry_point: Boolean(typed.is_entry_point),
+            is_exported: Boolean(typed.is_exported),
+        };
+    }
+    normalizeDecompiledFunction(raw) {
+        const typed = raw;
+        const callers = this.normalizeNamedAddressList(typed.callers);
+        const callees = this.normalizeNamedAddressList(typed.callees);
+        const callerRelationships = this.normalizeFunctionRelationships(typed.caller_relationships);
+        const calleeRelationships = this.normalizeFunctionRelationships(typed.callee_relationships);
+        const xrefs = this.normalizeCrossReferences(typed.xrefs);
+        return {
+            function: typeof typed.function === 'string' ? typed.function : 'unknown',
+            address: typeof typed.address === 'string' ? typed.address : '',
+            pseudocode: typeof typed.pseudocode === 'string' ? typed.pseudocode : '',
+            callers,
+            callees,
+            caller_relationships: callerRelationships.length > 0 ? callerRelationships : undefined,
+            callee_relationships: calleeRelationships.length > 0 ? calleeRelationships : undefined,
+            xrefs: xrefs.length > 0 ? xrefs : undefined,
+        };
+    }
+    /**
+     * Parse Ghidra output JSON
+     *
+     * Requirements: 8.3
+     *
+     * @param output - Ghidra stdout output
+     * @returns Parsed analysis output
+     */
+    parseGhidraOutput(output, stderr, diagnostics) {
+        try {
+            // Extract JSON from output (Ghidra may output other text before/after JSON)
+            const jsonMatch = output.match(/\{[\s\S]*"functions"[\s\S]*\}/);
+            if (!jsonMatch) {
+                throw new GhidraOutputParseError(this.buildNoJsonOutputMessage('ghidra.analyze', output, stderr, diagnostics), diagnostics || this.buildSyntheticDiagnostics(output, stderr));
+            }
+            const parsed = JSON.parse(jsonMatch[0]);
+            // Validate required fields
+            if (!parsed.functions || !Array.isArray(parsed.functions)) {
+                throw new Error('Invalid Ghidra output: missing functions array');
+            }
+            const functions = parsed.functions
+                .map((item) => this.normalizeGhidraFunction(item))
+                .filter((item) => Boolean(item));
+            const normalized = {
+                program_name: typeof parsed.program_name === 'string' ? parsed.program_name : 'unknown',
+                program_path: typeof parsed.program_path === 'string' ? parsed.program_path : '',
+                function_count: Number(parsed.function_count || functions.length),
+                functions,
+            };
+            logger.debug({
+                functionCount: normalized.function_count,
+                programName: normalized.program_name
+            }, 'Parsed Ghidra output');
+            return normalized;
+        }
+        catch (error) {
+            if (error instanceof GhidraOutputParseError) {
+                throw error;
+            }
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            logger.error({
+                error: errorMessage,
+                outputPreview: output.substring(0, 500),
+                stderrPreview: stderr.substring(0, 500),
+            }, 'Failed to parse Ghidra output');
+            throw new GhidraOutputParseError(`Failed to parse Ghidra output: ${errorMessage}`, diagnostics || this.buildSyntheticDiagnostics(output, stderr));
+        }
+    }
+    /**
+     * Execute DecompileFunction.py script
+     *
+     * Requirements: 10.1, 10.2, 10.6 (timeout handling)
+     *
+     * @param projectPath - Ghidra project directory path
+     * @param projectKey - Unique project key
+     * @param samplePath - Path to sample file
+     * @param addressOrSymbol - Function address or symbol name
+     * @param includeXrefs - Whether to include cross-references
+     * @param timeout - Timeout in milliseconds
+     * @returns Ghidra output (stdout)
+     */
+    async executeDecompileScript(projectPath, projectKey, samplePath, addressOrSymbol, includeXrefs, timeout) {
+        const scriptOrder = ['DecompileFunction.java'];
+        let lastError;
+        for (const scriptName of scriptOrder) {
+            const command = ghidraConfig.analyzeHeadlessPath;
+            const args = [
+                projectPath,
+                projectKey,
+                '-process', path.basename(samplePath),
+                '-readOnly',
+                '-scriptPath', ghidraConfig.scriptsDir,
