Prepare mapped binary releases for radare2 6.2.4

.github/scripts/stage_artifacts.sh

@@ -2,7 +2,7 @@
 # Stage the same plugins/ layout on every platform for r2pm -bi.
 set -euo pipefail
 
-# The pinned radare2 predates r2pm -H R2PM_TRIPLET.
+# Derive the target from the runner, independent of the build host's r2pm.
 case "${RUNNER_OS}-${RUNNER_ARCH}" in
   Linux-X64) R2PM_TRIPLET=linux-x86-64; ext=so ;;
   Windows-X64) R2PM_TRIPLET=windows-x86-64; ext=dll ;;
@@ -27,7 +27,8 @@ cat > dist/plugin/README.txt <<EOF
 r2xsql — radare2 core plugin
 
 Built against radare2 ${R2_REF} for ${R2PM_TRIPLET}.
-Install with a matching radare2 version and a recent r2pm:
+Install with a matching radare2 version and an r2pm supporting
+R2PM_VERSION_MAP (available in radare2 git; planned for 6.2.6):
 
   r2pm -U
   r2pm -bi r2xsql
@@ -48,7 +49,7 @@ with double quotes to preserve SQL operators and statement separators.
 Analysis is explicit: run aaa or start radare2 with -A.
 
 The plugin also works through radare2's own HTTP server:
-  radare2 -e http.bind=127.0.0.1 -e http.port=9090 -c aaa -c '=h' <file>
+  radare2 -e http.bind=127.0.0.1 -e http.sandbox=false -e http.port=9090 -c aaa -c '=h' <file>
   curl --data-binary '"sqlj SELECT name FROM funcs LIMIT 5"' http://127.0.0.1:9090/cmd/
 
 Read the command output for errors even when HTTP returns status 200.

.github/workflows/build.yml

@@ -18,7 +18,7 @@ concurrency:
 
 # Build against this radare2 release without changing its version for r2pm.
 env:
-  R2_REF: "6.2.2"
+  R2_REF: "6.2.4"
 
 jobs:
   # ============================================================================

docs/development.md

@@ -64,12 +64,34 @@ consume [`libxsql`](https://github.com/0xeb/libxsql): the Makefile uses a
 sibling `../libxsql` checkout (else clones it), and meson pulls it as a
 subproject. All three builds pin the same libxsql release tag (`v1.0.21`).
 
-When published, binary release assets are named `r2xsql-<radare2-version>-<R2PM_TRIPLET>.zip`, for
-example `r2xsql-6.2.4-linux-x86-64.zip`. Each contains the plugin in `plugins/`.
-With a recent r2pm supporting binary installs, use `r2pm -U` followed by
-`r2pm -bi r2xsql`; uninstall with `r2pm -u r2xsql`. Only matching radare2
-versions and targets are installed. To install manually, copy the plugin to
-the directory printed by `radare2 -NN -H R2_USER_PLUGINS`.
+## Binary releases
+
+The plugin release version and radare2 version are separate. A plugin release
+such as `v0.0.1` contains assets named
+`r2xsql-<radare2-version>-<R2PM_TRIPLET>.zip`, for example
+`r2xsql-6.2.4-linux-x86-64.zip`. Each archive contains the plugin in `plugins/`.
+The current CI targets Linux x64, Windows x64 and macOS ARM64 against radare2
+6.2.4. A different engine ABI needs a matching build, including iaito's engine.
+
+Pushing a `v*` tag runs the build workflow and, after all platform builds
+succeed, creates a GitHub Release with the ZIPs attached. Branch builds and
+manual workflow runs upload CI artifacts without publishing a release.
+Keep `R2_REF` in `.github/workflows/build.yml` and the compatibility table in
+[`radare2-pm/db/r2xsql`](https://github.com/radareorg/radare2-pm/blob/master/db/r2xsql)
+aligned. The recipe uses `R2PM_VERSION_MAP` to map the installed radare2 version
+(`R2V`) to the plugin release tag (`R2PM_VERSION`). It downloads from that exact
+release, retaining `R2V` in the asset name to select the compatible build.
+Add a mapping only when that release supplies a build for the engine version;
+a new r2pm version alone does not make an older plugin ABI compatible.
+
+Binary installation requires r2pm with `R2PM_VERSION_MAP` support, available in
+radare2 git and planned for radare2 6.2.6. Radare2 6.2.4 introduced binary
+installation, but its r2pm lacks this mapping facility. The mapped release
+and matching target asset must also be published; a CI artifact alone is not
+enough. With a suitable r2pm, use `r2pm -U` then `r2pm -bi r2xsql`; uninstall
+with `r2pm -u r2xsql`. Unsupported versions or targets fail instead of falling
+back to a source build. To install manually, copy the matching plugin to the
+directory printed by `radare2 -NN -H R2_USER_PLUGINS`.
 
 ## Tests
 

docs/usage.md

@@ -18,7 +18,8 @@ does the same for a local build. Manual installation uses the directory
 reported by `r2 -NN -H R2_USER_PLUGINS`. Restart a host after installation.
 The plugin's radare2 ABI must match the engine loading it; iaito can use a
 different engine from the standalone r2 on PATH. Binary installation with
-`r2pm -bi r2xsql` requires an available asset matching the host and platform.
+`r2pm -bi r2xsql` requires an available asset matching the host and platform,
+plus r2pm with `R2PM_VERSION_MAP` support (radare2 git; planned for 6.2.6).
 See [building and packaging](development.md).
 
 For a build that is not installed: