diff options
| author | user <user@clank> | 2026-08-07 15:14:30 +0200 |
|---|---|---|
| committer | user <user@clank> | 2026-08-07 15:14:30 +0200 |
| commit | 72fce7da1a1fd6527e389ffeb0f951157523589a (patch) | |
| tree | 3f08a83f0d99f3d3fc7069b7be00d235bab82817 /ida-codemode-mcp.patch | |
| parent | Stop tracking 157MB of core dumps, and ignore them (diff) | |
| parent | docs: upstream findings for the ida-codemode maintainers (diff) | |
| download | ida-tui-72fce7da1a1fd6527e389ffeb0f951157523589a.tar.gz ida-tui-72fce7da1a1fd6527e389ffeb0f951157523589a.tar.xz ida-tui-72fce7da1a1fd6527e389ffeb0f951157523589a.zip | |
Merge the IDA Code Mode port
Replaces the private idalib worker (idatui/worker.py + worker_client.py, with
server/patch_server.py injecting tools into ida-pro-mcp) with an ordinary
client of ida_codemode.client.DatabaseHandle. A database open by an IDA GUI is
reused; otherwise Code Mode starts or shares a managed idalib worker. The TUI
no longer owns an IDA process, and closing it releases only its lease.
Based on Duncan Ogilvie's port, rebased onto ~150 commits of local work it
predated. The rebase itself was mechanical; landing it was not. Nine defects
had to be fixed before the feature set was whole again, none of which the
patch's own tests could catch:
- DatabaseHandle.open() takes image_base, not loading_address: every
connect() would have raised TypeError on the first call
- five operations our tree had grown were simply missing (flowchart, so the
graph view was dead; op_format/pc_nums/pc_num_format, so 'o'/'O' were;
survey_binary)
- set_comments wrote only the disassembly comment, so comments never
appeared in pseudocode
- xref_query returned rows in raw IDA order, and 'follow the call' silently
followed the fall-through instead
- rename accepted one edit per category, so bulk symbol import was dead
- decompile ran decomp_map's full per-column ctree sweep to fill in a
per-line address anchor
- heads shipped without operand extents or the digest protocol
- the package became unimportable without ida_codemode installed, which
killed the offline test suites
Verified against the pre-codemode tag rather than against assumptions: the
full suite is 788 passed / 0 failed, and the pilot's 301 checks match the old
backend exactly. Performance is within 2x on the listing hot path and faster
on decompile, disasm and connect, after fixing two runtime costs that are
documented for upstream in docs/CODEMODE_UPSTREAM.md.
Test runtime came down from ~9m20s to 115s along the way -- not by removing
checks, but by removing four kinds of waiting-on-a-guess that were also
hiding real failures.
Diffstat (limited to 'ida-codemode-mcp.patch')
| -rw-r--r-- | ida-codemode-mcp.patch | 5848 |
1 files changed, 5848 insertions, 0 deletions
diff --git a/ida-codemode-mcp.patch b/ida-codemode-mcp.patch new file mode 100644 index 0000000..82a9b3b --- /dev/null +++ b/ida-codemode-mcp.patch @@ -0,0 +1,5848 @@ +From 0db18f870a45c0355ca1b28db1a2e763b60f6226 Mon Sep 17 00:00:00 2001 +From: Duncan Ogilvie <mr.exodia.tpodt@gmail.com> +Date: Fri, 31 Jul 2026 01:40:21 +0200 +Subject: [PATCH] WIP: vibeslop ida-codemode port + +--- + README.md | 100 +-- + TODO | 17 +- + docs/CODEMODE_PORT.md | 175 +++++ + docs/PAGING_FINDINGS.md | 54 +- + docs/PROJECTS.md | 41 +- + docs/SPLIT_VIEW.md | 12 +- + experiments/worker_smoke.py | 104 ++- + ida-tui | 7 +- + idatui/__init__.py | 5 +- + idatui/app.py | 206 +++--- + idatui/codemode_client.py | 1107 +++++++++++++++++++++++++++++ + idatui/domain.py | 194 +++-- + idatui/drive.py | 3 +- + idatui/errors.py | 10 +- + idatui/launch.py | 92 +-- + idatui/pane.py | 92 +-- + idatui/pool.py | 100 +-- + idatui/project.py | 35 +- + idatui/worker.py | 233 ------ + idatui/worker_client.py | 234 ------- + pyproject.toml | 17 +- + server/patch_server.py | 1248 --------------------------------- + tests/test_codemode_client.py | 137 ++++ + tests/test_pool.py | 61 +- + tests/test_project.py | 2 +- + tests/test_scenarios.py | 18 +- + uv.lock | 65 +- + 27 files changed, 2055 insertions(+), 2314 deletions(-) + create mode 100644 docs/CODEMODE_PORT.md + create mode 100644 idatui/codemode_client.py + delete mode 100644 idatui/worker.py + delete mode 100644 idatui/worker_client.py + delete mode 100644 server/patch_server.py + create mode 100644 tests/test_codemode_client.py + +diff --git a/README.md b/README.md +index 7d7d8d7..47d5366 100644 +--- a/README.md ++++ b/README.md +@@ -1,13 +1,13 @@ + # ida-tui + + A minimal, keyboard-first (mouse-capable) **TUI frontend for IDA Pro**, built with +-[Textual](https://textual.textualize.io/) and driving **idalib** (IDA headless). ++[Textual](https://textual.textualize.io/) and using ++[ida-codemode-mcp](../ida-codemode-mcp) as a Python library. + +-Opening a binary spawns our own **idalib worker** — a private subprocess talking a +-unix socket (`idatui/worker.py` + `WorkerClient`), ~50–100× cheaper per call than +-an HTTP transport. It reuses [ida-pro-mcp](https://github.com/mrexodia/ida-pro-mcp)'s +-tool implementations in-process; the old ida-pro-mcp HTTP server/supervisor path +-has been **removed**. ++ida-tui attaches to databases through `ida_codemode.client.DatabaseHandle`. A ++matching database already open in the IDA GUI is reused; otherwise Code Mode ++reuses or starts a shared managed idalib worker. The TUI owns only a client lease, ++never the GUI or worker process. + + ## ⚠️ Status: not ready for public consumption + +@@ -31,7 +31,7 @@ don't file expectations. **Use at your own risk.** + - A unified **IDA-style listing** (continuous disassembly interleaved with data / + undefined heads) as the default code view; `F5`/`Tab` drops into the + **decompiler (pseudocode)** for the function under the cursor. Both are +- line-virtualized and page lazily over the worker. ++ line-virtualized and page lazily over the Code Mode database. + - A **Ghidra-style split view** (`s`): listing and pseudocode side by side, kept + in cursor sync — the focused pane drives and the other highlights the linked + region (every instruction a C line owns), following you across functions. +@@ -49,46 +49,58 @@ don't file expectations. **Use at your own risk.** + + ## Architecture (three layers, kept separate) + +-- **`idatui/worker.py` + `idatui/worker_client.py`** — the backend. `worker.py` +- opens one DB with idalib (on its main thread) and serves ida-pro-mcp's tool +- functions over a unix socket; `WorkerClient` spawns it and is a stdlib-only +- drop-in client (length-prefixed pickle, calls serialized under a lock). Shared +- error types + the `Session` model live in `idatui/errors.py`. +-- **`idatui/domain.py`** — paging/caching over the worker client (`FunctionIndex`, +- `DisasmModel`, `ListingModel`, `decompile`, xrefs, resolve). Synchronous, +- thread-safe. Tools ida-pro-mcp lacks (`heads`, `read_raw`, `resolve_names`, +- `xref_types`, …) are injected by `server/patch_server.py`, which the worker +- runs itself on startup. ++- **`idatui/codemode_client.py`** — lifecycle and execution adapter. It leases a ++ registered GUI/idalib instance with `DatabaseHandle`, waits for autoanalysis, ++ normalizes errors, saves, and releases the lease. Address-centric operations ++ are sent through Code Mode's `execute_python` surface and use its preloaded ++ `ida-domain` `db` object. ++- **`idatui/domain.py`** — synchronous, thread-safe paging/caching ++ (`FunctionIndex`, `DisasmModel`, `ListingModel`, decompile, xrefs, resolve). ++ It has no process/database ownership logic. + - **`idatui/app.py`** — the Textual app (virtualized `ScrollView`s, shared cursor/ + search/nav mixins, modals). + +-The domain + worker-client layers are intentionally **stdlib-only** (the worker +-process links idalib); only the TUI layer pulls in Textual + Pygments. ++`idatui/pool.py` retains LRU project leases. Releasing an entry never kills a GUI ++or another client's worker. See `docs/CODEMODE_PORT.md` for what maps to public ++ida-domain APIs and which remaining features require IDAPython inside the Code ++Mode execution sandbox. + + ## Requirements + + - Python ≥ 3.11 +-- A working **IDA Pro** with **idalib** and **ida-pro-mcp** installed (the worker +- reuses ida-pro-mcp's tool implementations in-process — no server runs). +-- Textual ≥ 8 and Pygments ≥ 2 for the TUI (`pip install -e '.[tui]'`). ++- IDA Pro 9.4+ with idalib configured ++- `ida-codemode-mcp` installed in the TUI environment (this checkout uses the ++ editable sibling path `../ida-codemode-mcp`) ++- The ida-codemode IDA plugin installed so GUI databases register themselves ++- Textual ≥ 8 and Pygments ≥ 2 (`uv sync` installs both) + +-Two python environments are expected: one with **textual + idapro** for the TUI +-(`~/ida-venv`, override `$IDATUI_PYTHON`) and one with **idapro + ida_pro_mcp** +-for the worker (auto-detected, override `$IDATUI_WORKER_PYTHON`). ++Code Mode's own worker launcher carries the correct Python environment; ida-tui ++no longer searches for a second Python or imports `ida_pro_mcp`. + + ## Running + +-One command — it spawns a private idalib worker for the binary (which opens + +-auto-analyzes it in its own process over a unix socket) and drops you into the +-TUI behind a loading overlay: ++Install the project and its TUI dependencies: + + ```sh +-./ida-tui /path/to/binary # open a binary and drive it — that's it ++uv sync + ``` + +-It uses `~/ida-venv/bin/python` for the TUI (override with `$IDATUI_PYTHON`) and +-resolves binary paths against your real cwd. The binary's directory must be +-writable (idalib writes a `.i64` there). ++Pass an executable/IDB path. If the plugin has registered a matching GUI session, ++ida-tui attaches to it; otherwise Code Mode opens a managed idalib database: ++ ++```sh ++./ida-tui /path/to/binary ++``` ++ ++With exactly one registered database, the path may be omitted: ++ ++```sh ++./ida-tui ++``` ++ ++When several databases are registered, the launcher lists their paths and asks ++for one explicitly. A newly managed single-binary database still needs a writable ++output location; projects stage binaries and IDBs in their sidecar directory. + + Headerless blobs need to be told what they are — a raw firmware dump has no + format to detect, and IDA falls back to x86 at address 0, which analyses to +@@ -102,15 +114,16 @@ ARM images that use Thumb need one more thing: press `t` on the listing to switc + ARM/Thumb decoding at the cursor (it sets IDA's `T` register, and the segment to + 32-bit, since Thumb doesn't exist in AArch64). + +-`--base` is a real address (IDA's own `-b` is in paragraphs; the conversion is +-done for you). In a project the options are recorded per binary, which is what a +-multi-image firmware wants. They apply to the first open only — after that the +-`.i64` records how the image was loaded. See `docs/PROJECTS.md`. ++`--base` is a real address (Code Mode's typed loading address is also natural, ++so no paragraph conversion crosses the dependency boundary). In a project the ++options are recorded per binary. They apply only when Code Mode must create the ++first database; a registered or existing IDB already records them. Arbitrary ++`--ida-args` are rejected because `DatabaseHandle.open()` has no equivalent; ++processor, base, and loader/file type are the supported import surface. + +-> Recovering a wedged database: if a worker was hard-killed it leaves unpacked +-> `foo.id0/.id1/.id2/.nam/.til` next to `foo.i64`, and the `.i64` then refuses to +-> reopen. Delete those stale files (never the `.i64`) and retry — `ida-tui` does +-> this automatically. ++ida-tui never deletes unpacked IDA scratch files during discovery: those files ++may belong to a registered GUI or another Code Mode client. Registry locks and ++health probes are the ownership authority. + + ## Execution traces + +@@ -166,8 +179,8 @@ See `docs/RPC.md` for the full protocol. + + ## Tests + +-A headless Textual `Pilot` suite lives in `tests/`; it spawns a worker on the +-given binary (default `targets/echo`): ++A headless Textual `Pilot` suite lives in `tests/`; it attaches through Code Mode ++(or starts a managed worker) for the given binary: + + ```sh + python tests/test_scenarios.py targets/echo # full UI suite +@@ -177,6 +190,7 @@ python tests/test_scenarios.py --only hex,rename + ## Docs + + - `docs/RPC.md` — the RPC protocol +-- `docs/PAGING_FINDINGS.md` — idalib tool paging/scale quirks ++- `docs/CODEMODE_PORT.md` — port coverage, API gaps, and lifecycle semantics ++- `docs/PAGING_FINDINGS.md` — historical paging/scale findings + - `docs/TEXTUAL_NOTES.md` — Textual pitfalls encountered + - `docs/TUI_DRIVING_BLUEPRINT.md` — generalizing the driving layer +diff --git a/TODO b/TODO +index 58b4693..c578cff 100644 +--- a/TODO ++++ b/TODO +@@ -4,14 +4,15 @@ + bugs: + + current: +-[~] DITCH ida-pro-mcp -> our own idalib worker (idatui/worker.py + WorkerClient) +- [x] worker + WorkerClient (drop-in for IDAClient, same tool shapes) +- [x] --backend {worker,mcp}; worker is now the DEFAULT for opening a binary +- [x] worker spawns under the IDA python; {"result":...} wrapping to match MCP +- [ ] run the pilot suite against --backend worker (blocked: idalib reaping here) +- [ ] progress reporting during analysis (worker streams notes to the overlay) +- [ ] once solid: delete client.py, server/patch_server.py, spawn.sh, and +- launch.py's whole supervisor/ensure_server/lock-sweep dance ++[x] PORT TO ida-codemode-mcp as a library dependency ++ [x] DatabaseHandle discovery prefers registered GUI sessions ++ [x] shared managed idalib workers + SSE lease lifecycle ++ [x] domain operations execute against ida-domain through Code Mode ++ [x] delete the private pickle worker and ida-pro-mcp patch injection ++ [x] stop sweeping/reaping resources that may belong to another client ++ [ ] run the full live Pilot suite against both GUI and managed backends ++ [ ] add database revision/change notifications for cross-client cache invalidation ++ [ ] decide how "discard changes" should work (Code Mode final workers save) + [x] RPC endpoint for robot-spectator-ida + -> progressssss + +diff --git a/docs/CODEMODE_PORT.md b/docs/CODEMODE_PORT.md +new file mode 100644 +index 0000000..4b4bc45 +--- /dev/null ++++ b/docs/CODEMODE_PORT.md +@@ -0,0 +1,175 @@ ++# ida-tui → IDA Code Mode port ++ ++This port is an experiment: can ida-tui be implemented as an ordinary client of ++`ida_codemode`, sharing GUI databases and managed idalib workers instead of ++owning a private worker and depending on ida-pro-mcp tool functions? ++ ++## Result ++ ++Yes for the database lifecycle and the complete current TUI feature set, with a ++small number of operations implemented using IDAPython inside Code Mode's ++`execute_python` sandbox because ida-domain does not yet expose the required ++behavior. ++ ++The old components are gone: ++ ++- `idatui/worker.py` (private pickle/socket idalib process) ++- `idatui/worker_client.py` ++- `server/patch_server.py` (ida-pro-mcp tool injection) ++ ++The replacement is `idatui/codemode_client.py`. ++ ++## Lifecycle mapping ++ ++`CodeModeClient.connect()` calls `ida_codemode.client.DatabaseHandle.open()`. ++Resolution is therefore Code Mode's resolution, not ida-tui's: ++ ++1. Match a registered GUI by executable path. ++2. Otherwise match the owner of the expected IDB. ++3. Otherwise serialize creation and start a managed `ida-codemode-worker`. ++4. Establish an authenticated SSE lease. ++5. Wait through the public autoanalysis route. ++ ++The handle's registry entry supplies the backend, PID, executable path, IDB path, ++and record ID used by the status/pool layers. ++ ++Closing ida-tui closes only its lease. It never closes a GUI or kills an idalib ++process. A managed worker saves and exits under Code Mode's own policy after its ++last lease disappears. A second agent or TUI can keep using the same instance. ++ ++This also changes project pooling semantics. `DatabasePool` is an LRU pool of ++leases, not process ownership. Managed-IDB save-on-evict remains; budget eviction ++does not implicitly save a GUI. Eviction cannot force a shared worker to exit, ++and GUI process memory is only advisory. ++ ++## ida-domain coverage ++ ++The remote snippets receive Code Mode's preloaded `db` (`ida_domain.Database`). ++The following TUI needs map to public ida-domain entities: ++ ++| TUI need | ida-domain surface | ++|---|---| ++| Function paging, lookup, names, sizes | `db.functions` | ++| Segments and names | `db.segments` | ++| Instructions and plain disassembly | `db.instructions`, `db.functions.get_instructions()` | ++| Heads and item classification | `db.heads`, `db.bytes` | ++| Bytes and strings | `db.bytes`, `db.strings` | ++| Symbol resolution and rename | `db.names`, `db.functions` | ++| Comments | `db.comments` | ++| Imports and exports | `db.imports`, `db.entries` | ++| Xrefs and fine type predicates | `db.xrefs` / `XrefInfo` | ++| Named types, members, parse/apply | `db.types` | ++| Function prototypes and local variables | `db.pseudocode`, `PseudocodeFunction.local_variables` | ++| Decompilation text and object references | `db.pseudocode` | ++ ++All values are reduced to JSON primitives inside the database process. No SWIG ++or ida-domain object crosses the Code Mode boundary. ++ ++## Remaining IDAPython gaps ++ ++Code Mode intentionally allows regular Python imports, so these features still ++work, but they identify useful additions to ida-domain: ++ ++1. **Rich continuous listing** ++ - ida-domain enumerates defined heads and renders plain disassembly. ++ - ida-tui also needs coalesced undefined runs, IDA colour-tag spans, function ++ banners, code-label rows, file-region offsets, and expanded struct members. ++ - The `heads` operation uses `ida_bytes`, `ida_lines`, and related modules for ++ this presentation model. ++ ++2. **Instruction/function carving** ++ - Creating an instruction and walking a speculative decode run requires ++ `ida_ua.create_insn` and processor flow/return checks. ++ - Function creation exists in ida-domain; the explicit-end fallback still ++ needs lower-level item boundaries. ++ ++3. **ARM/Thumb state** ++ - T-register ranges and segment addressing use `ida_segregs`, `ida_idp`, and ++ `ida_segment`. There is no equivalent ida-domain operation. ++ ++4. **Detailed decompiler diagnostics and line maps** ++ - Pseudocode text, ctree objects, and the address map are available through ++ ida-domain. ++ - Reproducing IDA's per-rendered-line coverage uses ++ `cfunc.get_line_item`; obtaining the exact Hex-Rays failure description ++ uses `hexrays_failure_t`. ++ ++5. **A few type/item primitives** ++ - Deleting a named local type and some exact item-undefinition/data-creation ++ behavior still use `ida_typeinf`/`ida_bytes` directly. ++ ++These uses are isolated in `idatui/codemode_client.py`; the paging and Textual ++layers do not import IDAPython. ++ ++## API limitations exposed by the port ++ ++### No rollback or close-without-save ++ ++A Code Mode lease has no rollback operation. Closing a GUI handle leaves the GUI ++state as-is. A managed idalib worker currently saves when its final lease closes. ++Consequently ida-tui's old “discard & quit” guarantee cannot be implemented. ++The UI now labels this choice “leave as-is & quit” and does not explicitly save, ++but managed-worker policy may still persist the changes. ++ ++A true discard action would need a Code Mode/database API for transaction-like ++rollback, a close policy on a newly-owned worker, or a TUI-managed disposable DB ++copy. ++ ++### Typed loader options only ++ ++`DatabaseHandle.open()` supports processor, natural loading address, file type, ++output database, and fresh-database selection. It does not support ida-tui's ++arbitrary `ida_args` escape hatch. The adapter rejects unsupported switches ++rather than silently loading at the wrong architecture/base. ++ ++### No database-change notification stream ++ ++The lease reports liveness, not mutations. If a GUI user or another Code Mode ++client renames/retypes content while ida-tui is open, already-materialized TUI ++caches are not invalidated automatically. TUI-originated edits invalidate their ++own caches correctly. A database revision counter or change feed would make ++shared interactive editing robust. ++ ++### Discovery requires a path for ambiguity ++ ++`ida-tui` with no path attaches automatically when exactly one database is ++registered. With several registrations it lists them and requires an explicit ++executable/IDB path. There is not yet a pre-connection database picker in the ++Textual UI. ++ ++### `DatabaseHandle` import stability ++ ++The usable library primitive currently lives at ++`ida_codemode.client.DatabaseHandle`; `ida_codemode.__init__` exports nothing. ++The port therefore depends on a submodule path. Exporting the handle and public ++client exceptions from the package root would make the supported library API ++clearer. ++ ++## Safety differences ++ ++ida-tui no longer removes `.id0/.id1/.id2/.nam/.til` files before opening. That ++was only defensible when the TUI exclusively owned a private process; it is ++unsafe when a GUI or another client may own the database. Code Mode registry ++locks, health probes, and IDA itself now arbitrate ownership. ++ ++The old pane “reap private workers” behavior is obsolete. A TUI crash closes its ++lease at the socket/kernel boundary; Code Mode decides whether a managed worker ++still has clients and when it should stop. ++ ++## Verification surfaces ++ ++The non-IDA suite verifies project staging, LRU lease behavior, load-option ++translation, and adapter response/error normalization. The existing live suites ++remain the end-to-end contract: ++ ++```sh ++uv run python tests/test_codemode_client.py ++uv run python tests/test_pool.py ++uv run python tests/test_project.py ++uv run python tests/test_scenarios.py /path/to/binary ++``` ++ ++For GUI reuse, open the same binary in an IDA with the Code Mode plugin, confirm ++it appears in `ida_codemode.registry.discover_instances()`, then launch ++`ida-tui /path/to/binary`. The TUI status/`CodeModeClient.backend` should report ++`gui`, and closing the TUI must leave IDA open. +diff --git a/docs/PAGING_FINDINGS.md b/docs/PAGING_FINDINGS.md +index bcde583..bd6c38f 100644 +--- a/docs/PAGING_FINDINGS.md ++++ b/docs/PAGING_FINDINGS.md +@@ -2,10 +2,10 @@ + + Measured against a real target: `libcrypto.so.3` (5.7 MB, **10,092 functions**, + biggest function **52,120 instructions**). These constraints drive the domain / +-paging layer. They describe the ida-pro-mcp *tool functions* (`list_funcs`, +-`disasm`, `decompile`, `xref_query`, …) which the idalib worker now calls +-in-process (`idatui/worker.py`) — the shapes and caps below are the tools' +-behaviour and are unchanged by dropping the HTTP transport. ++paging layer. The measurements below came from the former ida-pro-mcp tool ++backend. The Code Mode port preserves the adapter response shapes and conservative ++page sizes, but executes enumeration through ida-domain; old server caps and RTT ++numbers are historical rather than Code Mode constraints. + + ## Response shape (list_* / *_query tools) + +@@ -93,32 +93,26 @@ disasm totals are **top-level** fields, not under `asm`: + (correct). The pseudocode view must handle "decompilation failed" gracefully — + fall back to the disassembly view or show an error panel. + +-Normal decompile bodies are server-truncated with a `[N chars total]` marker +-(still to be solved for full-body display — see Phase 2). +- +-## Worker lifecycle (idatui's own idalib worker) +- +-idatui no longer uses ida-pro-mcp's shared HTTP supervisor. `idatui/worker.py` +-opens exactly **one** database with `idapro.open_database(...)` in its own process +-and serves tool calls over a unix socket (`WorkerClient`). Consequences vs the +-old supervisor model, which several design choices here were built around: +- +-* **No `max_workers` cap, no cross-session contention.** Each TUI owns its +- worker; there is no "Maximum idalib worker count reached" and no shared license +- slot to free. +-* **No idle self-exit / keepalive dance.** The old per-worker `WorkerLifecycle` +- watchdog (`idle_ttl_sec`, default 600s) and the `KeepAlive` heartbeat that +- fought it are gone with the supervisor. The worker lives as long as the TUI +- holds the socket and dies with it. `WorkerClient.keepalive()` is a no-op kept +- for API parity, and `--ttl` is passed through but the single owned worker does +- not self-reap. +-* **A crashed worker drops the socket**, surfacing as `IDAConnectionError`; the +- app's `_reconnect` respawns a fresh worker (re-opening + re-analyzing the +- binary). The hard-kill lock recovery below still applies. ++Code Mode returns the complete execution result directly; ida-tui no longer ++needs MCP structured-content/download-URL recovery for large pseudocode bodies. ++ ++## Code Mode lifecycle ++ ++`CodeModeClient` owns an authenticated SSE lease on a registered database: ++ ++* A matching GUI is preferred and remains open when the TUI exits. ++* Otherwise Code Mode reuses or starts a shared managed idalib worker. ++* Releasing one lease never terminates another client's session. A managed ++ worker saves and exits after its final lease under Code Mode's grace policy. ++* Lease loss surfaces as `IDAConnectionError`; reconnect performs discovery ++ again and may bind a newly-created instance. It does not silently swap the ++ handle underneath an operation. ++* `--ttl` and the old keepalive flag are compatibility no-ops; the lease itself ++ carries heartbeats. + + ## Writable path requirement (operational) + +-`idb_open` writes the `.i64` next to the input binary, so the path must be +-**writable**. Opening from read-only dirs (e.g. `/usr/lib`) fails with +-`"Failed to open database"`. Copy targets into a writable dir first +-(`targets/` in this repo). ++Attaching to a registered GUI does not require ida-tui to write beside the input. ++Creating a managed database does require a writable output path. Multi-binary ++projects provide one in their sidecar. ida-tui does not sweep IDA scratch files, ++because another registered session may own them. +diff --git a/docs/PROJECTS.md b/docs/PROJECTS.md +index fe6c2a8..0efee31 100644 +--- a/docs/PROJECTS.md ++++ b/docs/PROJECTS.md +@@ -7,9 +7,11 @@ search across all of them, and (later) follow calls from one into another. + + ## The constraint that shapes everything + +-`idatui/worker.py` is `serve(sock, binpath)` — **one worker process holds exactly +-one database** (idalib is main-thread-only and single-DB). So N binaries = N +-worker processes, each with the analyzed DB resident. ++IDA still exposes one active database per GUI/idalib process. Code Mode makes ++those instances discoverable and shareable: each project entry retains one ++`DatabaseHandle` lease, which may target a registered GUI or a managed idalib ++worker. N resident project databases can therefore mean up to N processes, but ++ida-tui no longer owns or terminates them. + + Measured cost (this box, `targets/`): + +@@ -30,13 +32,13 @@ crypto library. + + Two capabilities that feel like one, but aren't: + +-1. **Switching** to a binary needs a *live worker*. ++1. **Switching** to a binary needs a *live Code Mode lease*. + 2. **Searching across** binaries does *not* — if a per-binary index (functions, + strings, imports/exports) is cached on disk. + + That split is the unlock: project-wide search stays instant across every binary, + including ones never opened this session, and only *jumping* to a hit costs a +-worker spawn. ++Code Mode attach/open. + + ## Layout + +@@ -83,17 +85,16 @@ basename and must be unique (it names the staged file). + + ## Runtime + +-- **`WorkerPool`** — one `WorkerClient` per binary, spawned lazily on first +- switch, kept resident until the memory budget is exceeded, then LRU-evicted. +- Eviction **saves the DB first**, so returning to a binary is a DB load, not a +- re-analysis. Binaries can be pinned to stay resident. ++- **`DatabasePool`** — one `CodeModeClient` lease per resident binary, attached ++ lazily on first switch and LRU-released when the advisory memory budget is ++ exceeded. Eviction explicitly saves managed IDBs but never implicitly saves a ++ GUI. Closing a lease never kills a GUI or another client's managed worker; ++ Code Mode owns final worker shutdown. + - **`BinaryState`** — per binary: `client, program, nav, cur, func_index, + pref/active/split, filter`. Switching snapshots the current state and restores +- the target's. `_after_reconnect` already does exactly this swap (client + +- program, reload the index, re-open the entry) — switching reuses that seam. +-- **Clean shutdown** — the worker currently does `close_database(save=False)` and +- is hard-killed on exit, which is why wedge files accumulate. Projects need +- save-on-evict and an orderly close anyway, so that gets fixed here. ++ the target's. `_after_reconnect` provides the client/program swap seam. ++- **Clean shutdown** — release all leases. Managed idalib workers save/close on ++ their own main thread after the final lease; GUI sessions remain open. + + ## UI + +@@ -109,8 +110,8 @@ basename and must be unique (it names the staged file). + ## Phases + + **Phase 1 — project model + switching. DONE.