+                '-postScript', scriptName, addressOrSymbol, String(includeXrefs),
+                '-noanalysis'
+            ];
+            logger.debug({
+                command,
+                args,
+                timeout,
+                script: scriptName,
+            }, 'Executing function decompilation post-script');
+            try {
+                return await this.runGhidraCommand(command, args, projectPath, timeout, undefined, `E_TIMEOUT: Function decompilation exceeded timeout of ${timeout}ms`, `Function decompilation failed (${scriptName})`);
+            }
+            catch (error) {
+                lastError = error;
+                const diagnostics = getGhidraDiagnostics(error);
+                logger.warn({
+                    script: scriptName,
+                    error: error instanceof Error ? error.message : String(error),
+                    ghidra_diagnostics: diagnostics,
+                }, 'Function decompilation script attempt failed');
+            }
+        }
+        throw lastError instanceof Error
+            ? lastError
+            : new Error('Function decompilation failed for all configured post-scripts.');
+    }
+    /**
+     * Parse decompile script output
+     *
+     * Requirements: 10.3, 10.4, 10.5
+     *
+     * @param output - Script stdout output
+     * @returns Parsed decompiled function or error
+     */
+    parseDecompileOutput(output, stderr, diagnostics) {
+        try {
+            // Extract JSON from output
+            const jsonMatch = output.match(/\{[\s\S]*\}/);
+            if (!jsonMatch) {
+                throw new GhidraOutputParseError(this.buildNoJsonOutputMessage('code.function.decompile', output, stderr, diagnostics), diagnostics || this.buildSyntheticDiagnostics(output, stderr));
+            }
+            const parsed = JSON.parse(jsonMatch[0]);
+            // Check for error in the result
+            if (parsed.error) {
+                return {
+                    error: typeof parsed.error === 'string' ? parsed.error : String(parsed.error),
+                    diagnostics: diagnostics || this.buildSyntheticDiagnostics(output, stderr),
+                };
+            }
+            // Validate required fields
+            if (!parsed.function || !parsed.address || !parsed.pseudocode) {
+                throw new Error('Invalid decompile output: missing required fields');
+            }
+            const normalized = this.normalizeDecompiledFunction(parsed);
+            logger.debug({
+                function: normalized.function,
+                address: normalized.address,
+                pseudocodeLength: normalized.pseudocode.length,
+                callerRelationships: normalized.caller_relationships?.length || 0,
+                calleeRelationships: normalized.callee_relationships?.length || 0,
+            }, 'Parsed decompile output');
+            return normalized;
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            const normalizedDiagnostics = diagnostics || getGhidraDiagnostics(error) || this.buildSyntheticDiagnostics(output, stderr);
+            logger.error({
+                error: errorMessage,
+                outputPreview: output.substring(0, 500),
+                stderrPreview: stderr.substring(0, 500),
+            }, 'Failed to parse decompile output');
+            return {
+                error: `Failed to parse decompile output: ${errorMessage}`,
+                diagnostics: normalizedDiagnostics,
+            };
+        }
+    }
+    /**
+     * Get control flow graph for a function
+     *
+     * Requirements: 11.1, 11.2, 11.3, 11.4, 11.5
+     *
+     * @param sampleId - Sample identifier
+     * @param addressOrSymbol - Function address (hex string) or symbol name
+     * @param timeout - Timeout in milliseconds (default: 30000)
+     * @returns Control flow graph with nodes and edges
+     */
+    async getFunctionCFG(sampleId, addressOrSymbol, timeout = 30000) {
+        // Check if Ghidra is configured
+        if (!ghidraConfig.isValid) {
+            throw new Error('Ghidra is not properly configured. Please set GHIDRA_PATH or GHIDRA_INSTALL_DIR environment variable.');
+        }
+        logger.debug({
+            sampleId,
+            addressOrSymbol,
+            timeout
+        }, 'Extracting function CFG');
+        // 1. Validate that the sample has been analyzed
+        const sample = this.database.findSample(sampleId);
+        if (!sample) {
+            throw new Error(`Sample not found: ${sampleId}`);
+        }
