Release xref-9b research preview

.gitattributes

@@ -1,35 +1,2 @@
-*.7z filter=lfs diff=lfs merge=lfs -text
-*.arrow filter=lfs diff=lfs merge=lfs -text
-*.bin filter=lfs diff=lfs merge=lfs -text
-*.bz2 filter=lfs diff=lfs merge=lfs -text
-*.ckpt filter=lfs diff=lfs merge=lfs -text
-*.ftz filter=lfs diff=lfs merge=lfs -text
-*.gz filter=lfs diff=lfs merge=lfs -text
-*.h5 filter=lfs diff=lfs merge=lfs -text
-*.joblib filter=lfs diff=lfs merge=lfs -text
-*.lfs.* filter=lfs diff=lfs merge=lfs -text
-*.mlmodel filter=lfs diff=lfs merge=lfs -text
-*.model filter=lfs diff=lfs merge=lfs -text
-*.msgpack filter=lfs diff=lfs merge=lfs -text
-*.npy filter=lfs diff=lfs merge=lfs -text
-*.npz filter=lfs diff=lfs merge=lfs -text
-*.onnx filter=lfs diff=lfs merge=lfs -text
-*.ot filter=lfs diff=lfs merge=lfs -text
-*.parquet filter=lfs diff=lfs merge=lfs -text
-*.pb filter=lfs diff=lfs merge=lfs -text
-*.pickle filter=lfs diff=lfs merge=lfs -text
-*.pkl filter=lfs diff=lfs merge=lfs -text
-*.pt filter=lfs diff=lfs merge=lfs -text
-*.pth filter=lfs diff=lfs merge=lfs -text
-*.rar filter=lfs diff=lfs merge=lfs -text
+*.gguf filter=lfs diff=lfs merge=lfs -text
 *.safetensors filter=lfs diff=lfs merge=lfs -text
-saved_model/**/* filter=lfs diff=lfs merge=lfs -text
-*.tar.* filter=lfs diff=lfs merge=lfs -text
-*.tar filter=lfs diff=lfs merge=lfs -text
-*.tflite filter=lfs diff=lfs merge=lfs -text
-*.tgz filter=lfs diff=lfs merge=lfs -text
-*.wasm filter=lfs diff=lfs merge=lfs -text
-*.xz filter=lfs diff=lfs merge=lfs -text
-*.zip filter=lfs diff=lfs merge=lfs -text
-*.zst filter=lfs diff=lfs merge=lfs -text
-*tfevents* filter=lfs diff=lfs merge=lfs -text

README.md

@@ -0,0 +1,230 @@
+---
+license: apache-2.0
+language:
+- en
+pipeline_tag: text-generation
+library_name: llama.cpp
+tags:
+- gguf
+- qwen
+- qwen3
+- qwen3.5
+- cybersecurity
+- malware-analysis
+- reverse-engineering
+- pe
+- elf
+- ghidra
+- agent
+- research
+inference: false
+---
+
+<p align="center">
+  <img src="assets/xref-9b-banner.svg" alt="xref-9b" width="860">
+</p>
+
+# xref-9b
+
+`xref-9b` is a research-preview reverse-engineering assistant for static PE and ELF malware triage. It is intended to be used with a local tool wrapper that exposes static analysis tools such as `file`, `strings`, `readelf`, `objdump`, PE header/import inspection, entropy checks, and optional Ghidra headless summaries.
+
+This release is distributed as GGUF for local inference with llama.cpp.
+
+## What Is Included
+
+| File | Purpose |
+|---|---|
+| `xref-9b-q4_k_m.gguf` | Recommended GGUF for local use. |
+| `xref-9b-f16.gguf` | Full precision GGUF artifact for conversion/experimentation. |
+| `agentre.py` | Interactive chat wrapper for PE/ELF reverse engineering. |
+| `agentre_triage.py` | Static tool runtime and batch triage backend. |
+| `reverse_engineering_spec_unified.md` | Tool-use and verdict spec given to the model. |
+| `tools/ghidra_scripts/AgentRESummary.java` | Ghidra headless script used by `/ghidra` and `ghidra_summary`. |
+| `scripts/` | Convenience scripts and environment template. |
+| `assets/` | Release graphics and evaluation chart. |
+
+## Intended Use
+
+This model is for defensive research, malware triage, reverse-engineering education, and local analyst-assist workflows. It is not a production malware detector and should not be used as the only basis for blocking, attribution, incident response, or legal decisions.
+
+The model should be treated as an assistant that proposes evidence-backed hypotheses from static tool output. It can be wrong, especially on stripped, packed, obfuscated, or sparse-string binaries.
+
+## Training Summary
+
+`xref-9b` was trained from a Qwen-family 9B base model using:
+
+- supervised fine-tuning (SFT) on reverse-engineering instruction traces;
+- additional PE and ELF malware/benign triage data;
+- reinforcement learning / preference optimization with IPO over curated preference pairs;
+- tool-use formatting for local static analysis workflows.
+
+Training data sources are intentionally not enumerated in this public model card.
+
+## Evaluation Snapshot
+
+Held-out mixed PE/ELF evaluation, 40 binaries total, balanced by format and benign/malicious label. Results are research-preview numbers and should be read as directional rather than definitive.
+
+<p align="center">
+  <img src="assets/xref-9b-eval-chart.svg" alt="xref-9b evaluation chart" width="760">
+</p>
+
+| Checkpoint / workflow | Strict accuracy | Binary accuracy | Notes |
+|---|---:|---:|---|
+| SFT baseline | 55.0% | 62.5% | Initial supervised model. |
+| SFT + IPO | 57.5% | 57.5% | Preference-tuned checkpoint; improved answer rate but still weak on ELF malware. |
+| SFT + IPO + release static workflow | 67.5% | 67.5% | Same IPO family with deeper static-analysis workflow and final-answer forcing. |
+
+Observed gains:
+
+- strict accuracy improved from 55.0% to 67.5% in the release workflow (+12.5 percentage points);
+- labeled ELF malware performance improved substantially under the deeper static workflow;
+- benign ELF calibration regressed in that run, so unknown/benign decisions still need analyst review.
+
+## Quick Start
+
+### 1. Install Runtime Dependencies
+
+Required:
+
+- Python 3.10+
+- llama.cpp with `llama-completion`
+- common Unix tools: `file`, `strings`, `readelf`, `objdump`, `nm`, `hexdump` or `xxd`
+
+Optional but recommended:
+
+- Ghidra headless (`analyzeHeadless`)
+- MinGW binutils for richer PE inspection on Linux (`x86_64-w64-mingw32-objdump`, `x86_64-w64-mingw32-nm`)
+
+### 2. Download
+
+Example with Hugging Face CLI:
+
+```bash
+hf download AgentreBench/xref-9b   xref-9b-q4_k_m.gguf agentre.py agentre_triage.py reverse_engineering_spec_unified.md   --local-dir xref-9b
+```
+
+For full local package including scripts and Ghidra helper:
+
+```bash
+hf download AgentreBench/xref-9b --local-dir xref-9b
+```
+
+### 3. Configure Environment
+
+```bash
+cd xref-9b
+cp scripts/xref9b.env.example scripts/xref9b.env
+$EDITOR scripts/xref9b.env
+source scripts/xref9b.env
+```
+
+At minimum set:
+
+```bash
+export XREF9B_GGUF="$PWD/xref-9b-q4_k_m.gguf"
+export XREF9B_LLAMA_CLI="/path/to/llama.cpp/build/bin/llama-completion"
+```
+
+Optional Ghidra:
+
+```bash
+export GHIDRA_HEADLESS="/path/to/ghidra/support/analyzeHeadless"
+```
+
+### 4. Chat With One Binary
+
+```bash
+python3 agentre.py chat /path/to/sample   --model "$XREF9B_GGUF"   --llama-cli "$XREF9B_LLAMA_CLI"   --ctx-size 65536   --gpu-layers 99   --max-turns 8   --max-tool-calls 16   --max-tokens 1600   --obs-limit 8000
+```
+
+Inside chat:
+
+```text
+/deep      run the deeper static workflow
+/ghidra    run Ghidra headless summary
+/verdict   force a concise final verdict
+/compact   compact long chat history
+/tools     list tools used
+/save      save transcript
+/quit      exit
+```
+
+You can also ask naturally:
+
+```text
+is this malicious or benign?
+use ghidra and explain the key functions
+is this packed?
+what evidence supports malicious behavior?
+```
+
+### 5. Directory Mode
+
+Directory mode is explicit:
+
+```bash
+python3 agentre.py chat -d /path/to/binaries   --model "$XREF9B_GGUF"   --llama-cli "$XREF9B_LLAMA_CLI"   --ctx-size 65536   --gpu-layers 99
+```
+
+Use `/samples` and `/open N` inside the session.
+
+### 6. Batch Triage
+
+```bash
+python3 agentre.py triage /path/to/binaries   --model "$XREF9B_GGUF"   --llama-cli "$XREF9B_LLAMA_CLI"   --ctx-size 65536   --gpu-layers 99   --max-tool-calls 16   --max-tokens 1600   --obs-limit 8000
+```
+
+## Ghidra Support
+
+`xref-9b` does not run arbitrary Ghidra commands. The wrapper exposes one Ghidra tool, `ghidra_summary`, implemented with Ghidra headless and `tools/ghidra_scripts/AgentRESummary.java`.
+
+The wrapper runs a command equivalent to:
+
+```bash
+analyzeHeadless /tmp/agentre_ghidra_xxx agentre_project   -import <staged_sample>   -overwrite   -analysisTimeoutPerFile 180   -scriptPath tools/ghidra_scripts   -postScript AgentRESummary.java /tmp/agentre_ghidra_summary.txt
+```
+
+Ghidra is used for static summaries: program metadata, memory blocks, imports/external symbols, strings, functions, and short instruction excerpts. It does not unpack malware, execute binaries, emulate payloads, or dynamically dump memory.
+
+## Limitations
+
+- Research preview; not production detection.
+- Static-only; no execution, sandboxing, unpacking, or memory dumping.
+- Stripped/static/packed binaries can require manual analyst follow-up.
+- The model can overfit to tool artifacts or overclaim from weak signals.
+- PE and ELF performance is uneven across families and compiler/linker settings.
+- The model may classify offensive dual-use tools as `hackware` or `malicious` depending on evidence and workflow.
+- Long tool histories can degrade answers; use `/compact`.
+
+## Improving The Model
+
+Useful next steps for contributors:
+
+- Add more stripped ELF and statically linked ELF training traces.
+- Add calibrated benign PE examples that contain network/admin APIs but no malicious behavior.
+- Add preference pairs that penalize overclaiming from entropy or strings alone.
+- Add tool traces that distinguish virtual addresses from file offsets.
+- Improve Ghidra summaries with function call graphs, xrefs, and decompiler snippets.
+- Add safer structured verdict calibration: `malicious`, `benign`, `hackware`, `unknown`.
+- Evaluate with family-disjoint and compiler-disjoint splits.
+
+## Recommended Settings
+
+For most local analysis:
+
+```bash
+--ctx-size 65536 --max-turns 8 --max-tool-calls 16 --max-tokens 1600 --obs-limit 8000
+```
+
+Use larger `--max-tokens` for deeper explanations, and `/compact` if the session becomes repetitive or context-heavy.
+
+## File Hashes
+
+```text
+87f320a4edda407a00ddb005774640acac4c45882a9d03674e5f2c37e9dbafd6  xref-9b-q4_k_m.gguf
+2e9438786b7aed9a9314629e811900616c1b4666a2f7cffa2f537fd566f238d8  xref-9b-f16.gguf
+```
+
+## Citation
+
+If you use this model in research, cite AgentRE-Bench / xref-9b and include the exact GGUF hash used.

SHA256SUMS

@@ -0,0 +1,2 @@
+87f320a4edda407a00ddb005774640acac4c45882a9d03674e5f2c37e9dbafd6  xref-9b-q4_k_m.gguf
+2e9438786b7aed9a9314629e811900616c1b4666a2f7cffa2f537fd566f238d8  xref-9b-f16.gguf

agentre.py

@@ -0,0 +1,983 @@
+#!/usr/bin/env python3
+"""AgentRE local launcher.
+
+`chat` starts a persistent reverse-engineering session for one file, or a directory passed with `-d`.
+`inspect` is kept as a compatibility alias for `chat`.
+`triage` delegates to the existing bulk PE/ELF analyzer.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import shlex
+import shutil
+import sys
+import time
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+import agentre_triage as triage
+
+
+ROOT = Path(__file__).resolve().parent
+LOCAL_AGENTRE_ENV = ROOT / "scripts" / "xref9b.env"
+
+
+def read_shell_exports(path: Path) -> dict[str, str]:
+    exports: dict[str, str] = {}
+    if not path.exists():
+        return exports
+    for raw in path.read_text(encoding="utf-8", errors="replace").splitlines():
+        line = raw.strip()
+        if not line.startswith("export "):
+            continue
+        try:
+            parts = shlex.split(line)
+        except ValueError:
+            continue
+        for part in parts[1:]:
+            key, sep, value = part.partition("=")
+            if sep and key:
+                exports[key] = value
+    return exports
+
+
+def load_local_agentre_env() -> dict[str, str]:
+    exports = read_shell_exports(LOCAL_AGENTRE_ENV)
+    for key, value in exports.items():
+        os.environ.setdefault(key, value)
+    return exports
+
+
+def now_stamp() -> str:
+    return datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+
+
+def print_top_help() -> None:
+    print(
+        """AgentRE local PE/ELF reverse-engineering CLI.
+
+Usage:
+  python3 agentre.py chat FILE [options]
+  python3 agentre.py chat -d DIR [options]
+  python3 agentre.py inspect FILE [options]
+  python3 agentre.py inspect -d DIR [options]
+  python3 agentre.py triage FILE_OR_DIR [options]
+
+Commands:
+  chat      Chat with the model while it uses static PE/ELF RE tools. Use -d for directories.
+  inspect   Alias for chat.
+  triage    Analyze one file or a directory of PE/ELF files and write reports.
+
+Examples:
+  python3 agentre.py chat holdout/mixed40/staged/sample_0003.elf
+  python3 agentre.py chat -d holdout/mixed40/staged
+  python3 agentre.py triage holdout/mixed40/staged --model ./xref-9b-q4_k_m.gguf
+"""
+    )
+
+
+def build_backend(args: argparse.Namespace) -> tuple[str, Any]:
+    backend_name = args.backend
+    if backend_name == "auto":
+        backend_name = "llama-cpp" if str(args.model).lower().endswith(".gguf") else "transformers"
+    print(f"[xref 9b] backend={backend_name} model={args.model}", flush=True)
+    if args.adapter and backend_name == "transformers":
+        print(f"[xref 9b] adapter={args.adapter}", flush=True)
+    elif args.adapter and backend_name == "llama-cpp":
+        print("[xref 9b] note: --adapter is ignored by llama-cpp; use a merged GGUF or --llama-lora", flush=True)
+
+    if backend_name == "transformers":
+        return backend_name, triage.LocalQwenBackend(args.model, args.adapter or None, args.dtype, args.device_map)
+    return backend_name, triage.LlamaCppBackend(
+        args.model,
+        args.llama_cli,
+        args.ctx_size,
+        args.threads,
+        args.gpu_layers,
+        args.llama_lora or None,
+        args.llama_extra_arg,
+    )
+
+
+def build_inspect_messages(spec: str, sample_id: str, fmt: str, request: str) -> list[dict[str, Any]]:
+    system = (
+        spec.strip()
+        + "\n\nRuntime rules:\n"
+        + f"- You are in an interactive reverse-engineering session for staged sample `{sample_id}` only.\n"
+        + f"- Detected format: {fmt}.\n"
+        + "- The original path is hidden from the model to avoid path/name bias.\n"
+        + "- Any tool path argument is ignored; tools are routed to the staged sample.\n"
+        + "- Use static analysis only. Never ask to execute the sample.\n"
+        + "- Use tools when they would materially improve the answer.\n"
+        + "- Answer the user's follow-up questions directly and cite concrete evidence from tool output.\n"
+        + "- If evidence is insufficient, say so plainly; classify as unknown or suspicious/unknown rather than guessing.\n"
+        + "- For stripped, static, packed, encrypted, or sparse-string samples where confidence is low, explicitly recommend closer disassembly with Ghidra or another disassembler.\n"
+        + "- Think internally, but do not expose chain-of-thought.\n"
+        + "- Only call final_answer when the user asks for a final verdict or when your answer is a classification decision.\n"
+    )
+    user = (
+        f"{request.strip()}\n\n"
+        "Start by inspecting basic metadata and strings, then give a concise initial assessment. "
+        "Do not require the user to know tool names."
+    )
+    return [{"role": "system", "content": system}, {"role": "user", "content": user}]
+
+
+def stage_one(source_path: Path, run_dir: Path, sample_id: str = "inspect_0001") -> tuple[Path, str]:
+    fmt = triage.detect_format(source_path)
+    suffix = ".elf" if fmt == "ELF" else ".exe" if fmt == "PE" else source_path.suffix
+    stage_dir = run_dir / "staged"
+    stage_dir.mkdir(parents=True, exist_ok=True)
+    staged_path = (stage_dir / f"{sample_id}{suffix}").resolve()
+    shutil.copy2(source_path, staged_path)
+    return staged_path, fmt
+
+
+def progress(state: dict[str, Any], message: str) -> None:
+    if state.get("progress", True):
+        print(f"[xref 9b] {message}", file=sys.stderr, flush=True)
+
+
+def looks_truncated_reply(text: str) -> bool:
+    stripped = text.rstrip()
+    if len(stripped) < 600:
+        return False
+    if stripped.endswith((".", "!", "?", ")", "]", "}", "`")):
+        return False
+    tail = stripped.rsplit(maxsplit=1)[-1].lower().strip(",:;")
+    return tail in {
+        "a",
+        "an",
+        "and",
+        "are",
+        "as",
+        "because",
+        "but",
+        "for",
+        "from",
+        "given",
+        "in",
+        "is",
+        "of",
+        "or",
+        "that",
+        "the",
+        "this",
+        "to",
+        "with",
+    } or not stripped.endswith((".", "!", "?", ":", ";"))
+
+
+def requested_direct_tool(text: str) -> tuple[str, dict[str, Any]] | None:
+    lowered = text.lower()
+    if "ghidra" in lowered and any(
+        word in lowered
+        for word in ("analyze", "disassembl", "dive", "open", "run", "try", "use", "with")
+    ):
+        return "ghidra_summary", {"timeout": 180}
+    return None
+
+
+def format_final(answer: dict[str, Any] | None) -> str:
+    if not answer:
+        return "Final verdict was submitted, but it was not valid JSON."
+    label = triage.normalize_prediction(answer)
+    summary = answer.get("summary") or answer.get("rationale") or answer.get("reason") or ""
+    evidence = answer.get("evidence") or answer.get("key_evidence") or []
+    lines = [f"Final verdict: {label}"]
+    if summary:
+        lines.append(str(summary))
+    if isinstance(evidence, list) and evidence:
+        lines.append("Evidence:")
+        for item in evidence[:6]:
+            lines.append(f"- {item}")
+    return "\n".join(lines)
+
+
+def shorten_text(text: str, limit: int) -> str:
+    stripped = "\n".join(line.rstrip() for line in text.strip().splitlines())
+    if len(stripped) <= limit:
+        return stripped
+    return stripped[:limit].rstrip() + f"\n[truncated to {limit} chars]"
+
+
+def deep_tool_sequence(fmt: str) -> list[tuple[str, dict[str, Any]]]:
+    common: list[tuple[str, dict[str, Any]]] = [
+        ("file", {}),
+        ("entropy", {}),
+        ("strings", {"min_length": 5}),
+    ]
+    if fmt == "ELF":
+        return [
+            ("file", {}),
+            ("readelf", {}),
+            ("nm", {}),
+            ("entropy", {}),
+            ("strings", {"min_length": 5}),
+            ("objdump", {}),
+            ("ghidra_summary", {"timeout": 240}),
+        ]
+    if fmt == "PE":
+        return [
+            ("file", {}),
+            ("pe_headers", {}),
+            ("pe_sections", {}),
+            ("pe_imports", {}),
+            ("pe_exports", {}),
+            ("entropy", {}),
+            ("strings", {"min_length": 5}),
+            ("pe_disasm", {}),
+            ("ghidra_summary", {"timeout": 240}),
+        ]
+    return common + [("ghidra_summary", {"timeout": 240})]
+
+
+def compact_messages(
+    messages: list[dict[str, Any]],
+    tools: triage.StaticTools,
+    state: dict[str, Any],
+    max_tool_summaries: int = 12,
+    max_assistant_summaries: int = 5,
+) -> list[dict[str, Any]]:
+    system_msg = next((msg for msg in messages if msg.get("role") == "system"), None)
+    first_user = next((msg for msg in messages if msg.get("role") == "user"), None)
+
+    tool_msgs = [msg for msg in messages if msg.get("role") == "tool"][-max_tool_summaries:]
+    assistant_msgs = [
+        msg for msg in messages
+        if msg.get("role") == "assistant" and str(msg.get("content") or "").strip()
+    ][-max_assistant_summaries:]
+
+    lines = [
+        "Session context was compacted to reduce prompt length.",
+        f"Total tool calls before compaction: {state.get('tool_calls_seen', 0)}",
+        "Tools used: " + (", ".join(tools.used_tools[-40:]) if tools.used_tools else "none"),
+    ]
+    if state.get("last_final"):
+        lines.append("Last submitted final verdict JSON: " + json.dumps(state["last_final"], ensure_ascii=True)[:1600])
+
+    if tool_msgs:
+        lines.append("\nRecent tool observations:")
+        for msg in tool_msgs:
+            name = str(msg.get("name") or "tool")
+            content = shorten_text(str(msg.get("content") or ""), 900)
+            lines.append(f"\n[{name}]\n{content}")
+
+    if assistant_msgs:
+        lines.append("\nRecent assistant conclusions:")
+        for msg in assistant_msgs:
+            content = shorten_text(str(msg.get("content") or ""), 700)
+            lines.append(f"- {content}")
+
+    lines.append("\nIf exact old bytes or full tool output are needed, rerun a targeted tool or /deep.")
+
+    compacted: list[dict[str, Any]] = []
+    if system_msg:
+        compacted.append(system_msg)
+    if first_user:
+        compacted.append(first_user)
+    compacted.append({"role": "assistant", "content": "\n".join(lines), "reasoning_content": ""})
+    return compacted
+
+
+def save_compaction_snapshot(run_dir: Path, session: dict[str, Any]) -> Path:
+    snapshot_dir = run_dir / "compaction_snapshots"
+    snapshot_dir.mkdir(parents=True, exist_ok=True)
+    sample_id = str(session.get("sample_id") or "sample")
+    path = snapshot_dir / f"{sample_id}_{now_stamp()}_precompact.json"
+    payload = {
+        "sample_id": sample_id,
+        "source_path": str(session.get("source_path")),
+        "staged_path": str(session.get("staged_path")),
+        "format": session.get("fmt"),
+        "tools_used": session.get("tools").used_tools if session.get("tools") else [],
+        "state": session.get("state", {}),
+        "messages": session.get("messages", []),
+        "saved_at": datetime.now(timezone.utc).isoformat(),
+    }
+    path.write_text(json.dumps(payload, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
+    return path
+
+
+def append_direct_tool_result(
+    canonical: str,
+    args: dict[str, Any],
+    tools: triage.StaticTools,
+    messages: list[dict[str, Any]],
+    cfg: triage.RuntimeConfig,
+    state: dict[str, Any],
+) -> None:
+    call_id = f"manual_{int(time.time() * 1000)}"
+    started = time.monotonic()
+    state["tool_calls_seen"] = int(state.get("tool_calls_seen", 0)) + 1
+    progress(state, f"direct tool {state['tool_calls_seen']}: {canonical}")
+    try:
+        content = getattr(tools, canonical)(**args)
+    except Exception as exc:
+        content = f"tool error: {type(exc).__name__}: {exc}"
+    elapsed = time.monotonic() - started
+    progress(state, f"tool done: {canonical} in {elapsed:.1f}s, observation={len(str(content))} chars")
+
+    messages.append(
+        {
+            "role": "assistant",
+            "content": "",
+            "reasoning_content": "",
+            "tool_calls": [
+                {
+                    "id": call_id,
+                    "type": "function",
+                    "function": {"name": canonical, "arguments": args},
+                }
+            ],
+        }
+    )
+    messages.append(
+        {
+            "role": "tool",
+            "tool_call_id": call_id,
+            "name": canonical,
+            "content": str(content)[: cfg.obs_limit],
+        }
+    )
+
+
+def save_inspect_session(
+    run_dir: Path,
+    source_path: Path,
+    staged_path: Path,
+    fmt: str,
+    messages: list[dict[str, Any]],
+    tools: triage.StaticTools,
+    state: dict[str, Any],
+) -> None:
+    sample_id = str(state.get("sample_id") or staged_path.stem)
+    payload = {
+        "sample_id": sample_id,
+        "source_path": str(source_path),
+        "staged_path": str(staged_path),
+        "format": fmt,
+        "tools_used": tools.used_tools,
+        "tool_calls": state.get("tool_calls_seen", 0),
+        "last_final": state.get("last_final"),
+        "messages": messages,
+        "saved_at": datetime.now(timezone.utc).isoformat(),
+    }
+    json_text = json.dumps(payload, indent=2, ensure_ascii=True) + "\n"
+    (run_dir / "inspect_transcript.json").write_text(json_text, encoding="utf-8")
+    (run_dir / f"{sample_id}_transcript.json").write_text(json_text, encoding="utf-8")
+
+    lines = [
+        "# AgentRE Chat Session",
+        "",
+        f"- Sample: `{sample_id}`",
+        f"- Source: `{source_path}`",
+        f"- Staged: `{staged_path}`",
+        f"- Format: `{fmt}`",
+        f"- Tool calls: `{state.get('tool_calls_seen', 0)}`",
+        "",
+        "## Conversation",
+        "",
+    ]
+    for msg in messages:
+        role = msg.get("role")
+        if role not in {"user", "assistant"}:
+            continue
+        content = str(msg.get("content") or "").strip()
+        if not content:
+            continue
+        lines.append(f"### {role}")
+        lines.append("")
+        lines.append(content[:8000])
+        lines.append("")
+    md_text = "\n".join(lines)
+    (run_dir / "INSPECT.md").write_text(md_text, encoding="utf-8")
+    (run_dir / f"{sample_id}.md").write_text(md_text, encoding="utf-8")
+
+
+def run_tool_calls(
+    tool_calls: list[dict[str, Any]],
+    tools: triage.StaticTools,
+    messages: list[dict[str, Any]],
+    cfg: triage.RuntimeConfig,
+    state: dict[str, Any],
+    turn: int,
+) -> str | None:
+    final_text: str | None = None
+    for idx, tc in enumerate(tool_calls):
+        fn = tc.get("function", {})
+        name = str(fn.get("name") or "")
+        args = triage._parse_args(fn.get("arguments"))
+        tcid = tc.get("id") or f"inspect_{turn}_{idx}"
+        started = time.monotonic()
+
+        if name in triage.FINAL_TOOLS:
+            progress(state, "model submitted final_answer")
+            answer = triage.final_answer_from_args(args)
+            state["last_final"] = answer
+            content = "final verdict submitted"
+            final_text = format_final(answer)
+        else:
+            canonical = triage.TOOL_ALIASES.get(name)
+            if canonical is None:
+                progress(state, f"unknown tool requested: {name}")
+                content = f"unknown tool {name}. Use listed tools or answer naturally."
+            elif int(state.get("request_tool_calls_seen", 0)) >= cfg.max_tool_calls:
+                progress(state, "tool budget exhausted for this request")
+                content = "tool budget exhausted for this request; answer with the evidence already gathered, or ask the user to continue."
+            else:
+                state["request_tool_calls_seen"] = int(state.get("request_tool_calls_seen", 0)) + 1
+                state["tool_calls_seen"] += 1
+                progress(
+                    state,
+                    f"tool {state['request_tool_calls_seen']}/{cfg.max_tool_calls} this request "
+                    f"(total {state['tool_calls_seen']}): {canonical}",
+                )
+                try:
+                    content = getattr(tools, canonical)(**args)
+                except Exception as exc:
+                    content = f"tool error: {type(exc).__name__}: {exc}"
+                elapsed = time.monotonic() - started
+                progress(state, f"tool done: {canonical} in {elapsed:.1f}s, observation={len(str(content))} chars")
+
+        messages.append(
+            {
+                "role": "tool",
+                "tool_call_id": tcid,
+                "name": name,
+                "content": str(content)[: cfg.obs_limit],
+            }
+        )
+    return final_text
+
+
+def generate_visible_reply(
+    backend: Any,
+    messages: list[dict[str, Any]],
+    cfg: triage.RuntimeConfig,
+    tools: triage.StaticTools,
+    state: dict[str, Any],
+) -> str:
+    final_text: str | None = None
+    last_visible_reply = ""
+    own_tool_budget = "request_tool_calls_seen" not in state
+    if own_tool_budget:
+        state["request_tool_calls_seen"] = 0
+    for turn in range(cfg.max_turns):
+        progress(state, f"model turn {turn + 1}/{cfg.max_turns}: generating")
+        started = time.monotonic()
+        generated, step_usage = backend.generate(
+            messages,
+            triage.tool_definitions(),
+            cfg.max_tokens,
+            cfg.temperature,
+            cfg.thinking,
+        )
+        elapsed = time.monotonic() - started
+        progress(state, f"model turn {turn + 1}/{cfg.max_turns}: generated in {elapsed:.1f}s")
+        usage = state.setdefault("usage", {"prompt_tokens": 0, "completion_tokens": 0, "total_tokens": 0})
+        for key, value in step_usage.items():
+            usage[key] = usage.get(key, 0) + int(value)
+
+        reasoning, visible = triage.split_thinking(generated)
+        tool_calls = triage.parse_tool_calls(generated)
+        if tool_calls:
+            progress(state, f"model requested {len(tool_calls)} tool call(s)")
+        assistant_content = triage.strip_tool_xml(visible)
+        if assistant_content:
+            last_visible_reply = assistant_content
+        assistant_msg: dict[str, Any] = {"role": "assistant", "content": assistant_content}
+        if reasoning and cfg.save_reasoning:
+            assistant_msg["reasoning_content"] = reasoning
+        elif reasoning:
+            assistant_msg["reasoning_content"] = ""
+        if tool_calls:
+            assistant_msg["tool_calls"] = [
+                triage.make_history_tool_call(tc, f"inspect_{turn}_{idx}")
+                for idx, tc in enumerate(tool_calls)
+            ]
+        messages.append(assistant_msg)
+
+        if not tool_calls:
+            reply = assistant_content or generated.strip() or "(no response)"
+            if looks_truncated_reply(reply):
+                state["last_reply_truncated"] = True
+                progress(state, "reply may have hit --max-tokens; use /continue or raise --max-tokens")
+                reply += (
+                    "\n\n[xref 9b] response may have hit --max-tokens before finishing; "
+                    "use /continue or raise --max-tokens for longer answers."
+                )
+            if own_tool_budget:
+                state.pop("request_tool_calls_seen", None)
+            return reply
+
+        maybe_final = run_tool_calls(tool_calls, tools, messages, cfg, state, turn)
+        if maybe_final:
+            final_text = maybe_final
+            messages.append(
+                {
+                    "role": "user",
+                    "content": "Summarize that final verdict for the user in concise natural language. Do not call another tool unless needed.",
+                }
+            )
+
+    if final_text:
+        if own_tool_budget:
+            state.pop("request_tool_calls_seen", None)
+        return final_text
+    if last_visible_reply:
+        if own_tool_budget:
+            state.pop("request_tool_calls_seen", None)
+        return (
+            last_visible_reply
+            + "\n\n[xref 9b] internal tool loop reached --max-turns before a final tool submission; "
+            + "ask a follow-up or raise --max-turns if you want deeper analysis."
+        )
+    if own_tool_budget:
+        state.pop("request_tool_calls_seen", None)
+    return "[xref 9b] assistant turn stopped after the internal turn limit; ask a narrower follow-up or raise --max-turns."
+
+
+def default_chat_model() -> str:
+    packaged = ROOT / "xref-9b-q4_k_m.gguf"
+    return (
+        os.environ.get("XREF9B_GGUF")
+        or os.environ.get("AGENTRE_GGUF")
+        or os.environ.get("AGENTRE_MODEL")
+        or (str(packaged) if packaged.exists() else triage.DEFAULT_BASE_MODEL)
+    )
+
+
+def default_llama_cli() -> str:
+    return os.environ.get("XREF9B_LLAMA_CLI") or os.environ.get("AGENTRE_LLAMA_CLI") or triage.DEFAULT_LLAMA_CLI
+
+
+def default_adapter_for_model(model: str) -> str:
+    return "" if str(model).lower().endswith(".gguf") else triage.DEFAULT_ADAPTER
+
+
+def sample_id_for_index(index: int, total: int) -> str:
+    return "inspect_0001" if total == 1 else f"sample_{index + 1:04d}"
+
+
+def display_path(path: Path, root: Path) -> str:
+    try:
+        base = root if root.is_dir() else root.parent
+        return str(path.relative_to(base))
+    except Exception:
+        return str(path)
+
+
+def save_chat_index(
+    run_dir: Path,
+    target_root: Path,
+    targets: list[Path],
+    active_idx: int,
+    sessions: dict[int, dict[str, Any]],
+) -> None:
+    samples: list[dict[str, Any]] = []
+    for idx, path in enumerate(targets):
+        session = sessions.get(idx)
+        state = session.get("state", {}) if session else {}
+        samples.append(
+            {
+                "index": idx + 1,
+                "sample_id": sample_id_for_index(idx, len(targets)),
+                "path": str(path),
+                "display_path": display_path(path, target_root),
+                "format": session.get("fmt") if session else triage.detect_format(path),
+                "opened": bool(session),
+                "tool_calls": state.get("tool_calls_seen", 0),
+                "last_final": state.get("last_final"),
+            }
+        )
+    payload = {
+        "target_root": str(target_root),
+        "active_index": active_idx + 1,
+        "samples": samples,
+        "saved_at": datetime.now(timezone.utc).isoformat(),
+    }
+    (run_dir / "chat_state.json").write_text(json.dumps(payload, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
+
+    lines = [
+        "# AgentRE Chat Index",
+        "",
+        f"- Target: `{target_root}`",
+        f"- Active sample: `{active_idx + 1}`",
+        f"- Samples: `{len(targets)}`",
+        "",
+        "## Samples",
+        "",
+    ]
+    for sample in samples:
+        marker = "*" if sample["index"] == active_idx + 1 else "-"
+        opened = " opened" if sample["opened"] else ""
+        lines.append(
+            f"{marker} `{sample['index']:04d}` `{sample['format']}`{opened} "
+            f"tools={sample['tool_calls']} `{sample['display_path']}`"
+        )
+    (run_dir / "CHAT.md").write_text("\n".join(lines) + "\n", encoding="utf-8")
+
+
+def print_sample_list(target_root: Path, targets: list[Path], active_idx: int, sessions: dict[int, dict[str, Any]], limit: int = 80) -> None:
+    shown = targets[:limit]
+    for idx, path in enumerate(shown):
+        session = sessions.get(idx)
+        fmt = session.get("fmt") if session else triage.detect_format(path)
+        marker = "*" if idx == active_idx else " "
+        opened = " opened" if session else ""
+        print(f"{marker} {idx + 1:4d} {fmt:7s}{opened:8s} {display_path(path, target_root)}")
+    if len(targets) > limit:
+        print(f"... {len(targets) - limit} more samples not shown; use /open N by index.")
+
+
+def resolve_sample_selector(selector: str, target_root: Path, targets: list[Path]) -> int:
+    text = selector.strip()
+    if not text:
+        raise ValueError("usage: /open N or /open path-substring")
+    if text.isdigit():
+        idx = int(text) - 1
+        if 0 <= idx < len(targets):
+            return idx
+        raise ValueError(f"sample index out of range: {text}")
+
+    maybe_path = Path(text).expanduser()
+    if maybe_path.exists():
+        resolved = maybe_path.resolve()
+        for idx, path in enumerate(targets):
+            if path == resolved:
+                return idx
+
+    lowered = text.lower()
+    matches = [
+        idx
+        for idx, path in enumerate(targets)
+        if lowered in path.name.lower() or lowered in display_path(path, target_root).lower() or lowered in str(path).lower()
+    ]
+    if len(matches) == 1:
+        return matches[0]
+    if not matches:
+        raise ValueError(f"no sample matched: {text}")
+    preview = ", ".join(str(idx + 1) for idx in matches[:12])
+    raise ValueError(f"ambiguous sample selector; matched indexes: {preview}")
+
+
+def run_tool_smoke_targets(targets: list[Path], run_dir: Path, cfg: triage.RuntimeConfig) -> int:
+    for idx, source_path in enumerate(targets):
+        sample_id = sample_id_for_index(idx, len(targets))
+        staged_path, fmt = stage_one(source_path, run_dir, sample_id)
+        tools = triage.StaticTools(staged_path, fmt, cfg.obs_limit, cfg.ghidra_script_dir)
+        print(f"== {idx + 1}: {source_path} ({fmt}) ==")
+        print("\n[file]")
+        print(tools.file())
+        print("\n[strings]")
+        print(tools.strings()[:2500])
+        print(f"\n[xref 9b] staged={staged_path}")
+    return 0
+
+
+def run_chat(argv: list[str], command_name: str = "chat") -> int:
+    parser = argparse.ArgumentParser(
+        prog=f"agentre.py {command_name}",
+        description="Chat with AgentRE about one PE/ELF sample, or a directory passed with -d, while it uses static RE tools.",
+    )
+    loaded_env = load_local_agentre_env()
+    default_model = default_chat_model()
+    default_cli = default_llama_cli()
+    parser.add_argument("target", nargs="?", help="Binary file to inspect. Use -d/--directory for directory mode.")
+    parser.add_argument("-d", "--directory", default="", help="Directory of PE/ELF files to inspect interactively.")
+    parser.add_argument("--spec", default=str(triage.DEFAULT_SPEC), help="Unified reverse-engineering spec.")
+    parser.add_argument(
+        "--backend",
+        choices=["auto", "transformers", "llama-cpp"],
+        default="auto",
+        help="Inference backend. auto selects llama-cpp for .gguf models, otherwise transformers.",
+    )
+    parser.add_argument("--model", default=default_model, help="HF base model path/name or GGUF path for llama.cpp.")
+    parser.add_argument("--adapter", default=None, help="Optional HF LoRA adapter for transformers. Use '' to disable.")
+    parser.add_argument("--output-dir", default="", help="Output directory. Defaults to runs/agentre_chat_<timestamp>.")
+    parser.add_argument("--max-files", type=int, default=0, help="Directory mode limit; 0 means no limit.")
+    parser.add_argument("--include-unknown", action="store_true", help="Include files that are not PE/ELF by magic bytes.")
+    parser.add_argument("--max-turns", type=int, default=8, help="Internal assistant/tool rounds per user message.")
+    parser.add_argument("--max-tool-calls", type=int, default=40, help="Model-selected tool calls allowed per user request.")
+    parser.add_argument("--max-tokens", type=int, default=1200)
+    parser.add_argument("--obs-limit", type=int, default=7000)
+    parser.add_argument("--temperature", type=float, default=0.1)
+    parser.add_argument("--dtype", default="auto", help="auto, bfloat16, float16, float32.")
+    parser.add_argument("--device-map", default="auto")
+    parser.add_argument("--llama-cli", default=default_cli, help="Path to llama.cpp llama-completion.")
+    parser.add_argument("--ctx-size", type=int, default=65536, help="llama.cpp context size.")
+    parser.add_argument("--threads", type=int, default=0, help="llama.cpp CPU threads; 0 lets llama.cpp choose.")
+    parser.add_argument("--gpu-layers", type=int, default=-1, help="llama.cpp GPU layers; -1 leaves default.")
+    parser.add_argument("--llama-lora", default="", help="Optional llama.cpp-compatible LoRA adapter.")
+    parser.add_argument("--llama-extra-arg", action="append", default=[], help="Extra raw argument passed to llama-completion. Repeatable.")
+    parser.add_argument("--no-thinking", action="store_true", help="Disable Qwen thinking template flag.")
+    parser.add_argument("--quiet", action="store_true", help="Hide progress messages while the model/tools run.")
+    parser.add_argument("--save-reasoning", action="store_true", help=argparse.SUPPRESS)
+    parser.add_argument("--ghidra-script-dir", default=str(triage.DEFAULT_GHIDRA_SCRIPT_DIR))
+    parser.add_argument(
+        "--request",
+        default="Is this malicious or benign? Reverse engineer it and use the available tools.",
+        help="Initial user request.",
+    )
+    parser.add_argument("--one-shot", action="store_true", help="Run the initial inspection and exit instead of opening the prompt.")
+    parser.add_argument("--tool-smoke", action="store_true", help="Run static tools and exit without loading a model.")
+    args = parser.parse_args(argv)
+
+    if loaded_env and not args.quiet:
+        print(f"[xref 9b] loaded defaults from {LOCAL_AGENTRE_ENV}", flush=True)
+
+    args.adapter = default_adapter_for_model(args.model) if args.adapter is None else args.adapter
+
+    if args.directory and args.target:
+        print("[xref 9b] provide either one file target or -d/--directory, not both.", file=sys.stderr)
+        return 2
+    if not args.directory and not args.target:
+        print("[xref 9b] provide one binary file, or use -d/--directory DIR for directory mode.", file=sys.stderr)
+        return 2
+
+    directory_mode = bool(args.directory)
+    target_root = Path(args.directory or args.target).expanduser().resolve()
+    if directory_mode:
+        if not target_root.is_dir():
+            print(f"[xref 9b] -d/--directory expects a directory: {target_root}", file=sys.stderr)
+            return 2
+    elif target_root.is_dir():
+        print(f"[xref 9b] refusing implicit directory chat target: {target_root}", file=sys.stderr)
+        print("[xref 9b] use -d/--directory for directory mode, or pass the full file path.", file=sys.stderr)
+        return 2
+
+    try:
+        targets = triage.collect_targets(target_root, include_unknown=args.include_unknown, max_files=args.max_files)
+    except FileNotFoundError:
+        print(f"[xref 9b] target not found: {target_root}", file=sys.stderr)
+        return 2
+    if not targets:
+        print(f"[xref 9b] no PE/ELF targets found under {target_root}", file=sys.stderr)
+        return 2
+
+    run_dir = Path(args.output_dir).expanduser().resolve() if args.output_dir else (ROOT / "runs" / f"agentre_chat_{now_stamp()}").resolve()
+    run_dir.mkdir(parents=True, exist_ok=True)
+    cfg = triage.RuntimeConfig(
+        max_turns=args.max_turns,
+        max_tool_calls=args.max_tool_calls,
+        max_tokens=args.max_tokens,
+        obs_limit=args.obs_limit,
+        temperature=args.temperature,
+        thinking=not args.no_thinking,
+        save_transcripts=True,
+        save_reasoning=False,
+        ghidra_script_dir=Path(args.ghidra_script_dir).expanduser().resolve(),
+    )
+
+    if args.tool_smoke:
+        return run_tool_smoke_targets(targets, run_dir, cfg)
+
+    spec = Path(args.spec).read_text(encoding="utf-8")
+    sessions: dict[int, dict[str, Any]] = {}
+    active_idx = 0
+
+    print(f"[xref 9b] chat target={target_root}", flush=True)
+    print(f"[xref 9b] discovered={len(targets)} output={run_dir}", flush=True)
+    print(f"[xref 9b] thinking={'on' if cfg.thinking else 'off'}", flush=True)
+    if len(targets) > 1:
+        print("[xref 9b] use /samples to list files and /open N to switch samples", flush=True)
+    _, backend = build_backend(args)
+
+    def ensure_session(index: int) -> dict[str, Any]:
+        if index in sessions:
+            return sessions[index]
+        source_path = targets[index]
+        sample_id = sample_id_for_index(index, len(targets))
+        staged_path, fmt = stage_one(source_path, run_dir, sample_id)
+        session = {
+            "source_path": source_path,
+            "sample_id": sample_id,
+            "staged_path": staged_path,
+            "fmt": fmt,
+            "tools": triage.StaticTools(staged_path, fmt, cfg.obs_limit, cfg.ghidra_script_dir),
+            "messages": build_inspect_messages(spec, sample_id, fmt, args.request),
+            "state": {"sample_id": sample_id, "tool_calls_seen": 0, "last_final": None, "progress": not args.quiet},
+            "started": False,
+        }
+        sessions[index] = session
+        return session
+
+    def save_session(index: int) -> None:
+        session = ensure_session(index)
+        save_inspect_session(
+            run_dir,
+            session["source_path"],
+            session["staged_path"],
+            session["fmt"],
+            session["messages"],
+            session["tools"],
+            session["state"],
+        )
+        save_chat_index(run_dir, target_root, targets, index, sessions)
+
+    def activate_sample(index: int) -> dict[str, Any]:
+        session = ensure_session(index)
+        print(
+            f"[xref 9b] active {index + 1}/{len(targets)} {session['sample_id']} "
+            f"format={session['fmt']} path={display_path(session['source_path'], target_root)}",
+            flush=True,
+        )
+        if not session["started"]:
+            reply = generate_visible_reply(backend, session["messages"], cfg, session["tools"], session["state"])
+            session["started"] = True
+            print("\nxref 9b> " + reply.strip() + "\n")
+        save_session(index)
+        return session
+
+    current = activate_sample(active_idx)
+    if args.one_shot:
+        print(f"[xref 9b] transcript={run_dir / 'INSPECT.md'}")
+        return 0
+
+    print("Commands: /help, /samples, /open N, /current, /tools, /deep, /ghidra, /verdict, /compact, /continue, /save, /quit")
+    while True:
+        try:
+            user_text = input("you> ").strip()
+        except (EOFError, KeyboardInterrupt):
+            print()
+            break
+        if not user_text:
+            continue
+        if user_text in {"/q", "/quit", "quit", "exit"}:
+            break
+        if user_text == "/help":
+            print("Ask natural-language RE questions about the active sample.")
+            print("Examples: `is this packed?`, `run Ghidra`, `why malicious?`, `what strings matter?`")
+            print("Slash commands: /samples, /open N, /current, /tools, /deep, /ghidra, /verdict, /compact, /continue, /save, /quit.")
+            continue
+        if user_text == "/samples":
+            print_sample_list(target_root, targets, active_idx, sessions)
+            continue
+        if user_text.startswith("/open"):
+            selector = user_text[len("/open") :].strip()
+            try:
+                active_idx = resolve_sample_selector(selector, target_root, targets)
+            except ValueError as exc:
+                print(f"[xref 9b] {exc}")
+                continue
+            current = activate_sample(active_idx)
+            continue
+        if user_text == "/current":
+            state = current["state"]
+            print(
+                f"{active_idx + 1}/{len(targets)} {current['sample_id']} {current['fmt']} "
+                f"tools={state.get('tool_calls_seen', 0)} {display_path(current['source_path'], target_root)}"
+            )
+            continue
+        if user_text == "/tools":
+            used = current["tools"].used_tools
+            print(", ".join(used) if used else "(no tools used yet)")
+            continue
+        if user_text == "/save":
+            save_session(active_idx)
+            print(f"[xref 9b] transcript={run_dir / 'INSPECT.md'}")
+            continue
+        if user_text == "/compact":
+            before = len(current["messages"])
+            snapshot = save_compaction_snapshot(run_dir, current)
+            current["messages"] = compact_messages(current["messages"], current["tools"], current["state"])
+            after = len(current["messages"])
+            save_session(active_idx)
+            print(f"[xref 9b] compacted conversation {before}->{after} messages; precompact={snapshot}")
+            continue
+        if user_text == "/continue":
+            user_text = "Continue the previous answer from where it stopped. Do not repeat earlier content."
+        elif user_text == "/ghidra":
+            user_text = "Run Ghidra headless on this sample and explain what it shows."
+
+        if user_text == "/deep":
+            state = current["state"]
+            current["messages"].append({
+                "role": "user",
+                "content": "Run the deeper static reverse-engineering workflow for this sample, then summarize the evidence.",
+            })
+            sequence = deep_tool_sequence(current["fmt"])
+            progress(state, f"deep analysis: running {len(sequence)} static tools")
+            for canonical, tool_args in sequence:
+                append_direct_tool_result(canonical, tool_args, current["tools"], current["messages"], cfg, state)
+            current["messages"].append({
+                "role": "user",
+                "content": (
+                    "Using the deep static tool results just provided, give a concise analyst summary. "
+                    "Classify only if the evidence supports it; otherwise say unknown and name the missing evidence. "
+                    "Do not repeat raw tool output and do not run the same broad tools again unless one targeted follow-up is essential."
+                ),
+            })
+            state["request_tool_calls_seen"] = 0
+            try:
+                reply = generate_visible_reply(backend, current["messages"], cfg, current["tools"], state)
+            finally:
+                state.pop("request_tool_calls_seen", None)
+            print("\nxref 9b> " + reply.strip() + "\n")
+            save_session(active_idx)
+            continue
+
+        if user_text == "/verdict":
+            state = current["state"]
+            current["messages"].append({
+                "role": "user",
+                "content": (
+                    "Give a concise final verdict now using the evidence already gathered. "
+                    "Call final_answer with classification, confidence, summary, and key evidence. "
+                    "Do not call additional tools; if evidence is insufficient, classify as unknown and explain why."
+                ),
+            })
+            state["request_tool_calls_seen"] = cfg.max_tool_calls
+            try:
+                reply = generate_visible_reply(backend, current["messages"], cfg, current["tools"], state)
+            finally:
+                state.pop("request_tool_calls_seen", None)
+            print("\nxref 9b> " + reply.strip() + "\n")
+            save_session(active_idx)
+            continue
+
+        current["messages"].append({"role": "user", "content": user_text})
+        state = current["state"]
+        state["request_tool_calls_seen"] = 0
+        try:
+            direct_tool = requested_direct_tool(user_text)
+            if direct_tool:
+                canonical, tool_args = direct_tool
+                append_direct_tool_result(canonical, tool_args, current["tools"], current["messages"], cfg, state)
+            reply = generate_visible_reply(backend, current["messages"], cfg, current["tools"], state)
+        finally:
+            state.pop("request_tool_calls_seen", None)
+        print("\nxref 9b> " + reply.strip() + "\n")
+        save_session(active_idx)
+
+    save_session(active_idx)
+    print(f"[xref 9b] transcript={run_dir / 'INSPECT.md'}")
+    print(f"[xref 9b] chat index={run_dir / 'CHAT.md'}")
+    return 0
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = list(sys.argv[1:] if argv is None else argv)
+    if not args or args[0] in {"-h", "--help", "help"}:
+        print_top_help()
+        return 0
+    command, rest = args[0], args[1:]
+    if command == "triage":
+        script = ROOT / "agentre_triage.py"
+        os.execv(sys.executable, [sys.executable, str(script)] + rest)
+    if command == "chat":
+        return run_chat(rest, "chat")
+    if command == "inspect":
+        return run_chat(rest, "inspect")
+    print(f"Unknown command: {command}\n", file=sys.stderr)
+    print_top_help()
+    return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

agentre_triage.py

@@ -0,0 +1,1265 @@
+#!/usr/bin/env python3
+"""User-facing AgentRE PE/ELF triage CLI.
+
+This is intentionally not an eval harness and does not require vLLM. It loads a
+local Qwen/Qwen3.5-style model with an optional LoRA adapter through
+Transformers, exposes static reverse-engineering tools, and lets the model
+inspect one file or every PE/ELF file in a directory.
+
+Static analysis only: samples are copied to neutral staging paths, never
+executed, and tool path arguments are ignored.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import math
+import os
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+
+ROOT = Path(__file__).resolve().parent
+STARTER = ROOT.parents[1] / "agentre_rl_starter"
+
+DEFAULT_BASE_MODEL = os.environ.get("XREF9B_BASE_MODEL") or os.environ.get("AGENTRE_BASE_MODEL") or "Qwen/Qwen3.5-9B"
+DEFAULT_ADAPTER = os.environ.get("XREF9B_ADAPTER") or os.environ.get("AGENTRE_ADAPTER", "")
+DEFAULT_SPEC = ROOT / "reverse_engineering_spec_unified.md"
+DEFAULT_GHIDRA_SCRIPT_DIR = ROOT / "tools" / "ghidra_scripts"
+DEFAULT_LLAMA_CLI = os.environ.get("AGENTRE_LLAMA_CLI", "llama-completion")
+
+FINAL_TOOLS = {"final_answer", "submit_answer", "submit"}
+
+TOOL_LIMITS = {
+    "file": 3000,
+    "strings": 9000,
+    "readelf": 14000,
+    "objdump": 18000,
+    "nm": 8000,
+    "hexdump": 8000,
+    "xxd": 8000,
+    "entropy": 2000,
+    "disasm_func": 18000,
+    "pe_headers": 14000,
+    "pe_sections": 9000,
+    "pe_imports": 14000,
+    "pe_exports": 9000,
+    "pe_disasm": 18000,
+    "pe_symbols": 9000,
+    "ghidra_summary": 24000,
+}
+
+TOOL_ALIASES = {
+    "file": "file",
+    "run_file": "file",
+    "strings": "strings",
+    "run_strings": "strings",
+    "readelf": "readelf",
+    "run_readelf": "readelf",
+    "objdump": "objdump",
+    "run_objdump": "objdump",
+    "nm": "nm",
+    "run_nm": "nm",
+    "hexdump": "hexdump",
+    "run_hexdump": "hexdump",
+    "xxd": "xxd",
+    "run_xxd": "xxd",
+    "entropy": "entropy",
+    "run_entropy": "entropy",
+    "disasm_func": "disasm_func",
+    "run_disasm_func": "disasm_func",
+    "pe_headers": "pe_headers",
+    "run_pe_headers": "pe_headers",
+    "pe_sections": "pe_sections",
+    "run_pe_sections": "pe_sections",
+    "pe_imports": "pe_imports",
+    "run_pe_imports": "pe_imports",
+    "pe_exports": "pe_exports",
+    "run_pe_exports": "pe_exports",
+    "pe_disasm": "pe_disasm",
+    "run_pe_disasm": "pe_disasm",
+    "pe_symbols": "pe_symbols",
+    "run_pe_symbols": "pe_symbols",
+    "ghidra_summary": "ghidra_summary",
+    "run_ghidra": "ghidra_summary",
+}
+
+XML_TOOL_RE = re.compile(
+    r"<tool_call>\s*<function=([^>\n]+)>\s*(.*?)\s*</function>\s*</tool_call>",
+    re.DOTALL,
+)
+XML_PARAM_RE = re.compile(
+    r"<parameter=([^>\n]+)>\s*(.*?)\s*</parameter>",
+    re.DOTALL,
+)
+JSON_TOOL_RE = re.compile(r"<tool_call>\s*(\{.*?\})\s*</tool_call>", re.DOTALL)
+THINK_RE = re.compile(r"<think>\s*(.*?)\s*</think>\s*", re.DOTALL)
+
+
+def _now_stamp() -> str:
+    return datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+
+
+def _json_from(text: str, pos: int = 0) -> Any | None:
+    decoder = json.JSONDecoder()
+    i = text.find("{", pos)
+    while i >= 0:
+        try:
+            obj, _ = decoder.raw_decode(text[i:])
+            return obj
+        except Exception:
+            i = text.find("{", i + 1)
+    return None
+
+
+def _parse_json_maybe(value: Any) -> Any:
+    if not isinstance(value, str):
+        return value
+    text = value.strip()
+    if text.startswith("```"):
+        lines = text.splitlines()
+        if lines and lines[0].lstrip().startswith("```"):
+            lines = lines[1:]
+        if lines and lines[-1].strip().startswith("```"):
+            lines = lines[:-1]
+        text = "\n".join(lines).strip()
+    try:
+        return json.loads(text)
+    except Exception:
+        obj = _json_from(text)
+        return obj if obj is not None else value
+
+
+def _parse_args(raw: Any) -> dict[str, Any]:
+    if isinstance(raw, dict):
+        return raw
+    if raw in (None, ""):
+        return {}
+    parsed = _parse_json_maybe(raw)
+    return parsed if isinstance(parsed, dict) else {}
+
+
+def _tool_call(name: str, args: Any, idx: int) -> dict[str, Any]:
+    if not isinstance(args, dict):
+        args = {}
+    return {
+        "id": f"call_{idx}",
+        "type": "function",
+        "function": {"name": name, "arguments": args},
+    }
+
+
+def parse_tool_calls(text: str | None) -> list[dict[str, Any]]:
+    content = text or ""
+    calls: list[dict[str, Any]] = []
+
+    for idx, match in enumerate(XML_TOOL_RE.finditer(content)):
+        name = match.group(1).strip()
+        body = match.group(2)
+        args: dict[str, Any] = {}
+        for param in XML_PARAM_RE.finditer(body):
+            key = param.group(1).strip()
+            value = param.group(2).strip()
+            args[key] = _parse_json_maybe(value)
+        calls.append(_tool_call(name, args, idx))
+    if calls:
+        return calls
+
+    for idx, match in enumerate(JSON_TOOL_RE.finditer(content)):
+        try:
+            obj = json.loads(match.group(1))
+        except Exception:
+            continue
+        name = obj.get("name") or obj.get("function", {}).get("name")
+        args = obj.get("arguments") or obj.get("function", {}).get("arguments") or {}
+        if name:
+            calls.append(_tool_call(str(name), _parse_args(args), idx))
+    if calls:
+        return calls
+
+    lower = content.lower()
+    for marker in ("final_answer", "submit_answer", "submit"):
+        pos = lower.find(marker)
+        if pos >= 0:
+            obj = _json_from(content, pos)
+            if isinstance(obj, dict):
+                if obj.get("name") in FINAL_TOOLS:
+                    return [_tool_call(str(obj["name"]), obj.get("arguments", {}), 0)]
+                return [_tool_call(marker, obj, 0)]
+
+    obj = _json_from(content)
+    if isinstance(obj, dict) and (
+        "classification" in obj
+        or "recommended_label" in obj
+        or "malware" in obj
+        or "hackware" in obj
+    ):
+        return [_tool_call("final_answer", {"answer_json": obj}, 0)]
+    return []
+
+
+def split_thinking(text: str) -> tuple[str | None, str]:
+    match = THINK_RE.search(text)
+    if match:
+        reasoning = match.group(1).strip()
+        visible = text[: match.start()] + text[match.end() :]
+        return reasoning, visible.strip()
+
+    # llama.cpp completion receives the opening <think> in the prompt, so the
+    # generated text may contain only the closing tag. Treat the prefix as
+    # hidden reasoning in that case.
+    end_tag = "</think>"
+    pos = text.find(end_tag)
+    if pos >= 0:
+        reasoning = text[:pos].strip()
+        visible = text[pos + len(end_tag) :].strip()
+        return reasoning or None, visible
+    return None, text
+
+
+def strip_tool_xml(text: str) -> str:
+    text = XML_TOOL_RE.sub("", text)
+    text = JSON_TOOL_RE.sub("", text)
+    return text.strip()
+
+
+def final_answer_from_args(args: dict[str, Any]) -> dict[str, Any] | None:
+    answer = args.get("answer_json", args)
+    answer = _parse_json_maybe(answer)
+    return answer if isinstance(answer, dict) else None
+
+
+def normalize_prediction(answer: Any) -> str:
+    if not isinstance(answer, dict):
+        return "unknown"
+    for key in ("classification", "recommended_label", "label", "verdict"):
+        value = answer.get(key)
+        if isinstance(value, str):
+            return normalize_prediction_string(value)
+    if bool(answer.get("hackware")):
+        return "hackware"
+    if isinstance(answer.get("malware"), bool):
+        return "malicious" if answer["malware"] else "benign"
+    return normalize_prediction_string(json.dumps(answer, sort_keys=True))
+
+
+def normalize_prediction_string(value: str) -> str:
+    text = value.lower()
+    if "hackware" in text or "dual-use" in text or "offensive tool" in text:
+        return "hackware"
+    if "benign" in text or "not malware" in text or "non-malicious" in text:
+        return "benign"
+    if "malicious" in text or "malware" in text or "c2" in text or "reverse shell" in text:
+        return "malicious"
+    return "unknown"
+
+
+def openai_tool(name: str, description: str, props: dict[str, Any] | None = None) -> dict[str, Any]:
+    return {
+        "type": "function",
+        "function": {
+            "name": name,
+            "description": description,
+            "parameters": {
+                "type": "object",
+                "properties": props or {},
+                "required": [],
+            },
+        },
+    }
+
+
+def tool_definitions() -> list[dict[str, Any]]:
+    path_prop = {"path": {"type": "string", "description": "Optional. Ignored; routed to current sample."}}
+    str_props = dict(path_prop)
+    str_props["min_length"] = {"type": "integer", "description": "Minimum printable string length."}
+    dump_props = dict(path_prop)
+    dump_props["length"] = {"type": "integer", "description": "Maximum bytes to dump."}
+    dump_props["offset"] = {"type": "integer", "description": "Start offset in bytes."}
+    disasm_props = {"function": {"type": "string", "description": "Function symbol name to disassemble."}}
+    ghidra_props = {
+        "timeout": {"type": "integer", "description": "Optional max seconds for Ghidra analysis."}
+    }
+    final_props = {"answer_json": {"type": "object", "description": "Final JSON verdict."}}
+    T = openai_tool
+    return [
+        T("run_file", "Identify file type, format, architecture, linkage, and stripped status.", path_prop),
+        T("file", "Alias for run_file.", path_prop),
+        T("run_strings", "Extract printable strings from the sample.", str_props),
+        T("strings", "Alias for run_strings.", str_props),
+        T("run_readelf", "Inspect ELF headers, sections, symbols, program headers, and dynamic imports.", path_prop),
+        T("readelf", "Alias for run_readelf.", path_prop),
+        T("run_objdump", "Disassemble or dump ELF sections with objdump.", path_prop),
+        T("objdump", "Alias for run_objdump.", path_prop),
+        T("nm", "List symbols when present.", path_prop),
+        T("run_pe_headers", "PE file and optional headers.", path_prop),
+        T("pe_headers", "Alias for run_pe_headers.", path_prop),
+        T("run_pe_sections", "PE section table and entropy.", path_prop),
+        T("pe_sections", "Alias for run_pe_sections.", path_prop),
+        T("run_pe_imports", "PE import tables and WinAPI symbols.", path_prop),
+        T("pe_imports", "Alias for run_pe_imports.", path_prop),
+        T("run_pe_exports", "PE export table and data directories.", path_prop),
+        T("pe_exports", "Alias for run_pe_exports.", path_prop),
+        T("run_pe_disasm", "Disassemble a PE sample.", path_prop),
+        T("pe_disasm", "Alias for run_pe_disasm.", path_prop),
+        T("run_pe_symbols", "List PE symbols when present.", path_prop),
+        T("pe_symbols", "Alias for run_pe_symbols.", path_prop),
+        T("run_disasm_func", "Disassemble one named function.", disasm_props),
+        T("disasm_func", "Alias for run_disasm_func.", disasm_props),
+        T("hexdump", "Hex dump bytes from the sample.", dump_props),
+        T("xxd", "Alias hex dump using xxd.", dump_props),
+        T("entropy", "Compute whole-file Shannon entropy.", path_prop),
+        T("ghidra_summary", "Run Ghidra headless static analysis and summarize output.", ghidra_props),
+        T("final_answer", "Submit exactly one final JSON verdict.", final_props),
+        T("submit_answer", "Alias for final_answer.", final_props),
+    ]
+
+
+def render_qwen_xml_tool_call(name: str, args: dict[str, Any]) -> str:
+    parts = ["<tool_call>\n", f"<function={name}>\n"]
+    for key, value in args.items():
+        if isinstance(value, (dict, list)):
+            value_text = json.dumps(value, ensure_ascii=True)
+        else:
+            value_text = str(value)
+        parts.extend([f"<parameter={key}>\n", value_text, "\n</parameter>\n"])
+    parts.append("</function>\n</tool_call>")
+    return "".join(parts)
+
+
+def render_qwen_xml_chat(
+    messages: list[dict[str, Any]],
+    tools: list[dict[str, Any]],
+    thinking: bool,
+    add_generation_prompt: bool = True,
+) -> str:
+    """Render a Qwen3.5 XML-tool prompt for llama.cpp GGUF inference."""
+    chunks: list[str] = []
+    system_content = ""
+    start_index = 0
+    if messages and messages[0].get("role") == "system":
+        system_content = str(messages[0].get("content") or "").strip()
+        start_index = 1
+
+    if tools:
+        chunks.append("<|im_start|>system\n")
+        chunks.append("# Tools\n\nYou have access to the following functions:\n\n<tools>")
+        for tool in tools:
+            chunks.append("\n")
+            chunks.append(json.dumps(tool, ensure_ascii=True))
+        chunks.append("\n</tools>")
+        chunks.append(
+            "\n\nIf you choose to call a function ONLY reply in the following format with NO suffix:\n\n"
+            "<tool_call>\n<function=example_function_name>\n"
+            "<parameter=example_parameter_1>\nvalue_1\n</parameter>\n"
+            "<parameter=example_parameter_2>\nThis is the value for the second parameter\n"
+            "that can span\nmultiple lines\n</parameter>\n"
+            "</function>\n</tool_call>\n\n"
+            "<IMPORTANT>\n"
+            "Reminder:\n"
+            "- Function calls MUST follow the specified format: an inner <function=...></function> block must be nested within <tool_call></tool_call> XML tags\n"
+            "- Required parameters MUST be specified\n"
+            "- You may provide optional reasoning for your function call in natural language BEFORE the function call, but NOT after\n"
+            "- If there is no function call available, answer the question like normal with your current knowledge and do not tell the user about function calls\n"
+            "</IMPORTANT>"
+        )
+        if system_content:
+            chunks.append("\n\n")
+            chunks.append(system_content)
+        chunks.append("<|im_end|>\n")
+    elif system_content:
+        chunks.append("<|im_start|>system\n")
+        chunks.append(system_content)
+        chunks.append("<|im_end|>\n")
+
+    i = start_index
+    while i < len(messages):
+        msg = messages[i]
+        role = msg.get("role")
+        content = str(msg.get("content") or "").strip()
+        if role == "user":
+            chunks.append("<|im_start|>user\n")
+            chunks.append(content)
+            chunks.append("<|im_end|>\n")
+        elif role == "assistant":
+            chunks.append("<|im_start|>assistant\n")
+            reasoning = str(msg.get("reasoning_content") or "").strip()
+            if reasoning:
+                chunks.append("<think>\n")
+                chunks.append(reasoning)
+                chunks.append("\n</think>\n\n")
+            elif msg.get("reasoning_content") is not None:
+                chunks.append("<think>\n\n</think>\n\n")
+            chunks.append(content)
+            tool_calls = msg.get("tool_calls") or []
+            if tool_calls:
+                if content:
+                    chunks.append("\n\n")
+                for tc in tool_calls:
+                    fn = tc.get("function", {})
+                    name = str(fn.get("name") or "")
+                    args = _parse_args(fn.get("arguments"))
+                    chunks.append(render_qwen_xml_tool_call(name, args))
+                    chunks.append("\n")
+            chunks.append("<|im_end|>\n")
+        elif role == "tool":
+            chunks.append("<|im_start|>user")
+            while i < len(messages) and messages[i].get("role") == "tool":
+                tool_msg = messages[i]
+                chunks.append("\n<tool_response>\n")
+                chunks.append(str(tool_msg.get("content") or ""))
+                chunks.append("\n</tool_response>")
+                i += 1
+            chunks.append("<|im_end|>\n")
+            continue
+        i += 1
+
+    if add_generation_prompt:
+        chunks.append("<|im_start|>assistant\n")
+        if thinking:
+            chunks.append("<think>\n")
+        else:
+            chunks.append("<think>\n\n</think>\n\n")
+    return "".join(chunks)
+
+
+def _parse_int(value: Any, default: int) -> int:
+    try:
+        if isinstance(value, str):
+            return int(value.strip(), 0)
+        return int(value)
+    except Exception:
+        return default
+
+
+def _dump_bounds(length: Any, offset: Any) -> tuple[int, int]:
+    length_i = _parse_int(length, 1024)
+    offset_i = _parse_int(offset, 0)
+    return max(64, min(length_i, 8192)), max(0, offset_i)
+
+
+def detect_format(path: Path) -> str:
+    try:
+        magic = path.read_bytes()[:4]
+    except Exception:
+        return "unknown"
+    if magic == b"\x7fELF":
+        return "ELF"
+    if magic[:2] == b"MZ":
+        return "PE"
+    return "unknown"
+
+
+def collect_targets(path: Path, include_unknown: bool, max_files: int) -> list[Path]:
+    if path.is_file():
+        return [path]
+    if not path.is_dir():
+        raise FileNotFoundError(path)
+    out: list[Path] = []
+    for p in sorted(path.rglob("*")):
+        if not p.is_file() or p.is_symlink():