** Project file + staging +-(`idatui/project.py`), `WorkerPool` with budget eviction / save-on-evict / +-clean shutdown (`idatui/pool.py`), `BinaryState` snapshot+restore and the switch ++(`idatui/project.py`), `DatabasePool` with budgeted lease release and ++save-on-evict (`idatui/pool.py`), `BinaryState` snapshot+restore and the switch + itself, the `Ctrl+O` switcher palette, the active binary in the status line, and + `--project` (which creates the project when given binaries). One active binary; + no cross-binary search yet. +@@ -118,9 +119,9 @@ no cross-binary search yet. + Project mode is **additive**: with no `--project` the app is byte-for-byte the + single-binary tool it was, which is what keeps the 167-check pilot honest. + Switching reuses the `_after_reconnect` shape — swap client+program, rebuild the +-index, reopen the entry. A binary whose worker is still resident restores +-instantly (its `Program` and index are still in memory); an evicted one comes +-back with a fresh worker but keeps its nav history, since that is just addresses. ++index, reopen the entry. A binary whose lease is still resident restores ++instantly (its `Program` and index are still in memory); an evicted one attaches ++again but keeps its nav history, since that is just addresses. + + **Phase 2 — index cache + project-wide search. (symbols done)** + `idatui/index.py` keeps one **SQLite FTS5 trigram** index at +@@ -222,7 +223,7 @@ records nothing — that's not navigation. + *Pre-warm follows the linkage graph, not list order.* When a binary finishes + indexing, `_prewarm_provider` warms the binary that provides the most of its + imports — where a follow is most likely to take you, so its startup is paid +-before you ask. `WorkerPool.prewarm()` refuses rather than evicting: spending a ++before you ask. `DatabasePool.prewarm()` refuses rather than evicting: spending a + binary you visited on one you haven't is a straight downgrade, and it would throw + away that binary's caches too. At a tight budget pre-warm simply does nothing. It + estimates the cost of a not-yet-spawned worker from the largest resident one, +diff --git a/docs/SPLIT_VIEW.md b/docs/SPLIT_VIEW.md +index de37dc1..c421656 100644 +--- a/docs/SPLIT_VIEW.md ++++ b/docs/SPLIT_VIEW.md +@@ -29,11 +29,11 @@ Ghidra highlights **all** instructions a C line owns. We have one ea per line + (the marker), not the set. Getting the set is the only real work, and it's a + known technique: + +-ida-pro-mcp derives the per-line marker via ++The old ida-pro-mcp backend derived the per-line marker via + `cfunc.get_line_item(line, col=0, …).get_ea()`. To get the **full set**, sweep + every column of the line (`get_line_item(line, x, …).get_ea()` for `x` in +-`0..len`) and collect distinct non-`BADADDR` EAs. Same proven API, swept across +-the line. A custom `decomp_map(ea)` tool in `server/patch_server.py` returns ++`0..len`) and collect distinct non-`BADADDR` EAs. The Code Mode adapter's ++`decomp_map(ea)` operation returns + `[{line, primary_ea, eas:[…]}, …]`; invert for `ea → line`. + + ## State model +@@ -78,14 +78,14 @@ decomp→listing uses `ListingModel.ensure_ea`. Tab re-links from the new driver + Still single-ea per line (one instruction highlighted); the region comes in + phase 3. + +-**Phase 3 — rich highlight. DONE.** `decomp_map` custom tool +-(`server/patch_server.py`) sweeps `cfunc.get_line_item` across every column of ++**Phase 3 — rich highlight. DONE.** The Code Mode `decomp_map` operation ++(`idatui/codemode_client.py`) sweeps `cfunc.get_line_item` across every column of + each pseudocode line and collects the EAs from each item's `dstr()` (`'EA: desc'` + — the same source as the `/*ea*/` marker, so it aligns). `Program.decomp_map(ea)` + returns the per-line ea lists (cached by name-gen); the app loads it async into + `_split_eamap` / `_split_ea2line` and `_sync_split` bands the **whole** instruction + region of a C line (and uses the exact ea→line inverse for the reverse). Falls +-back to the single marker until the map lands. Verified on the pilot's real worker ++back to the single marker until the map lands. Verified on a real Code Mode database + (alignment + multi-instruction region band). + + **Phase 4 — polish. DONE.** +diff --git a/experiments/worker_smoke.py b/experiments/worker_smoke.py +index b215a57..9b55138 100644 +--- a/experiments/worker_smoke.py ++++ b/experiments/worker_smoke.py +@@ -1,58 +1,56 @@ +-"""Runnable read-path smoke: drives the REAL domain.Program through WorkerClient +-(our idalib worker over a unix socket). Run when idalib can spawn: +- ~/ida-venv/bin/python experiments/worker_smoke.py +-""" +-import os, sys, shutil, time +-REPO=os.path.expanduser("~/dev/ida-tui-maybe"); sys.path.insert(0, REPO); os.chdir(REPO) +-# fresh copy so the worker's idalib doesn't fight any running server +-src=f"{REPO}/targets/echo"; tmp="/tmp/echo_worker" +-shutil.copy(src, tmp) +-for e in ".i64 .id0 .id1 .id2 .nam .til".split(): +- try: os.remove(tmp+e) +- except OSError: pass +- +-from idatui.worker_client import WorkerClient +-from idatui.domain import Program +- +-print("spawning worker + opening echo…", flush=True) +-t=time.time() +-cl=WorkerClient(tmp) +-cl.connect(progress=lambda m: None) +-print(f" worker ready in {time.time()-t:.2f}s session={cl.resolve_db()}", flush=True) +-prog=Program(cl) +- +-# --- drive the REAL domain layer through the worker (read path) --- +-main=prog.resolve("main") +-print("resolve('main') =", hex(main), flush=True) ++"""Exercise the real domain.Program through an IDA Code Mode lease. + +-idx=prog.functions(); idx.load_all() +-print("functions() ->", len(idx), "funcs", flush=True) +- +-fn=prog.function_of(main) +-print("function_of(main) ->", fn.name, hex(fn.addr), "size", fn.size, flush=True) +- +-b=prog.read_bytes(main, 16) +-print("read_bytes(main,16) ->", b.hex(), flush=True) +- +-lm=prog.listing(main) +-for _ in range(3): lm.load_next_page() +-rows=[lm.get(i) for i in range(min(6,len(lm)))] +-print("listing() first rows:", flush=True) +-for h in rows: +- if h: print(" ", hex(h.ea), h.kind, repr(h.text[:44]), flush=True) ++A matching registered GUI is reused; otherwise Code Mode starts a managed ++idalib worker. Usage: ``uv run python experiments/worker_smoke.py FILE``. ++""" ++from __future__ import annotations + +-d=prog.decompile(main) +-print("decompile(main) -> failed?", d.failed, "lines:", len((d.code or '').splitlines()), flush=True) ++import os ++import sys ++import time + +-regs=prog.file_regions() +-print("file_regions ->", len(regs), "segments", flush=True) ++from idatui.codemode_client import CodeModeClient ++from idatui.domain import Program + +-# xrefs to a called function +-callee=next((f.addr for f in idx.all_loaded() if f.name.startswith("sub_")), None) +-if callee: +- xr=prog.xrefs_to(callee) +- print("xrefs_to(", hex(callee), ") ->", len(xr), "refs", flush=True) + +-ok = (fn.name=="main" and len(idx)>100 and b and not d.failed and len(regs)>0) +-print("VERDICT:", "OK — domain.Program runs unchanged on the worker" if ok else "FAIL", flush=True) +-cl.close() ++def main() -> int: ++ target = os.path.abspath(sys.argv[1] if len(sys.argv) > 1 else "experiments/fibonacci.elf") ++ print(f"attaching Code Mode to {target}…", flush=True) ++ started = time.time() ++ client = CodeModeClient(target) ++ client.connect(progress=lambda message: print(f" {message}", flush=True)) ++ print( ++ f" ready in {time.time() - started:.2f}s; backend={client.backend}; " ++ f"session={client.resolve_db()}", ++ flush=True, ++ ) ++ program = Program(client) ++ try: ++ index = program.functions() ++ index.load_all() ++ print(f"functions() -> {len(index)}", flush=True) ++ first = index.get(0) ++ if first is None: ++ print("VERDICT: FAIL — no functions", flush=True) ++ return 1 ++ fn = program.function_of(first.addr) ++ data = program.read_bytes(first.addr, 16) ++ decompilation = program.decompile(first.addr) ++ print(f"function_of() -> {fn}", flush=True) ++ print(f"read_bytes() -> {data.hex()}", flush=True) ++ print( ++ f"decompile() -> failed={decompilation.failed}; " ++ f"lines={len((decompilation.code or '').splitlines())}", ++ flush=True, ++ ) ++ print(f"file_regions() -> {len(program.file_regions())}", flush=True) ++ ok = fn is not None and bool(data) and bool(program.file_regions()) ++ print(f"VERDICT: {'OK' if ok else 'FAIL'}", flush=True) ++ return 0 if ok else 1 ++ finally: ++ program.close() ++ client.close() ++ ++ ++if __name__ == "__main__": ++ raise SystemExit(main()) +diff --git a/ida-tui b/ida-tui +index 9ceb949..a488cac 100755 +--- a/ida-tui ++++ b/ida-tui +@@ -3,10 +3,9 @@ + # + # ./ida-tui foo.elf # open a binary and drive it — that's it + # +-# Opening a binary spins up our own idalib worker (a unix-socket subprocess; +-# no HTTP, no supervisor). Uses the venv python that has textual (override with +-# $IDATUI_PYTHON); the worker auto-picks the python that has ida_pro_mcp +-# (override with $IDATUI_WORKER_PYTHON). ++# The launcher leases a registered IDA GUI or shared managed idalib worker ++# through ida_codemode. The selected Python must have ida-tui's dependencies; ++# override it with $IDATUI_PYTHON. + set -eu + + SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd) +diff --git a/idatui/__init__.py b/idatui/__init__.py +index 2cbdde8..7da28b3 100644 +--- a/idatui/__init__.py ++++ b/idatui/__init__.py +@@ -1,5 +1,4 @@ +-"""idatui — a minimal keyboard-first TUI for IDA Pro, driving idalib via a +-private unix-socket worker (idatui.worker / WorkerClient).""" ++"""idatui — a keyboard-first TUI using shared IDA Code Mode databases.""" + + from .errors import ( + IDAError, +@@ -11,6 +10,7 @@ from .errors import ( + IDASessionError, + Session, + ) ++from .codemode_client import CodeModeClient + from .domain import ( + Program, + FunctionIndex, +@@ -25,6 +25,7 @@ from .domain import ( + ) + + __all__ = [ ++ "CodeModeClient", + "Program", + "FunctionIndex", + "DisasmModel", +diff --git a/idatui/app.py b/idatui/app.py +index 1edc65e..984140f 100644 +--- a/idatui/app.py ++++ b/idatui/app.py +@@ -10,8 +10,8 @@ Design notes: + without ever materializing 52k lines in a widget. + * All network/domain work runs in Textual worker threads; the UI never blocks. + * An address-history stack backs Enter (follow) / Esc (back), IDA-style. +-* On startup we bump the worker idle-TTL and run a keepalive heartbeat so the +- session never gets reaped while we chill. ++* Database lifecycle is lease-based through ida_codemode: matching GUI sessions ++ are reused, otherwise a shared managed idalib worker is opened on demand. + """ + + from __future__ import annotations +@@ -30,7 +30,7 @@ from textual import work + from textual.app import App, ComposeResult + from textual.binding import Binding + from textual.command import DiscoveryHit, Hit, Provider +-from textual.containers import Grid, Horizontal, Vertical, VerticalScroll ++from textual.containers import Horizontal, Vertical, VerticalScroll + from textual.geometry import Region, Size + from textual.message import Message + from textual.reactive import reactive +@@ -46,8 +46,8 @@ from textual.widgets.option_list import Option + from .highlight import highlight_c + + from .errors import IDAToolError, IDAConnectionError +-from .worker_client import WorkerClient +-from .domain import DisasmModel, Func, Head, ListingModel, Program, Struct ++from .codemode_client import CodeModeClient, registered_database ++from .domain import Func, Head, ListingModel, Program, Struct + + # Styles for the disassembly listing. + _S_ADDR = Style(color="#6b7684") +@@ -126,8 +126,8 @@ _ADDR_MARK_STRIP_RE = re.compile(r"\s*/\*\s*0x[0-9A-Fa-f]+\s*\*/") + @dataclass + class BinaryState: + """Everything that makes one project binary's session resumable across a +- switch. Addresses outlive the worker, so nav history survives eviction; the +- Program/index only survive while that worker is still resident.""" ++ switch. Addresses outlive a database lease, so nav history survives eviction; ++ the Program/index only survive while that lease remains resident.""" + + label: str + program: object | None = None +@@ -812,9 +812,9 @@ class ListingView(SearchMixin, NavMixin, ColumnCursor, ScrollView, can_focus=Tru + def _span_segments(h: Head, fallback: Style): + """Segments for a row's disassembly text. + +- Uses IDA's own token classification when the worker supplied it; falls +- back to the old mnemonic/rest split so an older worker (or a row whose +- spans didn't match the text) still renders. ++ Uses IDA's own token classification when Code Mode supplies it; falls ++ back to the mnemonic/rest split when spans are absent or disagree with ++ the plain text. + """ + if h.spans: + return [Segment(t, _S_SPAN.get(k, fallback)) for k, t in h.spans] +@@ -2228,12 +2228,16 @@ _HELP = ( + + + class QuitScreen(ModalScreen): +- """Asked before exiting with unsaved database changes. Dismisses with +- "save", "discard" or None (stay).""" ++ """Asked before exiting with unsaved database changes. ++ ++ Code Mode clients cannot roll a shared database back. The ``d`` choice means ++ "do not explicitly save": a GUI keeps the changes dirty, while a managed ++ idalib worker may persist them when its final lease closes. ++ """ + + BINDINGS = [ + Binding("s", "save", "Save & quit"), +- Binding("d", "discard", "Discard & quit"), ++ Binding("d", "discard", "Leave & quit"), + Binding("escape,c", "cancel", "Cancel"), + ] + +@@ -2250,7 +2254,7 @@ class QuitScreen(ModalScreen): + for label in self._labels: + body.append(f" \u2022 {label}\n", _S_LABEL) + yield Static(body, id="quit-list") +- yield Static("s save & quit d discard & quit Esc cancel", ++ yield Static("s save & quit d leave as-is & quit Esc cancel", + id="quit-help") + + def action_save(self) -> None: +@@ -3392,15 +3396,16 @@ class IdaTui(App): + self._index = None # project-wide symbol/string index + if project is not None: + from .index import ProjectIndex +- from .pool import WorkerPool +- self._pool = WorkerPool(project, ttl=ttl) ++ from .pool import DatabasePool ++ self._pool = DatabasePool(project, ttl=ttl) + self._index = ProjectIndex( + os.path.join(project.index_dir, "project.db")) + self._binary = project.refs[0].label + open_path = project.refs[0].staged + self._open_path = open_path + self._ttl = ttl +- self._load_args = load_args or "" # IDA switches for a headerless blob ++ self._load_args = load_args or "" # first-open options for a headerless blob ++ self._new_database = False # Ctrl+L asks Code Mode for a fresh IDB + self._title = (os.path.basename(open_path) if open_path else "") + self._trace_path = trace_path or "" # Tenet execution trace to explore + self._trace = None # the loaded Trace, once analysed +@@ -3414,7 +3419,7 @@ class IdaTui(App): + self._do_keepalive = keepalive + self._rpc_path = rpc_path + self._rpc = None +- self.client: WorkerClient | None = None ++ self.client: CodeModeClient | None = None + self.program: Program | None = None + self._loading_screen: LoadingScreen | None = None + self._ka = None +@@ -3512,8 +3517,8 @@ class IdaTui(App): + if self._rpc_path: + self._start_rpc() + # A file no loader recognises has to be described before it can be +- # opened, so ask BEFORE the worker starts — once IDA has made a database +- # the answer is baked in and changing it means deleting the .i64. ++ # opened, so ask BEFORE Code Mode creates it — once IDA has made a database ++ # the answer is baked in and changing it requires a fresh-IDB reopen. + if self._project is not None: + ref = self._pending_load_ref() + if ref is not None: +@@ -3544,6 +3549,11 @@ class IdaTui(App): + if os.path.exists(self._open_path + ".i64") or os.path.exists( + os.path.splitext(self._open_path)[0] + ".i64"): + return False ++ try: ++ if registered_database(self._open_path): ++ return False ++ except Exception: ++ pass # connect() will surface registry failures with full diagnostics + return needs_load_options(self._open_path) + + def action_load_options(self) -> None: +@@ -3557,7 +3567,11 @@ class IdaTui(App): + forward. + """ + if not self._can_reload(): +- self._status("nothing to reload") ++ if self.client is not None and self.client.backend == "gui": ++ self._status( ++ "reload unavailable for a GUI-owned database — reopen it in IDA") ++ else: ++ self._status("nothing to reload") + return + n = len(self._func_index) if self._func_index else 0 + note = ("this image has no functions, so nothing is lost" +@@ -3576,10 +3590,13 @@ class IdaTui(App): + ref = self._project.by_label(self._binary) + if ref is not None: + path, label = ref.source, ref.label +- # Drop the worker first: it holds the database open, and the .i64 can't +- # be removed (or rebuilt) underneath a live one. +- self._release_worker() +- self._drop_database() ++ # Release our lease first. Code Mode waits for a managed worker's final ++ # lease grace, then creates the replacement IDB atomically. A GUI-backed ++ # database is rejected by _can_reload(): the TUI must never close it. ++ self._release_database() ++ self._new_database = True ++ if label is not None and self._pool is not None: ++ self._pool.recreate_on_next_open(label) + self._reset_for_reload() + self._load_args = "" + if label is not None and self._project is not None: +@@ -3591,7 +3608,9 @@ class IdaTui(App): + self._pending_switch = None + self._ask_load_options(path, label=label) + +- def _release_worker(self) -> None: ++ def _release_database(self) -> None: ++ if self.program is not None: ++ self.program.close() + if self._pool is not None and self._binary is not None: + try: + self._pool.evict(self._binary, save=False) +@@ -3605,23 +3624,6 @@ class IdaTui(App): + self.client = None + self.program = None + +- def _drop_database(self) -> None: +- """Remove the .i64 (and any unpacked scratch) so the next open re-reads +- the raw image with new options.""" +- base = self._open_path +- if self._project is not None and self._binary is not None: +- ref = self._project.by_label(self._binary) +- if ref is not None: +- base = ref.staged +- if not base: +- return +- for suffix in (".i64", ".id0", ".id1", ".id2", ".nam", ".til"): +- for cand in (base + suffix, os.path.splitext(base)[0] + suffix): +- try: +- os.remove(cand) +- except OSError: +- pass +- + def _reset_for_reload(self) -> None: + self._no_functions = False + self._func_index = None +@@ -3665,6 +3667,11 @@ class IdaTui(App): + if os.path.exists(ref.db) or os.path.exists( + os.path.splitext(ref.staged)[0] + ".i64"): + return None # already analysed: the .i64 records how ++ try: ++ if registered_database(ref.staged, output_database=ref.db): ++ return None ++ except Exception: ++ pass + from .formats import needs_load_options + return ref if needs_load_options(ref.source) else None + +@@ -3718,10 +3725,6 @@ class IdaTui(App): + + asyncio.get_running_loop().create_task(_serve()) + +- async def on_unmount(self) -> None: +- if self._rpc is not None: +- await self._rpc.stop() +- + # -- status helper ----------------------------------------------------- # + def _status(self, text: str, priority: bool = False) -> None: + """Write the status bar. ``priority`` marks the RESULT of something the +@@ -3786,9 +3789,10 @@ class IdaTui(App): + + # -- connection loss / recovery --------------------------------------- # + def _handle_exception(self, error: BaseException) -> None: +- """Intercept a lost-connection error from any worker so the whole app +- doesn't die when the analysis server goes away (it can idle out, be +- killed, or the box can sleep). Everything else crashes as usual.""" ++ """Intercept a lost Code Mode lease so the app can rediscover the DB. ++ ++ Everything unrelated to database connectivity crashes as usual. ++ """ + from textual.worker import WorkerFailed + orig = error.error if isinstance(error, WorkerFailed) else error + if isinstance(orig, IDAConnectionError): +@@ -3820,15 +3824,15 @@ class IdaTui(App): + + @work(thread=True, exclusive=True, group="reconnect") + def _reconnect(self) -> None: +- # The worker died (segfault -> dropped socket). Respawn it: it re-opens +- # and re-analyzes the binary in a fresh process, then we rebuild. ++ # The registered instance disappeared. Rediscover it; Code Mode may find ++ # a GUI/replacement worker, then we rebuild caches against the new handle. + try: + if self._open_path is None: + self.app.call_from_thread(self._reconnect_failed, + "no binary to reopen") + return +- client = WorkerClient(self._open_path, ttl=self._ttl, +- load_args=self._load_args) ++ client = CodeModeClient(self._open_path, ttl=self._ttl, ++ load_args=self._load_args) + client.connect(progress=lambda m: self.app.call_from_thread( + self._conn_note, m)) + except Exception as e: # noqa: BLE001 +@@ -3836,7 +3840,7 @@ class IdaTui(App): + return + self.app.call_from_thread(self._after_reconnect, client, Program(client)) + +- def _after_reconnect(self, client: "WorkerClient", program: "Program") -> None: ++ def _after_reconnect(self, client: "CodeModeClient", program: "Program") -> None: + self.client = client + self.program = program + self._reconnecting = False +@@ -3856,13 +3860,13 @@ class IdaTui(App): + @work(thread=True, exclusive=True, group="connect") + def _connect(self) -> None: + try: +- client = self._open_worker_client() ++ client = self._open_database_client() + if client is None: + return # the opener already reported + dismissed the overlay + module = client.health().get("module", "?") + if self._do_keepalive: +- # Keep the session warm while we run; don't make it immortal, so +- # it's reclaimed after the TUI closes. (No-op for the worker.) ++ # Compatibility shim: DatabaseHandle's SSE lease already owns ++ # liveness and heartbeat behavior. + self._ka = client.keepalive(interval=120.0).start() + program = Program(client) + except Exception as e: # noqa: BLE001 +@@ -3877,14 +3881,14 @@ class IdaTui(App): + return + self.client = client + self.program = program +- self.app.call_from_thread(self._status, f"{module} — loading functions…") ++ self._new_database = False ++ self.app.call_from_thread( ++ self._status, f"{module} [{client.backend}] — loading functions…") + self._load_functions() + +- def _open_worker_client(self): # type: ignore[no-untyped-def] +- """Our idalib-worker path: spawn the worker (it opens + analyzes the +- binary in its own process) and connect. Returns the client, or None.""" +- from .worker_client import WorkerClient +- if self._pool is not None: # project mode: the pool owns the workers ++ def _open_database_client(self): # type: ignore[no-untyped-def] ++ """Attach through Code Mode, reusing a GUI or managed idalib database.""" ++ if self._pool is not None: # project mode: the pool owns the leases + label = self._binary or self._project.refs[0].label + client = self._pool.get(label, progress=lambda m: + self.app.call_from_thread(self._status, m)) +@@ -3895,14 +3899,15 @@ class IdaTui(App): + return client + if not self._open_path: + self.app.call_from_thread( +- self._status, "the worker backend needs a binary path") ++ self._status, "Code Mode needs a database or executable path") + self.app.call_from_thread(self._dismiss_loading) + return None + base = os.path.basename(self._open_path) + self.app.call_from_thread( +- self._status, f"starting worker — initial auto-analysis of {base}…") +- client = WorkerClient(self._open_path, ttl=self._ttl, +- load_args=self._load_args) ++ self._status, f"discovering Code Mode database for {base}…") ++ client = CodeModeClient(self._open_path, ttl=self._ttl, ++ load_args=self._load_args, ++ new_database=self._new_database) + client.connect(progress=lambda m: self.app.call_from_thread( + self._status, m)) + return client +@@ -3974,7 +3979,7 @@ class IdaTui(App): + @work(thread=True, exclusive=True, group="index") + def _index_binary(self) -> None: + """Fold this binary's symbols + strings into the project index, so it can +- be searched later even when its worker is gone.""" ++ be searched later even when its Code Mode lease is gone.""" + if self._index is None or self._project is None or self._binary is None: + return + ref = self._project.by_label(self._binary) +@@ -3992,7 +3997,7 @@ class IdaTui(App): + imps, exps = self.program.linkage() + entries += [(KIND_IMPORT, i.addr, i.name) for i in imps] + entries += [(KIND_EXPORT, e.addr, e.name) for e in exps] +- except Exception: # noqa: BLE001 -- an old worker has no list_linkage ++ except Exception: # noqa: BLE001 -- indexing is best-effort + pass + try: + n = self._index.reindex(self._binary, entries, source=ref.source) +@@ -4077,7 +4082,13 @@ class IdaTui(App): + cursor=0, push=True, is_region=True) + + def _can_reload(self) -> bool: +- """Whether we're able to re-open this binary with different options.""" ++ """Whether Code Mode can replace this IDB with different options. ++ ++ A GUI database is owned by the user and has no remote close/rollback ++ route. Managed idalib databases can be released and reopened fresh. ++ """ ++ if self.client is not None and self.client.backend == "gui": ++ return False + if self._project is not None and self._binary is not None: + return True + return bool(self._open_path) +@@ -4267,6 +4278,9 @@ class IdaTui(App): + + def _on_quit_choice(self, choice: str | None) -> None: + if choice == "discard": ++ # Code Mode has no rollback/close-without-save operation. For GUI ++ # sessions this leaves changes dirty in IDA; a managed worker owns ++ # its final save policy and may persist them on final lease release. + self._save_on_exit = False + self.exit() + elif choice == "save": +@@ -4283,7 +4297,7 @@ class IdaTui(App): + if self._pool is not None: + self._pool.close_all(save=True) # saves each resident worker + elif self.program is not None: +- self.program.client.call("idb_save", timeout=600.0) ++ self.program.client.save_database() + except Exception as e: # noqa: BLE001 -- still exit, but say so + self.app.call_from_thread(self._status, f"save failed: {e}") + self.app.call_from_thread(self._finish_exit) +@@ -4323,7 +4337,7 @@ class IdaTui(App): + self._ask_load_options(ref.source, label=label) + return + # Snapshot what we're leaving so coming back restores the view, then let +- # the pool hand us a worker (spawning + evicting as the budget dictates). ++ # the pool hand us a lease (attaching + evicting as the budget dictates). + if self._binary is not None: + self._states[self._binary] = BinaryState( + label=self._binary, program=self.program, +@@ -4344,8 +4358,8 @@ class IdaTui(App): + self.app.call_from_thread(self._switch_failed, label, str(e)) + return + st = self._states.get(label) +- # The Program (and its caches) only survive while that worker does; a +- # binary that was evicted comes back with a fresh one. Either way the nav ++ # The Program (and its caches) only survive while that lease does; an ++ # evicted binary reattaches. Either way the nav + # history is just addresses, so it always survives. + reuse = (st is not None and st.program is not None + and getattr(st.program, "client", None) is client) +@@ -4382,7 +4396,7 @@ class IdaTui(App): + self._did_auto_land = False + self._auto_land() + return +- # Cold (first visit, or the worker was evicted): rebuild the index, then ++ # Cold (first visit, or the lease was evicted): rebuild the index, then + # land back where we were via _pending_restore. + self._cur = None + self._func_index = None +@@ -4439,28 +4453,6 @@ class IdaTui(App): + return + self._goto_ea(addr, push=True) # land on the literal in the listing + +- def on_descendant_focus(self, event) -> None: # type: ignore[no-untyped-def] +- """Keep ``_active`` in step with focus while split. +- +- Tab moves both together, but focus also moves on its own — a click, or a +- pane focusing itself after a load — and then ``_active`` still names the +- pane you're NOT in. Everything downstream trusts ``_active``: follow +- resolves the word under that pane's cursor and pushes history for it, so +- Enter in the pseudocode would follow something from the listing and the +- next Esc got spent undoing it. +- """ +- if not self._split: +- return +- w = self.focused +- mode = ("decomp" if isinstance(w, DecompView) +- else "listing" if isinstance(w, ListingView) else None) +- if mode is None or mode == self._active: +- return +- self._active = mode +- self._sync_split(mode) # re-link the band from the new driver +- if not self.query_one(DecompView).loading: +- self._status_for_cur("split") # never clobber "decompiling…" +- + def action_toggle_view(self) -> None: + """Tab: switch the code pane between disassembly and pseudocode (or leave + the hex view back to the preferred code view).""" +@@ -4807,7 +4799,7 @@ class IdaTui(App): + def _cross_binary_impl(self, name: str) -> tuple[str, int] | None: + """``(binary, addr)`` of a project binary that EXPORTS ``name``. + +- Reads the on-disk index, so a provider resolves even when its worker was ++ Reads the on-disk index, so a provider resolves even when its lease was + evicted — the whole reason the index exists. + """ + if self._index is None or self._project is None or not name: +@@ -4980,7 +4972,7 @@ class IdaTui(App): + def _foreign_importers(self, subj: int, subj_name, fn): # type: ignore[no-untyped-def] + """Project binaries that IMPORT the symbol at ``subj`` — the other half + of the phase-3 join, read from the on-disk index so a caller shows up +- whether or not its worker is resident. ++ whether or not its database lease is resident. + + Only for a symbol this binary actually exports: a local name that + happens to collide with another binary's import isn't a caller of ours. +@@ -5422,7 +5414,7 @@ class IdaTui(App): + kind = "stack" + batch = {"stack": {"func_addr": hex(cur.ea), "old": old, "new": new}} + try: +- res = prog.client.call("rename", batch=batch) ++ res = prog.client.invoke("rename", batch=batch) + except IDAToolError as e: + self.app.call_from_thread(self._status, f"rename failed: {e.message}") + return +@@ -5438,7 +5430,6 @@ class IdaTui(App): + self.app.call_from_thread(self._after_rename, kind, addr, old, new) + + def _after_rename(self, kind: str, addr: int | None, old: str, new: str) -> None: +- cur = self._cur + # A renamed symbol can appear in many functions, so invalidate globally; + # each function refreshes its names the next time it's viewed. + self.program.bump_names() +@@ -5465,7 +5456,7 @@ class IdaTui(App): + — unlike the symbol-by-name path, this names the address directly.""" + assert self.program is not None + try: +- res = self.program.client.call( ++ res = self.program.client.invoke( + "rename", batch={"data": {"addr": hex(addr), "new": name}}) + except IDAToolError as e: + self.app.call_from_thread(self._status, f"name failed: {e.message}") +@@ -5729,7 +5720,6 @@ class IdaTui(App): + screen row, so the eye tracks straight across. + """ + lst = self.query_one(ListingView) +- dec = self.query_one(DecompView) + if lst.model is None: + return False + row = lst.model.ensure_ea(pc) +@@ -6022,7 +6012,7 @@ class IdaTui(App): + def _save(self) -> None: + assert self.program is not None + try: +- self.program.client.call("idb_save", timeout=300.0) ++ self.program.client.save_database() + except Exception as e: # noqa: BLE001 + self.app.call_from_thread(self._status, f"save failed: {e}") + return +@@ -6951,7 +6941,9 @@ class IdaTui(App): + "(c code · p func · u undefine · Enter follow)") + + # -- teardown ---------------------------------------------------------- # +- def on_unmount(self) -> None: ++ async def on_unmount(self) -> None: ++ if self._rpc is not None: ++ await self._rpc.stop() + if self._ka is not None: + self._ka.stop() + if self.program is not None: +@@ -6963,7 +6955,7 @@ class IdaTui(App): + elif self.client is not None: + if self._save_on_exit is None and self._dirty: + try: # unexpected teardown with edits: don't drop them +- self.client.call("idb_save", timeout=600.0) ++ self.client.save_database() + except Exception: # noqa: BLE001 + pass + self.client.close() +diff --git a/idatui/codemode_client.py b/idatui/codemode_client.py +new file mode 100644 +index 0000000..ab4e698 +--- /dev/null ++++ b/idatui/codemode_client.py +@@ -0,0 +1,1107 @@ ++"""Client adapter from ida-tui's domain operations to IDA Code Mode. ++ ++``DatabaseHandle`` is the lifecycle boundary: it discovers an already-registered ++GUI database, reuses a shared managed idalib worker, or starts one when needed. ++The TUI never owns or terminates an IDA process. Closing this client releases ++only its lease. ++ ++The Code Mode transport intentionally exposes one broad operation, ++``execute_python``. ``CodeModeClient.invoke`` turns the small, address-centric ++operations needed by the paging layer into self-contained snippets. The ++snippets prefer the public ``ida-domain`` ``db`` object. A handful of features ++that ida-domain does not currently expose (IDA-coloured listing rows, creating ++instructions, ARM T-state, and detailed Hex-Rays line maps/failures) use the ++IDAPython modules that Code Mode deliberately makes importable. ++""" ++from __future__ import annotations ++ ++import json ++import os ++import shlex ++import threading ++import time ++from textwrap import dedent ++from typing import Any ++ ++from ida_codemode.client import ( ++ ClientError, ++ DatabaseHandle, ++ InstanceDisconnectedError, ++ RemoteError, ++) ++from ida_codemode.registry import ( ++ REGISTRY_DIR, ++ FileLock, ++ RegistryEntry, ++ canonical_path, ++ idb_key, ++ scan_instances, ++) ++from ida_codemode.resolver import IdbBusy, expected_idb_path ++ ++from .errors import IDAConnectionError, IDATimeoutError, IDAToolError, Session ++ ++ ++def registered_database(path: str, output_database: str | None = None) -> bool: ++ """Whether a live/lock-held Code Mode instance owns this target.""" ++ source = canonical_path(path) ++ expected = canonical_path(output_database) if output_database else expected_idb_path(source) ++ expected_key = idb_key(expected) ++ for instance in scan_instances(timeout=0.5): ++ entry = instance.entry ++ if entry.idb_key == expected_key: ++ return True ++ if not output_database and entry.backend == "gui" and entry.exe_path: ++ if canonical_path(entry.exe_path) == source: ++ return True ++ return False ++ ++ ++class _NoopKeepAlive: ++ """Compatibility shim: the DatabaseHandle's SSE lease is the heartbeat.""" ++ ++ def __init__(self) -> None: ++ self.beats = self.failures = 0 ++ ++ def start(self) -> "_NoopKeepAlive": ++ return self ++ ++ def stop(self) -> None: ++ pass ++ ++ ++def _parse_load_args(value: str) -> tuple[str | None, int | None, str | None]: ++ """Translate ida-tui's legacy first-open switches to Code Mode options. ++ ++ Code Mode has typed options for processor, natural loading address and file ++ type. It deliberately has no arbitrary command-line escape hatch; reject ++ switches we cannot represent instead of silently loading a blob wrongly. ++ """ ++ processor: str | None = None ++ loading_address: int | None = None ++ file_type: str | None = None ++ unsupported: list[str] = [] ++ try: ++ words = shlex.split(value or "", posix=os.name != "nt") ++ except ValueError as exc: ++ raise ValueError(f"invalid IDA load options: {exc}") from exc ++ for word in words: ++ if word.startswith("-p") and len(word) > 2: ++ processor = word[2:] ++ elif word.startswith("-b") and len(word) > 2: ++ try: ++ # IDA's -b is in 16-byte paragraphs. DatabaseHandle expects the ++ # natural address, which is the safer public API. ++ loading_address = int(word[2:], 16) << 4 ++ except ValueError as exc: ++ raise ValueError(f"invalid IDA loading address: {word!r}") from exc ++ elif word.startswith("-T") and len(word) > 2: ++ file_type = word[2:] ++ else: ++ unsupported.append(word) ++ if unsupported: ++ joined = " ".join(unsupported) ++ raise ValueError( ++ "ida-codemode cannot represent arbitrary IDA load options: " ++ f"{joined!r}; use processor/base/file type options instead" ++ ) ++ return processor, loading_address, file_type ++ ++ ++def _script(args: dict[str, Any], body: str) -> str: ++ """Bind JSON arguments without interpolating user text into Python code.""" ++ encoded = json.dumps(args, ensure_ascii=False, separators=(",", ":")) ++ return f"import json\na = json.loads({encoded!r})\n{dedent(body).strip()}\n" ++ ++ ++# Rich flat-listing generation is the largest ida-domain gap in this port. ++# ida-domain can enumerate heads and render plain disassembly, but it does not ++# expose undefined runs, IDA colour spans, function banners, or expanded UDT ++# members. Keep that IDAPython-only logic isolated in this one operation. ++_HEADS = r''' ++import ida_bytes, ida_funcs, ida_idaapi, ida_lines, ida_name, ida_nalt, ida_segment, ida_typeinf ++start = int(str(a["addr"]), 16) ++count = max(1, min(int(a.get("count", 200)), 2000)) ++offset = max(0, int(a.get("offset", 0))) ++annotate = bool(a.get("annotate", False)) ++seg = db.segments.get_at(start) ++if seg is None: ++ result = {"addr": a["addr"], "error": "no segment", "heads": [], "cursor": {"done": True}} ++else: ++ lo, hi = int(seg.start_ea), int(seg.end_ea) ++ if a.get("end"): ++ hi = min(hi, int(str(a["end"]), 16)) ++ ++ span_names = { ++ "insn": ("SCOLOR_INSN", "SCOLOR_KEYWORD", "SCOLOR_ASMDIR", "SCOLOR_MACRO"), ++ "reg": ("SCOLOR_REG",), ++ "num": ("SCOLOR_NUMBER", "SCOLOR_CHAR", "SCOLOR_BINPREF"), ++ "str": ("SCOLOR_STRING",), ++ "name": ("SCOLOR_DATNAME", "SCOLOR_CODNAME", "SCOLOR_LOCNAME", "SCOLOR_IMPNAME", ++ "SCOLOR_DEMNAME", "SCOLOR_LIBNAME", "SCOLOR_CNAME", "SCOLOR_DNAME", ++ "SCOLOR_CREF", "SCOLOR_DREF", "SCOLOR_CREFTAIL", "SCOLOR_DREFTAIL"), ++ "seg": ("SCOLOR_SEGNAME",), ++ "cmt": ("SCOLOR_AUTOCMT", "SCOLOR_REGCMT", "SCOLOR_RPTCMT", "SCOLOR_VOIDOP"), ++ "punct": ("SCOLOR_SYMBOL", "SCOLOR_ALTOP", "SCOLOR_HIDNAME"), ++ "err": ("SCOLOR_ERROR",), ++ } ++ tag_kinds = {} ++ for kind, names in span_names.items(): ++ for name in names: ++ value = getattr(ida_lines, name, None) ++ if isinstance(value, str) and value: ++ tag_kinds[value[0]] = kind ++ elif isinstance(value, int): ++ tag_kinds[chr(value)] = kind ++ ++ def spans(tagged): ++ on, off, esc = "\x01", "\x02", "\x03" ++ addr_tag = chr(getattr(ida_lines, "COLOR_ADDR", 0x28)) ++ addr_len = int(getattr(ida_lines, "COLOR_ADDR_SIZE", 16)) ++ out, stack, buf = [], [], [] ++ def flush(): ++ if buf: ++ out.append([stack[-1] if stack else "text", "".join(buf)]) ++ buf.clear() ++ i = 0 ++ while i < len(tagged): ++ ch = tagged[i] ++ if ch == on and i + 1 < len(tagged): ++ tag = tagged[i + 1] ++ if tag == addr_tag: ++ i += 2 + addr_len ++ continue ++ flush(); stack.append(tag_kinds.get(tag, "text")); i += 2; continue ++ if ch == off and i + 1 < len(tagged): ++ flush() ++ if stack: stack.pop() ++ i += 2; continue ++ if ch == esc and i + 1 < len(tagged): ++ buf.append(tagged[i + 1]); i += 2; continue ++ buf.append(ch); i += 1 ++ flush() ++ collapsed, previous_space = [], False ++ for kind, text in out: ++ acc = [] ++ for ch in text: ++ if ch.isspace(): ++ if previous_space: continue ++ acc.append(" "); previous_space = True ++ else: ++ acc.append(ch); previous_space = False ++ if acc: collapsed.append([kind, "".join(acc)]) ++ if collapsed: ++ collapsed[0][1] = collapsed[0][1].lstrip() ++ collapsed[-1][1] = collapsed[-1][1].rstrip() ++ return [[kind, text] for kind, text in collapsed if text] ++ ++ def row(ea): ++ flags = ida_bytes.get_flags(ea) ++ kind = "code" if ida_bytes.is_code(flags) else ("data" if ida_bytes.is_data(flags) else "unknown") ++ tagged = ida_lines.generate_disasm_line(ea, 0) or "" ++ text = " ".join(ida_lines.tag_remove(tagged).split()) if tagged else "" ++ item = {"ea": hex(ea), "kind": kind, "size": int(ida_bytes.get_item_size(ea)), "text": text} ++ if tagged: ++ rich = spans(tagged) ++ if " ".join("".join(x[1] for x in rich).split()) == text: ++ item["spans"] = rich ++ name = ida_name.get_ea_name(ea) ++ if name: item["name"] = name ++ return item ++ ++ def unknown_row(ea, size): ++ if size <= 1: return row(ea) ++ item = {"ea": hex(ea), "kind": "unknown", "size": int(size), "text": f"db {size} dup(?)"} ++ name = ida_name.get_ea_name(ea) ++ if name: item["name"] = name ++ return item ++ ++ def members(ea): ++ tif = db.types.get_at(ea) ++ if tif is None or not tif.is_udt(): return [] ++ answer = [] ++ for member in db.types.get_udt_members(tif): ++ type_text = member.type.dstr() or "" ++ text = f"+{member.offset:X} {member.name}" + (f" {type_text}" if type_text else "") ++ answer.append({"ea": hex(ea + member.offset), "kind": "member", ++ "size": int(member.size), "text": text}) ++ return answer ++ ++ def is_unknown(ea): ++ flags = ida_bytes.get_flags(ea) ++ return not (ida_bytes.is_code(flags) or ida_bytes.is_data(flags)) ++ def run_end(ea): ++ nxt = ida_bytes.next_head(ea, hi) ++ return nxt if nxt != ida_idaapi.BADADDR and ea < nxt <= hi else hi ++ def advance(ea): ++ if is_unknown(ea): return run_end(ea) ++ nxt = ida_bytes.get_item_end(ea) ++ return nxt if nxt > ea else ea + 1 ++ def rows_for(ea): ++ if is_unknown(ea): return [unknown_row(ea, run_end(ea) - ea)] ++ fn = db.functions.get_at(ea) if annotate else None ++ at_start = fn is not None and int(fn.start_ea) == ea ++ answer = [] ++ if at_start: ++ name = db.functions.get_name(fn) or f"sub_{ea:X}" ++ answer += [ ++ {"ea": hex(ea), "kind": "sep", "size": 0, "text": ""}, ++ {"ea": hex(ea), "kind": "sep", "size": 0, ++ "text": "; " + "=" * 15 + " S U B R O U T I N E " + "=" * 15}, ++ {"ea": hex(ea), "kind": "funchdr", "size": 0, ++ "text": name + " proc", "name": name}, ++ ] ++ item = row(ea) ++ if at_start: ++ item["name"] = None ++ elif annotate and item["kind"] == "code" and item.get("name"): ++ name = item["name"] ++ answer.append({"ea": hex(ea), "kind": "label", "size": 0, ++ "text": name + ":", "name": name}) ++ item["name"] = None ++ answer.append(item) ++ if item["kind"] == "data": answer += members(ea) ++ if fn is not None and ida_bytes.get_item_end(ea) >= int(fn.end_ea): ++ name = db.functions.get_name(fn) or f"sub_{int(fn.start_ea):X}" ++ answer += [ ++ {"ea": hex(ea), "kind": "funchdr", "size": 0, ++ "text": name + " endp", "name": name}, ++ {"ea": hex(ea), "kind": "sep", "size": 0, "text": "; " + "-" * 60}, ++ ] ++ return answer ++ ++ ea = ida_bytes.get_item_head(start) ++ if ea == ida_idaapi.BADADDR: ea = start ++ for _ in range(offset): ++ if ea >= hi: break ++ ea = advance(ea) ++ rows = [] ++ more = False ++ while ea != ida_idaapi.BADADDR and ea < hi: ++ if len(rows) >= count: ++ more = True; break ++ rows += rows_for(ea) ++ ea = advance(ea) ++ result = {"addr": a["addr"], "heads": rows, ++ "cursor": {"next": hex(ea)} if more else {"done": True}} ++result ++''' ++ ++ ++_DECOMP_MAP_HELPER = r''' ++def line_map(cfunc): ++ import ida_hexrays ++ answer = [] ++ for sl in cfunc.get_pseudocode(): ++ tagged, eas, seen = sl.line, [], set() ++ for x in range(len(tagged) + 1): ++ head = ida_hexrays.ctree_item_t(); item = ida_hexrays.ctree_item_t(); tail = ida_hexrays.ctree_item_t() ++ if not cfunc.get_line_item(tagged, x, False, head, item, tail): continue ++ text = item.dstr() or "" ++ try: ea = int(text.split(": ", 1)[0], 16) ++ except (ValueError, IndexError): continue ++ if ea not in seen: seen.add(ea); eas.append(ea) ++ answer.append(eas) ++ return answer ++''' ++ ++ ++_OPERATIONS: dict[str, str] = { ++ "list_funcs": r''' ++import fnmatch ++queries = a.get("queries") or [{}] ++q = queries[0] ++offset, count = max(0, int(q.get("offset", 0))), max(1, int(q.get("count", 500))) ++pattern = str(q.get("filter") or "").lower() ++if pattern and not any(ch in pattern for ch in "*?["): pattern = "*" + pattern + "*" ++rows = [] ++for fn in db.functions.get_all(): ++ name = db.functions.get_name(fn) or f"sub_{int(fn.start_ea):X}" ++ if pattern and not fnmatch.fnmatchcase(name.lower(), pattern): continue ++ rows.append({"addr": hex(int(fn.start_ea)), "name": name, ++ "size": int(fn.end_ea) - int(fn.start_ea)}) ++page = rows[offset:offset + count] ++result = {"result": [{"data": page, "next_offset": offset + len(page), "total": len(rows)}]} ++result ++''', ++ "disasm": r''' ++ea = int(str(a["addr"]), 16) ++fn = db.functions.get_at(ea) ++if fn is None: ++ result = {"instructions": [], "total_instructions": 0, "instruction_count": 0} ++else: ++ instructions = list(db.functions.get_instructions(fn)) ++ limit = max(1, int(a.get("max_instructions", len(instructions) or 1))) ++ rows = [{"addr": hex(int(insn.ea)), "instruction": db.instructions.get_disassembly(insn)} ++ for insn in instructions[:limit]] ++ result = {"instructions": rows, "total_instructions": len(instructions), ++ "instruction_count": len(instructions)} ++result ++''', ++ "file_regions": r''' ++import idaapi ++rows = [] ++for seg in db.segments.get_all(): ++ try: file_off = int(idaapi.get_fileregion_offset(seg.start_ea)) ++ except Exception: file_off = -1 ++ if file_off < 0 or file_off >= (1 << 48): file_off = -1 ++ rows.append({"start": hex(int(seg.start_ea)), "end": hex(int(seg.end_ea)), ++ "file_off": file_off, "name": db.segments.get_name(seg) or ""}) ++result = {"regions": rows} ++result ++''', ++ "read_raw": r''' ++import ida_bytes ++ea, size = int(str(a["addr"]), 16), max(0, int(a["size"])) ++raw = ida_bytes.get_bytes(ea, size) or b"" ++raw = raw[:size] + b"\xff" * max(0, size - len(raw)) ++data = bytearray(raw) ++for index, value in enumerate(data): ++ if value == 0xFF and not ida_bytes.is_loaded(ea + index): data[index] = 0 ++result = {"addr": a["addr"], "hex": bytes(data).hex(), "n": len(data)} ++result ++''', ++ "get_bytes": r''' ++rows = [] ++for region in a.get("regions", []): ++ ea, size = int(str(region["addr"]), 16), int(region["size"]) ++ raw = db.bytes.get_bytes_at(ea, size) or b"" ++ rows.append({"addr": region["addr"], "data": " ".join(f"{b:02x}" for b in raw)}) ++result = {"result": rows} ++result ++''', ++ "search_structs": r''' ++needle = str(a.get("filter") or "").lower() ++rows = [] ++for tif in db.types.get_all(): ++ name = tif.get_type_name() or "" ++ if not name or needle not in name.lower() or not tif.is_udt(): continue ++ members = list(db.types.get_udt_members(tif)) ++ rows.append({"name": name, "size": int(tif.get_size()), "is_union": bool(tif.is_union()), ++ "cardinality": len(members), "ordinal": int(tif.get_ordinal())}) ++result = {"result": rows} ++result ++''', ++ "type_inspect": r''' ++rows = [] ++for query in a.get("queries", []): ++ name = str(query.get("name") or "") ++ tif = db.types.get_by_name(name) ++ if tif is None: ++ rows.append({"name": name, "error": "type not found"}); continue ++ members = [{"name": m.name, "type": m.type.dstr() or str(m.type), ++ "offset": int(m.offset), "size": int(m.size)} ++ for m in db.types.get_udt_members(tif)] if tif.is_udt() else [] ++ rows.append({"name": name, "size": int(tif.get_size()), "is_union": bool(tif.is_union()), ++ "members": members}) ++result = {"result": rows} ++result ++''', ++ "declare_type": r''' ++import ida_typeinf ++decls = a.get("decls", "") ++if isinstance(decls, str): decls = [decls] ++rows = [] ++for declaration in decls: ++ try: ++ errors = int(db.types.parse_declarations(ida_typeinf.get_idati(), declaration)) ++ rows.append({"ok": errors == 0, **({} if errors == 0 else {"error": f"{errors} parse error(s)"})}) ++ except Exception as exc: ++ rows.append({"ok": False, "error": str(exc)}) ++result = {"result": rows} ++result ++''', ++ "del_type": r''' ++import ida_typeinf ++name = str(a["name"]) ++ok = bool(ida_typeinf.del_named_type(ida_typeinf.get_idati(), name, ida_typeinf.NTF_TYPE)) ++result = {"name": name, "deleted": ok, **({} if ok else {"error": f"Type {name!r} not found or could not be deleted"})} ++result ++''', ++ "func_types": r''' ++import ida_typeinf ++ea = int(str(a["addr"]), 16) ++fn = db.functions.get_at(ea) ++if fn is None: ++ result = {"addr": a["addr"], "error": "no function at address"} ++else: ++ pseudo = db.pseudocode.decompile(fn) ++ name = db.functions.get_name(fn) or "" ++ tif = pseudo.get_func_type() ++ try: prototype = ida_typeinf.print_tinfo("", 0, 0, ida_typeinf.PRTYPE_1LINE, tif, name, "") if tif else "" ++ except Exception: prototype = tif.dstr() if tif else "" ++ lvars = [{"name": var.name, "type": var.type_info.dstr() if var.type_info else "", ++ "is_arg": bool(var.is_arg)} for var in pseudo.local_variables] ++ result = {"addr": hex(int(fn.start_ea)), "name": name, ++ "prototype": (prototype or "").strip(), "lvars": lvars} ++result ++''', ++ "set_lvar_type": r''' ++import ida_typeinf ++ea, variable, declaration = int(str(a["addr"]), 16), str(a["variable"]), str(a["type"]) ++fn = db.functions.get_at(ea) ++if fn is None: ++ result = {"error": "no function at address"} ++else: ++ pseudo = db.pseudocode.decompile(fn) ++ var = pseudo.find_local_variable(variable) ++ if var is None: ++ result = {"error": f"local variable {variable!r} not found"} ++ else: ++ try: ++ tif = db.types.parse_one_declaration(ida_typeinf.get_idati(), declaration) ++ accepted = bool(var.set_type(tif)) ++ saved = bool(pseudo.save_local_variable_info(var, save_type=True)) if accepted else False ++ result = {"addr": hex(int(fn.start_ea)), "variable": variable, ++ "type": declaration, "ok": accepted and saved} ++ except Exception as exc: ++ result = {"error": f"bad type {declaration!r}: {exc}"} ++result ++''', ++ "set_type": r''' ++from ida_domain.types import TypeApplyFlags ++rows = [] ++for edit in a.get("edits", []): ++ ea = int(str(edit["addr"]), 16) ++ declaration = str(edit.get("signature") or edit.get("type") or "") ++ try: ++ ok = bool(db.types.apply_declaration_at(ea, declaration, TypeApplyFlags.DEFINITE)) ++ rows.append({"addr": hex(ea), "ok": ok, **({} if ok else {"error": "IDA rejected the type"})}) ++ except Exception as exc: ++ rows.append({"addr": hex(ea), "ok": False, "error": str(exc)}) ++result = {"result": rows} ++result ++''', ++ "data_type": r''' ++ea = int(str(a["addr"]), 16) ++try: ++ tif = db.types.get_at(ea) ++ fn = db.functions.get_at(ea) ++ result = {"addr": hex(ea), "name": db.names.get_at(ea) or "", ++ "type": tif.dstr() if tif else "", "size": int(db.heads.size(ea)) if db.heads.is_head(ea) else 0, ++ "is_func": bool(fn)} ++except Exception as exc: ++ result = {"addr": hex(ea), "error": str(exc)} ++result ++''', ++ "force_recompile": r''' ++import ida_hexrays ++rows = [] ++for item in a.get("items", []): ++ ea = int(str(item["addr"]), 16) ++ ida_hexrays.mark_cfunc_dirty(ea, False) ++ rows.append({"addr": hex(ea), "ok": True}) ++result = {"result": rows} ++result ++''', ++ "undefine": r''' ++import ida_bytes ++rows = [] ++for item in a.get("items", []): ++ ea = int(str(item["addr"]), 16) ++ size = max(1, int(item.get("size") or ida_bytes.get_item_size(ea) or 1)) ++ ok = bool(ida_bytes.del_items(ea, ida_bytes.DELIT_SIMPLE, size)) ++ rows.append({"addr": hex(ea), "ok": ok, **({} if ok else {"error": "delete items failed"})}) ++result = {"result": rows} ++result ++''', ++ "define_code": r''' ++import ida_ua ++rows = [] ++for item in a.get("items", []): ++ ea = int(str(item["addr"]), 16); size = int(ida_ua.create_insn(ea)) ++ rows.append({"addr": hex(ea), "ok": size > 0, "size": size, ++ **({} if size > 0 else {"error": "instruction did not decode"})}) ++result = {"result": rows} ++result ++''', ++ "define_func": r''' ++rows = [] ++for item in a.get("items", []): ++ ea = int(str(item["addr"]), 16); ok = bool(db.functions.create(ea)) ++ rows.append({"addr": hex(ea), "ok": ok, **({} if ok else {"error": "IDA refused the function"})}) ++result = {"result": rows} ++result ++''', ++ "make_data": r''' ++import ida_bytes, ida_idaapi, ida_typeinf ++from ida_domain.types import TypeApplyFlags ++rows = [] ++for item in a.get("items", []): ++ ea, declaration = int(str(item["addr"]), 16), str(item["type"]) ++ try: ++ tif = db.types.parse_one_declaration(ida_typeinf.get_idati(), declaration) ++ size = max(1, int(tif.get_size())) ++ saved_names = [(addr, name) for addr, name in db.names.get_all() ++ if ea <= int(addr) < ea + size] ++ ida_bytes.del_items(ea, ida_bytes.DELIT_EXPAND | ida_bytes.DELIT_DELNAMES, ++ max(size, int(ida_bytes.get_item_size(ea) or 1))) ++ created = bool(ida_bytes.create_data(ea, ida_bytes.FF_BYTE, size, ida_idaapi.BADADDR)) ++ ok = created and bool(db.types.apply_at(tif, ea, TypeApplyFlags.DEFINITE)) ++ for address, name in saved_names: ++ db.names.set_name(int(address), name) ++ if ok and item.get("name"): ok = bool(db.names.set_name(ea, str(item["name"]))) ++ rows.append({"addr": hex(ea), "ok": ok, "size": size, ++ **({} if ok else {"error": "IDA rejected the data type"})}) ++ except Exception as exc: ++ rows.append({"addr": hex(ea), "ok": False, "error": str(exc)}) ++result = {"result": rows} ++result ++''', ++ "make_string": r''' ++from ida_domain.strings import StringType ++ea, length = int(str(a["addr"]), 16), max(0, int(a.get("length", 0))) ++kind = {"c": StringType.C, "c16": StringType.C_16, "c32": StringType.C_32, ++ "pascal": StringType.PASCAL}.get(str(a.get("kind", "c")).lower(), StringType.C) ++import ida_bytes ++try: ++ ida_bytes.del_items(ea, ida_bytes.DELIT_SIMPLE, length if length > 0 else 1) ++except Exception: ++ pass ++try: ++ ok = bool(db.bytes.create_string_at(ea, length or None, kind)) ++ text = db.bytes.get_string_at(ea) or "" if ok else "" ++ result = {"addr": hex(ea), "ok": ok, "size": int(db.heads.size(ea)) if ok else 0, "text": text} ++except Exception as exc: ++ result = {"addr": hex(ea), "ok": False, "error": str(exc)} ++result ++''', ++ "list_strings": r''' ++from ida_domain.strings import StringListConfig ++offset, count, min_len = max(0, int(a.get("offset", 0))), max(1, int(a.get("count", 2000))), max(1, int(a.get("min_len", 4))) ++if offset == 0 or a.get("refresh"): ++ from ida_domain.strings import StringType ++ db.strings.rebuild(StringListConfig(string_types=list(StringType), min_len=min_len, ++ only_ascii_7bit=False)) ++items = list(db.strings.get_all()) ++page = items[offset:offset + count] ++rows = [] ++for item in page: ++ try: text = str(item) ++ except Exception: text = item.contents.decode("utf-8", "replace") if item.contents else "" ++ rows.append({"addr": hex(int(item.address)), "text": text, "len": int(item.length), "type": item.type.name}) ++result = {"strings": rows, "total": len(items), "next_offset": offset + len(rows)} ++result ++''', ++ "list_linkage": r''' ++imports = [{"addr": hex(int(item.address)), "name": item.name, "module": item.module_name} ++ for item in db.imports.get_all_imports() if item.name] ++exports = [{"addr": hex(int(item.address)), "name": item.name, "ordinal": int(item.ordinal)} ++ for item in db.entries.get_all() if item.name] ++result = {"imports": imports, "exports": exports, ++ "n_imports": len(imports), "n_exports": len(exports)} ++result ++''', ++ "lookup_funcs": r''' ++rows = [] ++for query in a.get("queries", []): ++ raw = str(query) ++ try: ea = int(raw, 16) ++ except ValueError: ++ fn = db.functions.get_by_name(raw); ea = int(fn.start_ea) if fn else None ++ else: fn = db.functions.get_at(ea) ++ if fn is None: ++ rows.append({"query": raw, "fn": None}) ++ else: ++ rows.append({"query": raw, "fn": {"addr": hex(int(fn.start_ea)), ++ "name": db.functions.get_name(fn) or f"sub_{int(fn.start_ea):X}", ++ "size": int(fn.end_ea) - int(fn.start_ea)}}) ++result = {"result": rows} ++result ++''', ++ "resolve_names": r''' ++import ida_idaapi, ida_name ++rows = [] ++for query in a.get("queries", []): ++ name = str(query).strip(); ea = ida_name.get_name_ea(ida_idaapi.BADADDR, name) ++ rows.append({"query": name, "ea": hex(int(ea)) if ea != ida_idaapi.BADADDR else None}) ++result = {"result": rows} ++result ++''', ++ "xref_types": r''' ++queries = a.get("queries") or [] ++all_results = [] ++for query in queries: ++ ea, direction = int(str(query["addr"]), 16), str(query.get("direction", "both")) ++ refs = [] ++ if direction in ("to", "both"): refs += list(db.xrefs.to_ea(ea)) ++ if direction in ("from", "both"): refs += list(db.xrefs.from_ea(ea)) ++ rows, seen = [], set() ++ for ref in refs: ++ key = (int(ref.from_ea), int(ref.to_ea), int(ref.type)) ++ if query.get("dedup") and key in seen: continue ++ seen.add(key) ++ fn = db.functions.get_at(int(ref.from_ea)) ++ kind = ("call" if ref.is_call else "jump" if ref.is_jump else "flow" if ref.is_flow ++ else "read" if ref.is_read else "write" if ref.is_write else ref.type.name.lower()) ++ row = {"from": hex(int(ref.from_ea)), "to": hex(int(ref.to_ea)), ++ "type": "code" if ref.is_code else "data", "kind": kind} ++ if query.get("include_fn") and fn is not None: ++ row["fn"] = {"addr": hex(int(fn.start_ea)), "name": db.functions.get_name(fn) or ""} ++ rows.append(row) ++ if len(rows) >= int(query.get("count", 2000)): break ++ all_results.append({"data": rows}) ++result = {"result": all_results} ++result ++''', ++ "xref_query": r''' ++queries = a.get("queries") or [] ++all_results = [] ++for query in queries: ++ ea, direction = int(str(query["addr"]), 16), str(query.get("direction", "both")) ++ refs = [] ++ if direction in ("to", "both"): refs += list(db.xrefs.to_ea(ea)) ++ if direction in ("from", "both"): refs += list(db.xrefs.from_ea(ea)) ++ rows = [] ++ for ref in refs[:int(query.get("count", 2000))]: ++ fn = db.functions.get_at(int(ref.from_ea)) ++ row = {"from": hex(int(ref.from_ea)), "to": hex(int(ref.to_ea)), ++ "type": "code" if ref.is_code else "data"} ++ if query.get("include_fn") and fn is not None: ++ row["fn"] = {"addr": hex(int(fn.start_ea)), "name": db.functions.get_name(fn) or ""} ++ rows.append(row) ++ all_results.append({"data": rows}) ++result = {"result": all_results} ++result ++''', ++ "set_comments": r''' ++rows = [] ++for item in a.get("items", []): ++ ea, text = int(str(item["addr"]), 16), str(item.get("comment") or "") ++ try: ++ if text: ok = bool(db.comments.set_at(ea, text)) ++ else: db.comments.delete_at(ea); ok = True ++ rows.append({"addr": hex(ea), "ok": ok}) ++ except Exception as exc: ++ rows.append({"addr": hex(ea), "ok": False, "error": str(exc)}) ++result = {"result": rows} ++result ++''', ++ "rename": r''' ++import ida_idaapi, ida_name, ida_typeinf ++batch = a.get("batch") or {} ++out = {}; ok_count = failed = 0 ++for category, edit in batch.items(): ++ try: ++ if category == "func": ++ ea, new = int(str(edit["addr"]), 16), str(edit["name"]) ++ fn = db.functions.get_at(ea); ok = bool(fn and db.functions.set_name(fn, new)) ++ elif category == "data": ++ new = str(edit.get("new") or "") ++ if edit.get("addr") is not None: ea = int(str(edit["addr"]), 16) ++ else: ea = int(ida_name.get_name_ea(ida_idaapi.BADADDR, str(edit.get("old") or ""))) ++ ok = bool(db.names.set_name(ea, new)) ++ elif category in ("local", "stack"): ++ ea, old, new = int(str(edit["func_addr"]), 16), str(edit["old"]), str(edit["new"]) ++ pseudo = db.pseudocode.decompile(ea); var = pseudo.find_local_variable(old) ++ if var is None: ok = False ++ else: ++ var.set_user_name(new) ++ ok = bool(pseudo.save_local_variable_info(var, save_name=True)) ++ else: ++ raise ValueError(f"unsupported rename category: {category}") ++ row = {"ok": ok, **({} if ok else {"error": "IDA rejected the name"})} ++ except Exception as exc: ++ row = {"ok": False, "error": str(exc)} ++ out[category] = [row] ++ if row["ok"]: ok_count += 1 ++ else: failed += 1 ++out["summary"] = {"ok": ok_count, "failed": failed} ++result = out ++result ++''', ++} ++ ++ ++_OPERATIONS["decompile"] = _DECOMP_MAP_HELPER + r''' ++ea = int(str(a["addr"]), 16) ++fn = db.functions.get_at(ea) ++if fn is None: ++ result = {"error": f"no function at {ea:#x}"} ++else: ++ pseudo = db.pseudocode.decompile(fn) ++ mapping = line_map(pseudo.raw_cfunc) ++ plain = pseudo.to_text() ++ marked = [line + (f" /*0x{eas[0]:X}*/" if eas else "") ++ for line, eas in zip(plain, mapping)] ++ import ida_name ++ refs, seen = [], set() ++ for expr in pseudo.find_objects(): ++ target = int(expr.obj_ea) ++ if target in seen or not (db.is_valid_ea(target) or db.is_private_ea(target)): continue ++ seen.add(target) ++ name = expr.obj_name or ida_name.get_name(target) or "" ++ try: string = db.bytes.get_string_at(target) if db.is_valid_ea(target) else None ++ except Exception: string = None ++ refs.append({"addr": hex(target), "name": name, "string": string}) ++ result = {"addr": hex(int(fn.start_ea)), "code": "\n".join(marked), "refs": refs} ++result ++''' ++ ++_OPERATIONS["decomp_map"] = _DECOMP_MAP_HELPER + r''' ++ea = int(str(a["addr"]), 16) ++fn = db.functions.get_at(ea) ++if fn is None: ++ result = {"error": f"no function at {ea:#x}"} ++else: ++ pseudo = db.pseudocode.decompile(fn) ++ mapping = line_map(pseudo.raw_cfunc) ++ result = {"addr": hex(int(fn.start_ea)), ++ "lines": [{"ea": hex(eas[0]) if eas else None, ++ "eas": [hex(item) for item in eas]} for eas in mapping]} ++result ++''' ++ ++_OPERATIONS["define_code_run"] = r''' ++import ida_bytes, ida_idp, ida_segment, ida_ua, idaapi ++ea, limit = int(str(a["addr"]), 16), max(1, min(int(a.get("limit", 20000)), 200000)) ++seg = ida_segment.getseg(ea) ++if seg is None: ++ result = {"addr": a["addr"], "error": "no segment", "count": 0} ++else: ++ start, count, stopped, hi = ea, 0, "limit", int(seg.end_ea) ++ while count < limit: ++ if ea >= hi: stopped = "segment"; break ++ flags = ida_bytes.get_flags(ea) ++ if ida_bytes.is_code(flags) or ida_bytes.is_data(flags): stopped = "defined"; break ++ size = int(ida_ua.create_insn(ea)) ++ if size <= 0: stopped = "undecodable"; break ++ count += 1 ++ insn = ida_ua.insn_t() ++ if ida_ua.decode_insn(insn, ea) > 0: ++ try: is_ret = bool(ida_idp.is_ret_insn(insn)) ++ except Exception: is_ret = False ++ if is_ret or (insn.get_canon_feature() & idaapi.CF_STOP): ++ ea += size; stopped = "flow"; break ++ ea += size ++ result = {"start": hex(start), "end": hex(ea), "count": count, "stopped": stopped} ++result ++''' ++ ++_OPERATIONS["define_func_run"] = r''' ++import ida_bytes, ida_funcs, ida_segment ++ea = int(str(a["addr"]), 16) ++fn = db.functions.get_at(ea) ++if fn is not None and int(fn.start_ea) == ea: ++ result = {"addr": hex(ea), "ok": True, "start": hex(ea), "end": hex(int(fn.end_ea)), "how": "existed"} ++else: ++ automatic = bool(db.functions.create(ea)) ++ if not automatic: ++ seg = db.segments.get_at(ea); end = ea; hi = int(seg.end_ea) if seg else ea ++ while end < hi and ida_bytes.is_code(ida_bytes.get_flags(end)): ++ nxt = int(ida_bytes.get_item_end(end)) ++ if nxt <= end: break ++ end = nxt ++ ok = bool(end > ea and ida_funcs.add_func(ea, end)) ++ else: ok = True ++ fn = db.functions.get_at(ea) ++ result = ({"addr": hex(ea), "ok": True, "start": hex(int(fn.start_ea)), ++ "end": hex(int(fn.end_ea)), "how": "auto" if automatic else "explicit-end"} ++ if ok and fn is not None else ++ {"addr": hex(ea), "ok": False, "error": f"IDA refused a function at {ea:#x}"}) ++result ++''' ++ ++_OPERATIONS["set_thumb"] = r''' ++import ida_bytes, ida_ida, ida_idp, ida_segment, ida_segregs ++ea = int(str(a["addr"]), 16); treg = ida_idp.str2reg("T") ++seg = ida_segment.getseg(ea) ++if treg is None or treg < 0: ++ result = {"addr": hex(ea), "error": "no T register (not an ARM database)"} ++elif seg is None: ++ result = {"addr": hex(ea), "error": "no segment"} ++else: ++ current = ida_segregs.get_sreg(ea, treg) ++ current = 0 if current in (None, 0xFFFFFFFF, -1) else int(current) ++ want = {"on": 1, "off": 0}.get(str(a.get("mode", "toggle")).lower(), 0 if current else 1) ++ changed = False ++ if want and seg.bitness != 1: ++ ida_segment.set_segm_addressing(seg, 1); changed = True ++ size = max(int(ida_bytes.get_item_size(ea)), 2) ++ ida_bytes.del_items(ea, 0, size) ++ ok = bool(ida_segregs.split_sreg_range(ea, treg, want, ida_segregs.SR_user)) ++ now = ida_segregs.get_sreg(ea, treg) ++ result = {"addr": hex(ea), "thumb": bool(now), "was": bool(current), "ok": ok, ++ "bitness": ida_segment.getseg(ea).bitness, "forced_32bit": changed, ++ "db_64bit": bool(ida_ida.inf_get_app_bitness() == 64 and want)} ++result ++''' ++ ++_OPERATIONS["thumb_scan"] = r''' ++import ida_bytes, ida_funcs, ida_idp, ida_segment, ida_segregs, ida_ua ++lo, hi = int(str(a["start"]), 16), int(str(a["end"]), 16) ++apply, limit = bool(a.get("apply", True)), int(a.get("limit", 512)) ++treg = ida_idp.str2reg("T"); found = []; applied = 0; cursor = lo ++while cursor + 4 <= hi and len(found) < limit: ++ at = cursor; value = int(ida_bytes.get_dword(cursor)); cursor += 4 ++ if not value & 1: continue ++ target = value & ~1; seg = ida_segment.getseg(target) ++ if seg is None or not (seg.perm & ida_segment.SEGPERM_EXEC or seg.perm == 0): continue ++ flags = ida_bytes.get_flags(target) ++ if ida_bytes.is_data(flags): continue ++ item = {"at": hex(at), "value": hex(value), "target": hex(target), ++ "was_code": bool(ida_bytes.is_code(flags))}; found.append(item) ++ if not apply: continue ++ if treg is not None and treg >= 0: ida_segregs.split_sreg_range(target, treg, 1, ida_segregs.SR_user) ++ if not ida_bytes.is_code(ida_bytes.get_flags(target)): ++ ida_bytes.del_items(target, 0, 2) ++ if ida_ua.create_insn(target) <= 0: item["decoded"] = False; continue ++ item["decoded"] = True; item["function"] = bool(db.functions.get_at(target) or db.functions.create(target)); applied += 1 ++result = {"start": hex(lo), "end": hex(hi), "found": found, "applied": applied, "n": len(found)} ++result ++''' ++ ++_OPERATIONS["decomp_error"] = r''' ++import ida_hexrays, ida_ida ++ea = int(str(a["addr"]), 16); fn = db.functions.get_at(ea) ++result = {"addr": hex(ea), "bitness": ida_ida.inf_get_app_bitness()} ++if fn is None: ++ result["reason"] = "no function here" ++else: ++ try: ++ failure = ida_hexrays.hexrays_failure_t(); cfunc = ida_hexrays.decompile_func(fn, failure) ++ if cfunc is not None: result["reason"] = "" ++ else: ++ result.update({"reason": failure.desc() or f"error {failure.code}", ++ "code": int(failure.code), "errea": hex(int(failure.errea))}) ++ except Exception as exc: result["reason"] = f"{type(exc).__name__}: {exc}" ++result ++''' ++ ++ ++class CodeModeClient: ++ """A leased GUI/idalib database accessed through ``ida_codemode``.""" ++ ++ def __init__( ++ self, ++ binary_path: str, ++ *, ++ ttl: int = 0, ++ load_args: str = "", ++ processor: str | None = None, ++ loading_address: int | None = None, ++ file_type: str | None = None, ++ output_database: str | None = None, ++ spawn: bool = True, ++ new_database: bool = False, ++ ) -> None: ++ del ttl # managed-worker lifetime is lease-based, not idle-TTL based ++ self._path = os.path.abspath(os.path.expanduser(binary_path)) ++ parsed_processor, parsed_address, parsed_file_type = _parse_load_args(load_args) ++ self._processor = processor or parsed_processor ++ self._loading_address = loading_address if loading_address is not None else parsed_address ++ self._file_type = file_type or parsed_file_type ++ self._output_database = output_database ++ self._spawn = spawn ++ self._new_database = new_database ++ self._handle: DatabaseHandle | None = None ++ self._last_entry: RegistryEntry | None = None ++ self._connect_lock = threading.Lock() ++ ++ def connect(self, timeout: float = 1800.0, progress=None) -> "CodeModeClient": ++ with self._connect_lock: ++ if self._handle is not None and self._handle.connected: ++ return self ++ if progress: ++ progress(f"discovering Code Mode database for {os.path.basename(self._path)}…") ++ try: ++ # A Ctrl+L reload releases its current managed-worker lease, but ++ # that worker remains registered during Code Mode's final-lease ++ # grace period. Retry only that known handoff window. A GUI or ++ # another long-lived client remains busy and yields a clear ++ # failure rather than being modified underneath its owner. ++ deadline = time.monotonic() + min(timeout, 60.0) ++ while True: ++ try: ++ handle = DatabaseHandle.open( ++ self._path, ++ spawn=self._spawn, ++ timeout=max(0.1, timeout), ++ output_database=self._output_database, ++ processor=self._processor, ++ loading_address=self._loading_address, ++ file_type=self._file_type, ++ new_database=self._new_database, ++ ) ++ break ++ except IdbBusy: ++ if not self._new_database or time.monotonic() >= deadline: ++ raise ++ if progress: ++ progress("waiting for the previous Code Mode lease to close…") ++ # Remember the record before managed shutdown withdraws ++ # its JSON. The lifetime lock remains held until IDA has ++ # actually closed the IDB; waiting on it avoids racing a ++ # replacement worker into the old process's file lock. ++ expected = canonical_path( ++ self._output_database or expected_idb_path(self._path) ++ ) ++ owners = [item.entry for item in scan_instances(timeout=0.5) ++ if item.entry.idb_key == idb_key(expected)] ++ if owners: ++ self._wait_for_entry_release( ++ owners[0], max(0.0, deadline - time.monotonic()) ++ ) ++ else: ++ time.sleep(0.2) ++ if progress: ++ backend = handle.entry.backend ++ progress(f"attached to {backend} database; waiting for auto-analysis…") ++ handle.wait_autoanalysis(timeout=timeout) ++ except Exception as exc: # normalize the dependency's transport errors ++ raise self._connection_error(exc) from exc ++ self._handle = handle ++ self._last_entry = handle.entry ++ return self ++ ++ @staticmethod ++ def _connection_error(exc: BaseException) -> IDAConnectionError: ++ return IDAConnectionError(str(exc) or type(exc).__name__) ++ ++ @property ++ def connected(self) -> bool: ++ return self._handle is not None and self._handle.connected ++ ++ @property ++ def pid(self) -> int | None: ++ return self._handle.entry.pid if self._handle is not None else None ++ ++ @property ++ def backend(self) -> str | None: ++ return self._handle.entry.backend if self._handle is not None else None ++ ++ def execute_python(self, code: str, *, timeout: float | None = None) -> Any: ++ if not self.connected: ++ self.connect() ++ handle = self._handle ++ if handle is None: ++ raise IDAConnectionError("Code Mode database is not connected") ++ try: ++ response = handle.execute_python(code, timeout=timeout) ++ except RemoteError as exc: ++ details = exc.details or {} ++ message = str(exc) ++ if details.get("traceback"): ++ message += f"\n{details['traceback']}" ++ if exc.code == "operation_timeout": ++ raise IDATimeoutError(message) from exc ++ raise IDAToolError("execute_python", message) from exc ++ except (InstanceDisconnectedError, ClientError) as exc: ++ raise self._connection_error(exc) from exc ++ if not isinstance(response, dict) or "result" not in response: ++ raise IDAToolError("execute_python", "Code Mode returned an invalid execution result") ++ return response["result"] ++ ++ def invoke(self, operation: str, *, timeout: float | None = None, **args) -> Any: ++ """Execute one TUI domain operation through Code Mode.""" ++ if operation in ("idb_save", "save"): ++ return self.save_database() ++ if operation in ("server_health", "ping", "health", "state"): ++ return self.health() ++ body = _HEADS if operation == "heads" else _OPERATIONS.get(operation) ++ if body is None: ++ raise IDAToolError(operation, f"unknown ida-tui Code Mode operation: {operation}") ++ try: ++ return self.execute_python(_script(args, body), timeout=timeout) ++ except IDAToolError as exc: ++ if exc.tool == "execute_python": ++ raise IDAToolError(operation, exc.message) from exc ++ raise ++ ++ # Temporary source compatibility for external drivers/tests that used the ++ # old WorkerClient. Application code uses the accurately named invoke(). ++ call = invoke ++ ++ def save_database(self) -> dict[str, Any]: ++ if not self.connected: ++ self.connect() ++ handle = self._handle ++ if handle is None: ++ raise IDAConnectionError("Code Mode database is not connected") ++ try: ++ return handle.save_database() ++ except RemoteError as exc: ++ raise IDAToolError("save_database", str(exc)) from exc ++ except (InstanceDisconnectedError, ClientError) as exc: ++ raise self._connection_error(exc) from exc ++ ++ def health(self) -> dict[str, Any]: ++ if not self.connected: ++ self.connect() ++ assert self._handle is not None ++ entry = self._handle.entry ++ module = os.path.basename(entry.exe_path or entry.idb_path or self._path) ++ return { ++ "ok": self._handle.connected, ++ "module": module, ++ "backend": entry.backend, ++ "record_id": entry.record_id, ++ "input_path": entry.exe_path, ++ "idb_path": entry.idb_path, ++ } ++ ++ def keepalive(self, interval: float = 120.0) -> _NoopKeepAlive: ++ del interval ++ return _NoopKeepAlive() ++ ++ def resolve_db(self) -> str: ++ if not self.connected: ++ self.connect() ++ assert self._handle is not None ++ return self._handle.entry.record_id ++ ++ def set_db(self, db: str | None) -> None: ++ del db # one handle is permanently bound to one registered database ++ ++ def list_sessions(self) -> list[Session]: ++ if not self.connected: ++ self.connect() ++ assert self._handle is not None ++ entry = self._handle.entry ++ path = entry.exe_path or entry.idb_path or self._path ++ return [Session(session_id=entry.record_id, filename=os.path.basename(path), ++ input_path=path, is_active=True)] ++ ++ def close(self, grace: float = 0.0) -> None: ++ del grace ++ with self._connect_lock: ++ handle, self._handle = self._handle, None ++ if handle is not None: ++ self._last_entry = handle.entry ++ handle.close() # release our lease; never close a GUI/other client's DB ++ ++ @staticmethod ++ def _wait_for_entry_release(entry: RegistryEntry, timeout: float) -> bool: ++ path = REGISTRY_DIR / f"{entry.record_id}.lock" ++ deadline = time.monotonic() + max(0.0, timeout) ++ while True: ++ lock = FileLock(path) ++ try: ++ if lock.try_acquire(): ++ return True ++ except OSError: ++ pass ++ finally: ++ lock.close() ++ if time.monotonic() >= deadline: ++ return False ++ time.sleep(min(0.1, deadline - time.monotonic())) ++ ++ def wait_released(self, timeout: float = 45.0) -> bool: ++ """Wait until a managed instance releases its lifetime lock. ++ ++ Normal application shutdown must not wait: another client may retain the ++ worker. This is an explicit test/maintenance helper for deleting a ++ temporary IDB safely after this client closes. GUI instances return ++ ``False`` immediately because clients never own their lifetime. ++ """ ++ entry = self._last_entry ++ if entry is None or entry.backend != "idalib": ++ return False ++ return self._wait_for_entry_release(entry, timeout) ++ ++ def __enter__(self) -> "CodeModeClient": ++ return self.connect() ++ ++ def __exit__(self, *exc) -> None: ++ self.close() +diff --git a/idatui/domain.py b/idatui/domain.py +index 97b042d..2d6500e 100644 +--- a/idatui/domain.py ++++ b/idatui/domain.py +@@ -1,19 +1,15 @@ +-"""Domain / paging layer: address-centric models over the raw MCP client. ++"""Domain / paging layer: address-centric models over IDA Code Mode. + + This is where the "millions of lines" problem is solved, so the TUI widgets only + ever see a viewport-sized slice. Every hard-won constraint from + ``docs/PAGING_FINDINGS.md`` is encoded here: + +-* Per-call caps are silent (over the cap the server returns 10, not a clamp), so +- we clamp page sizes ourselves: ``LIST_PAGE`` / ``DISASM_BLOCK`` <= the caps. +-* ``next_offset`` is unreliable; we paginate by advancing ``len(data)``. +-* ``disasm offset=N`` is O(N) with no resumable cursor, so windowed disassembly +- is **block-cached** (revisits are free) and **prefetches** the next block on a +- background thread (the client is concurrency-safe). +-* ``include_total`` scans the whole function (~200ms on monsters); totals are +- fetched once and cached. +-* ``decompile`` can hard-fail on huge functions as a *soft* error (``code`` is +- null); that is surfaced as data, not an exception. ++* Page sizes remain bounded so remote execution returns viewport-scale JSON. ++* Pagination advances by the number of rows actually returned. ++* Deep head walks are block-cached (revisits are free) and neighboring blocks ++ prefetch through the thread-safe Code Mode client. ++* Expensive function totals are fetched once and cached. ++* Decompilation failures are surfaced as data, not application crashes. + + Everything here is synchronous and thread-safe. The TUI runs these calls from + Textual worker threads; the internal prefetch pool is separate and small. +@@ -22,10 +18,8 @@ Textual worker threads; the internal prefetch pool is separate and small. + from __future__ import annotations + + import bisect +-import json + import re + import threading +-import urllib.request + from concurrent.futures import ThreadPoolExecutor + from dataclasses import dataclass, field, replace + from typing import Callable, TYPE_CHECKING +@@ -33,7 +27,7 @@ from typing import Callable, TYPE_CHECKING + from .errors import IDAToolError + + if TYPE_CHECKING: # type hint only +- from .worker_client import WorkerClient # noqa: F401 ++ from .codemode_client import CodeModeClient + + # Clamps derived from measured caps (list ~700, disasm ~500). Margin included. + LIST_PAGE = 500 +@@ -63,7 +57,7 @@ class Func: + def from_raw(cls, d: dict) -> "Func": + addr = _as_int(d["addr"]) + name = d.get("name") +- # An unnamed function (server returns null/empty) must still have a ++ # An unnamed function must still have a + # usable string name — synthesize IDA's sub_ADDR so every consumer + # (palette, sort, rename prefill) can treat name as a str. + if not name: +@@ -91,7 +85,7 @@ class Line: + + @dataclass(frozen=True) + class Head: +- """One flat-listing item (from the ``heads`` server tool): a code ++ """One flat-listing item from the Code Mode ``heads`` operation: a code + instruction, a data item, or an undefined byte run.""" + + ea: int +@@ -101,7 +95,7 @@ class Head: + name: str | None = None + raw: bytes | None = None # opcode/item bytes (filled in for code by the model) + #: [(kind, text)] from IDA's own colour tags — mnem/reg/num/name/str/punct/… +- #: None when the worker didn't provide them (older worker, or the spans ++ #: None when Code Mode didn't provide them (or the spans + #: disagreed with the plain text, in which case the text wins). + spans: tuple[tuple[str, str], ...] | None = None + +@@ -240,7 +234,7 @@ class FunctionIndex: + """A lazily-paginated, cached view of the function list. + + Loads pages of ``LIST_PAGE`` on demand, advancing by ``len(data)`` (never by +- ``next_offset``). A single index instance corresponds to one server-side ++ ``next_offset``). A single index instance corresponds to one remote + ``filter`` glob (``None`` = all functions). + """ + +@@ -260,7 +254,7 @@ class FunctionIndex: + query: dict = {"offset": offset, "count": LIST_PAGE} + if self.filter: + query["filter"] = self.filter +- data = _query_data(self._prog.client.call("list_funcs", queries=[query])) ++ data = _query_data(self._prog.client.invoke("list_funcs", queries=[query])) + added = 0 + with self._lock: + for d in data: +@@ -370,7 +364,7 @@ class DisasmModel: + code function this equals the heads row count that backs the lines.""" + if self._total is not None: + return self._total +- payload = self._prog.client.call( ++ payload = self._prog.client.invoke( + "disasm", addr=hex(self.ea), max_instructions=1, include_total=True + ) + total = payload.get("total_instructions") +@@ -431,7 +425,7 @@ class DisasmModel: + # The function disasm view is a listing filtered to the function: fetch a + # block of heads (one per instruction for code). Over-fetch one row so + # the block knows where its last instruction ends (opcode-byte sizing). +- payload = self._prog.client.call( ++ payload = self._prog.client.invoke( + "heads", addr=hex(self.ea), offset=b * self.BLOCK, + count=self.BLOCK + 1, **self._end_kw(), + ) +@@ -572,15 +566,15 @@ class ListingModel: + """A flat, IDA-style disassembly *listing* over one segment: code, data and + undefined heads interleaved, unlike ``DisasmModel`` (one function, code only). + +- Backed by the injected ``heads`` server tool, which walks item heads and +- renders each via ``generate_disasm_line``. The segment is walked lazily in ++ Backed by the Code Mode adapter's ``heads`` operation, which walks item heads ++ and renders each via ``generate_disasm_line``. The segment is walked lazily in + forward pages (``FunctionIndex`` style); line index == position in the walked + head list. Random access to an address is O(distance-from-seg-start) the + first time (then cached) — the same tradeoff as ``disasm offset=N``. Grows + on demand as the viewport scrolls. Synchronous + thread-safe. + """ + +- PAGE = 500 # heads per server call (well under the tool's 2000 cap) ++ PAGE = 500 # viewport-scale heads per Code Mode execution + + def __init__(self, program: "Program", seg_start: int, seg_end: int, + name: str | None = None): +@@ -654,7 +648,7 @@ class ListingModel: + if self._done or self._next is None: + return 0 + frm = self._next +- payload = self._prog.client.call( ++ payload = self._prog.client.invoke( + "heads", addr=hex(frm), count=self.PAGE, annotate=True) + rows = payload.get("heads", []) if isinstance(payload, dict) else [] + cur = payload.get("cursor", {}) if isinstance(payload, dict) else {} +@@ -956,7 +950,7 @@ class HexModel: + class Program: + """The bound analysis session: models, caches, and a small prefetch pool.""" + +- def __init__(self, client: "WorkerClient", prefetch_workers: int = 2): ++ def __init__(self, client: "CodeModeClient", prefetch_workers: int = 2): + self.client = client + self._pool = ThreadPoolExecutor( + max_workers=prefetch_workers, thread_name_prefix="idatui-prefetch" +@@ -973,7 +967,7 @@ class Program: + self._sections: list[tuple[int, int, str]] | None = None + self._fileregions: list[tuple[int, int, int]] | None = None + self._hexmodel: "HexModel | None" = None +- self._no_read_raw = False # set if the server lacks the read_raw tool ++ self._no_read_raw = False # compatibility fallback for alternate clients + self._lock = threading.Lock() + + # -- prefetch plumbing ------------------------------------------------- # +@@ -1000,17 +994,14 @@ class Program: + """Sorted raw segment map [(start, end, file_off, name)] — the single + source for sections()/file_regions()/image_range. Cached. + +- Uses the injected ``file_regions`` tool (a plain segment walk, ~ms). +- This deliberately AVOIDS ``survey_binary``, which also computes function +- counts / strings / stats and takes *seconds* on a large IDB (it was the +- cause of the multi-second hex-pane open). Falls back to survey_binary +- only if the injected tool is missing. ++ Uses the Code Mode adapter's ``file_regions`` operation (a plain segment ++ walk, ~ms), avoiding broad binary surveys on the hex-pane open path. + """ + if self._segments_cache is not None: + return self._segments_cache + segs: list[tuple[int, int, int, str]] = [] + try: +- r = self.client.call("file_regions") ++ r = self.client.invoke("file_regions") + for d in (r.get("regions", []) if isinstance(r, dict) else []): + if isinstance(d, dict) and "start" in d: + segs.append((_as_int(d["start"]), _as_int(d["end"]), +@@ -1019,7 +1010,7 @@ class Program: + segs = [] + if not segs: # older server without file_regions -> survey_binary (slow) + try: +- sb = self.client.call("survey_binary") ++ sb = self.client.invoke("survey_binary") + for s in (sb.get("segments", []) if isinstance(sb, dict) else []): + try: + segs.append((_as_int(s["start"]), _as_int(s["end"]), -1, +@@ -1061,8 +1052,7 @@ class Program: + + def file_regions(self) -> list[tuple[int, int, int]]: + """Sorted [(start, end, file_off)] mapping loaded segments to raw file +- offsets (file_off == -1 for non-file-backed, e.g. .bss). Cached; needs +- the injected ``file_regions`` server tool.""" ++ offsets (file_off == -1 for non-file-backed, e.g. .bss). Cached.""" + if self._fileregions is not None: + return self._fileregions + regions = [(s, e, fo) for s, e, fo, _nm in self._segments()] +@@ -1080,15 +1070,14 @@ class Program: + def read_bytes(self, ea: int, n: int) -> bytes: + """Raw bytes [ea, ea+n) from IDA (gaps read as zero). + +- Fast path: the injected ``read_raw`` tool returns one contiguous hex +- string (C-speed both ends). Falls back to the stock ``get_bytes`` (a +- per-byte '0x..'