+        const resolved = this.resolveGhidraAnalysisForCapability(sampleId, 'cfg');
+        // 2. Get workspace and project paths
+        const workspace = await this.workspaceManager.getWorkspace(sampleId);
+        const samplePath = this.resolveSamplePath(workspace.original);
+        // Verify sample file exists
+        if (!fs.existsSync(samplePath)) {
+            throw new Error(`Sample file not found: ${samplePath}`);
+        }
+        // 3. Reuse the Ghidra project from the capability-ready analysis
+        const { projectPath, projectKey } = resolved;
+        // 4. Execute ExtractCFG.py script
+        try {
+            const result = await this.runWithProjectLockRetry('Function CFG extraction', async () => {
+                const output = await this.executeCFGScript(projectPath, projectKey, samplePath, addressOrSymbol, timeout);
+                const parsed = this.parseCFGOutput(output.stdout, output.stderr, output.diagnostics);
+                if ('error' in parsed) {
+                    throw parsed.diagnostics
+                        ? new GhidraOutputParseError(parsed.error, parsed.diagnostics)
+                        : new Error(parsed.error);
+                }
+                return parsed;
+            }, {
+                sampleId,
+                addressOrSymbol,
+            });
+            logger.info({
+                sampleId,
+                function: result.function,
+                address: result.address,
+                nodeCount: result.nodes?.length || 0,
+                edgeCount: result.edges?.length || 0
+            }, 'Function CFG extracted successfully');
+            return result;
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            const diagnostics = getGhidraDiagnostics(error);
+            logger.error({
+                sampleId,
+                addressOrSymbol,
+                error: errorMessage,
+                ghidra_diagnostics: diagnostics
+            }, 'Function CFG extraction failed');
+            throw error;
+        }
+    }
+    /**
+     * Execute ExtractCFG.py script
+     *
+     * Requirements: 11.1
+     *
+     * @param projectPath - Ghidra project directory path
+     * @param projectKey - Unique project key
+     * @param samplePath - Path to sample file
+     * @param addressOrSymbol - Function address or symbol name
+     * @param timeout - Timeout in milliseconds
+     * @returns Ghidra output (stdout)
+     */
+    async executeCFGScript(projectPath, projectKey, samplePath, addressOrSymbol, timeout) {
+        const scriptOrder = ['ExtractCFG.java'];
+        let lastError;
+        for (const scriptName of scriptOrder) {
+            const command = ghidraConfig.analyzeHeadlessPath;
+            const args = [
+                projectPath,
+                projectKey,
+                '-process', path.basename(samplePath),
+                '-readOnly',
+                '-scriptPath', ghidraConfig.scriptsDir,
+                '-postScript', scriptName, addressOrSymbol,
+                '-noanalysis'
+            ];
+            logger.debug({
+                command,
+                args,
+                timeout,
+                script: scriptName,
+            }, 'Executing CFG extraction post-script');
+            try {
+                return await this.runGhidraCommand(command, args, projectPath, timeout, undefined, `E_TIMEOUT: CFG extraction exceeded timeout of ${timeout}ms`, `CFG extraction failed (${scriptName})`);
+            }
+            catch (error) {
+                lastError = error;
+                const diagnostics = getGhidraDiagnostics(error);
+                logger.warn({
+                    script: scriptName,
+                    error: error instanceof Error ? error.message : String(error),
+                    ghidra_diagnostics: diagnostics,
+                }, 'CFG extraction script attempt failed');
+            }
+        }
+        throw lastError instanceof Error
+            ? lastError
+            : new Error('CFG extraction failed for all configured post-scripts.');
+    }
+    async searchFunctionsWithGhidra(sampleId, apiQuery, stringQuery, limit, timeout) {
+        const resolved = this.resolveGhidraAnalysisForCapability(sampleId, 'function_index');
+        const workspace = await this.workspaceManager.getWorkspace(sampleId);
+        const samplePath = this.resolveSamplePath(workspace.original);
+        if (!fs.existsSync(samplePath)) {
+            throw new Error(`Sample file not found: ${samplePath}`);