+            continue
+        fmt = detect_format(p)
+        if fmt in {"PE", "ELF"} or include_unknown:
+            out.append(p)
+        if max_files and len(out) >= max_files:
+            break
+    return out
+
+
+@dataclass
+class RuntimeConfig:
+    max_turns: int
+    max_tool_calls: int
+    max_tokens: int
+    obs_limit: int
+    temperature: float
+    thinking: bool
+    save_transcripts: bool
+    save_reasoning: bool
+    ghidra_script_dir: Path
+
+
+class StaticTools:
+    def __init__(self, staged_path: Path, fmt: str, obs_limit: int, ghidra_script_dir: Path):
+        self.staged_path = staged_path
+        self.format = fmt
+        self.obs_limit = obs_limit
+        self.ghidra_script_dir = ghidra_script_dir
+        self.used_tools: list[str] = []
+        self.file_metadata: str | None = None
+        self.mingw_objdump = shutil.which("x86_64-w64-mingw32-objdump") or "objdump"
+        self.mingw_nm = shutil.which("x86_64-w64-mingw32-nm") or "nm"
+
+    def _limit(self, text: str, limit: int) -> str:
+        limit = min(limit, self.obs_limit)
+        text = text.replace(str(self.staged_path), "<sample>")
+        if len(text) > limit:
+            return text[:limit] + f"\n[truncated to {limit} chars]"
+        return text
+
+    def _run(self, cmd: list[str], tool_name: str, limit: int, timeout: int = 45) -> str:
+        self.used_tools.append(tool_name)
+        try:
+            proc = subprocess.run(
+                cmd,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True,
+                errors="replace",
+                timeout=timeout,
+                cwd=str(self.staged_path.parent),
+                check=False,
+            )
+        except FileNotFoundError:
+            return f"tool unavailable: {cmd[0]} not found"
+        except subprocess.TimeoutExpired:
+            return f"tool timeout after {timeout}s: {' '.join(cmd[:3])}"
+        out = proc.stdout
+        if proc.stderr:
+            out += "\n[stderr]\n" + proc.stderr
+        if not out.strip():
+            out = f"{tool_name} completed with no output, exit={proc.returncode}"
+        return self._limit(out, limit)
+
+    def file(self, **_: Any) -> str:
+        out = self._run(["file", "-b", str(self.staged_path)], "file", TOOL_LIMITS["file"], timeout=20)
+        self.file_metadata = out
+        return out
+
+    def strings(self, min_length: Any = 5, **_: Any) -> str:
+        try:
+            n = int(min_length)
+        except Exception:
+            n = 5
+        n = max(3, min(n, 32))
+        return self._run(["strings", "-a", "-n", str(n), str(self.staged_path)], "strings", TOOL_LIMITS["strings"], 35)
+
+    def readelf(self, **_: Any) -> str:
+        if self.format != "ELF":
+            return "readelf is only useful for ELF samples; use PE tools for PE files."
+        return self._run(["readelf", "-aW", str(self.staged_path)], "readelf", TOOL_LIMITS["readelf"], 35)
+
+    def objdump(self, **_: Any) -> str:
+        if self.format == "PE":
+            return self.pe_disasm()
+        tool = shutil.which("x86_64-linux-gnu-objdump") or "objdump"
+        cmd = [tool, "-d", "-M", "intel", str(self.staged_path)] if self._is_x86() else [tool, "-d", str(self.staged_path)]
+        return self._run(cmd, "objdump", TOOL_LIMITS["objdump"], 60)
+
+    def nm(self, **_: Any) -> str:
+        nm_tool = self.mingw_nm if self.format == "PE" else "nm"
+        return self._run([nm_tool, "-an", str(self.staged_path)], "nm", TOOL_LIMITS["nm"], 30)
+
+    def disasm_func(self, function: Any = "", **_: Any) -> str:
+        name = str(function or "").strip()
+        if not name:
+            self.used_tools.append("disasm_func")
+            return "disasm_func requires a function symbol name."
+        if self.format == "PE":
+            cmd = [self.mingw_objdump, "-d", "-M", "intel", f"--disassemble={name}", str(self.staged_path)]
+        else:
+            tool = shutil.which("x86_64-linux-gnu-objdump") or "objdump"
+            cmd = [tool, "-d", "-M", "intel", f"--disassemble={name}", str(self.staged_path)] if self._is_x86() else [tool, "-d", f"--disassemble={name}", str(self.staged_path)]
+        return self._run(cmd, "disasm_func", TOOL_LIMITS["disasm_func"], 60)
+
+    def pe_headers(self, **_: Any) -> str:
+        if self.format != "PE":
+            return "pe_headers is only useful for PE samples; use readelf for ELF files."
+        a = self._run([self.mingw_objdump, "-f", str(self.staged_path)], "pe_headers", TOOL_LIMITS["pe_headers"], 25)
+        b = self._run([self.mingw_objdump, "-p", str(self.staged_path)], "pe_headers", TOOL_LIMITS["pe_headers"], 45)
+        return self._limit(a + "\n\n== private headers (-p) ==\n" + b, TOOL_LIMITS["pe_headers"])
+
+    def pe_sections(self, **_: Any) -> str:
+        if self.format != "PE":
+            return "pe_sections is only useful for PE samples."
+        hdr = self._run([self.mingw_objdump, "-h", str(self.staged_path)], "pe_sections", TOOL_LIMITS["pe_sections"], 25)
+        return self._limit(hdr + "\n\n== per-section entropy ==\n" + self._section_entropy(hdr), TOOL_LIMITS["pe_sections"])
+
+    def pe_imports(self, **_: Any) -> str:
+        if self.format != "PE":
+            return "pe_imports is only useful for PE samples."
+        return self._run([self.mingw_objdump, "-x", str(self.staged_path)], "pe_imports", TOOL_LIMITS["pe_imports"], 45)
+
+    def pe_exports(self, **_: Any) -> str:
+        if self.format != "PE":
+            return "pe_exports is only useful for PE samples."
+        return self._run([self.mingw_objdump, "-p", str(self.staged_path)], "pe_exports", TOOL_LIMITS["pe_exports"], 45)
+
+    def pe_disasm(self, **_: Any) -> str:
+        if self.format != "PE":
+            return "pe_disasm is only useful for PE samples; use objdump for ELF files."
+        return self._run([self.mingw_objdump, "-d", "-M", "intel", str(self.staged_path)], "pe_disasm", TOOL_LIMITS["pe_disasm"], 70)
+
+    def pe_symbols(self, **_: Any) -> str:
+        if self.format != "PE":
+            return "pe_symbols is only useful for PE samples; use nm for ELF files."
+        return self._run([self.mingw_nm, str(self.staged_path)], "pe_symbols", TOOL_LIMITS["pe_symbols"], 30)
+
+    def hexdump(self, length: Any = 1024, offset: Any = 0, **_: Any) -> str:
+        length_i, offset_i = _dump_bounds(length, offset)
+        if shutil.which("hexdump"):
+            return self._run(["hexdump", "-C", "-n", str(length_i), "-s", str(offset_i), str(self.staged_path)], "hexdump", TOOL_LIMITS["hexdump"], 20)
+        return self.xxd(length=length_i, offset=offset_i)
+
+    def xxd(self, length: Any = 1024, offset: Any = 0, **_: Any) -> str:
+        length_i, offset_i = _dump_bounds(length, offset)
+        return self._run(["xxd", "-g", "1", "-l", str(length_i), "-s", str(offset_i), str(self.staged_path)], "xxd", TOOL_LIMITS["xxd"], 20)
+
+    def entropy(self, **_: Any) -> str:
+        self.used_tools.append("entropy")
+        counts = [0] * 256
+        total = 0
+        with self.staged_path.open("rb") as fh:
+            while True:
+                chunk = fh.read(1 << 20)
+                if not chunk:
+                    break
+                total += len(chunk)
+                for b in chunk:
+                    counts[b] += 1
+        ent = 0.0 if total == 0 else -sum((c / total) * math.log2(c / total) for c in counts if c)
+        return json.dumps({"bytes": total, "shannon_entropy": round(ent, 4)})
+
+    def ghidra_summary(self, timeout: Any = 180, **_: Any) -> str:
+        self.used_tools.append("ghidra_summary")
+        try:
+            timeout_i = max(30, min(int(timeout), 900))
+        except Exception:
+            timeout_i = 180
+        headless = find_ghidra_headless()
+        if not headless:
+            return "ghidra unavailable: analyzeHeadless not found. Set GHIDRA_HEADLESS or add analyzeHeadless to PATH."
+        script_dir = self.ghidra_script_dir
+        script_file = script_dir / "AgentRESummary.java"
+        if not script_file.exists():
+            return f"ghidra script unavailable: {script_file}"
+        with tempfile.TemporaryDirectory(prefix="agentre_ghidra_") as tmp:
+            tmp_path = Path(tmp)
+            out_path = tmp_path / "agentre_ghidra_summary.txt"
+            cmd = [
+                headless,
+                str(tmp_path),
+                "agentre_project",
+                "-import",
+                str(self.staged_path),
+                "-overwrite",
+                "-analysisTimeoutPerFile",
+                str(timeout_i),
+                "-scriptPath",
+                str(script_dir),
+                "-postScript",
+                "AgentRESummary.java",
+                str(out_path),
+            ]
+            try:
+                proc = subprocess.run(
+                    cmd,
+                    stdout=subprocess.PIPE,
+                    stderr=subprocess.PIPE,
+                    text=True,
+                    errors="replace",
+                    timeout=timeout_i + 90,
+                    check=False,
+                )
+            except subprocess.TimeoutExpired:
+                return f"ghidra timeout after {timeout_i + 90}s"
+            out = out_path.read_text(encoding="utf-8", errors="replace") if out_path.exists() else ""
+            log = proc.stdout + (("\n[stderr]\n" + proc.stderr) if proc.stderr else "")
+            if out.strip():
+                return self._limit(out + "\n\n== Ghidra log tail ==\n" + log[-4000:], TOOL_LIMITS["ghidra_summary"])
+            return self._limit("Ghidra produced no summary file.\n\n" + log, TOOL_LIMITS["ghidra_summary"])
+
+    def _is_x86(self) -> bool:
+        meta = self.file_metadata or self.file()
+        low = meta.lower()
+        return "x86-64" in low or "80386" in low or "intel" in low or "amd64" in low
+
+    def _section_entropy(self, section_table: str) -> str:
+        try:
+            data = self.staged_path.read_bytes()
+        except Exception as exc:
+            return f"<cannot read: {exc}>"
+        rows: list[str] = []
+        for line in section_table.splitlines():
+            parts = line.split()
+            if len(parts) >= 6 and parts[0].isdigit():
+                try:
+                    size, off = int(parts[2], 16), int(parts[5], 16)
+                except ValueError:
+                    continue
+                blob = data[off : off + size]
+                if not blob:
+                    rows.append(f"{parts[1]:14s} size={size:<8} entropy=n/a")
+                    continue
+                counts = [0] * 256
+                for b in blob:
+                    counts[b] += 1
+                n = len(blob)
+                ent = -sum((v / n) * math.log2(v / n) for v in counts if v)
+                flag = "  <HIGH: packed/encrypted?>" if ent > 7.2 else ""
+                rows.append(f"{parts[1]:14s} size={size:<8} entropy={ent:4.2f}{flag}")
+        return "\n".join(rows) or "<no section table>"
+
+
+def find_ghidra_headless() -> str | None:
+    env = os.environ.get("GHIDRA_HEADLESS")
+    if env and Path(env).exists():
+        return env
+    found = shutil.which("analyzeHeadless")
+    if found:
+        return found
+
+    # Keep this bounded. A recursive home-directory scan can hang on large
+    # workstations, so only check common Ghidra install layouts.
+    candidates = [
+        Path("/opt/ghidra/support/analyzeHeadless"),
+        Path("/usr/share/ghidra/support/analyzeHeadless"),
+        Path.home() / "ghidra" / "support" / "analyzeHeadless",
+    ]
+    candidates.extend(Path("/opt").glob("ghidra*/support/analyzeHeadless") if Path("/opt").exists() else [])
+    for path in candidates:
+        if path.is_file() and os.access(path, os.X_OK):
+            return str(path)
+    return None
+
+
+class LocalQwenBackend:
+    def __init__(self, base_model: str, adapter: str | None, dtype: str, device_map: str):
+        try:
+            import torch
+            from transformers import AutoModelForCausalLM, AutoTokenizer
+        except Exception as exc:
+            raise RuntimeError("Transformers local backend requires torch and transformers") from exc
+
+        self.torch = torch
+        tokenizer_path = adapter if adapter and Path(adapter).exists() else base_model
+        self.tokenizer = AutoTokenizer.from_pretrained(tokenizer_path, trust_remote_code=True)
+        torch_dtype = "auto" if dtype == "auto" else getattr(torch, dtype)
+        self.model = AutoModelForCausalLM.from_pretrained(
+            base_model,
+            trust_remote_code=True,
+            torch_dtype=torch_dtype,
+            device_map=device_map,
+        )
+        if adapter:
+            try:
+                from peft import PeftModel
+            except Exception as exc:
+                raise RuntimeError("Loading a LoRA adapter requires peft") from exc
+            self.model = PeftModel.from_pretrained(self.model, adapter)
+        self.model.eval()
+
+    def generate(
+        self,
+        messages: list[dict[str, Any]],
+        tools: list[dict[str, Any]],
+        max_new_tokens: int,
+        temperature: float,
+        thinking: bool,
+    ) -> tuple[str, dict[str, int]]:
+        prompt = self.tokenizer.apply_chat_template(
+            messages,
+            tools=tools,
+            tokenize=False,
+            add_generation_prompt=True,
+            enable_thinking=thinking,
+        )
+        inputs = self.tokenizer([prompt], return_tensors="pt")
+        device = next(self.model.parameters()).device
+        inputs = {k: v.to(device) for k, v in inputs.items()}
+        do_sample = temperature > 0
+        with self.torch.inference_mode():
+            output = self.model.generate(
+                **inputs,
+                max_new_tokens=max_new_tokens,
+                do_sample=do_sample,
+                temperature=temperature if do_sample else None,
+                pad_token_id=self.tokenizer.eos_token_id,
+            )
+        input_len = int(inputs["input_ids"].shape[1])
+        generated_ids = output[0][input_len:]
+        text = self.tokenizer.decode(generated_ids, skip_special_tokens=False)
+        if "<|im_end|>" in text:
+            text = text.split("<|im_end|>", 1)[0]
+        usage = {
+            "prompt_tokens": input_len,
+            "completion_tokens": int(generated_ids.shape[0]),
+            "total_tokens": input_len + int(generated_ids.shape[0]),
+        }
+        return text, usage
+
+
+
+def clean_llama_completion_output(text: str) -> str:
+    lines: list[str] = []
+    for line in text.splitlines():
+        stripped = line.strip()
+        if line.startswith("ggml_cuda_init:") or line.startswith("  Device "):
+            continue
+        if stripped in {"[end of text]", ""}:
+            if lines:
+                lines.append("")
+            continue
+        lines.append(line)
+    cleaned = "\n".join(lines).replace(" [end of text]", "").replace("[end of text]", "").strip()
+    return cleaned
+
+
+class LlamaCppBackend:
+    def __init__(
+        self,
+        model_path: str,
+        llama_cli: str,
+        ctx_size: int,
+        threads: int,
+        gpu_layers: int,
+        llama_lora: str | None,
+        extra_args: list[str],
+    ):
+        resolved_cli = shutil.which(llama_cli) or llama_cli
+        cli_path = Path(resolved_cli)
+        if cli_path.name == "llama-cli":
+            sibling_completion = cli_path.with_name("llama-completion")
+            if sibling_completion.exists():
+                resolved_cli = str(sibling_completion)
+        if not Path(resolved_cli).exists() and shutil.which(resolved_cli) is None:
+            raise RuntimeError(f"llama.cpp completion binary not found: {llama_cli}. Set --llama-cli or AGENTRE_LLAMA_CLI.")
+        if not Path(model_path).exists():
+            raise RuntimeError(f"GGUF model not found: {model_path}")
+        self.llama_cli = resolved_cli
+        self.model_path = model_path
+        self.ctx_size = ctx_size
+        self.threads = threads
+        self.gpu_layers = gpu_layers
+        self.llama_lora = llama_lora
+        self.extra_args = extra_args
+
+    def generate(
+        self,
+        messages: list[dict[str, Any]],
+        tools: list[dict[str, Any]],
+        max_new_tokens: int,
+        temperature: float,
+        thinking: bool,
+    ) -> tuple[str, dict[str, int]]:
+        prompt = render_qwen_xml_chat(messages, tools, thinking=thinking, add_generation_prompt=True)
+
+        def build_cmd(ctx_size: int) -> list[str]:
+            cmd = [
+                self.llama_cli,
+                "-m",
+                self.model_path,
+                "-p",
+                prompt,
+                "-n",
+                str(max_new_tokens),
+                "-c",
+                str(ctx_size),
+                "--temp",
+                str(max(0.0, temperature)),
+                "--no-display-prompt",
+                "-no-cnv",
+                "--simple-io",
+                "--no-warmup",
+                "-lv",
+                "1",
+            ]
+            if self.threads > 0:
+                cmd.extend(["-t", str(self.threads)])
+            if self.gpu_layers >= 0:
+                cmd.extend(["-ngl", str(self.gpu_layers)])
