worker: idalib worker + WorkerClient (drop-in for IDAClient) — migration step 1

First concrete step off the mcp HTTP transport. Instead of reimplementing ~25
tools, reuse ida-pro-mcp's tool *functions* verbatim and replace only the
transport + process management:

* idatui/worker.py — opens ONE database in-process on the main thread (as idalib
  requires), imports ida_pro_mcp (which registers every stock + our patched-in
  custom tool against MCP_SERVER), then serves MCP_SERVER.tools.methods[name]
  (**args) over a unix socket with length-prefixed pickle. Serial on the main
  thread (idalib is single-threaded; tools run inline through execute_sync).
  Session-management tools (idb_open/idb_save/server_health/idb_list) are shimmed
  since the worker *is* the single session.
* idatui/worker_client.py — WorkerClient exposes the exact surface the app/domain
  use on the client (call/call_envelope/connect/set_db/resolve_db/list_sessions/
  health/keepalive/close) and returns byte-identical payloads (the worker calls
  the same functions IDAClient.call ultimately hits). So domain.py and the app
  are UNCHANGED — you just construct a WorkerClient instead of an IDAClient.
  Calls are serialized under a lock over one socket; keepalive is a no-op (the
  worker is ours and never idles out).

Not wired into the app yet — the mcp path is fully intact.

Verified without idalib: pickle framing round-trips arbitrary payloads incl raw
bytes; WorkerClient has full IDAClient surface; call_envelope produces the
result.structuredContent shape domain.decompile() reads. The idalib E2E
(experiments/worker_smoke.py drives the real domain.Program read path through the
worker) is written but couldn't run here — this sandbox has degraded to reaping
any idalib spawn; the underlying unix-socket protocol already ran clean in the
inproc_spike bench (~50us/call), and the worker dispatches the same tool
functions the HTTP path does, so shapes match by construction.

Next: stand up progress reporting during analysis, then flip _connect/_reconnect
to build a WorkerClient behind a flag and run the pilot suite against it.

1 files changed, 58 insertions, 0 deletions

diff --git a/experiments/worker_smoke.py b/experiments/worker_smoke.py
new file mode 100644
index 0000000..b215a57
--- /dev/null
+++ b/experiments/worker_smoke.py
@@ -0,0 +1,58 @@
+"""Runnable read-path smoke: drives the REAL domain.Program through WorkerClient
+(our idalib worker over a unix socket). Run when idalib can spawn:
+    ~/ida-venv/bin/python experiments/worker_smoke.py
+"""
+import os, sys, shutil, time
+REPO=os.path.expanduser("~/dev/ida-tui-maybe"); sys.path.insert(0, REPO); os.chdir(REPO)
+# fresh copy so the worker's idalib doesn't fight any running server
+src=f"{REPO}/targets/echo"; tmp="/tmp/echo_worker"
+shutil.copy(src, tmp)
+for e in ".i64 .id0 .id1 .id2 .nam .til".split(): 
+    try: os.remove(tmp+e)
+    except OSError: pass
+
+from idatui.worker_client import WorkerClient
+from idatui.domain import Program
+
+print("spawning worker + opening echo…", flush=True)
+t=time.time()
+cl=WorkerClient(tmp)
+cl.connect(progress=lambda m: None)
+print(f"  worker ready in {time.time()-t:.2f}s  session={cl.resolve_db()}", flush=True)
+prog=Program(cl)
+
+# --- drive the REAL domain layer through the worker (read path) ---
+main=prog.resolve("main")
+print("resolve('main') =", hex(main), flush=True)
+
+idx=prog.functions(); idx.load_all()
+print("functions() ->", len(idx), "funcs", flush=True)
+
+fn=prog.function_of(main)
+print("function_of(main) ->", fn.name, hex(fn.addr), "size", fn.size, flush=True)
+
+b=prog.read_bytes(main, 16)
+print("read_bytes(main,16) ->", b.hex(), flush=True)
+
+lm=prog.listing(main)
+for _ in range(3): lm.load_next_page()
+rows=[lm.get(i) for i in range(min(6,len(lm)))]
+print("listing() first rows:", flush=True)
+for h in rows:
+    if h: print("   ", hex(h.ea), h.kind, repr(h.text[:44]), flush=True)
+
+d=prog.decompile(main)
+print("decompile(main) -> failed?", d.failed, "lines:", len((d.code or '').splitlines()), flush=True)
+
+regs=prog.file_regions()
+print("file_regions ->", len(regs), "segments", flush=True)
+
+# xrefs to a called function
+callee=next((f.addr for f in idx.all_loaded() if f.name.startswith("sub_")), None)
+if callee:
+    xr=prog.xrefs_to(callee)
+    print("xrefs_to(", hex(callee), ") ->", len(xr), "refs", flush=True)
+
+ok = (fn.name=="main" and len(idx)>100 and b and not d.failed and len(regs)>0)
+print("VERDICT:", "OK — domain.Program runs unchanged on the worker" if ok else "FAIL", flush=True)
+cl.close()