+        }
+        return this.runWithProjectLockRetry('Function reference search', async () => {
+            const output = await this.executeSearchScript(resolved.projectPath, resolved.projectKey, samplePath, apiQuery, stringQuery, limit, timeout);
+            const result = this.parseSearchOutput(output.stdout, output.stderr, output.diagnostics);
+            if ('error' in result) {
+                throw result.diagnostics
+                    ? new GhidraOutputParseError(result.error, result.diagnostics)
+                    : new Error(result.error);
+            }
+            return result;
+        }, {
+            sampleId,
+            apiQuery,
+            stringQuery,
+        });
+    }
+    searchFunctionsFromIndex(sampleId, apiQuery, limit) {
+        const needle = apiQuery.toLowerCase();
+        const matches = this.database
+            .findFunctions(sampleId)
+            .reduce((acc, func) => {
+            const callees = this.parseFunctionCallees(func.callees);
+            const apiMatches = callees.filter((callee) => callee.toLowerCase().includes(needle));
+            if (apiMatches.length === 0) {
+                return acc;
+            }
+            acc.push({
+                function: func.name || 'unknown',
+                address: func.address,
+                caller_count: func.caller_count ?? 0,
+                callee_count: func.callee_count ?? 0,
+                api_matches: apiMatches,
+                match_types: ['api_call_index'],
+            });
+            return acc;
+        }, [])
+            .sort((left, right) => {
+            const leftScore = (left.api_matches?.length ?? 0) * 10 + left.caller_count;
+            const rightScore = (right.api_matches?.length ?? 0) * 10 + right.caller_count;
+            return rightScore - leftScore;
+        })
+            .slice(0, limit);
+        return {
+            query: {
+                api: apiQuery,
+                limit,
+            },
+            matches,
+            count: matches.length,
+        };
+    }
+    parseFunctionCallees(raw) {
+        if (!raw) {
+            return [];
+        }
+        try {
+            const parsed = JSON.parse(raw);
+            if (!Array.isArray(parsed)) {
+                return [];
+            }
+            return parsed.filter((item) => typeof item === 'string');
+        }
+        catch {
+            return [];
+        }
+    }
+    async executeSearchScript(projectPath, projectKey, samplePath, apiQuery, stringQuery, limit, timeout) {
+        const command = ghidraConfig.analyzeHeadlessPath;
+        const args = [
+            projectPath,
+            projectKey,
+            '-process', path.basename(samplePath),
+            '-readOnly',
+            '-scriptPath', ghidraConfig.scriptsDir,
+            '-postScript', 'SearchFunctionReferences.java', apiQuery || '-', stringQuery || '-', String(limit),
+            '-noanalysis',
+        ];
+        logger.debug({
+            command,
+            args,
+            timeout,
+        }, 'Executing function reference search post-script');
+        return this.runGhidraCommand(command, args, projectPath, timeout, undefined, `E_TIMEOUT: Function search exceeded timeout of ${timeout}ms`, 'Function search failed');
+    }
+    parseSearchOutput(output, stderr, diagnostics) {
+        try {
+            const jsonMatch = output.match(/\{[\s\S]*\}/);
+            if (!jsonMatch) {
+                throw new GhidraOutputParseError(this.buildNoJsonOutputMessage('code.functions.search', output, stderr, diagnostics), diagnostics || this.buildSyntheticDiagnostics(output, stderr));
+            }
+            const parsed = JSON.parse(jsonMatch[0]);
+            if (parsed.error) {
+                return { error: String(parsed.error) };
+            }
+            if (!parsed.query || !parsed.matches || !Array.isArray(parsed.matches)) {
+                throw new Error('Invalid function search output: missing query or matches');
+            }
+            const matches = [];
+            for (const rawMatch of parsed.matches) {
+                if (!rawMatch || typeof rawMatch !== 'object') {
+                    continue;
+                }
+                const match = rawMatch;
+                const apiMatches = Array.isArray(match.api_matches)
+                    ? match.api_matches.filter((item) => typeof item === 'string')
+                    : [];
+                const stringMatches = [];
+                if (Array.isArray(match.string_matches)) {
