Module state 

Server state: the single worker held behind an async mutex, its active attachment + address canonicalizer, the poison set, and a permit semaphore. Lazy single-flight boot (spec §5); strict inner<outer timeouts (spec §4.7); transparent crash respawn (spec §4.3) lives in execute.rs.

Structs

ServerState

WorkerHolder

A booted, attached worker plus the derived per-program address canonicalizer.

Enums

WorkerSlot

Constants

EXPECTED_WORKER_VERSION

The worker script version this binary requires; must equal GhidraMcpWorker.java’s WORKER_SCRIPT_VERSION (bumped to “0.7.0” for M2d: the set_local write method + the structured locals[] array on inspect_function). Bump BOTH in lockstep whenever the worker’s method surface changes. Exact-match (not semver-range) is sufficient because the worker is embedded + hash-extracted, so host and worker are always the same build in practice (spec §5).

SERVER_PERMITS

Max concurrent in-flight+queued tool calls before SERVER_BUSY (spec §5 / §9.4).

Functions

boot_env 🔒

A structured boot/transport failure envelope (retryable).

boot_reattach

Re-attach last_good on a freshly-booted holder if it differs from the boot’s initial attachment (spec §4.3). Best-effort: a re-attach failure is swallowed (the fresh worker is still usable at its bootstrap program; the caller’s retry will surface any real problem).

check_worker_version

Pure: decide whether an announced worker version is compatible. Skew → a sticky WORKER_INCOMPATIBLE envelope (spec §5).

config_unusable 🔒

A configuration that could not be resolved, as the envelope every tool call will return.

expect_success

Turn an RpcResponse into its result Value, or map a worker Failure into a structured envelope.

mk

Build an RpcRequest with a fixed id=1 (single in-flight request per conn — the worker services one at a time; the id is validated by WorkerConn per §4.4).