-with-spaces string) on an older server without it. ++ The Code Mode adapter returns one contiguous hex string (C-speed in IDA). ++ A legacy ``get_bytes`` decoding fallback remains for alternate clients. + """ + if n <= 0: + return b"" + if not self._no_read_raw: + try: +- r = self.client.call("read_raw", addr=hex(ea), size=int(n)) ++ r = self.client.invoke("read_raw", addr=hex(ea), size=int(n)) + h = r.get("hex") if isinstance(r, dict) else None + if isinstance(h, str): + out = bytes.fromhex(h) +@@ -1102,7 +1091,7 @@ class Program: + except (ValueError, KeyError): + pass # malformed hex -> fall through to the legacy decoder + try: +- r = self.client.call("get_bytes", regions=[{"addr": hex(ea), "size": int(n)}]) ++ r = self.client.invoke("get_bytes", regions=[{"addr": hex(ea), "size": int(n)}]) + except IDAToolError: + return b"\x00" * n + res = r.get("result", []) if isinstance(r, dict) else [] +@@ -1151,7 +1140,7 @@ class Program: + def list_structs(self, filter: str = "") -> list[Struct]: + """All local structs/unions (optionally name-substring filtered), sorted + by name.""" +- payload = self.client.call("search_structs", filter=filter) ++ payload = self.client.invoke("search_structs", filter=filter) + res = payload.get("result", []) if isinstance(payload, dict) else [] + out = [Struct.from_raw(d) for d in res + if isinstance(d, dict) and d.get("name") +@@ -1161,9 +1150,9 @@ class Program: + + def struct_source(self, name: str) -> str: + """A C definition for ``name`` reconstructed from its member layout +- (the server exposes members, not printable source). Faithful to IDA's ++ (the remote operation exposes members, not printable source). Faithful to IDA's + field names/types; array dims are moved after the field name.""" +- payload = self.client.call( ++ payload = self.client.invoke( + "type_inspect", queries=[{"name": name, "include_members": True}]) + res = payload.get("result", []) if isinstance(payload, dict) else [] + info = res[0] if res and isinstance(res[0], dict) else {} +@@ -1186,7 +1175,7 @@ class Program: + def declare_type(self, decl: str) -> str | None: + """Create or update a C type. Returns None on success, else the parse + error. (Re-declaring a name updates it in place.)""" +- payload = self.client.call("declare_type", decls=decl) ++ payload = self.client.invoke("declare_type", decls=decl) + res = payload.get("result", []) if isinstance(payload, dict) else [] + if res and isinstance(res[0], dict): + return res[0].get("error") +@@ -1195,10 +1184,9 @@ class Program: + # -- function / variable types ---------------------------------------- # + def func_types(self, ea: int) -> FuncTypes | None: + """Structured decompiler types for the function at ``ea`` (prototype + +- local variables). None if ``ea`` isn't a decompilable function. Requires +- the injected ``func_types`` server tool.""" ++ local variables). None if ``ea`` isn't a decompilable function.""" + try: +- r = self.client.call("func_types", addr=hex(ea)) ++ r = self.client.invoke("func_types", addr=hex(ea)) + except IDAToolError: + return None + if not isinstance(r, dict) or r.get("error"): +@@ -1211,7 +1199,7 @@ class Program: + + def set_function_type(self, ea: int, signature: str) -> str | None: + """Set a function's prototype. None on success, else an error string.""" +- r = self.client.call("set_type", edits=[{"addr": hex(ea), "signature": signature}]) ++ r = self.client.invoke("set_type", edits=[{"addr": hex(ea), "signature": signature}]) + res = r.get("result", []) if isinstance(r, dict) else [] + row = res[0] if res and isinstance(res[0], dict) else {} + if row.get("ok"): +@@ -1220,9 +1208,9 @@ class Program: + + def data_type(self, ea: int) -> dict | None: + """Current type info for a data item/global: {addr,name,type,size,is_func}. +- None if the tool is unavailable or the address isn't mapped.""" ++ None if the operation fails or the address isn't mapped.""" + try: +- r = self.client.call("data_type", addr=hex(ea)) ++ r = self.client.invoke("data_type", addr=hex(ea)) + except IDAToolError: + return None + if not isinstance(r, dict) or r.get("error"): +@@ -1231,7 +1219,7 @@ class Program: + + def set_data_type(self, ea: int, decl: str) -> str | None: + """Set a global/data item's type. None on success, else an error string.""" +- r = self.client.call( ++ r = self.client.invoke( + "set_type", edits=[{"kind": "global", "addr": hex(ea), "type": decl}]) + res = r.get("result", []) if isinstance(r, dict) else [] + row = res[0] if res and isinstance(res[0], dict) else {} +@@ -1240,9 +1228,9 @@ class Program: + return row.get("error") or "failed to set the type" + + def set_lvar_type(self, fn_ea: int, var: str, ty: str) -> str | None: +- """Set a decompiler local variable's type (via the injected server tool). ++ """Set a decompiler local variable's type through ida-domain pseudocode. + None on success, else an error string.""" +- r = self.client.call("set_lvar_type", addr=hex(fn_ea), variable=var, type=ty) ++ r = self.client.invoke("set_lvar_type", addr=hex(fn_ea), variable=var, type=ty) + if isinstance(r, dict) and r.get("error"): + return r["error"] + if isinstance(r, dict) and not r.get("ok"): +@@ -1251,15 +1239,14 @@ class Program: + + def delete_type(self, name: str) -> str | None: + """Delete a named type. Returns None on success, else an error string. +- Requires a server-side ``del_type`` tool; if absent, a clear message is +- returned instead of raising.""" ++ Returns a clear error instead of raising when the runtime cannot do it.""" + try: +- self.client.call("del_type", name=name) ++ self.client.invoke("del_type", name=name) + return None + except IDAToolError as e: + msg = e.message + if "not found" in msg.lower() and "del_type" in msg: +- return "delete needs a 'del_type' tool on the ida-pro-mcp server" ++ return "the connected Code Mode runtime cannot delete local types" + return msg + + # -- disassembly ------------------------------------------------------- # +@@ -1273,13 +1260,7 @@ class Program: + + # -- decompilation ----------------------------------------------------- # + def decompile(self, ea: int, refresh: bool = False) -> Decompilation: +- """Full pseudocode for a function. +- +- The server truncates responses over 50KB (strings clipped to 1000 +- chars) but caches the full output and exposes it at +- ``_meta.ida_mcp.download_url``. We transparently fetch that so the view +- always gets the complete body, not a 1KB stub. +- """ ++ """Full pseudocode for a function, returned directly by Code Mode.""" + if not refresh: + with self._lock: + hit = self._decomp.get(ea) +@@ -1288,10 +1269,10 @@ class Program: + dec, hit_gen = hit + if hit_gen == gen: + return dec +- # Cached before a rename: names may be stale. Drop the server's +- # Hex-Rays cache so the refetch reflects the new names. ++ # Cached before a rename: names may be stale. Drop Hex-Rays' ++ # cache so the refetch reflects the new names. + try: +- self.client.call("force_recompile", items=[{"addr": hex(ea)}]) ++ self.client.invoke("force_recompile", items=[{"addr": hex(ea)}]) + except Exception: # noqa: BLE001 + pass + # Bound the decompile: a function Hex-Rays can't handle tends to stall +@@ -1301,7 +1282,10 @@ class Program: + # rpcclient socket timeout, and cache the failure below so a re-request + # returns instantly instead of re-grinding. + try: +- envelope = self.client.call_envelope( ++ # Code Mode returns the complete JSON result directly; unlike the ++ # old MCP tool transport there is no structured-content envelope or ++ # out-of-band download URL to unwrap. ++ payload = self.client.invoke( + "decompile", addr=hex(ea), timeout=DECOMPILE_TIMEOUT + ) + except Exception as e: # noqa: BLE001 -- surface as a failed decompile +@@ -1309,15 +1293,6 @@ class Program: + with self._lock: + self._decomp[ea] = (dec, self._name_gen) + return dec +- result = envelope.get("result", {}) +- payload = result.get("structuredContent") +- if payload is None: # fall back to text content +- payload = self.client._extract_payload("decompile", result) +- meta = (result.get("_meta") or {}).get("ida_mcp") +- if isinstance(meta, dict) and meta.get("download_url"): +- full = self._fetch_output(meta["download_url"]) +- if isinstance(full, dict) and full.get("code"): +- payload = full + dec = _parse_decompilation(ea, payload) + with self._lock: + self._decomp[ea] = (dec, self._name_gen) +@@ -1365,18 +1340,18 @@ class Program: + Undefine first so it works even when the bytes are currently part of a + data/align item — ``create_insn`` refuses to carve into a live item.""" + try: +- self.client.call("undefine", items=[{"addr": hex(ea)}]) ++ self.client.invoke("undefine", items=[{"addr": hex(ea)}]) + except IDAToolError: + pass # nothing defined here yet -> just try to create the insn + res = self._first_result( +- self.client.call("define_code", items=[{"addr": hex(ea)}])) ++ self.client.invoke("define_code", items=[{"addr": hex(ea)}])) + if res.get("error"): + raise IDAToolError("define_code", f"@ {ea:#x}: {res['error']}") + + def decomp_error(self, ea: int) -> str: + """Hex-Rays' own reason for refusing ``ea``, or "" if it won't say.""" + try: +- r = self.client.call("decomp_error", addr=hex(ea)) ++ r = self.client.invoke("decomp_error", addr=hex(ea)) + except IDAToolError: + return "" + if not isinstance(r, dict): +@@ -1395,7 +1370,7 @@ class Program: + + def thumb_scan(self, start: int, end: int, apply: bool = True) -> dict: + """Find Thumb entry points from odd pointers in ``[start, end)``.""" +- r = self.client.call("thumb_scan", start=hex(start), end=hex(end), ++ r = self.client.invoke("thumb_scan", start=hex(start), end=hex(end), + apply=bool(apply)) + if not isinstance(r, dict) or r.get("error"): + raise IDAToolError("thumb_scan", +@@ -1404,7 +1379,7 @@ class Program: + + def set_thumb(self, ea: int, mode: str = "toggle") -> dict: + """Switch ARM/Thumb decoding at ``ea``. Returns the resulting state.""" +- r = self.client.call("set_thumb", addr=hex(ea), mode=mode) ++ r = self.client.invoke("set_thumb", addr=hex(ea), mode=mode) + if not isinstance(r, dict) or r.get("error"): + raise IDAToolError("set_thumb", + f"@ {ea:#x}: {(r or {}).get('error', 'failed')}") +@@ -1413,11 +1388,11 @@ class Program: + def define_code_run(self, ea: int, limit: int = 20000) -> dict: + """Disassemble consecutively from ``ea`` until something stops it. + +- Falls back to a single instruction when the worker predates the tool, so +- an old worker degrades to the previous behaviour instead of failing. ++ Falls back to a single instruction for alternate clients that do not ++ provide the run operation. + """ + try: +- r = self.client.call("define_code_run", addr=hex(ea), limit=int(limit)) ++ r = self.client.invoke("define_code_run", addr=hex(ea), limit=int(limit)) + except IDAToolError: + self.define_code(ea) + return {"count": 1, "stopped": "single", "end": hex(ea)} +@@ -1429,14 +1404,14 @@ class Program: + def define_func(self, ea: int) -> dict: + """Create a function starting at ``ea`` (IDA's 'p'). + +- Prefers the injected tool, which works out the end when IDA can't; +- falls back to the plain one for an older worker. ++ Prefers the Code Mode operation, which works out the end when IDA can't; ++ falls back to a plain create for alternate clients. + """ + try: +- r = self.client.call("define_func_run", addr=hex(ea)) ++ r = self.client.invoke("define_func_run", addr=hex(ea)) + except IDAToolError: + res = self._first_result( +- self.client.call("define_func", items=[{"addr": hex(ea)}])) ++ self.client.invoke("define_func", items=[{"addr": hex(ea)}])) + if res.get("error"): + raise IDAToolError("define_func", f"@ {ea:#x}: {res['error']}") + return {"ok": True, "how": "legacy"} +@@ -1450,7 +1425,7 @@ class Program: + item: dict = {"addr": hex(ea)} + if size: + item["size"] = int(size) +- res = self._first_result(self.client.call("undefine", items=[item])) ++ res = self._first_result(self.client.invoke("undefine", items=[item])) + if res.get("error"): + raise IDAToolError("undefine", f"@ {ea:#x}: {res['error']}") + +@@ -1460,7 +1435,7 @@ class Program: + item: dict = {"addr": hex(ea), "type": type_decl} + if name: + item["name"] = name +- res = self._first_result(self.client.call("make_data", items=[item])) ++ res = self._first_result(self.client.invoke("make_data", items=[item])) + if res.get("ok") is False or res.get("error"): + raise IDAToolError( + "make_data", f"@ {ea:#x}: {res.get('error') or 'rejected'}") +@@ -1468,7 +1443,7 @@ class Program: + def make_string(self, ea: int, length: int = 0, kind: str = "c") -> str: + """Create a string literal at ``ea`` (IDA's 'A'); auto-length when 0. + Returns the decoded contents.""" +- r = self.client.call("make_string", addr=hex(ea), length=int(length), kind=kind) ++ r = self.client.invoke("make_string", addr=hex(ea), length=int(length), kind=kind) + res = r if isinstance(r, dict) else {} + if not res.get("ok"): + raise IDAToolError( +@@ -1483,15 +1458,6 @@ class Program: + sec = None + return f"{sec} @ {ea:#x}" if sec else f"<no function> @ {ea:#x}" + +- @staticmethod +- def _fetch_output(url: str, timeout: float = 15.0): +- """GET the server's cached full-output blob (plain HTTP, not MCP).""" +- try: +- with urllib.request.urlopen(url, timeout=timeout) as r: +- return json.loads(r.read().decode("utf-8", "replace")) +- except Exception: # noqa: BLE001 -- fall back to the truncated preview +- return None +- + def strings(self, min_len: int = 4, refresh: bool = False) -> list[StrLit]: + """Every string literal in the binary (IDA's Shift+F12 list), paged in + full and cached. ``[]`` if the tool is unavailable.""" +@@ -1504,7 +1470,7 @@ class Program: + offset, page = 0, 2000 + while True: + try: +- payload = self.client.call( ++ payload = self.client.invoke( + "list_strings", offset=offset, count=page, min_len=min_len, + refresh=(refresh and offset == 0)) + except IDAToolError: +@@ -1529,13 +1495,13 @@ class Program: + + def linkage(self) -> tuple[list[Linkage], list[Linkage]]: + """``(imports, exports)`` for this binary, cached. ``([], [])`` if the +- tool is unavailable — an old worker must not break the caller.""" ++ operation is unavailable — an alternate client must not break the caller.""" + with self._lock: + hit = self._linkage + if hit is not None: + return hit + try: +- payload = self.client.call("list_linkage", kind="both") ++ payload = self.client.invoke("list_linkage", kind="both") + except IDAToolError: + return ([], []) + if not isinstance(payload, dict): +@@ -1566,7 +1532,7 @@ class Program: + if hit is not None and hit[1] == gen: + return hit[0] + try: +- payload = self.client.call("decomp_map", addr=hex(ea)) ++ payload = self.client.invoke("decomp_map", addr=hex(ea)) + except IDAToolError: + return [] + lines = payload.get("lines", []) if isinstance(payload, dict) else [] +@@ -1579,13 +1545,13 @@ class Program: + # -- cross-references & containing function --------------------------- # + def function_of(self, ea: int) -> Func | None: + """Return the function containing ``ea`` (resolves mid-function addrs).""" +- payload = self.client.call("lookup_funcs", queries=[hex(ea)]) ++ payload = self.client.invoke("lookup_funcs", queries=[hex(ea)]) + res = payload.get("result", []) if isinstance(payload, dict) else [] + fn = res[0].get("fn") if res and isinstance(res[0], dict) else None + return Func.from_raw(fn) if fn else None + + def xrefs_from(self, ea: int) -> list[Xref]: +- payload = self.client.call( ++ payload = self.client.invoke( + "xref_query", + queries=[{"addr": hex(ea), "direction": "from", "include_fn": True}], + ) +@@ -1597,9 +1563,9 @@ class Program: + try: + # xref_types adds a fine-grained `kind` (call/read/write/...) for the + # xref dialog; fall back to xref_query (code/data only) if absent. +- payload = self.client.call("xref_types", queries=q) ++ payload = self.client.invoke("xref_types", queries=q) + except IDAToolError: +- payload = self.client.call("xref_query", queries=q) ++ payload = self.client.invoke("xref_query", queries=q) + return _parse_xrefs(payload) + + # -- address resolution ------------------------------------------------ # +@@ -1617,17 +1583,17 @@ class Program: + # (loc_/locret_): lookup_funcs would map a label to its *containing* + # function's entry, so double-clicking a label jumped to the wrong place. + try: +- payload = self.client.call("resolve_names", queries=[s]) ++ payload = self.client.invoke("resolve_names", queries=[s]) + res = payload.get("result", []) if isinstance(payload, dict) else [] + ea = res[0].get("ea") if res and isinstance(res[0], dict) else None + if ea: + return _as_int(ea) + except IDAToolError: +- pass # older server without resolve_names -> fall back below ++ pass # alternate client without resolve_names -> fall back below + # Fall back to function-name resolution (also drives the 'did you mean' + # suggestion when the name is unknown). + try: +- payload = self.client.call("lookup_funcs", queries=[s]) ++ payload = self.client.invoke("lookup_funcs", queries=[s]) + except IDAToolError as e: + raise KeyError(f"cannot resolve {target!r}: {e}") from e + res = payload.get("result", []) if isinstance(payload, dict) else [] +@@ -1665,7 +1631,7 @@ class Program: + """Set (empty text clears) the comment at ``ea``; affects both the disasm + and decompiler views. Returns the raw payload so the caller can surface a + soft per-item error. The caller must invalidate/recompile to see it.""" +- return self.client.call("set_comments", items=[{"addr": hex(ea), "comment": text}]) ++ return self.client.invoke("set_comments", items=[{"addr": hex(ea), "comment": text}]) + + # -- invalidation (after edits) --------------------------------------- # + def invalidate(self, ea: int) -> None: +diff --git a/idatui/drive.py b/idatui/drive.py +index b6fa641..0d865b5 100644 +--- a/idatui/drive.py ++++ b/idatui/drive.py +@@ -121,7 +121,8 @@ def cmd_pc(c, args): + lines = d["code"].splitlines() + if needle: + nlow = needle.lower() +- lines = [f"{i:4} {l}" for i, l in enumerate(lines) if nlow in l.lower()] ++ lines = [f"{i:4} {line}" for i, line in enumerate(lines) ++ if nlow in line.lower()] + return "\n".join(lines) or f"(no line matches {needle!r})" + return d["code"] + +diff --git a/idatui/errors.py b/idatui/errors.py +index 29b09ae..aaf2dc5 100644 +--- a/idatui/errors.py ++++ b/idatui/errors.py +@@ -1,10 +1,8 @@ +-"""Transport-agnostic error hierarchy and the Session model. ++"""TUI-facing error hierarchy and lightweight database session model. + +-These were originally defined in client.py (the ida-pro-mcp HTTP client), but the +-idalib worker path (worker_client / domain / app) needs the same exception types +-and Session dataclass without dragging in the HTTP transport. They live here so +-both backends share one definition; client.py re-exports them for backwards +-compatibility with the (deprecated) mcp tooling and the stress tests. ++The Code Mode adapter normalizes ``ida_codemode.client`` transport and execution ++errors into these types so the domain and Textual layers do not depend on HTTP or ++registry implementation details. + """ + from __future__ import annotations + +diff --git a/idatui/launch.py b/idatui/launch.py +index 64e1546..f78213c 100644 +--- a/idatui/launch.py ++++ b/idatui/launch.py +@@ -1,15 +1,13 @@ +-"""One-shot launcher: ``ida-tui foo.elf`` and you're in the TUI. ++"""One-shot launcher for the IDA Code Mode-backed TUI. + +-Spawns a private idalib worker (``idatui.worker``) that opens + auto-analyzes +-THIS binary in its own process, talking to the TUI over a unix socket. No shared +-supervisor, no HTTP: everything slow (open + analysis) happens behind the TUI's +-loading overlay. ++A path first resolves to a registered GUI database; when none matches, Code Mode ++reuses or starts a managed idalib worker. With no path, a single registered ++database is selected automatically. + +-Usage: ++Usage:: + +- ida-tui /path/to/binary # open a binary and drive it +- +-Extras: --ttl, --no-keepalive, --rpc (all forwarded to the TUI). ++ ida-tui /path/to/binary ++ ida-tui # attach when exactly one database is registered + """ + from __future__ import annotations + +@@ -17,12 +15,6 @@ import argparse + import os + import sys + +-# The unpacked working-copy files IDA writes next to a `.i64` while a database is +-# open. A hard-killed worker leaves them behind and the `.i64` then refuses to +-# reopen ("Failed to open database"). Safe to delete when nothing holds the DB. +-_LOCK_SUFFIXES = (".id0", ".id1", ".id2", ".nam", ".til") +- +- + def _load_args(load: dict) -> str: + """``load`` as IDA switches, for the single-binary path (no project ref).""" + from .formats import load_args +@@ -34,24 +26,19 @@ def _log(msg: str) -> None: + print(f"ida-tui: {msg}", file=sys.stderr) + + +-def _sweep_locks(binary: str) -> int: +- """Remove stale unpacked DB files next to ``binary``. Returns how many.""" +- stem = os.path.splitext(binary)[0] +- n = 0 +- for base in (binary, stem): # IDA may key on the full name or the stem +- for suf in _LOCK_SUFFIXES: +- try: +- os.remove(base + suf) +- n += 1 +- except OSError: +- pass +- return n ++def _registered_databases() -> tuple[list[dict], list[dict]]: ++ """Ready and blocked Code Mode registrations, with normalized errors.""" ++ try: ++ from ida_codemode.registry import discover_instances ++ return discover_instances() ++ except Exception as exc: # discovery diagnostics belong at the CLI boundary ++ return [], [{"error": str(exc)}] + + + def main(argv: list[str] | None = None) -> int: + p = argparse.ArgumentParser( + prog="ida-tui", +- description="Open a binary in the IDA TUI (private idalib worker).") ++ description="Open a registered GUI or managed idalib database in the IDA TUI.") + p.add_argument("binary", nargs="*", + help="binary to open and analyze (several with --project " + "creates/extends that project)") +@@ -59,9 +46,9 @@ def main(argv: list[str] | None = None) -> int: + help="open a multi-binary project (created from the given " + "binaries if FILE doesn't exist)") + p.add_argument("--ttl", type=int, default=1800, +- help="worker idle-TTL seconds (default 1800)") ++ help="deprecated compatibility option (Code Mode uses leases)") + p.add_argument("--no-keepalive", action="store_true", +- help="do not run the keepalive heartbeat") ++ help="deprecated compatibility option (the lease is the heartbeat)") + p.add_argument("--rpc", metavar="PATH", + help="listen for RPC on this unix socket (puppeteer the TUI)") + p.add_argument("--trace", metavar="FILE", +@@ -76,7 +63,7 @@ def main(argv: list[str] | None = None) -> int: + g.add_argument("--base", metavar="ADDR", + help="load address, e.g. 0x8000000 (any base; NOT paragraphs)") + g.add_argument("--ida-args", metavar="STR", dest="ida_args", +- help="extra IDA command-line switches, passed through as-is") ++ help="legacy switches; only Code Mode-representable -p/-b/-T are accepted") + args = p.parse_args(argv) + + load: dict = {} +@@ -134,27 +121,42 @@ def main(argv: list[str] | None = None) -> int: + _log(str(e)) + return 2 + else: +- if len(args.binary) != 1: +- _log("give exactly one binary, or use --project for several") ++ ready, blocked = _registered_databases() ++ if len(args.binary) > 1: ++ _log("give at most one binary, or use --project for several") + return 2 +- binary = os.path.abspath(os.path.expanduser(args.binary[0])) +- if not os.path.isfile(binary): +- _log(f"no such file: {binary}") ++ if args.binary: ++ binary = os.path.abspath(os.path.expanduser(args.binary[0])) ++ key = os.path.normcase(os.path.realpath(binary)) ++ registered = any( ++ key == os.path.normcase(os.path.realpath(str(item.get(field) or ""))) ++ for item in ready for field in ("exe_path", "idb_path") ++ if item.get(field) ++ ) ++ if not os.path.isfile(binary) and not registered: ++ _log(f"no such file or registered database: {binary}") ++ return 2 ++ elif len(ready) == 1: ++ item = ready[0] ++ binary = str(item.get("exe_path") or item.get("idb_path") or "") ++ _log(f"attaching to registered {item.get('backend')} database: {binary}") ++ elif not ready: ++ detail = f" ({blocked[0].get('error')})" if blocked else "" ++ _log(f"no registered Code Mode database; pass a binary path{detail}") + return 2 +- if not os.access(os.path.dirname(binary), os.W_OK): +- _log(f"directory not writable (IDA writes a .i64 there): " +- f"{os.path.dirname(binary)}") ++ else: ++ _log("several Code Mode databases are registered; pass one of these paths:") ++ for item in ready: ++ _log(f" {item.get('exe_path') or item.get('idb_path')} " ++ f"[{item.get('backend')}, {item.get('record_id')}]") + return 2 +- swept = _sweep_locks(binary) # a crashed worker can leave the DB wedged +- if swept: +- _log(f"cleared {swept} stale lock file(s) from a crashed worker") + +- # Hand off to the TUI (imported late so --help works without textual). It +- # spawns the worker behind its loading overlay while auto-analysis runs. ++ # Hand off to the TUI (imported late so --help works without Textual). Code ++ # Mode discovery/opening happens behind its loading overlay. + try: + from .app import IdaTui + except ImportError as e: +- _log(f"the TUI needs textual; run with ~/ida-venv/bin/python ({e})") ++ _log(f"TUI dependencies are missing; run `uv sync` ({e})") + return 1 + rpc_path = os.path.abspath(os.path.expanduser(args.rpc)) if args.rpc else None + IdaTui(open_path=binary, keepalive=not args.no_keepalive, +diff --git a/idatui/pane.py b/idatui/pane.py +index 37a5f0c..0f8fa57 100644 +--- a/idatui/pane.py ++++ b/idatui/pane.py +@@ -15,9 +15,9 @@ then close it — all without a human touching the keyboard. + python -m idatui.pane list + python -m idatui.pane stop --sock <sock> # graceful quit + kill pane + +-Requires: running inside tmux. Each pane spawns its own private idalib worker +-(no shared supervisor). Uses ~/ida-venv/bin/python for the TUI (needs textual) +-unless --python / IDATUI_PYTHON says otherwise. ++Requires: running inside tmux. Each pane leases a registered GUI or shared ++managed idalib database through Code Mode. Uses ~/ida-venv/bin/python for the ++TUI unless --python / IDATUI_PYTHON says otherwise. + """ + from __future__ import annotations + +@@ -25,7 +25,6 @@ import argparse + import json + import os + import secrets +-import signal + import subprocess + import sys + import time +@@ -72,56 +71,14 @@ def _tmux(*args: str) -> str: + check=True).stdout.strip() + + +-# --------------------------------------------------------------------------- # +-# idalib worker reaping +-# +-# ``pane stop`` kills the TUI pane, but a hard-killed pane can leave its private +-# idalib worker (idatui/worker.py) running. A worker is only *safe* to reap when +-# no idatui pane is live (then every worker is orphaned), which avoids killing an +-# in-use analyser. +-# --------------------------------------------------------------------------- # +-_WORKER_PATTERN = r"idatui/worker\.py" +- +- +-def _worker_pids() -> list[int]: +- """PIDs of our private per-pane idalib worker processes (idatui/worker.py), +- never our own PID.""" +- try: +- out = subprocess.run(["pgrep", "-f", _WORKER_PATTERN], +- capture_output=True, text=True) +- except OSError: +- return [] +- me = os.getpid() +- pids: list[int] = [] +- for tok in out.stdout.split(): +- try: +- pid = int(tok) +- except ValueError: +- continue +- if pid != me: +- pids.append(pid) +- return pids +- +- + def _count_live_panes() -> int: + return sum(1 for r in _load_registry() if _pane_alive(r.get("pane", ""))) + + + def _reap_orphan_workers(force: bool = False) -> int: +- """Kill leaked idalib workers when it is safe (no live pane) or ``force``. +- +- Returns the number of workers signalled. Best-effort; never raises. +- """ +- if not force and _count_live_panes() > 0: +- return 0 +- reaped = 0 +- for pid in _worker_pids(): +- try: +- os.kill(pid, signal.SIGKILL) +- reaped += 1 +- except OSError: +- pass +- return reaped ++ """Compatibility no-op: Code Mode workers are shared and lease-managed.""" ++ del force ++ return 0 + + + # --------------------------------------------------------------------------- # +@@ -146,16 +103,8 @@ def spawn(args) -> int: + print(f"error: no such project: {project}", file=sys.stderr) + return 2 + +- # Reap workers leaked by previously-stopped/crashed panes so we don't spawn +- # into a full IDA_MCP_MAX_WORKERS (which makes the new TUI hang forever, +- # never reaching ready). No-op while any pane is live. +- reaped = _reap_orphan_workers() +- if reaped: +- print(f"reaped {reaped} orphaned idalib worker(s) before spawn", +- file=sys.stderr) +- +- # the command the pane runs: the launcher spawns a private idalib worker for +- # this binary and becomes the TUI, so kill-pane tears the whole thing down. ++ # The pane owns only the TUI. Code Mode's lease cleanup handles crashes; ++ # kill-pane must never reap a shared GUI/idalib database. + if project is not None: + # launch takes: --project FILE [binaries...]; extra binaries are added to + # the project (and a missing project file is created from them). +@@ -202,9 +151,8 @@ def _wait_ready(sock: str, timeout: float, pane: str, + stuck_after: float = 45.0) -> dict[str, Any]: + """Poll the socket + ping until the TUI reports ready (or timeout). + +- Emits a one-time hint to stderr if it's still not ready after ``stuck_after`` +- seconds, so a wedged idalib worker / full worker pool surfaces a diagnostic +- instead of an unexplained silent hang. ++ Emits a one-time hint if Code Mode discovery/opening is still not ready after ++ ``stuck_after`` seconds. + """ + start = time.time() + deadline = start + timeout +@@ -225,9 +173,8 @@ def _wait_ready(sock: str, timeout: float, pane: str, + warned = True + why = ("RPC socket not created yet" if not os.path.exists(sock) + else "TUI up but analysis not ready") +- print(f"still waiting ({int(time.time() - start)}s): {why}. If this " +- f"hangs, the idalib worker may be stuck — try " +- f"`python -m idatui.pane reap`.", file=sys.stderr) ++ print(f"still waiting ({int(time.time() - start)}s): {why}. " ++ f"Check Code Mode registrations and worker logs.", file=sys.stderr) + time.sleep(0.4) + last = dict(last) + last["ready"] = False +@@ -317,13 +264,9 @@ def list_panes(args) -> int: + + + def reap(args) -> int: +- """Kill leaked idalib workers (safe when no pane is live; --force overrides).""" +- live = _count_live_panes() +- n = _reap_orphan_workers(force=args.force) +- print(json.dumps({"reaped_workers": n, "live_panes": live, "forced": args.force})) +- if n == 0 and not args.force and live > 0: +- print(f"note: {live} live pane(s) — not reaping in-use workers; pass " +- f"--force to reap anyway", file=sys.stderr) ++ """Deprecated no-op; shared Code Mode workers are managed by leases.""" ++ print(json.dumps({"reaped_workers": 0, "live_panes": _count_live_panes(), ++ "forced": args.force, "deprecated": True})) + return 0 + + +@@ -361,9 +304,8 @@ def main(argv: list[str]) -> int: + ls.add_argument("--prune", action="store_true", help="drop dead panes (and their sockets)") + ls.set_defaults(fn=list_panes) + +- rp = sub.add_parser("reap", help="kill leaked idalib workers (frees worker slots)") +- rp.add_argument("--force", action="store_true", +- help="reap even while panes are live (may kill an in-use analyser)") ++ rp = sub.add_parser("reap", help="deprecated no-op (Code Mode uses shared leases)") ++ rp.add_argument("--force", action="store_true", help=argparse.SUPPRESS) + rp.set_defaults(fn=reap) + + args = p.parse_args(argv) +diff --git a/idatui/pool.py b/idatui/pool.py +index ae37c25..465dff2 100644 +--- a/idatui/pool.py ++++ b/idatui/pool.py +@@ -1,23 +1,16 @@ +-"""WorkerPool — keeps a live idalib worker per project binary, within a budget. ++"""DatabasePool — LRU leases on Code Mode databases for a project. + +-One worker process holds exactly one database (idalib is single-DB and +-main-thread-only), so a project with N binaries means up to N processes. They are +-not cheap and they do not share: a worker on ``bash`` measures ~126 MB RSS / +-117 MB PSS, and the database working set dominates for anything larger +-(``libcrypto.so.3``'s ``.i64`` alone is 72 MB). ++Code Mode may bind a lease to an existing IDA GUI or to a shared managed idalib ++worker. The pool therefore owns *client interest*, never an IDA process. Releasing ++an LRU entry persists managed IDBs but does not implicitly save a GUI, then closes ++only this TUI's lease; other clients and GUI sessions remain alive. Managed workers exit themselves after their final lease. + +-Residency is therefore bounded by a **memory budget**, not a worker count — a +-count is the wrong knob when one project holds both a 50 KB helper and a 6 MB +-crypto library. Workers are spawned lazily on first use, kept resident while they +-fit, and least-recently-used ones evicted when they don't. Eviction **saves the +-database first**, so coming back is a load rather than a re-analysis. +- +-The pool never evicts the active binary, nor anything pinned. ++The historical memory budget remains useful for managed idalib instances, while ++GUI process memory is only advisory. The active and pinned databases are never ++released to satisfy it. + """ + from __future__ import annotations + +-import os +- + from .project import BinaryRef, Project + + #: Fallback budget if /proc/meminfo can't be read (MB). +@@ -36,11 +29,11 @@ def _total_ram_mb() -> int: + + + def _pss_mb(pid: int | None) -> int: +- """Proportional set size of a worker, in MB. ++ """Proportional set size of the leased instance process, in MB. + +- PSS (not RSS) is the honest per-worker cost: it splits shared pages between +- the processes mapping them. In practice workers share very little, so the two +- are close, but PSS is what makes summing across workers meaningful. ++ PSS is useful for managed idalib workers. For GUI/shared processes it is only ++ advisory because the TUI neither owns all that memory nor controls process ++ exit. + """ + if not pid: + return 0 +@@ -54,13 +47,19 @@ def _pss_mb(pid: int | None) -> int: + return 0 + + +-def _default_spawn(ref: BinaryRef, ttl: int): # pragma: no cover - needs idalib +- from .worker_client import WorkerClient +- return WorkerClient(ref.staged, ttl=ttl, load_args=ref.load_args) ++def _default_spawn(ref: BinaryRef, ttl: int, *, new_database: bool = False): # pragma: no cover - needs IDA ++ from .codemode_client import CodeModeClient ++ return CodeModeClient( ++ ref.staged, ++ ttl=ttl, ++ load_args=ref.load_args, ++ output_database=ref.db, ++ new_database=new_database, ++ ) + + +-class WorkerPool: +- """Live workers for a project's binaries, keyed by label.""" ++class DatabasePool: ++ """Live Code Mode database leases, keyed by project label.""" + + def __init__(self, project: Project, *, budget_mb: int | None = None, + ttl: int = 1800, spawn=None, mem_fn=None) -> None: +@@ -71,6 +70,7 @@ class WorkerPool: + self._clients: dict[str, object] = {} + self._lru: list[str] = [] # least-recently-used first + self._pinned: set[str] = set() ++ self._recreate: set[str] = set() # Ctrl+L: next attachment creates a fresh IDB + self.active: str | None = None # never evicted + if budget_mb is None: + ram = _total_ram_mb() +@@ -98,11 +98,11 @@ class WorkerPool: + + # -- acquire ----------------------------------------------------------- # + def get(self, label: str, progress=None): +- """A live client for ``label``, spawning it (and making room) if needed. ++ """A live client for ``label``, attaching or spawning as needed. + +- Staging and the scratch sweep happen here: a worker killed hard last time +- leaves unpacked ``.id0/.id1/...`` behind, and the database then refuses to +- reopen. Nothing else holds this DB (one worker per label), so it is safe. ++ Do not sweep IDA scratch files here: a registered GUI or another Code ++ Mode client may own the database. Code Mode's registry locks and health ++ probes are the authority for safe discovery and stale-record cleanup. + """ + client = self._clients.get(label) + if client is not None: +@@ -118,28 +118,29 @@ class WorkerPool: + + note(f"staging {ref.label}\u2026") + self.project.stage(ref) +- self.project.sweep_scratch(ref) + note(f"opening {ref.label}\u2026") +- client = self._spawn(ref, self._ttl) ++ fresh = label in self._recreate ++ client = (_default_spawn(ref, self._ttl, new_database=fresh) ++ if self._spawn is _default_spawn else self._spawn(ref, self._ttl)) + connect = getattr(client, "connect", None) + if connect is not None: + connect(progress=progress) if progress is not None else connect() + self._clients[label] = client ++ self._recreate.discard(label) + self._lru.append(label) + self._enforce_budget(protect=label) + return client + + def prewarm(self, label: str, progress=None) -> bool: +- """Spawn a worker for ``label`` only if it fits the budget AS IT STANDS. ++ """Attach a database for ``label`` only if it fits the current budget. + + Pre-warming must never cost residency: evicting a binary the user + actually visited to speculatively load one they haven't is a straight + downgrade, and the eviction would also throw away that binary's caches. + So this refuses rather than making room, and returns False. + +- The cost of a worker that doesn't exist yet can only be estimated; the +- largest resident one is the best evidence available (they are all the +- same program with a different database). With nothing resident we have ++ The cost of a database not attached yet can only be estimated; the ++ largest resident instance is the best evidence available. With nothing resident we have + no evidence at all, so we allow one — that is the case where the budget + is certainly free. + """ +@@ -153,13 +154,19 @@ class WorkerPool: + return False + self.get(label, progress=progress) + # get() enforces the budget protecting the NEW label; if that had to +- # evict, our estimate was wrong and the speculative worker is the one ++ # evict, our estimate was wrong and the speculative lease is the one + # that should go — never a binary the user chose. + if self.memory_mb() > self.budget_mb and label != self.active: + self.evict(label) + return False + return True + ++ def recreate_on_next_open(self, label: str) -> None: ++ """Request a fresh IDB after the current lease has been released.""" ++ if self.project.by_label(label) is None: ++ raise KeyError(f"no such binary in the project: {label}") ++ self._recreate.add(label) ++ + def _touch(self, label: str) -> None: + if label in self._lru: + self._lru.remove(label) +@@ -171,16 +178,21 @@ class WorkerPool: + self._touch(label) + + # -- release ----------------------------------------------------------- # +- def evict(self, label: str, save: bool = True) -> bool: +- """Drop a resident worker, persisting its database first.""" ++ def evict(self, label: str, save: bool = True, ++ save_gui: bool = False) -> bool: ++ """Release a resident lease, persisting a managed database first. ++ ++ A budget-driven eviction must not save somebody's GUI implicitly. GUI ++ saves are reserved for an explicit/defensive ``close_all(save=True)``. ++ """ + client = self._clients.pop(label, None) + if client is None: + return False + if label in self._lru: + self._lru.remove(label) +- if save: ++ if save and (save_gui or getattr(client, "backend", None) != "gui"): + try: # persist analysis + edits so the next open is a load +- client.call("idb_save") ++ client.save_database() + except Exception: # noqa: BLE001 -- evict regardless + pass + try: +@@ -198,7 +210,7 @@ class WorkerPool: + return None + + def _enforce_budget(self, protect: str | None = None) -> int: +- """Evict LRU workers until the pool fits its budget. Returns how many.""" ++ """Release LRU leases until the pool fits its budget. Returns how many.""" + n = 0 + while self.memory_mb() > self.budget_mb: + victim = self._evictable(protect) +@@ -210,7 +222,7 @@ class WorkerPool: + + def close_all(self, save: bool = True) -> None: + for label in list(self._clients): +- self.evict(label, save=save) ++ self.evict(label, save=save, save_gui=save) + self.active = None + + # -- introspection ------------------------------------------------------ # +@@ -231,5 +243,9 @@ class WorkerPool: + return out + + def __repr__(self) -> str: # pragma: no cover - debug aid +- return (f"<WorkerPool {len(self._clients)}/{len(self.project.refs)} resident " ++ return (f"<DatabasePool {len(self._clients)}/{len(self.project.refs)} resident " + f"{self.memory_mb()}/{self.budget_mb}MB active={self.active}>") ++ ++ ++# Source compatibility for callers that imported the pre-Code-Mode name. ++WorkerPool = DatabasePool +diff --git a/idatui/project.py b/idatui/project.py +index e2fc542..6afd8a1 100644 +--- a/idatui/project.py ++++ b/idatui/project.py +@@ -23,7 +23,8 @@ firmware image, a cleaned build tree). + A source whose size/mtime no longer matches the staged copy is re-staged, and its + now-stale database is dropped (the DB describes the old bytes). + +-stdlib-only, like the domain/worker layers — the TUI is the only Textual consumer. ++The model has no IDA imports. Staging consults ida_codemode's registry before ++replacing files so it never mutates a database owned by a GUI/shared worker. + """ + from __future__ import annotations + +@@ -56,7 +57,7 @@ class BinaryRef: + #: it is, a raw firmware image doesn't, and IDA defaults to metapc at 0. + processor: str = "" # IDA processor name: arm, armb, mipsb, metapc, … + base: int = 0 # load address (natural, e.g. 0x8000000) +- ida_args: str = "" # escape hatch: extra IDA command-line switches ++ ida_args: str = "" # legacy -p/-b/-T switches accepted by Code Mode adapter + + @property + def db(self) -> str: +@@ -310,13 +311,32 @@ class Project: + """Ensure ``ref`` is staged in the sidecar; returns the staged path. + + Re-staging a changed source drops its database: the DB describes the old +- bytes, so keeping it would silently mismatch the disassembly (any renames +- in it are lost, which is why callers should say so out loud). ++ bytes. Refuse while Code Mode reports a GUI/idalib owner; replacing a ++ staged executable or IDB underneath a shared live instance is corruption. + """ + if not os.path.isfile(ref.source): + raise ProjectError(f"no such binary: {ref.source}") + if not self.is_stale(ref): + return ref.staged ++ try: ++ from ida_codemode.registry import canonical_path, idb_key, scan_instances ++ expected_key = idb_key(ref.db) ++ staged_path = canonical_path(ref.staged) ++ owner = next( ++ (item.entry for item in scan_instances(timeout=0.5) ++ if item.entry.idb_key == expected_key ++ or (item.entry.exe_path and canonical_path(item.entry.exe_path) == staged_path)), ++ None, ++ ) ++ except Exception as exc: ++ raise ProjectError( ++ f"cannot verify Code Mode ownership before staging {ref.label}: {exc}" ++ ) from exc ++ if owner is not None: ++ raise ProjectError( ++ f"cannot restage {ref.label}: Code Mode instance {owner.record_id} " ++ f"still owns {owner.idb_path}; close/release it first" ++ ) + os.makedirs(self.bin_dir, exist_ok=True) + tmp = ref.staged + ".staging" + _unlink(tmp) +@@ -338,10 +358,11 @@ class Project: + return out + + def sweep_scratch(self, ref: BinaryRef) -> int: +- """Delete IDA's unpacked working files (never the ``.i64``) for ``ref``. ++ """Delete unpacked working files (never the ``.i64``) for maintenance. + +- A hard-killed worker leaves them behind and the database then refuses to +- reopen. Only safe when no worker holds it. ++ Runtime paths no longer call this: Code Mode instances are shared, so a ++ registry owner may still be using these files. Callers must independently ++ prove that no GUI/idalib instance owns the database. + """ + return sum(1 for suf in SCRATCH_SUFFIXES if _unlink(ref.staged + suf)) + +diff --git a/idatui/worker.py b/idatui/worker.py +deleted file mode 100644 +index a4e3509..0000000 +--- a/idatui/worker.py ++++ /dev/null +@@ -1,233 +0,0 @@ +-"""idatui's own idalib worker — the replacement for the ida-pro-mcp supervisor. +- +-Opens ONE database in-process (on the main thread, as idalib requires) and +-serves ida-pro-mcp's *tool functions* over a unix socket with length-prefixed +-pickle. Same tool implementations as the MCP path (we call +-``MCP_SERVER.tools.methods[name](**args)`` directly), so return shapes are +-byte-identical — but with ~50us/call instead of the HTTP path's ~5ms, and no +-supervisor / HTTP / JSON / 50KB-truncation machinery. +- +- python -m idatui.worker <sock_path> <binary_path> +- +-The socket only appears once the database is open + analyzed, so a client can +-poll ``connect()`` to know when the worker is ready. Requests are served +-serially on the main thread (idalib is single-threaded; every tool runs inline +-through its own execute_sync, which is a no-op on the main thread). +- +-Protocol (both directions length-prefixed: 4-byte big-endian len + pickle): +- request = (tool_name: str, kwargs: dict) +- response = (ok: bool, result_or_error) +- tool_name == "__shutdown__" ends the worker. +-""" +-from __future__ import annotations +- +-import os +-import pickle +-import socket +-import struct +-import sys +-import uuid +- +- +-# --------------------------------------------------------------------------- # +-# framing +-# --------------------------------------------------------------------------- # +-def _recvn(sock: socket.socket, n: int) -> bytes | None: +- buf = bytearray() +- while len(buf) < n: +- chunk = sock.recv(n - len(buf)) +- if not chunk: +- return None +- buf += chunk +- return bytes(buf) +- +- +-def send(sock: socket.socket, obj) -> None: +- data = pickle.dumps(obj, protocol=pickle.HIGHEST_PROTOCOL) +- sock.sendall(struct.pack(">I", len(data)) + data) +- +- +-def recv(sock: socket.socket): +- hdr = _recvn(sock, 4) +- if hdr is None: +- return None +- (n,) = struct.unpack(">I", hdr) +- body = _recvn(sock, n) +- return None if body is None else pickle.loads(body) +- +- +-# --------------------------------------------------------------------------- # +-# worker +-# --------------------------------------------------------------------------- # +-def _ensure_tools_injected() -> None: +- """Inject idatui's custom tools (heads/read_raw/resolve_names/func_types/...) +- into the installed ida_pro_mcp, idempotently, so the worker is self-sufficient +- (nothing else has to inject these tools first). Must run BEFORE +- ida_pro_mcp.ida_mcp is imported (the injected code lives in api_types.py).""" +- import importlib.util +- repo = os.path.dirname(os.path.dirname(os.path.abspath(__file__))) +- patch = os.path.join(repo, "server", "patch_server.py") +- if not os.path.exists(patch): +- return +- try: +- spec = importlib.util.spec_from_file_location("_idatui_patch", patch) +- mod = importlib.util.module_from_spec(spec) +- spec.loader.exec_module(mod) # IDA-free; just defines + patches api_types +- mod.main() +- except Exception as e: # noqa: BLE001 -- tools may already be present +- sys.stderr.write(f"idatui: tool injection skipped: {e}\n") +- +- +-def _has_database(binpath: str) -> bool: +- """Whether IDA already has a database for ``binpath``. +- +- IDA names it ``<file>.i64`` (keeping the extension), but a database made +- from ``foo.bin`` can also appear as ``foo.i64`` depending on how it was +- created — check both, because guessing wrong here means re-passing load +- switches to an existing database, which fails the open. +- """ +- return (os.path.exists(binpath + ".i64") +- or os.path.exists(os.path.splitext(binpath)[0] + ".i64")) +- +- +-def _open_and_register(binpath: str, load_args: str = ""): +- """Open the DB (main thread) then import ida-pro-mcp so every @tool registers +- against this live database. Returns (tools_dict, module_name, save_fn). +- +- ``load_args`` is passed to IDA as command-line switches, which is the only +- way to tell it how to read a headerless blob: a raw firmware image has no +- format to detect, so without ``-p<processor>`` it loads as metapc at 0 and +- finds nothing. Ignored once a database exists — the .i64 already records how +- it was loaded, and re-passing conflicting switches is how you corrupt one. +- """ +- _ensure_tools_injected() # before any ida_pro_mcp import +- import idapro +- idapro.enable_console_messages(False) +- args = load_args or None +- if args and _has_database(binpath): +- # The .i64 already records how this image was loaded. Passing the +- # switches again on reopen makes IDA fail outright (rc != 0) — the load +- # options belong to the FIRST open only. +- args = None +- if idapro.open_database(binpath, run_auto_analysis=True, +- args=args): # nonzero == failure +- if args: +- # With load switches in play they are the likeliest culprit by far: +- # IDA refuses an unknown -p name with no diagnostic of its own, so +- # saying "the database is locked" here sends people hunting a +- # problem they don't have. +- raise RuntimeError( +- f"failed to open {binpath} with load options {args!r}: IDA " +- f"rejected them \u2014 an unknown processor name is the usual " +- f"cause (see tools/verify_procs.py for the valid ones)") +- raise RuntimeError( +- f"failed to open {binpath}: the .i64 is likely held by a running " +- f"ida-mcp worker (try: pkill -f idalib) or wedged from a crash " +- f"(delete its .id0/.id1/.id2/.nam/.til next to the binary)") +- import ida_auto +- ida_auto.auto_wait() # block until auto-analysis settles (match ida-mcp) +- +- # importing the package registers all api_*/patched tools against MCP_SERVER +- from ida_pro_mcp.ida_mcp import MCP_SERVER # noqa: WPS433 +- +- import ida_nalt +- module = os.path.basename(ida_nalt.get_root_filename() or binpath) +- +- def save(): +- import idc +- try: +- idc.save_database(idc.get_idb_path(), 0) +- except Exception: # noqa: BLE001 +- import ida_loader, ida_pro # noqa: WPS433 +- ida_loader.save_database(idc.get_idb_path(), 0) +- +- return MCP_SERVER.tools.methods, module, save +- +- +-def serve(sockpath: str, binpath: str, load_args: str = "") -> None: +- tools, module, save = _open_and_register(binpath, load_args) +- sid = uuid.uuid4().hex[:8] +- +- def dispatch(name: str, args: dict): +- args = dict(args) +- args.pop("database", None) # single-DB worker: no session routing +- # session-management shims (were the supervisor's job): +- if name in ("idb_open",): +- return {"success": True, +- "session": {"session_id": sid, "module": module, +- "input_path": binpath}} +- if name in ("idb_save", "save"): +- save() +- return {"success": True} +- if name in ("server_health", "ping", "health", "state"): +- return {"module": module, "ok": True, "session_id": sid} +- if name in ("idb_list",): +- return {"sessions": [{"session_id": sid, "module": module, +- "input_path": binpath}]} +- fn = tools.get(name) +- if fn is None: +- raise KeyError(f"unknown tool: {name!r}") +- result = fn(**args) +- # Match the MCP server's structuredContent: a dict passes through, any +- # other return (list/scalar) is wrapped as {"result": ...