+                    for (const item of match.string_matches) {
+                        if (!item || typeof item !== 'object') {
+                            continue;
+                        }
+                        const typed = item;
+                        const value = typeof typed.value === 'string' ? typed.value : '';
+                        if (!value) {
+                            continue;
+                        }
+                        const normalized = { value };
+                        if (typeof typed.data_address === 'string') {
+                            normalized.data_address = typed.data_address;
+                        }
+                        if (typeof typed.referenced_from === 'string') {
+                            normalized.referenced_from = typed.referenced_from;
+                        }
+                        stringMatches.push(normalized);
+                    }
+                }
+                const matchTypes = Array.isArray(match.match_types)
+                    ? match.match_types.filter((item) => item === 'api_call' || item === 'string_reference' || item === 'api_call_index')
+                    : [];
+                const normalizedMatchTypes = Array.from(new Set([
+                    ...matchTypes,
+                    ...(apiMatches.length > 0 ? ['api_call'] : []),
+                    ...(stringMatches.length > 0 ? ['string_reference'] : []),
+                ]));
+                matches.push({
+                    function: typeof match.function === 'string' ? match.function : 'unknown',
+                    address: typeof match.address === 'string' ? match.address : '',
+                    caller_count: Number(match.caller_count || 0),
+                    callee_count: Number(match.callee_count || 0),
+                    api_matches: apiMatches,
+                    string_matches: stringMatches,
+                    match_types: normalizedMatchTypes,
+                });
+            }
+            const normalizedResult = {
+                query: {
+                    api: typeof parsed.query?.api === 'string'
+                        ? String(parsed.query.api)
+                        : undefined,
+                    string: typeof parsed.query?.string === 'string'
+                        ? String(parsed.query.string)
+                        : undefined,
+                    limit: Number(parsed.query?.limit || matches.length || 0),
+                },
+                matches,
+                count: typeof parsed.count === 'number'
+                    ? parsed.count
+                    : matches.length,
+            };
+            return normalizedResult;
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            const normalizedDiagnostics = diagnostics || getGhidraDiagnostics(error) || this.buildSyntheticDiagnostics(output, stderr);
+            logger.error({
+                error: errorMessage,
+                outputPreview: output.substring(0, 500),
+                stderrPreview: stderr.substring(0, 500),
+            }, 'Failed to parse function search output');
+            return {
+                error: `Failed to parse function search output: ${errorMessage}`,
+                diagnostics: normalizedDiagnostics,
+            };
+        }
+    }
+    /**
+     * Parse CFG script output
+     *
+     * Requirements: 11.2, 11.3, 11.4, 11.5
+     *
+     * @param output - Script stdout output
+     * @returns Parsed control flow graph or error
+     */
+    parseCFGOutput(output, stderr, diagnostics) {
+        try {
+            // Extract JSON from output
+            const jsonMatch = output.match(/\{[\s\S]*\}/);
+            if (!jsonMatch) {
+                throw new GhidraOutputParseError(this.buildNoJsonOutputMessage('code.function.cfg', output, stderr, diagnostics), diagnostics || this.buildSyntheticDiagnostics(output, stderr));
+            }
+            const parsed = JSON.parse(jsonMatch[0]);
+            // Check for error in the result
+            if (parsed.error) {
+                return {
+                    error: parsed.error,
+                    diagnostics: diagnostics || this.buildSyntheticDiagnostics(output, stderr),
+                };
+            }
+            // Validate required fields
+            if (!parsed.function || !parsed.address || !parsed.nodes || !parsed.edges) {
+                throw new Error('Invalid CFG output: missing required fields');
+            }
+            logger.debug({