+            if self.llama_lora:
+                cmd.extend(["--lora", self.llama_lora])
+            cmd.extend(self.extra_args)
+            return cmd
+
+        ctx_size = self.ctx_size
+        proc: subprocess.CompletedProcess[str] | None = None
+        for attempt in range(2):
+            try:
+                proc = subprocess.run(
+                    build_cmd(ctx_size),
+                    stdout=subprocess.PIPE,
+                    stderr=subprocess.PIPE,
+                    text=True,
+                    errors="replace",
+                    timeout=900,
+                    check=False,
+                )
+            except FileNotFoundError as exc:
+                raise RuntimeError(f"llama.cpp CLI not found: {self.llama_cli}") from exc
+
+            if proc.returncode == 0:
+                self.ctx_size = ctx_size
+                break
+
+            error_text = proc.stderr[-4000:] or proc.stdout[-4000:]
+            match = re.search(r"prompt is too long \((\d+) tokens, max (\d+)\)", error_text)
+            if match and attempt == 0:
+                prompt_tokens = int(match.group(1))
+                needed = prompt_tokens + max_new_tokens + 128
+                next_ctx = max(ctx_size * 2, ((needed + 4095) // 4096) * 4096)
+                print(
+                    f"[xref 9b] llama.cpp prompt exceeded ctx={ctx_size}; retrying with ctx={next_ctx}",
+                    file=sys.stderr,
+                    flush=True,
+                )
+                ctx_size = next_ctx
+                continue
+
+            raise RuntimeError(
+                "llama.cpp generation failed "
+                f"exit={proc.returncode}: {error_text}"
+            )
+
+        if proc is None:
+            raise RuntimeError("llama.cpp generation did not start")
+        if proc.returncode != 0:
+            error_text = proc.stderr[-4000:] or proc.stdout[-4000:]
+            raise RuntimeError(
+                "llama.cpp generation failed "
+                f"exit={proc.returncode}: {error_text}"
+            )
+
+        text = clean_llama_completion_output(proc.stdout)
+        if "<|im_end|>" in text:
+            text = text.split("<|im_end|>", 1)[0]
+        return text, {"prompt_tokens": 0, "completion_tokens": 0, "total_tokens": 0}
+
+
+def build_messages(spec: str, sample_id: str, fmt: str, user_request: str) -> list[dict[str, Any]]:
+    system = (
+        spec.strip()
+        + "\n\nRuntime rules:\n"
+        + f"- You are analyzing staged sample `{sample_id}` only.\n"
+        + f"- Detected format: {fmt}.\n"
+        + "- The original path is hidden from the model to avoid path/name bias.\n"
+        + "- Any tool path argument is ignored; tools are routed to the staged sample.\n"
+        + "- Use static analysis only. Never ask to execute the sample.\n"
+        + "- If evidence is insufficient, classify as unknown and state that closer disassembly with Ghidra or another disassembler is needed.\n"
+        + "- For stripped, static, packed, encrypted, or sparse-string samples, prefer entropy, objdump/PE disassembly, and ghidra_summary before final_answer.\n"
+        + "- Think internally, but do not include chain-of-thought in the final answer.\n"
+    )
+    user = (
+        f"{user_request.strip()}\n\n"
+        "Use the available reverse-engineering tools. Decide whether this sample is benign, malicious, hackware, or unknown. "
+        "When finished, call final_answer with the structured JSON verdict."
+    )
+    return [{"role": "system", "content": system}, {"role": "user", "content": user}]
+
+
+def make_history_tool_call(tc: dict[str, Any], fallback_id: str) -> dict[str, Any]:
+    fn = tc.get("function", {})
+    args = _parse_args(fn.get("arguments"))
+    return {
+        "id": tc.get("id") or fallback_id,
+        "type": "function",
+        "function": {
+            "name": str(fn.get("name") or ""),
+            "arguments": args,
+        },
+    }
+
+
+def analyze_one(
+    backend: Any,
+    source_path: Path,
+    sample_id: str,
+    run_dir: Path,
+    spec: str,
+    cfg: RuntimeConfig,
+    user_request: str,
+) -> dict[str, Any]:
+    fmt = detect_format(source_path)
+    stage_dir = run_dir / "staged"
+    stage_dir.mkdir(parents=True, exist_ok=True)
+    suffix = ".elf" if fmt == "ELF" else ".exe" if fmt == "PE" else source_path.suffix
+    staged_path = (stage_dir / f"{sample_id}{suffix}").resolve()
+    shutil.copy2(source_path, staged_path)
+
+    tools = StaticTools(staged_path, fmt, cfg.obs_limit, cfg.ghidra_script_dir)
+    messages = build_messages(spec, sample_id, fmt, user_request)
+    answer: dict[str, Any] | None = None
+    error: str | None = None
+    usage: dict[str, int] = {"prompt_tokens": 0, "completion_tokens": 0, "total_tokens": 0}
+    tool_calls_seen = 0
+    transcript: list[dict[str, Any]] = list(messages)
+
+    try:
+        for turn in range(cfg.max_turns):
+            if tool_calls_seen >= cfg.max_tool_calls:
+                messages.append({"role": "user", "content": "Tool budget reached. Call final_answer now with your best JSON verdict."})
+                transcript.append(messages[-1])
+
+            generated, step_usage = backend.generate(
+                messages,
+                tool_definitions(),
+                cfg.max_tokens,
+                cfg.temperature,
+                cfg.thinking,
+            )
+            for key, value in step_usage.items():
+                usage[key] = usage.get(key, 0) + int(value)
+
+            reasoning, visible = split_thinking(generated)
+            tool_calls = parse_tool_calls(generated)
+            assistant_content = strip_tool_xml(visible)
+            assistant_msg: dict[str, Any] = {"role": "assistant", "content": assistant_content}
+            if reasoning and cfg.save_reasoning:
+                assistant_msg["reasoning_content"] = reasoning
+            elif reasoning:
+                assistant_msg["reasoning_content"] = ""
+            if tool_calls:
+                assistant_msg["tool_calls"] = [
+                    make_history_tool_call(tc, f"call_{turn}_{idx}")
+                    for idx, tc in enumerate(tool_calls)
+                ]
+            messages.append(assistant_msg)
+            transcript.append(dict(assistant_msg))
+
+            if not tool_calls:
+                parsed = final_answer_from_args({"answer_json": assistant_content or generated})
+                if parsed:
+                    answer = parsed
+                    break
+                if turn < cfg.max_turns - 1:
+                    prompt = "Call final_answer now with your compact JSON verdict."
+                    messages.append({"role": "user", "content": prompt})
+                    transcript.append(messages[-1])
+                    continue
+                break
+
+            stop = False
+            for idx, tc in enumerate(tool_calls):
+                fn = tc.get("function", {})
+                name = str(fn.get("name") or "")
+                args = _parse_args(fn.get("arguments"))
+                tcid = tc.get("id") or f"call_{turn}_{idx}"
+                if name in FINAL_TOOLS:
+                    answer = final_answer_from_args(args)
+                    msg = {"role": "tool", "tool_call_id": tcid, "name": name, "content": "submitted"}
+                    messages.append(msg)
+                    transcript.append(msg)
+                    stop = True
+                    break
+                canonical = TOOL_ALIASES.get(name)
+                if canonical is None:
+                    content = f"unknown tool {name}. Use the tools listed in the unified spec and final_answer."
+                elif tool_calls_seen >= cfg.max_tool_calls:
+                    content = "tool budget exhausted; submit final_answer."
+                else:
+                    tool_calls_seen += 1
+                    try:
+                        content = getattr(tools, canonical)(**args)
+                    except Exception as exc:
+                        content = f"tool error: {type(exc).__name__}: {exc}"
+                msg = {
+                    "role": "tool",
+                    "tool_call_id": tcid,
+                    "name": name,
+                    "content": str(content)[: cfg.obs_limit],
+                }
+                messages.append(msg)
+                transcript.append(msg)
+            if stop:
+                break
+    except Exception as exc:
+        error = f"{type(exc).__name__}: {exc}"
+
+    prediction = normalize_prediction(answer)
+    result = {
+        "sample_id": sample_id,
+        "source_path": str(source_path),
+        "staged_path": str(staged_path),
+        "format": fmt,
+        "prediction": prediction,
+        "answer": answer,
+        "error": error,
+        "tools_used": tools.used_tools,
+        "tool_calls": tool_calls_seen,
+        "usage": usage,
+    }
+    if cfg.save_transcripts:
+        result["transcript"] = transcript
+    return result
+
+
+def write_outputs(results: list[dict[str, Any]], run_dir: Path) -> None:
+    results_path = run_dir / "results.jsonl"
+    with results_path.open("w", encoding="utf-8") as fh:
+        for row in results:
+            fh.write(json.dumps(row, ensure_ascii=True) + "\n")
+
+    counts: dict[str, int] = {}
+    by_format: dict[str, dict[str, int]] = {}
+    for row in results:
+        pred = str(row.get("prediction", "unknown"))
+        fmt = str(row.get("format", "unknown"))
+        counts[pred] = counts.get(pred, 0) + 1
+        by_format.setdefault(fmt, {})
+        by_format[fmt][pred] = by_format[fmt].get(pred, 0) + 1
+    summary = {
+        "total": len(results),
+        "predictions": counts,
+        "by_format": by_format,
+        "errors": sum(1 for row in results if row.get("error")),
+        "completed_at": datetime.now(timezone.utc).isoformat(),
+    }
+    (run_dir / "summary.json").write_text(json.dumps(summary, indent=2) + "\n", encoding="utf-8")
+
+    lines = [
+        "# AgentRE Triage Summary",
+        "",
+        f"Total samples: {len(results)}",
+        f"Errors: {summary['errors']}",
+        "",
+        "## Predictions",
+        "",
+    ]
+    for label, count in sorted(counts.items()):
+        lines.append(f"- {label}: {count}")
+    lines += ["", "## Samples", ""]
+    for row in results:
+        lines.append(
+            f"- `{row['sample_id']}` `{row['format']}` `{row['prediction']}` "
+            f"tools={row['tool_calls']} path=`{row['source_path']}`"
+        )
+        answer = row.get("answer")
+        if isinstance(answer, dict) and answer.get("summary"):
+            lines.append(f"  - {answer['summary']}")
+        if row.get("error"):
+            lines.append(f"  - error: {row['error']}")
+    (run_dir / "SUMMARY.md").write_text("\n".join(lines) + "\n", encoding="utf-8")
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Analyze PE/ELF files with the AgentRE model and static tools.")
+    parser.add_argument("target", help="File or directory to analyze.")
+    parser.add_argument("--spec", default=str(DEFAULT_SPEC), help="Unified reverse-engineering spec.")
+    parser.add_argument(
+        "--backend",
+        choices=["auto", "transformers", "llama-cpp"],
+        default="auto",
+        help="Inference backend. auto selects llama-cpp for .gguf models, otherwise transformers.",
+    )
+    parser.add_argument("--model", default=DEFAULT_BASE_MODEL, help="HF base model path/name or GGUF path for llama-cpp.")
+    parser.add_argument("--adapter", default=DEFAULT_ADAPTER, help="Optional HF LoRA adapter path for transformers. Use '' to disable.")
+    parser.add_argument("--output-dir", default="", help="Output directory. Defaults to runs/agentre_triage_<timestamp>.")
+    parser.add_argument("--max-files", type=int, default=0, help="Directory mode limit; 0 means no limit.")
+    parser.add_argument("--include-unknown", action="store_true", help="Include files that are not PE/ELF by magic bytes.")
+    parser.add_argument("--max-turns", type=int, default=14)
+    parser.add_argument("--max-tool-calls", type=int, default=12)
+    parser.add_argument("--max-tokens", type=int, default=1200)
+    parser.add_argument("--obs-limit", type=int, default=5000)
+    parser.add_argument("--temperature", type=float, default=0.1)
+    parser.add_argument("--dtype", default="auto", help="auto, bfloat16, float16, float32.")
+    parser.add_argument("--device-map", default="auto")
+    parser.add_argument("--llama-cli", default=DEFAULT_LLAMA_CLI, help="Path to llama.cpp llama-cli.")
+    parser.add_argument("--ctx-size", type=int, default=32768, help="llama.cpp context size.")
+    parser.add_argument("--threads", type=int, default=0, help="llama.cpp CPU threads; 0 lets llama.cpp choose.")
+    parser.add_argument("--gpu-layers", type=int, default=-1, help="llama.cpp GPU layers; -1 leaves default.")
+    parser.add_argument("--llama-lora", default="", help="Optional llama.cpp-compatible LoRA adapter. HF PEFT LoRA is not accepted here.")
+    parser.add_argument("--llama-extra-arg", action="append", default=[], help="Extra raw argument passed to llama-cli. Repeatable.")
+    parser.add_argument("--no-thinking", action="store_true", help="Disable Qwen thinking template flag.")
+    parser.add_argument("--save-transcripts", action="store_true")
+    parser.add_argument("--save-reasoning", action="store_true", help="Only meaningful with --save-transcripts.")
+    parser.add_argument("--ghidra-script-dir", default=str(DEFAULT_GHIDRA_SCRIPT_DIR))
+    parser.add_argument(
+        "--request",
+        default="Is this malicious or benign? Reverse engineer it and use the available tools.",
+        help="User request inserted for each sample.",
+    )
+    parser.add_argument("--tool-smoke", action="store_true", help="Run static tools on the target and exit without loading the model.")
+    args = parser.parse_args()
+
+    target = Path(args.target).expanduser().resolve()
+    targets = collect_targets(target, include_unknown=args.include_unknown, max_files=args.max_files)
+    if not targets:
+        print(f"No PE/ELF targets found under {target}", file=sys.stderr)
+        return 2
+
+    if args.output_dir:
+        run_dir = Path(args.output_dir).expanduser().resolve()
+    else:
+        run_dir = (ROOT / "runs" / f"agentre_triage_{_now_stamp()}").resolve()
+    run_dir.mkdir(parents=True, exist_ok=True)
+
+    spec = Path(args.spec).read_text(encoding="utf-8")
+    cfg = RuntimeConfig(
+        max_turns=args.max_turns,
+        max_tool_calls=args.max_tool_calls,
+        max_tokens=args.max_tokens,
+        obs_limit=args.obs_limit,
+        temperature=args.temperature,
+        thinking=not args.no_thinking,
+        save_transcripts=args.save_transcripts,
+        save_reasoning=args.save_reasoning,
+        ghidra_script_dir=Path(args.ghidra_script_dir).expanduser().resolve(),
+    )
+
+    if args.tool_smoke:
+        smoke_dir = run_dir / "tool_smoke"
+        smoke_dir.mkdir(parents=True, exist_ok=True)
+        for idx, path in enumerate(targets, 1):
+            fmt = detect_format(path)
+            staged = smoke_dir / f"sample_{idx:04d}{'.elf' if fmt == 'ELF' else '.exe' if fmt == 'PE' else path.suffix}"
+            shutil.copy2(path, staged)
+            tools = StaticTools(staged, fmt, cfg.obs_limit, cfg.ghidra_script_dir)
+            print(f"== {path} ({fmt}) ==")
+            print(tools.file())
+            print(tools.strings()[:1200])
+        return 0
+
+    adapter = args.adapter.strip() or None
+    backend_name = args.backend
+    if backend_name == "auto":
+        backend_name = "llama-cpp" if str(args.model).lower().endswith(".gguf") else "transformers"
+    print(f"[xref 9b] backend={backend_name} model={args.model}", flush=True)
+    if adapter and backend_name == "transformers":
+        print(f"[xref 9b] adapter={adapter}", flush=True)
+    elif adapter and backend_name == "llama-cpp":
+        print("[xref 9b] note: --adapter is ignored by llama-cpp; use a merged GGUF or --llama-lora", flush=True)
+    print(f"[xref 9b] thinking={'on' if cfg.thinking else 'off'} targets={len(targets)} output={run_dir}", flush=True)
+    if backend_name == "transformers":
+        backend = LocalQwenBackend(args.model, adapter, args.dtype, args.device_map)
+    else:
+        backend = LlamaCppBackend(
+            args.model,
+            args.llama_cli,
+            args.ctx_size,
+            args.threads,
+            args.gpu_layers,
+            args.llama_lora.strip() or None,
+            args.llama_extra_arg,
+        )
+
+    results: list[dict[str, Any]] = []
+    for idx, path in enumerate(targets, 1):
+        sample_id = f"sample_{idx:04d}"
+        print(f"[xref 9b] analyzing {sample_id} {path}", flush=True)
+        result = analyze_one(backend, path, sample_id, run_dir, spec, cfg, args.request)
+        results.append(result)
+        print(
+            f"[xref 9b] {sample_id} format={result['format']} prediction={result['prediction']} "
+            f"tools={result['tool_calls']} error={result['error'] or ''}",
+            flush=True,
+        )
+        write_outputs(results, run_dir)
+
+    write_outputs(results, run_dir)
+    print(f"[xref 9b] summary={run_dir / 'SUMMARY.md'}", flush=True)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

release_manifest.json

@@ -0,0 +1,36 @@
+{
+  "model_name": "xref-9b",
+  "release_type": "research_preview_gguf",
+  "created_at_utc": "2026-07-14T07:31:21.401747+00:00",
+  "artifacts": [
+    {
+      "path": "xref-9b-q4_k_m.gguf",
+      "sha256": "87f320a4edda407a00ddb005774640acac4c45882a9d03674e5f2c37e9dbafd6",
+      "recommended": true
+    },
+    {
+      "path": "xref-9b-f16.gguf",
+      "sha256": "2e9438786b7aed9a9314629e811900616c1b4666a2f7cffa2f537fd566f238d8",
+      "recommended": false
+    }
+  ],
+  "training_summary_public": [
+    "SFT on PE/ELF reverse-engineering instruction traces",
+    "IPO preference optimization over curated PE/ELF triage pairs"
+  ],
+  "eval_summary": {
+    "mixed40_total": 40,
+    "sft_baseline_strict_accuracy": 0.55,
+    "sft_baseline_binary_accuracy": 0.625,
+    "ipo_strict_accuracy": 0.575,
+    "ipo_binary_accuracy": 0.575,
+    "ipo_release_workflow_strict_accuracy": 0.675,
+    "ipo_release_workflow_binary_accuracy": 0.675
+  },
+  "local_runtime_files": [
+    "agentre.py",
+    "agentre_triage.py",
+    "reverse_engineering_spec_unified.md",
+    "tools/ghidra_scripts/AgentRESummary.java"
+  ]
+}

requirements.txt

@@ -0,0 +1,3 @@
+# xref-9b wrapper runtime dependencies
+# The core chat workflow uses Python stdlib plus local command-line tools.
+# Optional HF/Transformers path may require torch, transformers, and peft.

reverse_engineering_spec_unified.md

@@ -0,0 +1,115 @@
+# AgentRE Unified Reverse Engineering Spec
+
+## Purpose
+
+You are a defensive reverse-engineering assistant. Analyze one binary with static tools, decide whether it is benign, malicious, hackware, or unknown, and submit one structured JSON verdict. The user may provide a single file or a directory of files; each analysis target is handled independently.
+
+Do not execute the sample. Do not provide instructions for running malware. Ground every claim in tool output.
+
+## Labels
+
+- `benign`: ordinary non-malicious PE or ELF software.
+- `malicious`: malware or clearly malicious implant behavior such as C2, reverse shell, loader/dropper, credential theft, persistence, destructive behavior, ransomware behavior, botnet behavior, worm behavior, or anti-analysis malware behavior.
+- `hackware`: offensive or dual-use intrusion tooling, including scanners, exploit tooling, payload delivery, backdoor administration, credential attack tooling, or shell-access tooling.
+- `unknown`: use only when static evidence is insufficient after reasonable tool use.
+- When using `unknown`, explain what evidence is missing and recommend closer inspection with Ghidra or another disassembler, especially for stripped, static, packed, encrypted, or sparse-string binaries.
+
+## Core Workflow
+
+1. Start with `file` or `run_file` to identify PE/ELF format, architecture, linkage, and stripped status.
+2. Use `strings` or `run_strings` early to find APIs, URLs, IPs, domains, paths, commands, mutexes, services, ransom notes, or suspicious blobs.
+3. Use format-specific metadata tools:
+   - ELF: `readelf`, `objdump`, `nm`.
+   - PE: `pe_headers`, `pe_sections`, `pe_imports`, `pe_exports`, `pe_symbols`, `pe_disasm`.
+4. Use disassembly before making behavior claims. Prefer targeted `disasm_func` or `run_disasm_func` when symbols name important functions.
+5. Use `entropy`, `hexdump`, or `xxd` for packed, encrypted, encoded, or blob-like data.
+6. Use `ghidra_summary` when binutils output is insufficient or when higher-level function/import/string summaries would help.
+   For stripped/static samples that loop on headers or have sparse strings, use `ghidra_summary` or disassembly before giving up.
+7. Submit exactly one `final_answer` JSON object.
+
+## Available Tools
+
+All tools are static. Tool path arguments are optional; the runtime routes tools to the current staged sample.
+
+Common tools:
+
+- `file` / `run_file`: identify file type, architecture, linkage, and stripped status.
+- `strings` / `run_strings`: extract printable strings.
+- `entropy`: compute whole-file Shannon entropy.
+- `hexdump`: dump bytes at an offset.
+- `xxd`: alternate hex dump.
+- `disasm_func` / `run_disasm_func`: disassemble one named function.
+- `ghidra_summary`: run Ghidra headless analysis and return imports, strings, functions, and short instruction excerpts when Ghidra is installed.
+- `final_answer` / `submit_answer`: submit the final JSON verdict.
+
+ELF tools:
+
+- `readelf` / `run_readelf`: inspect ELF headers, sections, symbols, program headers, and dynamic imports.
+- `objdump` / `run_objdump`: disassemble or dump ELF sections.
+- `nm`: list symbols.
+
+PE tools:
+
+- `pe_headers` / `run_pe_headers`: PE file header, optional header, data directories, subsystem, DLL characteristics.
+- `pe_sections` / `run_pe_sections`: PE section table and entropy.
+- `pe_imports` / `run_pe_imports`: imported DLLs and WinAPI symbols.
+- `pe_exports` / `run_pe_exports`: export table and data directories.
+- `pe_disasm` / `run_pe_disasm`: PE disassembly.
+- `pe_symbols` / `run_pe_symbols`: PE symbols when present.
+
+## PE Evidence Hints
+
+Malicious PE evidence includes:
+
+- C2 or beaconing: `InternetOpen`, `InternetConnect`, `HttpSendRequest`, `WinHttp*`, `WSAStartup`, `socket`, `connect`, hardcoded domains/IPs/URLs.
+- Injection: `VirtualAllocEx`, `WriteProcessMemory`, `CreateRemoteThread`, `NtCreateThreadEx`, `QueueUserAPC`, `SetThreadContext`.
+- Process hollowing: suspended process creation, `NtUnmapViewOfSection`, remote allocation/write, context change, resume.
+- Persistence: service APIs, Run keys, scheduled task strings, startup-folder paths.
+- Ransomware: recursive file traversal, file-extension targeting, ransom notes, crypto APIs, high-entropy encrypted payloads.
+- Anti-analysis: `IsDebuggerPresent`, `CheckRemoteDebuggerPresent`, `NtQueryInformationProcess`, PEB checks, sandbox DLL checks, CPUID VM checks.
+
+## ELF Evidence Hints
+
+Malicious ELF evidence includes:
+
+- C2 or botnet behavior: `socket`, `connect`, `send`, `recv`, `gethostbyname`, hardcoded domains/IPs, beacon loops.
+- Shell or command execution: `/bin/sh`, `execve`, `system`, `popen`, shell command strings.
+- Loader/dropper behavior: writes executable files, changes permissions with `chmod`, downloads via `wget`/`curl`, forks and execs payloads.
+- Botnet/scanner behavior: attack/scanner function names, `/proc/net/tcp`, port scanning, watchdog use, single-instance locks, process killer routines.
+- Anti-analysis: `ptrace`, anti-debug names, environment checks, process hiding, string/config decoding before network use.
+
+## Final Answer Schema
+
+Call `final_answer` exactly once with:
+
+```json
+{
+  "answer_json": {
+    "schema_version": "agentre_triage_v1",
+    "file_type": "ELF64",
+    "architecture": "x86-64",
+    "classification": "malicious",
+    "confidence": 0.85,
+    "summary": "One or two sentence verdict.",
+    "evidence": ["tool-grounded fact 1", "tool-grounded fact 2"],
+    "techniques": ["socket_connect", "xor_string_obfuscation"],
+    "network_indicators": [],
+    "decoded_strings": {},
+    "encoded_strings": false,
+    "encryption_details": {
+      "algorithm": null,
+      "key": null,
+      "key_storage": null
+    },
+    "anti_analysis": [],
+    "important_functions": []
+  }
+}
+```
+
+Rules:
+
+- `classification` must be one of `benign`, `malicious`, `hackware`, `unknown`.
+- Use JSON `null`, `false`, empty lists, or empty objects for absent findings.
+- Keep evidence concise and tied to observed tool output.
+- Do not include chain-of-thought in the final answer.

scripts/check_tools.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+for tool in file strings readelf objdump nm; do
+  if command -v "$tool" >/dev/null 2>&1; then
+    echo "ok: $tool -> $(command -v "$tool")"
+  else
+    echo "missing: $tool"
+  fi
+done
+
+if command -v hexdump >/dev/null 2>&1; then
+  echo "ok: hexdump -> $(command -v hexdump)"
+elif command -v xxd >/dev/null 2>&1; then
+  echo "ok: xxd -> $(command -v xxd)"
+else
+  echo "missing: hexdump or xxd"
+fi
+
+if [[ -n "${GHIDRA_HEADLESS:-}" && -x "${GHIDRA_HEADLESS:-}" ]]; then
+  echo "ok: GHIDRA_HEADLESS -> $GHIDRA_HEADLESS"
+elif command -v analyzeHeadless >/dev/null 2>&1; then
+  echo "ok: analyzeHeadless -> $(command -v analyzeHeadless)"
+else
+  echo "optional missing: Ghidra analyzeHeadless"
+fi

scripts/run_xref9b_chat.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -lt 1 ]]; then
+  echo "usage: $0 /path/to/binary [extra agentre.py args...]" >&2
+  exit 2
+fi
+
+TARGET="$1"
+shift
+
+MODEL="${XREF9B_GGUF:-$PWD/xref-9b-q4_k_m.gguf}"
+LLAMA_CLI="${XREF9B_LLAMA_CLI:-llama-completion}"
+
+python3 agentre.py chat "$TARGET"   --model "$MODEL"   --llama-cli "$LLAMA_CLI"   --ctx-size "${XREF9B_CTX_SIZE:-65536}"   --gpu-layers "${XREF9B_GPU_LAYERS:-99}"   --max-turns "${XREF9B_MAX_TURNS:-8}"   --max-tool-calls "${XREF9B_MAX_TOOL_CALLS:-16}"   --max-tokens "${XREF9B_MAX_TOKENS:-1600}"   --obs-limit "${XREF9B_OBS_LIMIT:-8000}"   "$@"

scripts/run_xref9b_triage.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -lt 1 ]]; then
+  echo "usage: $0 /path/to/file_or_directory [extra agentre.py triage args...]" >&2
+  exit 2
+fi
+
+TARGET="$1"
+shift
+
+MODEL="${XREF9B_GGUF:-$PWD/xref-9b-q4_k_m.gguf}"
+LLAMA_CLI="${XREF9B_LLAMA_CLI:-llama-completion}"
+
+python3 agentre.py triage "$TARGET"   --model "$MODEL"   --llama-cli "$LLAMA_CLI"   --ctx-size "${XREF9B_CTX_SIZE:-65536}"   --gpu-layers "${XREF9B_GPU_LAYERS:-99}"   --max-tool-calls "${XREF9B_MAX_TOOL_CALLS:-16}"   --max-tokens "${XREF9B_MAX_TOKENS:-1600}"   --obs-limit "${XREF9B_OBS_LIMIT:-8000}"   "$@"

scripts/xref9b.env.example

@@ -0,0 +1,6 @@
+# Copy to scripts/xref9b.env and edit paths for your machine.
+export XREF9B_GGUF="$PWD/xref-9b-q4_k_m.gguf"
+export XREF9B_LLAMA_CLI="/path/to/llama.cpp/build/bin/llama-completion"
+
+# Optional. Required for /ghidra and ghidra_summary.
+export GHIDRA_HEADLESS="/path/to/ghidra/support/analyzeHeadless"

tools/ghidra_scripts/AgentRESummary.java

@@ -0,0 +1,152 @@
+// Static Ghidra headless summary script for AgentRE.
+// Usage from analyzeHeadless:
+//   -postScript AgentRESummary.java /path/to/output.txt
+
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Data;
+import ghidra.program.model.listing.DataIterator;
+import ghidra.program.model.listing.Function;
+import ghidra.program.model.listing.FunctionIterator;
+import ghidra.program.model.listing.Instruction;
+import ghidra.program.model.listing.InstructionIterator;
+import ghidra.program.model.listing.Listing;
+import ghidra.program.model.mem.MemoryBlock;
+import ghidra.program.model.symbol.Symbol;
+import ghidra.program.model.symbol.SymbolIterator;
+
+import java.io.File;
+import java.io.FileWriter;
+import java.io.PrintWriter;
+
+public class AgentRESummary extends GhidraScript {
+    private String clean(String s) {
+        if (s == null) {
+            return "";
+        }
+        s = s.replace('\n', ' ').replace('\r', ' ');
+        if (s.length() > 240) {
+            return s.substring(0, 240) + "...";
+        }
+        return s;
+    }
+
+    public void run() throws Exception {
+        String[] args = getScriptArgs();
+        if (args.length < 1) {
+            println("AgentRESummary requires an output path argument");
+            return;
+        }
+
+        File outFile = new File(args[0]);
+        try (PrintWriter out = new PrintWriter(new FileWriter(outFile))) {
+            Listing listing = currentProgram.getListing();
+
+            out.println("== Program ==");
+            out.println("name: " + currentProgram.getName());
+            out.println("format: " + currentProgram.getExecutableFormat());
+            out.println("language: " + currentProgram.getLanguageID());
+            out.println("compiler: " + currentProgram.getCompilerSpec().getCompilerSpecID());
+            out.println("image_base: " + currentProgram.getImageBase());
+
+            out.println();
+            out.println("== Memory Blocks ==");
+            for (MemoryBlock block : currentProgram.getMemory().getBlocks()) {
+                out.println(block.getName()
+                        + " start=" + block.getStart()
+                        + " end=" + block.getEnd()
+                        + " size=" + block.getSize()
+                        + " r=" + block.isRead()
+                        + " w=" + block.isWrite()
+                        + " x=" + block.isExecute());
+            }
+
+            out.println();
+            out.println("== External Symbols / Imports ==");
+            int count = 0;
+            SymbolIterator symbols = currentProgram.getSymbolTable().getExternalSymbols();
+            while (symbols.hasNext() && count < 600) {
+                Symbol sym = symbols.next();
+                out.println(sym.getName(true));
+                count++;
+            }
+            if (count >= 600) {
+                out.println("[truncated imports at 600]");
+            }
+
+            out.println();
+            out.println("== Strings ==");
+            count = 0;
+            DataIterator data = listing.getDefinedData(true);
+            while (data.hasNext() && count < 500) {
+                Data d = data.next();
+                Object value = null;
+                try {
+                    value = d.getValue();
+                } catch (Throwable ignored) {
+                    value = null;
+                }
+                if (value instanceof String) {
+                    String text = clean((String) value);
+                    if (text.length() >= 4) {
+                        out.println(d.getAddress() + " " + text);
+                        count++;
+                    }
+                }
+            }
+            if (count >= 500) {
+                out.println("[truncated strings at 500]");
+            }
+
+            out.println();
+            out.println("== Functions ==");
+            count = 0;
+            FunctionIterator funcs = listing.getFunctions(true);
+            while (funcs.hasNext() && count < 220) {
+                Function f = funcs.next();
+                out.println(f.getEntryPoint() + " " + f.getName(true));
+                count++;
+            }
+            if (count >= 220) {
+                out.println("[truncated functions at 220]");
+            }
+
+            out.println();
+            out.println("== Function Instruction Excerpts ==");
+            int funcsPrinted = 0;
+            funcs = listing.getFunctions(true);
+            while (funcs.hasNext() && funcsPrinted < 40) {
+                Function f = funcs.next();
+                String name = f.getName(true).toLowerCase();
+                boolean interesting = name.contains("main")
+                        || name.contains("connect")
+                        || name.contains("socket")
+                        || name.contains("send")
+                        || name.contains("recv")
+                        || name.contains("exec")
+                        || name.contains("crypt")
+                        || name.contains("decrypt")
+                        || name.contains("attack")
+                        || name.contains("scan")
+                        || name.contains("loader")
+                        || name.contains("start");
+                if (!interesting && funcsPrinted >= 12) {
+                    continue;
+                }
+                out.println();
+                out.println("-- " + f.getEntryPoint() + " " + f.getName(true) + " --");
+                InstructionIterator instrs = listing.getInstructions(f.getBody(), true);
+                int insnCount = 0;
+                while (instrs.hasNext() && insnCount < 45) {
+                    Instruction insn = instrs.next();
+                    Address addr = insn.getAddress();
+                    out.println("  " + addr + "  " + insn.toString());
+                    insnCount++;
+                }
+                funcsPrinted++;
+            }
+        }
+
+        println("AgentRE summary written to " + outFile.getAbsolutePath());
+    }
+}

xref-9b-f16.gguf

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:2e9438786b7aed9a9314629e811900616c1b4666a2f7cffa2f537fd566f238d8
+size 17920696640

xref-9b-q4_k_m.gguf

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:87f320a4edda407a00ddb005774640acac4c45882a9d03674e5f2c37e9dbafd6
+size 5629108544