+                function: parsed.function,
+                address: parsed.address,
+                nodeCount: parsed.nodes.length,
+                edgeCount: parsed.edges.length
+            }, 'Parsed CFG output');
+            return parsed;
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            const normalizedDiagnostics = diagnostics || getGhidraDiagnostics(error) || this.buildSyntheticDiagnostics(output, stderr);
+            logger.error({
+                error: errorMessage,
+                outputPreview: output.substring(0, 500),
+                stderrPreview: stderr.substring(0, 500),
+            }, 'Failed to parse CFG output');
+            return {
+                error: `Failed to parse CFG output: ${errorMessage}`,
+                diagnostics: normalizedDiagnostics,
+            };
+        }
+    }
+    /**
+     * Store functions to database
+     *
+     * Requirements: 8.4
+     *
+     * @param sampleId - Sample identifier
+     * @param functions - Array of functions from Ghidra
+     */
+    async storeFunctions(sampleId, functions) {
+        if (functions.length === 0) {
+            logger.warn({ sampleId }, 'No functions to store');
+            return;
+        }
+        logger.debug({
+            sampleId,
+            functionCount: functions.length
+        }, 'Storing functions to database');
+        // Convert Ghidra functions to database format
+        const dbFunctions = functions.map(func => {
+            const calleeNames = Array.from(new Set([
+                ...func.callees.map(c => c.name).filter((name) => typeof name === 'string' && name.length > 0),
+                ...(func.callee_relationships || [])
+                    .map((relationship) => relationship.name)
+                    .filter((name) => typeof name === 'string' && name.length > 0),
+            ]));
+            return {
+                sample_id: sampleId,
+                address: func.address,
+                name: func.name,
+                size: func.size,
+                score: 0.0, // Will be calculated by rankFunctions later
+                tags: JSON.stringify([]), // Will be populated by rankFunctions
+                summary: null,
+                caller_count: Math.max(func.caller_count, func.callers.length, func.caller_relationships?.length || 0),
+                callee_count: Math.max(func.callee_count, func.callees.length, func.callee_relationships?.length || 0),
+                is_entry_point: func.is_entry_point ? 1 : 0,
+                is_exported: func.is_exported ? 1 : 0,
+                callees: JSON.stringify(calleeNames)
+            };
+        });
+        // Use batch insert for better performance
+        this.database.insertFunctionsBatch(dbFunctions);
+        logger.info({
+            sampleId,
+            functionCount: dbFunctions.length
+        }, 'Functions stored successfully');
+    }
+    /**
+     * Create a job result from analysis result
+     * Helper method for job queue integration
+     *
+     * @param analysisResult - Analysis result
+     * @param elapsedMs - Elapsed time in milliseconds
+     * @returns Job result
+     */
+    createJobResult(analysisResult, elapsedMs) {
+        return {
+            jobId: analysisResult.analysisId,
+            ok: true,
+            data: analysisResult,
+            errors: [],
+            warnings: [],
+            artifacts: [],
+            metrics: {
+                elapsedMs,
+                peakRssMb: 0 // TODO: Implement memory tracking
+            }
+        };
+    }
+    /**
+     * Create a job result from error
+     * Helper method for job queue integration
+     *
+     * @param jobId - Job identifier
+     * @param error - Error that occurred
+     * @param elapsedMs - Elapsed time in milliseconds
+     * @returns Job result
+     */
+    createErrorJobResult(jobId, error, elapsedMs) {
+        return {
+            jobId,
+            ok: false,
+            errors: [error.message],
+            warnings: [],
+            artifacts: [],
+            metrics: {
+                elapsedMs,
+                peakRssMb: 0
+            }
+        };
+    }
+}
+/**
+ * Create a decompiler worker instance
+ *
+ * @param database - Database manager
+ * @param workspaceManager - Workspace manager
+ * @returns Decompiler worker instance
+ */
+export function createDecompilerWorker(database, workspaceManager) {
+    return new DecompilerWorker(database, workspaceManager);
+}
+//# sourceMappingURL=decompiler-worker.js.map