}. domain.py +- # parses that exact shape (e.g. lookup_funcs -> payload["result"]). +- return result if isinstance(result, dict) else {"result": result} +- +- try: +- os.unlink(sockpath) +- except OSError: +- pass +- srv = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) +- srv.bind(sockpath) +- srv.listen(8) +- try: +- while True: +- conn, _ = srv.accept() +- try: +- while True: +- req = recv(conn) +- if req is None: +- break +- name, args = req +- if name == "__shutdown__": +- return +- try: +- send(conn, (True, dispatch(name, args))) +- except Exception as e: # noqa: BLE001 -- report, keep serving +- send(conn, (False, f"{type(e).__name__}: {e}")) +- except (ConnectionError, OSError): +- pass +- finally: +- conn.close() +- finally: +- try: +- import idapro +- idapro.close_database(save=False) +- except Exception: # noqa: BLE001 +- pass +- try: +- os.unlink(sockpath) +- except OSError: +- pass +- +- +-def main(argv=None) -> None: +- argv = argv if argv is not None else sys.argv[1:] +- if len(argv) < 2: +- sys.stderr.write( +- "usage: python -m idatui.worker <sock> <binary> [ida-load-args]\n") +- raise SystemExit(2) +- try: +- serve(argv[0], argv[1], argv[2] if len(argv) > 2 else "") +- except SystemExit: +- raise +- except BaseException as e: # noqa: BLE001 -- surface a clean cause + code 1 +- import traceback +- sys.stderr.write(f"\nWORKER-FATAL: {type(e).__name__}: {e}\n") +- traceback.print_exc() +- sys.stderr.flush() +- raise SystemExit(1) +- +- +-if __name__ == "__main__": +- main() +diff --git a/idatui/worker_client.py b/idatui/worker_client.py +deleted file mode 100644 +index 79a6db9..0000000 +--- a/idatui/worker_client.py ++++ /dev/null +@@ -1,234 +0,0 @@ +-"""WorkerClient — a drop-in replacement for ``IDAClient`` backed by our own +-idalib worker (``idatui.worker``) over a unix socket instead of ida-pro-mcp's +-HTTP/JSON transport. +- +-It exposes exactly the surface the app/domain use on the client +-(``call``/``call_envelope``/``connect``/``set_db``/``resolve_db``/ +-``list_sessions``/``health``/``keepalive``/``close``) and returns byte-identical +-payloads (the worker calls the same tool functions), so ``domain.py`` and the +-app are unchanged — you just construct a WorkerClient instead of an IDAClient. +- +-Concurrency: the app fires calls from several worker threads over one client; +-the worker is single-threaded, so calls are serialized under a lock (the worker +-processes one tool at a time anyway — and at ~50us/call that's free). +-""" +-from __future__ import annotations +- +-import os +-import socket +-import subprocess +-import sys +-import threading +-import time +-import uuid +-from typing import Any +- +-from .errors import IDAToolError, IDAConnectionError, Session +-from .worker import recv as _recv +-from .worker import send as _send +- +-_WORKER_PY = os.path.join(os.path.dirname(os.path.abspath(__file__)), "worker.py") +-_worker_python_cache: str | None = None +- +- +-def _find_worker_python() -> str: +- """A python that can import ``ida_pro_mcp`` (and thus idalib) — NOT necessarily +- the TUI's python. On a typical box the TUI runs under a venv that has textual +- + idalib but not ida_pro_mcp, while the system python has idalib + +- ida_pro_mcp. Override with IDATUI_WORKER_PYTHON.""" +- global _worker_python_cache +- if _worker_python_cache: +- return _worker_python_cache +- override = os.environ.get("IDATUI_WORKER_PYTHON") +- candidates = [override] if override else [] +- candidates += ["/usr/bin/python", "/usr/bin/python3", sys.executable] +- for py in candidates: +- if not py or not os.path.exists(py): +- continue +- try: +- r = subprocess.run([py, "-c", "import ida_pro_mcp"], +- capture_output=True, timeout=30) +- if r.returncode == 0: +- _worker_python_cache = py +- return py +- except Exception: # noqa: BLE001 +- continue +- return sys.executable # last resort; the worker will report the real error +- +- +-class _NoopKeepAlive: +- """The worker is ours and never idles out, so keepalive is a no-op.""" +- +- def __init__(self) -> None: +- self.beats = self.failures = 0 +- +- def start(self): +- return self +- +- def stop(self) -> None: +- pass +- +- +-class WorkerClient: +- def __init__(self, binary_path: str, *, ttl: int = 0, +- python: str | None = None, load_args: str = "") -> None: +- self._bin = os.path.abspath(os.path.expanduser(binary_path)) +- self._load_args = load_args or "" # IDA switches for a headerless blob +- self._python = python or _find_worker_python() +- tag = f"{os.getpid()}-{uuid.uuid4().hex[:8]}" +- self._sock_path = f"/tmp/idatui-worker-{tag}.sock" +- self._log_path = f"/tmp/idatui-worker-{tag}.log" +- self._proc: subprocess.Popen | None = None +- self._sock: socket.socket | None = None +- self._sid = uuid.uuid4().hex[:8] +- self._lock = threading.Lock() # serialize socket use +- self._spawn_lock = threading.Lock() +- +- # -- lifecycle --------------------------------------------------------- # +- def connect(self, timeout: float = 1800.0, progress=None) -> "WorkerClient": +- """Spawn the worker (opens + analyzes the DB) and connect once ready.""" +- with self._spawn_lock: +- if self._sock is not None: +- return self +- if self._proc is None or self._proc.poll() is not None: +- # run worker.py as a SCRIPT (not -m idatui.worker) so we don't +- # import the textual-dependent idatui package __init__ under the +- # IDA python, which usually has no textual. +- argv = [self._python, _WORKER_PY, self._sock_path, self._bin] +- if self._load_args: +- argv.append(self._load_args) +- self._proc = subprocess.Popen( +- argv, +- stdout=open(self._log_path, "wb"), +- stderr=subprocess.STDOUT, stdin=subprocess.DEVNULL, +- ) +- deadline = time.time() + timeout +- t0 = time.time() +- while time.time() < deadline: +- try: +- s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) +- s.connect(self._sock_path) +- self._sock = s +- return self +- except OSError: +- if self._proc.poll() is not None: +- raise IDAConnectionError( +- f"worker exited (code {self._proc.returncode}): " +- f"{self._log_tail()} [full log: {self._log_path}]") +- if progress: +- progress(f"auto-analyzing {os.path.basename(self._bin)}… " +- f"({int(time.time() - t0)}s)") +- time.sleep(0.2) +- raise IDAConnectionError("worker did not become ready in time") +- +- @property +- def pid(self) -> int | None: +- """The worker process id (for memory accounting), or None if not spawned.""" +- return self._proc.pid if self._proc is not None else None +- +- def close(self, grace: float = 20.0) -> None: +- """Shut the worker down cleanly. +- +- After ``__shutdown__`` the worker still has to ``close_database()``, which +- re-packs the ``.i64`` and removes the unpacked ``.id0/.id1/...`` scratch. +- Signalling it before that finishes is what leaves databases wedged, so +- wait out the grace period first and only escalate if it really is stuck. +- """ +- with self._lock: +- s = self._sock +- self._sock = None +- if s is not None: +- try: +- _send(s, ("__shutdown__", {})) +- except Exception: # noqa: BLE001 +- pass +- try: +- s.close() +- except Exception: # noqa: BLE001 +- pass +- if self._proc is not None: +- try: +- self._proc.wait(timeout=grace) # let it close the DB properly +- except Exception: # noqa: BLE001 -- TimeoutExpired: it's stuck +- try: +- self._proc.terminate() +- self._proc.wait(timeout=5) +- except Exception: # noqa: BLE001 +- try: +- self._proc.kill() +- except Exception: # noqa: BLE001 +- pass +- +- # -- the call surface -------------------------------------------------- # +- def call(self, tool: str, *, timeout: float | None = None, **args) -> Any: +- if self._sock is None: +- self.connect() +- with self._lock: +- s = self._sock +- if s is None: +- raise IDAConnectionError("worker connection is closed") +- try: +- _send(s, (tool, args)) +- reply = _recv(s) +- except (OSError, ConnectionError) as e: +- self._sock = None +- raise IDAConnectionError(f"worker transport failed: {e}") from e +- if reply is None: +- self._sock = None +- raise IDAConnectionError("worker closed the connection") +- ok, payload = reply +- if not ok: +- raise IDAToolError(tool, str(payload)) +- return payload +- +- def call_envelope(self, tool: str, *, timeout: float | None = None, +- **args) -> dict: +- # domain.decompile() reads result.structuredContent — mirror that shape. +- return {"result": {"structuredContent": self.call(tool, timeout=timeout, +- **args)}} +- +- # -- session shims (single-DB worker) --------------------------------- # +- def set_db(self, db: str | None) -> None: +- if db: +- self._sid = db +- +- def resolve_db(self) -> str: +- return self._sid +- +- def list_sessions(self) -> list[Session]: +- return [Session(session_id=self._sid, +- filename=os.path.basename(self._bin), +- input_path=self._bin, is_active=True)] +- +- def health(self) -> dict: +- try: +- return self.call("server_health") +- except IDAToolError: +- return {"module": os.path.basename(self._bin), "ok": True} +- +- def keepalive(self, interval: float = 120.0) -> _NoopKeepAlive: +- return _NoopKeepAlive() +- +- def _log_tail(self, n: int = 400) -> str: +- """Last meaningful line(s) of the worker log (skip IDA's licence banner), +- so a startup crash surfaces the real cause instead of just 'code 1'.""" +- try: +- with open(self._log_path, encoding="utf-8", errors="replace") as f: +- lines = [ln.strip() for ln in f if ln.strip()] +- except OSError: +- return "(no worker log)" +- # the worker prints a clean 'WORKER-FATAL: ...' line on a startup crash +- for ln in reversed(lines): +- if ln.startswith("WORKER-FATAL:"): +- return ln[len("WORKER-FATAL:"):].strip()[-n:] +- skip = ("thank you", "licensed to", "[mcp]", "ida ", "hex-rays") +- meaningful = [ln for ln in lines +- if not any(s in ln.lower() for s in skip)] +- return " | ".join((meaningful or lines)[-3:])[-n:] +- +- # context manager parity with IDAClient +- def __enter__(self) -> "WorkerClient": +- return self.connect() +- +- def __exit__(self, *exc) -> None: +- self.close() +diff --git a/pyproject.toml b/pyproject.toml +index 30f8cc2..72f1ff3 100644 +--- a/pyproject.toml ++++ b/pyproject.toml +@@ -1,15 +1,17 @@ + [project] + name = "idatui" + version = "0.0.1" +-description = "A minimal keyboard-first TUI frontend for IDA Pro over the ida-pro-mcp (idalib) server." ++description = "A keyboard-first TUI frontend for shared IDA Code Mode databases." + requires-python = ">=3.11" +-# The client layer is intentionally stdlib-only (urllib/http.client), matching the +-# ida-mcp skill philosophy: no install needed to talk to the server. +-dependencies = [] ++# ida-codemode supplies GUI discovery, shared idalib workers, leases, and the ++# execute_python/ida-domain database surface. ++dependencies = [ ++ "ida-codemode-mcp", ++ "textual>=8", ++ "pygments>=2", # Used directly for pseudocode highlighting. ++] + + [project.optional-dependencies] +-# The TUI layer pulls in Textual; the client/domain layers are stdlib-only. +-tui = ["textual>=8", "pygments>=2"] # pygments ships with rich; explicit for the C lexer + dev = ["pytest>=8"] + + [project.scripts] +@@ -22,3 +24,6 @@ build-backend = "hatchling.build" + + [tool.hatch.build.targets.wheel] + packages = ["idatui"] ++ ++[tool.uv.sources] ++ida-codemode-mcp = { path = "../ida-codemode-mcp", editable = true } +diff --git a/server/patch_server.py b/server/patch_server.py +deleted file mode 100644 +index 160b15b..0000000 +--- a/server/patch_server.py ++++ /dev/null +@@ -1,1248 +0,0 @@ +-#!/usr/bin/env python3 +-"""Inject idatui's extra ida-pro-mcp tools into the installed server package. +- +-DEPRECATED along with the ida-pro-mcp transport: the default backend is now the +-idalib worker (idatui/worker.py), which registers these same tools in-process and +-needs no patching. Kept only for `--backend mcp`; slated for removal. +- +-ida-pro-mcp lacks a few tools idatui needs. Rather than vendor/fork the server, +-we keep the tool source here and inject it (idempotently) into the installed +-``api_types.py``. That module is imported by every worker +-(``python -m ida_pro_mcp.idalib_server``), so the tools register themselves via +-``@tool`` on the shared ``MCP_SERVER`` — no server code is forked, and re-running +-this (spawn.sh does, on every start) re-applies it after a reinstall/upgrade. +- +-Injected tools: +- * ``del_type`` — delete a named local type (struct editor CRUD). +- * ``func_types`` — structured decompiler types for a function (prototype + +- local variables), so clients don't parse pseudocode text. +- * ``set_lvar_type`` — set a decompiler local variable's type; works on auto/ +- register vars too (the stock set_type only updates lvars +- that already have user-saved info). +- +-The block between the BEGIN/END markers is *replaced* on each run, so editing +-BODY here and restarting the supervisor updates the tools. +- +-Run with the *same* interpreter the server uses (the idalib-mcp entry point's +-``/usr/bin/python``), so it patches the file the workers actually import. +-Changing a tool needs a supervisor restart so workers respawn. +-""" +-from __future__ import annotations +- +-import importlib.util +-import pathlib +-import sys +- +-BEGIN = "# >>> idatui-ext: begin (auto-injected by server/patch_server.py) >>>" +-END = "# <<< idatui-ext: end <<<" +- +-# Appended to ida_pro_mcp/ida_mcp/api_types.py, which already imports +-# ``Annotated``, ``tool``, ``idasync``, ``ida_typeinf``, ``parse_address`` and +-# ``_parse_type_tinfo``. +-BODY = ''' +-def _idatui_lv_get(x): +- return x() if callable(x) else x +- +- +-@tool +-@idasync +-def resolve_names( +- queries: Annotated[list, "Symbol name(s) to resolve to their OWN address"], +-) -> list: +- """Resolve named locations (functions, labels like loc_/locret_, data) to the +- exact address the NAME denotes, via get_name_ea. Unlike lookup_funcs, a +- mid-function label resolves to the label's address, not the containing +- function's entry.""" +- import idaapi +- qs = queries if isinstance(queries, list) else [queries] +- out = [] +- for q in qs: +- q = str(q).strip() +- ea = idaapi.get_name_ea(idaapi.BADADDR, q) +- out.append({"query": q, "ea": (hex(ea) if ea != idaapi.BADADDR else None)}) +- return out +- +- +-@tool +-@idasync +-def del_type( +- name: Annotated[str, "Local type name to delete (struct/union/enum/typedef)"], +-) -> dict: +- """Delete a named local type from the local type library.""" +- til = ida_typeinf.get_idati() +- ok = ida_typeinf.del_named_type(til, name, ida_typeinf.NTF_TYPE) +- if not ok: +- return {"name": name, "error": f"Type '{name}' not found or could not be deleted"} +- return {"name": name, "deleted": True} +- +- +-@tool +-@idasync +-def func_types( +- addr: Annotated[str, "Function address or name"], +-) -> dict: +- """Structured decompiler types for a function: its prototype plus each local +- variable (name/type/is_arg). Lets clients read/edit types without parsing +- pseudocode text.""" +- import ida_hexrays +- import idaapi +- +- def _tstr(tif): +- try: +- s = tif.dstr() +- if s: +- return s +- except Exception: +- pass +- return str(tif) +- +- ea = parse_address(addr) +- f = idaapi.get_func(ea) +- if not f: +- return {"addr": str(addr), "error": "no function at address"} +- try: +- cf = ida_hexrays.decompile(f.start_ea) +- except Exception as e: +- return {"addr": hex(f.start_ea), "error": f"decompile failed: {e}"} +- if cf is None: +- return {"addr": hex(f.start_ea), "error": "decompilation failed"} +- name = idaapi.get_func_name(f.start_ea) or "" +- try: +- proto = ida_typeinf.print_tinfo( +- "", 0, 0, ida_typeinf.PRTYPE_1LINE, cf.type, name, "") +- except Exception: +- proto = "" +- lvars = [] +- for lv in cf.get_lvars(): +- try: +- ty = _tstr(_idatui_lv_get(lv.type)) +- except Exception: +- ty = "" +- lvars.append({ +- "name": _idatui_lv_get(lv.name), +- "type": ty, +- "is_arg": bool(_idatui_lv_get(lv.is_arg_var)), +- }) +- return { +- "addr": hex(f.start_ea), +- "name": name, +- "prototype": (proto or "").strip(), +- "lvars": lvars, +- } +- +- +-@tool +-@idasync +-def set_lvar_type( +- addr: Annotated[str, "Function address or name"], +- variable: Annotated[str, "Local variable name"], +- type: Annotated[str, "New C type for the variable"], +-) -> dict: +- """Set a decompiler local variable's type. Handles auto/register vars (unlike +- set_type, which only updates lvars that already have user-saved info).""" +- import ida_hexrays +- import idaapi +- +- ea = parse_address(addr) +- f = idaapi.get_func(ea) +- if not f: +- return {"error": "no function at address"} +- try: +- cf = ida_hexrays.decompile(f.start_ea) +- except Exception as e: +- return {"error": f"decompile failed: {e}"} +- if cf is None: +- return {"error": "decompilation failed"} +- target = None +- for lv in cf.get_lvars(): +- if _idatui_lv_get(lv.name) == variable: +- target = lv +- break +- if target is None: +- return {"error": f"local variable {variable!r} not found"} +- try: +- tif = _parse_type_tinfo(type) +- except Exception as e: +- return {"error": f"bad type {type!r}: {e}"} +- lsi = ida_hexrays.lvar_saved_info_t() +- try: +- lsi.ll = target +- except Exception: +- try: +- lsi.ll.location = _idatui_lv_get(target.location) +- lsi.ll.defea = target.defea +- except Exception as e: +- return {"error": f"could not locate variable: {e}"} +- lsi.type = tif +- ok = bool(ida_hexrays.modify_user_lvar_info( +- f.start_ea, ida_hexrays.MLI_TYPE, lsi)) +- return {"addr": hex(f.start_ea), "variable": variable, "type": type, "ok": ok} +- +- +-@tool +-@idasync +-def file_regions() -> dict: +- """Loaded segments mapped to their raw file offsets (get_fileregion_offset), +- so clients can convert a virtual address to an on-disk file offset without a +- format-specific header parser. file_off is -1 for non-file-backed segments +- (e.g. .bss).""" +- import ida_segment +- import idaapi +- +- out = [] +- seg = ida_segment.get_first_seg() +- while seg is not None: +- try: +- fo = int(idaapi.get_fileregion_offset(seg.start_ea)) +- except Exception: +- fo = -1 +- if fo < 0 or fo >= (1 << 48): +- fo = -1 +- try: +- nm = ida_segment.get_segm_name(seg) or "" +- except Exception: +- nm = "" +- out.append({"start": hex(seg.start_ea), "end": hex(seg.end_ea), +- "file_off": fo, "name": nm}) +- seg = ida_segment.get_next_seg(seg.start_ea) +- return {"regions": out} +- +- +-@tool +-@idasync +-def make_string( +- addr: Annotated[str, "Address of the string start"], +- length: Annotated[int, "Length in bytes (0 = auto-detect to the terminator)"] = 0, +- kind: Annotated[str, "String kind: c | c16 | c32 | pascal"] = "c", +-) -> dict: +- """Create a string literal at ``addr`` (IDA's 'A'). ``length`` 0 auto-detects +- to the terminator. Undefines any items in the way first, like the UI does. +- Returns the created byte size and the decoded contents.""" +- import ida_bytes +- import ida_nalt +- +- ea = parse_address(addr) +- strtype = { +- "c": ida_nalt.STRTYPE_C, +- "c16": ida_nalt.STRTYPE_C_16, +- "c32": ida_nalt.STRTYPE_C_32, +- "pascal": ida_nalt.STRTYPE_PASCAL, +- }.get(str(kind).lower(), ida_nalt.STRTYPE_C) +- n = max(int(length), 0) +- # Free any existing item(s) so create_strlit can carve the literal. +- ida_bytes.del_items(ea, ida_bytes.DELIT_SIMPLE, n if n > 0 else 1) +- ok = bool(ida_bytes.create_strlit(ea, n, strtype)) +- if not ok: +- return {"addr": addr, "ok": False, "error": "create_strlit failed"} +- size = int(ida_bytes.get_item_size(ea)) +- try: +- raw = ida_bytes.get_strlit_contents(ea, -1, strtype) +- text = raw.decode("utf-8", "replace") if raw else "" +- except Exception: +- text = "" +- return {"addr": addr, "ok": True, "size": size, "text": text} +- +- +-@tool +-@idasync +-def read_raw( +- addr: Annotated[str, "Start address (hex or name)"], +- size: Annotated[int, "Number of bytes to read"], +-) -> dict: +- """Read ``size`` bytes at ``addr`` as ONE contiguous lowercase hex string +- (no per-byte '0x'/spaces). The hot path for the hex view and disasm opcode +- bytes. +- +- Fast: does a single bulk ``ida_bytes.get_bytes`` (C-speed) instead of the +- per-byte read_bytes_bss_safe loop (2 IDA calls/byte). Unloaded bytes come +- back from IDA as the 0xFF sentinel, so we only re-check is_loaded for the +- (usually sparse) 0xFF bytes and zero the genuinely-unloaded ones — matching +- get_bytes' bss semantics without paying per-byte for the whole range. +- +- Encoding is compact hex (~2.5x smaller than get_bytes' '0x..'-with-spaces) +- and, unlike get_bytes, does not truncate on large reads.""" +- import ida_bytes +- +- ea = parse_address(addr) +- n = max(int(size), 0) +- if n == 0: +- return {"addr": addr, "hex": "", "n": 0} +- raw = ida_bytes.get_bytes(ea, n) +- if raw is None or len(raw) < n: # nothing (or not all) mapped +- base = bytearray(raw or b"") +- base.extend(b"\\xff" * (n - len(base))) +- raw = bytes(base) +- ba = bytearray(raw) +- # Only unloaded bytes read as 0xFF; correct just those to 0 (bss => zero). +- i = ba.find(0xFF) +- while i != -1: +- if not ida_bytes.is_loaded(ea + i): +- ba[i] = 0 +- i = ba.find(0xFF, i + 1) +- return {"addr": addr, "hex": bytes(ba).hex(), "n": len(ba)} +- +- +-def _idatui_head_row(ea): +- """One flat-listing row for the head at ``ea``: kind (code/data/unknown), +- byte size, rendered text, and any symbol name.""" +- import ida_bytes +- import ida_lines +- import ida_name +- +- f = ida_bytes.get_flags(ea) +- if ida_bytes.is_code(f): +- kind = "code" +- elif ida_bytes.is_data(f): +- kind = "data" +- else: +- kind = "unknown" +- line = ida_lines.generate_disasm_line(ea, 0) +- text = ida_lines.tag_remove(line) if line else "" +- text = " ".join(text.split()) # collapse IDA's column padding +- row = { +- "ea": hex(ea), +- "kind": kind, +- "size": int(ida_bytes.get_item_size(ea)), +- "text": text, +- } +- if line: +- # Keep IDA's own token classification for syntax highlighting. Built from +- # the SAME line as `text`, then whitespace-collapsed identically so the +- # two never disagree about what the row says. +- spans = _idatui_spans(line) +- joined = "".join(t for _k, t in spans) +- if " ".join(joined.split()) == text: +- row["spans"] = spans +- nm = ida_name.get_ea_name(ea) +- if nm: +- row["name"] = nm +- return row +- +- +-#: IDA colour tag -> the semantic kind the TUI styles. IDA already classifies +-#: every token in a disassembly line, for every processor it supports, so there +-#: is nothing to lex: generate_disasm_line emits \x01<tag>text\x02<tag> and the +-#: tag says what the text IS. A pygments assembly lexer would be a worse guess at +-#: this and would need one dialect per architecture. +-_IDATUI_SPAN_KINDS = { +- "insn": ("SCOLOR_INSN", "SCOLOR_KEYWORD", "SCOLOR_ASMDIR", "SCOLOR_MACRO"), +- "reg": ("SCOLOR_REG",), +- "num": ("SCOLOR_NUMBER", "SCOLOR_CHAR", "SCOLOR_BINPREF"), +- "str": ("SCOLOR_STRING",), +- # NB the real constant names: DATNAME/CODNAME, not "DNAME". Guessing here +- # fails silently — an unmapped tag renders as plain body text, so symbols +- # just quietly aren't blue and nothing tells you why. +- "name": ("SCOLOR_DATNAME", "SCOLOR_CODNAME", "SCOLOR_LOCNAME", +- "SCOLOR_IMPNAME", "SCOLOR_DEMNAME", "SCOLOR_LIBNAME", +- "SCOLOR_CNAME", "SCOLOR_DNAME", +- "SCOLOR_CREF", "SCOLOR_DREF", "SCOLOR_CREFTAIL", "SCOLOR_DREFTAIL"), +- "seg": ("SCOLOR_SEGNAME",), +- "cmt": ("SCOLOR_AUTOCMT", "SCOLOR_REGCMT", "SCOLOR_RPTCMT", "SCOLOR_VOIDOP"), +- "punct": ("SCOLOR_SYMBOL", "SCOLOR_ALTOP", "SCOLOR_HIDNAME"), +- "err": ("SCOLOR_ERROR",), +-} +- +- +-def _idatui_tag_map(): +- """{tag character: kind}, built once from whatever this IDA actually has.""" +- import ida_lines +- out = {} +- for kind, names in _IDATUI_SPAN_KINDS.items(): +- for n in names: +- v = getattr(ida_lines, n, None) +- if isinstance(v, str) and v: +- out[v[0]] = kind +- elif isinstance(v, int): +- out[chr(v)] = kind +- return out +- +- +-_IDATUI_TAGS = None +- +- +-def _idatui_spans(line): +- """A tagged disasm line as [[kind, text], ...], colour tags resolved. +- +- Unknown tags become 'text' rather than being dropped: a processor module can +- emit a colour we don't classify, and losing the characters would corrupt the +- line.""" +- global _IDATUI_TAGS +- import ida_lines +- if _IDATUI_TAGS is None: +- _IDATUI_TAGS = _idatui_tag_map() +- on, off, esc = "\x01", "\x02", "\x03" +- addr_tag = chr(getattr(ida_lines, "COLOR_ADDR", 0x28)) +- addr_len = int(getattr(ida_lines, "COLOR_ADDR_SIZE", 16)) +- spans, stack, buf = [], [], [] +- i, n = 0, len(line) +- +- def flush(): +- if buf: +- spans.append([stack[-1] if stack else "text", "".join(buf)]) +- del buf[:] +- +- while i < n: +- ch = line[i] +- if ch == on and i + 1 < n: +- tag = line[i + 1] +- if tag == addr_tag: +- # An embedded target address, not display text: 16 hex digits +- # that must not reach the screen. +- i += 2 + addr_len +- continue +- flush() +- stack.append(_IDATUI_TAGS.get(tag, "text")) +- i += 2 +- continue +- if ch == off and i + 1 < n: +- flush() +- if stack: +- stack.pop() +- i += 2 +- continue +- if ch == esc and i + 1 < n: # escaped literal +- buf.append(line[i + 1]) +- i += 2 +- continue +- buf.append(ch) +- i += 1 +- flush() +- # Collapse IDA's column padding EXACTLY as the plain text does. A run of +- # spaces can straddle two spans, so this walks characters rather than +- # collapsing each span on its own — otherwise the spans and `text` disagree +- # about the line and the row silently loses its highlighting. +- out, prev_space = [], False +- for kind, txt in spans: +- acc = [] +- for ch in txt: +- if ch.isspace(): +- if prev_space: +- continue +- acc.append(" ") +- prev_space = True +- else: +- acc.append(ch) +- prev_space = False +- if acc: +- out.append([kind, "".join(acc)]) +- while out and out[0][1] == " ": +- out.pop(0) +- while out and out[-1][1] == " ": +- out.pop() +- if out and out[0][1].startswith(" "): +- out[0][1] = out[0][1].lstrip() +- if out and out[-1][1].endswith(" "): +- out[-1][1] = out[-1][1].rstrip() +- return [[k, t] for k, t in out if t] +- +- +-def _idatui_unknown_row(ea, size): +- """One collapsed row for a run of ``size`` undefined bytes starting at +- ``ea``. A single byte is rendered normally (shows its value); a longer run +- collapses to ``db N dup(?)`` so a big .bss/gap doesn't explode into millions +- of one-byte rows.""" +- import ida_name +- +- if size <= 1: +- return _idatui_head_row(ea) +- row = {"ea": hex(ea), "kind": "unknown", "size": int(size), +- "text": f"db {size} dup(?)"} +- nm = ida_name.get_ea_name(ea) +- if nm: +- row["name"] = nm +- return row +- +- +-def _idatui_struct_member_rows(ea): +- """Indented member rows for a struct-typed data item at ``ea`` (expansion), +- or [] if it isn't a struct. Top-level fields only.""" +- import ida_nalt +- import ida_typeinf +- import idaapi +- +- tif = ida_typeinf.tinfo_t() +- if not (ida_nalt.get_tinfo(tif, ea) and tif.is_udt()): +- return [] +- udt = ida_typeinf.udt_type_data_t() +- if not tif.get_udt_details(udt): +- return [] +- rows = [] +- for m in udt: +- off = m.begin() // 8 +- try: +- mtype = m.type._print() or "" +- except Exception: +- mtype = "" +- try: +- sz = int(m.type.get_size()) +- if sz == idaapi.BADSIZE: +- sz = 0 +- except Exception: +- sz = 0 +- name = m.name or "" +- text = f"+{off:X} {name}" + (f" {mtype}" if mtype else "") +- rows.append({"ea": hex(ea + off), "kind": "member", "size": sz, +- "text": text}) +- return rows +- +- +-def _idatui_func_header_rows(ea): +- """IDA-style subroutine banner rows shown just before a function's entry.""" +- import ida_funcs +- +- name = ida_funcs.get_func_name(ea) or "sub_%X" % ea +- bar = "=" * 15 + " S U B R O U T I N E " + "=" * 15 +- return [ +- {"ea": hex(ea), "kind": "sep", "size": 0, "text": ""}, +- {"ea": hex(ea), "kind": "sep", "size": 0, "text": "; " + bar}, +- {"ea": hex(ea), "kind": "funchdr", "size": 0, +- "text": name + " proc", "name": name}, +- ] +- +- +-def _idatui_func_footer_rows(ea, func): +- """End-of-function marker shown just after a function's last item.""" +- import ida_funcs +- +- name = ida_funcs.get_func_name(func.start_ea) or "sub_%X" % func.start_ea +- return [ +- {"ea": hex(ea), "kind": "funchdr", "size": 0, +- "text": name + " endp", "name": name}, +- {"ea": hex(ea), "kind": "sep", "size": 0, "text": "; " + "-" * 60}, +- ] +- +- +-@tool +-@idasync +-def heads( +- addr: Annotated[str, "Start address or name to walk from"], +- count: Annotated[int, "Max heads to return (default 200, max 2000)"] = 200, +- offset: Annotated[int, "Skip first N heads from addr (default 0)"] = 0, +- end: Annotated[str, "Optional exclusive end address; default = segment end"] = "", +- back: Annotated[bool, "Walk backwards: return the count heads ENDING just before addr, in forward order"] = False, +- annotate: Annotated[bool, "Emit IDA-style function boundary banner rows (kind sep/funchdr)"] = False, +-) -> dict: +- """Walk item heads from ``addr`` as a flat listing: every head is rendered +- (code OR data OR undefined) via generate_disasm_line and stepped with +- next_head/prev_head. Unlike ``disasm`` (code-only, bails at the first data +- byte) this shows db/dw/dd/... lines for data and undefined regions — IDA's +- real disassembly view. Address-paged: page forward by re-calling with +- ``addr`` = the returned cursor.next; page up with ``back=true``.""" +- import ida_bytes +- import ida_segment +- import idaapi +- +- count = 2000 if count > 2000 else (1 if count < 1 else count) +- offset = max(int(offset), 0) +- try: +- start = parse_address(addr) +- except Exception as e: +- return {"addr": str(addr), "error": str(e), "heads": [], "cursor": {"done": True}} +- seg = ida_segment.getseg(start) +- if not seg: +- return {"addr": str(addr), "error": "no segment", "heads": [], "cursor": {"done": True}} +- lo, hi = seg.start_ea, seg.end_ea +- if end: +- try: +- hi = min(hi, parse_address(end)) +- except Exception: +- pass +- +- rows = [] +- if back: +- # Collect up to (count+offset) heads strictly before `start`, then take +- # the window closest to `start`, returned in forward order. +- walk = [] +- cur = ida_bytes.prev_head(start, lo) +- while cur != idaapi.BADADDR and cur >= lo and len(walk) < count + offset: +- walk.append(cur) +- cur = ida_bytes.prev_head(cur, lo) +- walk.reverse() +- chosen = walk[: len(walk) - offset] if offset else walk +- chosen = chosen[-count:] +- rows = [_idatui_head_row(e) for e in chosen] +- first = chosen[0] if chosen else start +- pea = ida_bytes.prev_head(first, lo) +- cursor = {"done": True} if pea == idaapi.BADADDR or pea < lo else {"prev": hex(pea)} +- return {"addr": str(addr), "heads": rows, "cursor": cursor} +- +- # Walk by item END (not next_head): next_head SKIPS undefined bytes, but a +- # flat listing must show them (IDA renders undefined as `db ?` lines, and +- # navigating to an unmarked address must land ON it). Defined items advance +- # by get_item_end; a run of undefined bytes is COLLAPSED into one row (its +- # end found in O(1) via next_head, which skips undefined) so a large .bss or +- # gap doesn't explode into millions of one-byte rows. +- def _is_unknown(e): +- f = ida_bytes.get_flags(e) +- return not (ida_bytes.is_code(f) or ida_bytes.is_data(f)) +- +- def _run_end(e): +- """End (exclusive) of the undefined run starting at ``e``.""" +- nh = ida_bytes.next_head(e, hi) +- return nh if (nh != idaapi.BADADDR and e < nh <= hi) else hi +- +- def _advance(e): +- if _is_unknown(e): +- return _run_end(e) +- nxt = ida_bytes.get_item_end(e) +- return nxt if nxt > e else e + 1 +- +- def _rows_for(e): +- if _is_unknown(e): +- return [_idatui_unknown_row(e, _run_end(e) - e)] +- func = idaapi.get_func(e) if annotate else None +- at_start = func is not None and func.start_ea == e +- out = [] +- if at_start: +- out.extend(_idatui_func_header_rows(e)) +- row = _idatui_head_row(e) +- if at_start: +- row = dict(row) +- row["name"] = None # the name is shown on the proc header line +- elif annotate and row.get("kind") == "code" and row.get("name"): +- # A code label (loc_XXX/jump target) gets its OWN line at depth 0, +- # like IDA; strip it from the instruction row below. +- nm = row["name"] +- out.append({"ea": hex(e), "kind": "label", "size": 0, +- "text": nm + ":", "name": nm}) +- row = dict(row) +- row["name"] = None +- out.append(row) +- if row.get("kind") == "data": +- out.extend(_idatui_struct_member_rows(e)) # expand struct fields +- if func is not None and ida_bytes.get_item_end(e) >= func.end_ea: +- out.extend(_idatui_func_footer_rows(e, func)) +- return out +- +- ea = ida_bytes.get_item_head(start) +- for _ in range(offset): +- if ea >= hi or ea == idaapi.BADADDR: +- break +- ea = _advance(ea) +- more = False +- while ea != idaapi.BADADDR and ea < hi: +- if len(rows) >= count: +- more = True +- break +- rows.extend(_rows_for(ea)) # a struct head expands into member rows +- ea = _advance(ea) +- cursor = {"next": hex(ea)} if more else {"done": True} +- return {"addr": str(addr), "heads": rows, "cursor": cursor} +- +- +-@tool +-@idasync +-def xref_types( +- queries: Annotated[list, "[{addr, direction:'to'|'from'|'both', include_fn, dedup, count}]"], +-) -> dict: +- """Like xref_query, but every row carries a fine-grained ``kind`` derived from +- the IDA xref type \u2014 call/jump/flow for code, read/write/offset/text/info for +- data \u2014 alongside the coarse ``type`` (code/data). Feeds the xref dialog's +- r/w/call badges. Same query/envelope shape as xref_query.""" +- import idaapi, idautils, ida_funcs, ida_bytes, ida_xref +- code_kind = {ida_xref.fl_CF: "call", ida_xref.fl_CN: "call", +- ida_xref.fl_JF: "jump", ida_xref.fl_JN: "jump", +- ida_xref.fl_F: "flow"} +- data_kind = {ida_xref.dr_O: "offset", ida_xref.dr_W: "write", +- ida_xref.dr_R: "read", ida_xref.dr_T: "text", ida_xref.dr_I: "info"} +- +- def _kind(xr): +- table = code_kind if xr.iscode else data_kind +- return table.get(xr.type, "code" if xr.iscode else "data") +- +- def _fn(ea): +- f = ida_funcs.get_func(ea) +- if not f: +- return None +- return {"addr": hex(f.start_ea), "name": ida_funcs.get_func_name(f.start_ea)} +- +- def _resolve(raw): +- raw = str(raw).strip() +- try: +- return int(raw, 16) # handles '0x2490' and '2490' +- except ValueError: +- return idaapi.get_name_ea(idaapi.BADADDR, raw) +- +- qs = queries if isinstance(queries, list) else [queries] +- result = [] +- for q in qs: +- q = q if isinstance(q, dict) else {"addr": q} +- raw = str(q.get("addr", "")).strip() +- direction = str(q.get("direction", "to") or "to").lower() +- include_fn = bool(q.get("include_fn", True)) +- dedup = bool(q.get("dedup", True)) +- try: +- count = int(q.get("count", 2000) or 2000) +- except (TypeError, ValueError): +- count = 2000 +- target = _resolve(raw) +- rows = [] +- if target is not None and target != idaapi.BADADDR and ida_bytes.is_mapped(target): +- if direction in ("to", "both"): +- for xr in idautils.XrefsTo(target, 0): +- row = {"direction": "to", "addr": hex(xr.frm), "from": hex(xr.frm), +- "to": hex(target), "type": "code" if xr.iscode else "data", +- "kind": _kind(xr)} +- if include_fn: +- row["fn"] = _fn(xr.frm) +- rows.append(row) +- if direction in ("from", "both"): +- for xr in idautils.XrefsFrom(target, 0): +- row = {"direction": "from", "addr": hex(xr.to), "from": hex(target), +- "to": hex(xr.to), "type": "code" if xr.iscode else "data", +- "kind": _kind(xr)} +- if include_fn: +- row["fn"] = _fn(xr.to) +- rows.append(row) +- if dedup: +- seen = set() +- deduped = [] +- for r in rows: +- k = (r["direction"], r["from"], r["to"], r["kind"]) +- if k in seen: +- continue +- seen.add(k) +- deduped.append(r) +- rows = deduped +- rows = rows[:count] +- result.append({"query": raw, "data": rows, "next_offset": None}) +- return {"result": result} +- +- +-@tool +-@idasync +-def data_type( +- addr: Annotated[str, "Address or name of a data item / global"], +-) -> dict: +- """The current C type of a data item, for prefilling a retype prompt: +- {addr, name, type, size, is_func}. ``type`` is empty when the item is +- untyped; ``is_func`` distinguishes a global from a function so the caller +- knows which flavour of set_type to use.""" +- import idaapi +- import ida_bytes +- import ida_name +- import idc +- raw = str(addr).strip() +- try: +- ea = int(raw, 16) +- except ValueError: +- ea = idaapi.get_name_ea(idaapi.BADADDR, raw) +- if ea == idaapi.BADADDR or not ida_bytes.is_mapped(ea): +- return {"addr": raw, "error": f"not a mapped address: {raw}"} +- return { +- "addr": hex(ea), +- "name": ida_name.get_name(ea) or "", +- "type": idc.get_type(ea) or "", +- "size": int(ida_bytes.get_item_size(ea) or 0), +- "is_func": bool(idaapi.get_func(ea)), +- } +- +- +-@tool +-@idasync +-def decomp_map( +- addr: Annotated[str, "Function address or name"], +-) -> dict: +- """Per-pseudocode-line instruction coverage for the split view's region +- highlight: for each line, the set of EAs the decompiler attributes to it, +- swept across the line's columns via get_line_item. Shape: +- {addr, lines:[{ea: primary|None, eas:[hex,...]}, ...]}.""" +- import ida_hexrays +- import idaapi +- try: +- ea = int(str(addr), 16) +- except ValueError: +- ea = idaapi.get_name_ea(idaapi.BADADDR, str(addr).strip()) +- func = idaapi.get_func(ea) +- if not func: +- return {"error": f"no function at {addr}"} +- try: +- cfunc = ida_hexrays.decompile(func.start_ea) +- except Exception as e: # noqa: BLE001 +- return {"error": f"decompile failed: {e}"} +- if cfunc is None: +- return {"error": "decompile failed"} +- lines = [] +- for sl in cfunc.get_pseudocode(): +- line = sl.line +- eas, seen = [], set() +- for x in range(len(line) + 1): +- head = ida_hexrays.ctree_item_t() +- item = ida_hexrays.ctree_item_t() +- tail = ida_hexrays.ctree_item_t() +- if not cfunc.get_line_item(line, x, False, head, item, tail): +- continue +- # Match the /*ea*/ marker's source (decompile_function_safe): the +- # item's dstr() is 'EA: description'; get_ea() reports a different ea. +- dstr = item.dstr() +- if not dstr: +- continue +- parts = dstr.split(": ", 1) +- if len(parts) != 2: +- continue +- try: +- e = int(parts[0], 16) +- except ValueError: +- continue +- if e not in seen: +- seen.add(e) +- eas.append(hex(e)) +- lines.append({"ea": eas[0] if eas else None, "eas": eas}) +- return {"addr": hex(func.start_ea), "lines": lines} +- +- +-_idatui_strings_cache = {} +- +- +-def _idatui_build_strings(min_len): +- """[(ea, text, length, typename)] for every string IDA found, cached by +- min_len (rebuilding the list is O(n) and the browser pages through it).""" +- import idautils +- import ida_nalt +- hit = _idatui_strings_cache.get(min_len) +- if hit is not None: +- return hit +- tnames = {} +- for nm, lbl in (("STRTYPE_C", "C"), ("STRTYPE_C_16", "utf16"), +- ("STRTYPE_C_32", "utf32"), ("STRTYPE_PASCAL", "pascal")): +- v = getattr(ida_nalt, nm, None) +- if v is not None: +- tnames[v & 0xFF] = lbl +- items = [] +- for s in idautils.Strings(): +- if s is None: +- continue +- try: +- text = str(s) +- except Exception: # noqa: BLE001 -- undecodable literal +- continue +- if len(text) < min_len: +- continue +- st = getattr(s, "strtype", 0) & 0xFF +- items.append((s.ea, text, getattr(s, "length", len(text)), +- tnames.get(st, "t%d" % st))) +- _idatui_strings_cache[min_len] = items +- return items +- +- +-@tool +-@idasync +-def list_strings( +- offset: Annotated[int, "Start index into the strings list"] = 0, +- count: Annotated[int, "Max strings to return (page size)"] = 2000, +- min_len: Annotated[int, "Minimum string length to include"] = 4, +- refresh: Annotated[bool, "Rebuild the cached strings list"] = False, +-) -> dict: +- """Every string literal IDA found in the binary (IDA's Shift+F12 window), +- paginated: {strings:[{addr,text,len,type}], total, next_offset}. Feeds the +- TUI's strings browser.""" +- try: +- min_len = max(int(min_len), 1) +- except (TypeError, ValueError): +- min_len = 4 +- try: +- offset = max(int(offset), 0) +- except (TypeError, ValueError): +- offset = 0 +- try: +- count = max(int(count), 1) +- except (TypeError, ValueError): +- count = 2000 +- if refresh: +- _idatui_strings_cache.pop(min_len, None) +- items = _idatui_build_strings(min_len) +- page = items[offset:offset + count] +- return { +- "strings": [{"addr": hex(ea), "text": text, "len": ln, "type": ty} +- for (ea, text, ln, ty) in page], +- "total": len(items), +- "next_offset": offset + len(page), +- } +- +-@tool +-@idasync +-def list_linkage( +- kind: Annotated[str, "'import', 'export' or 'both'"] = "both", +-) -> dict: +- """What this binary imports from, and exports to, other modules: +- {imports:[{addr,name,module}], exports:[{addr,name,ordinal}]}. Feeds the +- project-wide import/export join, which resolves a PLT stub in one binary to +- the real implementation in another.""" +- import idaapi +- import idautils +- import ida_nalt +- want = str(kind or "both").lower() +- imports = [] +- exports = [] +- if want in ("import", "both"): +- n = ida_nalt.get_import_module_qty() +- for i in range(n): +- mod = ida_nalt.get_import_module_name(i) or "" +- +- def _cb(ea, name, ordinal, _mod=mod): +- # An ordinal-only import has no name; skip rather than invent one. +- if name: +- imports.append({"addr": hex(ea), "name": name, "module": _mod}) +- return True +- +- ida_nalt.enum_import_names(i, _cb) +- if want in ("export", "both"): +- for index, ordinal, ea, name in idautils.Entries(): +- if name: +- exports.append({"addr": hex(ea), "name": name, +- "ordinal": int(ordinal)}) +- return {"imports": imports, "exports": exports, +- "n_imports": len(imports), "n_exports": len(exports)} +- +-@tool +-@idasync +-def define_code_run( +- addr: Annotated[str, "Address to start disassembling from"], +- limit: Annotated[int, "Max instructions to create (safety stop)"] = 20000, +-) -> dict: +- """Disassemble CONSECUTIVELY from ``addr`` until something stops it, the way +- IDA's 'c' does — one instruction is rarely what you want when carving a raw +- image. Returns {start,end,count,stopped} where ``stopped`` says why: +- 'undecodable' (bytes aren't an instruction), 'flow' (the last instruction +- doesn't fall through, e.g. RET/B), 'defined' (ran into existing code/data), +- 'segment' (hit the end) or 'limit'. +- +- Runs in-process: doing this from the client would be one round trip per +- instruction, which is minutes on a real firmware image.""" +- import ida_bytes +- import ida_idp +- import ida_segment +- import ida_ua +- import idaapi +- +- try: +- ea = parse_address(addr) +- except Exception as e: +- return {"addr": str(addr), "error": str(e), "count": 0} +- +- seg = ida_segment.getseg(ea) +- if not seg: +- return {"addr": str(addr), "error": "no segment", "count": 0} +- hi = seg.end_ea +- try: +- limit = max(1, min(int(limit), 200000)) +- except (TypeError, ValueError): +- limit = 20000 +- +- start, count, stopped = ea, 0, "limit" +- while count < limit: +- if ea >= hi: +- stopped = "segment" +- break +- flags = ida_bytes.get_flags(ea) +- if ida_bytes.is_code(flags) or ida_bytes.is_data(flags): +- # Already defined: stop rather than clobber. Undefining someone's +- # existing work to keep a speculative run going is not a trade the +- # user asked for. +- stopped = "defined" +- break +- n = ida_ua.create_insn(ea) +- if n <= 0: +- stopped = "undecodable" +- break +- count += 1 +- # Stop where control flow stops. Past a RET the next bytes are usually +- # padding or a new function's data, and running on turns a clean carve +- # into a mess that has to be undone by hand. +- # +- # Ask ida_idp.is_ret_insn, NOT the canonical feature bits: on AArch64 +- # get_canon_feature() returns 0 for RET, so a CF_STOP test silently never +- # fires and the run walks straight through the end of the routine. +- insn = ida_ua.insn_t() +- if ida_ua.decode_insn(insn, ea) > 0: +- try: +- is_ret = ida_idp.is_ret_insn(insn) +- except Exception: +- is_ret = False +- if is_ret or (insn.get_canon_feature() & idaapi.CF_STOP): +- ea += n +- stopped = "flow" +- break +- ea += n +- +- return {"start": hex(start), "end": hex(ea), "count": count, +- "stopped": stopped} +- +-@tool +-@idasync +-def set_thumb( +- addr: Annotated[str, "Address to change the ARM decoding mode at"], +- mode: Annotated[str, "'toggle', 'on' (Thumb) or 'off' (ARM)"] = "toggle", +- end: Annotated[str, "Optional exclusive end address (default: this item)"] = "", +-) -> dict: +- """Switch ARM/Thumb decoding at ``addr`` (IDA's T segment register). +- +- Thumb is not a property of the bytes, it's a mode the CPU is in, so a raw +- image gives IDA no way to know: at a Thumb entry point it decodes 16-bit +- instructions as 32-bit ARM and produces confident nonsense +- (``push {r3,lr}`` reads as ``SVCLT 0xBF00``). +- +- Also forces the segment to 32-bit when turning Thumb ON. Thumb does not +- exist in AArch64, and a headerless blob loaded with -parm defaults to +- 64-bit — so setting T alone changes nothing and looks broken. Asking for +- Thumb IS asking for ARM32.""" +- import ida_bytes +- import ida_idp +- import ida_segment +- import ida_segregs +- +- try: +- ea = parse_address(addr) +- except Exception as e: +- return {"addr": str(addr), "error": str(e)} +- treg = ida_idp.str2reg("T") +- if treg is None or treg < 0: +- return {"addr": hex(ea), "error": "no T register (not an ARM database)"} +- seg = ida_segment.getseg(ea) +- if not seg: +- return {"addr": hex(ea), "error": "no segment"} +- +- import ida_ida +- db64 = ida_ida.inf_get_app_bitness() == 64 +- cur = ida_segregs.get_sreg(ea, treg) +- cur = 0 if cur in (None, 0xFFFFFFFF, -1) else int(cur) +- want = {"on": 1, "off": 0}.get(str(mode).lower(), 0 if cur else 1) +- +- changed_bits = False +- if want and seg.bitness != 1: +- ida_segment.set_segm_addressing(seg, 1) +- changed_bits = True +- +- try: +- stop = parse_address(end) if end else 0 +- except Exception: +- stop = 0 +- size = max(int(stop) - ea, 0) or max(ida_bytes.get_item_size(ea), 2) +- # The bytes are currently decoded in the OLD mode; leaving that item defined +- # pins the wrong instruction length and the new mode has nothing to apply to. +- ida_bytes.del_items(ea, 0, size) +- ok = bool(ida_segregs.split_sreg_range(ea, treg, want, ida_segregs.SR_user)) +- now = ida_segregs.get_sreg(ea, treg) +- return {"addr": hex(ea), "thumb": bool(now), "was": bool(cur), "ok": ok, +- "bitness": ida_segment.getseg(ea).bitness, +- "forced_32bit": changed_bits, +- # The DATABASE's bitness is fixed at load and can't be corrected +- # here (setting it post-hoc makes the decompiler INTERR). In a +- # 64-bit database a 32-bit function disassembles but Hex-Rays +- # refuses it outright, so say so instead of leaving the user to +- # discover that F5 does nothing. +- "db_64bit": bool(db64 and want)} +- +-def _idatui_add_func(ea): +- """add_func at ``ea``, falling back to an explicit end. +- +- ida_funcs.add_func(ea) asks IDA to find the end and on carved or +- freshly-marked code it often can't, failing with no reason given.""" +- import ida_bytes +- import ida_funcs +- import ida_segment +- import idaapi +- +- if idaapi.get_func(ea) is not None: +- return True +- if ida_funcs.add_func(ea): +- return True +- seg = ida_segment.getseg(ea) +- hi = seg.end_ea if seg else ea +- end = ea +- while end < hi and ida_bytes.is_code(ida_bytes.get_flags(end)): +- nxt = ida_bytes.get_item_end(end) +- if nxt <= end: +- break +- end = nxt +- return bool(end > ea and ida_funcs.add_func(ea, end)) +- +- +-@tool +-@idasync +-def define_func_run( +- addr: Annotated[str, "Entry point of the function to create"], +-) -> dict: +- """Create a function at ``addr``, working out its end if IDA can't. +- +- ida_funcs.add_func(ea) asks IDA to find the end itself, and on hand-carved +- code it often can't — a run that ends in a tail call, or whose last +- instruction isn't recognised as a return, simply fails with no reason given. +- You then have a disassembled routine that refuses to become a function, and +- F5 has nothing to work with. +- +- So: try IDA's way, and if that fails, use the end of the contiguous +- instruction run starting at ``addr``.""" +- import ida_bytes +- import ida_funcs +- import ida_segment +- import idaapi +- +- try: +- ea = parse_address(addr) +- except Exception as e: +- return {"addr": str(addr), "error": str(e), "ok": False} +- fn = idaapi.get_func(ea) +- if fn is not None and fn.start_ea == ea: +- return {"addr": hex(ea), "ok": True, "start": hex(fn.start_ea), +- "end": hex(fn.end_ea), "how": "existed"} +- auto = ida_funcs.add_func(ea) +- if not auto and not _idatui_add_func(ea): +- return {"addr": hex(ea), "ok": False, +- "error": f"IDA refused a function at {ea:#x}"} +- f = idaapi.get_func(ea) +- if f is None: +- return {"addr": hex(ea), "ok": False, "error": "function did not stick"} +- return {"addr": hex(ea), "ok": True, "start": hex(f.start_ea), +- "end": hex(f.end_ea), "how": "auto" if auto else "explicit-end"} +- +-@tool +-@idasync +-def decomp_error( +- addr: Annotated[str, "Address of the function that failed to decompile"], +-) -> dict: +- """Why Hex-Rays refused this function, in its own words. +- +- The plain decompile tool reports "Decompilation failed at 0x0" and drops the +- reason, which is the only useful part. Hex-Rays fills in a hexrays_failure_t +- saying things like "only 64-bit functions can be decompiled in the current +- database" — that one is unfixable in place (the database's bitness is set at +- load), so a user who can't see it has no way to know they must reload.""" +- import ida_funcs +- import ida_hexrays +- import ida_ida +- +- try: +- ea = parse_address(addr) +- except Exception as e: +- return {"addr": str(addr), "error": str(e)} +- out = {"addr": hex(ea), "bitness": ida_ida.inf_get_app_bitness()} +- fn = ida_funcs.get_func(ea) +- if fn is None: +- out["reason"] = "no function here" +- return out +- try: +- if not ida_hexrays.init_hexrays_plugin(): +- out["reason"] = "the decompiler is not available for this processor" +- return out +- hf = ida_hexrays.hexrays_failure_t() +- cf = ida_hexrays.decompile_func(fn, hf) +- if cf is not None: +- out["reason"] = "" # it decompiles now +- return out +- out["reason"] = hf.desc() or f"error {hf.code}" +- out["code"] = int(hf.code) +- out["errea"] = hex(hf.errea) +- except Exception as e: # noqa: BLE001 +- out["reason"] = f"{type(e).__name__}: {e}" +- return out +- +-@tool +-@idasync +-def thumb_scan( +- start: Annotated[str, "Start of the range to scan for entry pointers"] = "", +- end: Annotated[str, "Exclusive end of the range (default: 1KB from start)"] = "", +- apply: Annotated[bool, "Mark the targets as Thumb and disassemble them"] = True, +- limit: Annotated[int, "Max entries to act on"] = 512, +-) -> dict: +- """Find Thumb entry points from ODD pointers, e.g. a Cortex-M vector table. +- +- An ARM function pointer carries the mode in bit 0: odd means Thumb. A vector +- table is therefore a list of Thumb entry points that IDA won't follow on a +- headerless image, because nothing tells it those words are pointers at all. +- +- Being wrong here is expensive — marking a data word as code corrupts the +- listing — so a word only counts when it is odd, lands inside a loaded +- segment, and its target is EXECUTABLE and not already defined as data. The +- even words in a vector table (the initial stack pointer) fail the first test, +- which is the point.""" +- import ida_bytes +- import ida_funcs +- import ida_idp +- import ida_segment +- import ida_segregs +- import ida_ua +- +- seg0 = ida_segment.getseg(parse_address(start)) if start else None +- if seg0 is None: +- seg0 = ida_segment.getnseg(0) +- if seg0 is None: +- return {"error": "no segments", "found": [], "applied": 0} +- try: +- lo = parse_address(start) if start else seg0.start_ea +- hi = parse_address(end) if end else min(lo + 0x400, seg0.end_ea) +- except Exception as e: +- return {"error": str(e), "found": [], "applied": 0} +- +- treg = ida_idp.str2reg("T") +- found, applied = [], 0 +- ea = lo +- while ea + 4 <= hi and len(found) < limit: +- w = ida_bytes.get_dword(ea) +- ea += 4 +- if not (w & 1): +- continue # even: not a Thumb pointer +- tgt = w & ~1 +- seg = ida_segment.getseg(tgt) +- if seg is None or not (seg.perm & ida_segment.SEGPERM_EXEC or seg.perm == 0): +- continue # points outside the image, or at data +- f = ida_bytes.get_flags(tgt) +- if ida_bytes.is_data(f): +- continue # already something else; don't fight it +- rec = {"at": hex(ea - 4), "value": hex(w), "target": hex(tgt), +- "was_code": bool(ida_bytes.is_code(f))} +- found.append(rec) +- if not apply: +- continue +- if treg is not None and treg >= 0: +- ida_segregs.split_sreg_range(tgt, treg, 1, ida_segregs.SR_user) +- if not ida_bytes.is_code(ida_bytes.get_flags(tgt)): +- ida_bytes.del_items(tgt, 0, 2) +- if ida_ua.create_insn(tgt) <= 0: +- rec["decoded"] = False +- continue +- rec["decoded"] = True +- rec["function"] = _idatui_add_func(tgt) +- applied += 1 +- return {"start": hex(lo), "end": hex(hi), "found": found, +- "applied": applied, "n": len(found)} +-''' +- +-SNIPPET = f"{BEGIN}\n{BODY.strip()}\n{END}\n" +- +- +-def api_types_path() -> pathlib.Path | None: +- """Locate ida_pro_mcp/ida_mcp/api_types.py without importing it (importing the +- submodule would pull in IDA, which isn't available outside a worker).""" +- spec = importlib.util.find_spec("ida_pro_mcp") # top-level pkg is IDA-free +- if spec is None or not spec.submodule_search_locations: +- return None +- p = pathlib.Path(spec.submodule_search_locations[0]) / "ida_mcp" / "api_types.py" +- return p if p.exists() else None +- +- +-def main() -> int: +- path = api_types_path() +- if path is None: +- print("idatui: ida_pro_mcp not found; skipping tool injection", file=sys.stderr) +- return 0 +- text = path.read_text() +- if BEGIN in text and END in text: # replace the existing block in place +- pre = text[: text.index(BEGIN)].rstrip() +- post = text[text.index(END) + len(END):].lstrip("\n") +- new = pre + "\n\n" + SNIPPET + ("\n" + post if post else "") +- else: +- new = text.rstrip() + "\n\n" + SNIPPET +- if new == text: +- return 0 +- try: +- path.write_text(new) +- except OSError as e: +- print(f"idatui: could not patch {path}: {e}", file=sys.stderr) +- return 1 +- print(f"idatui: injected/updated idatui-ext tools in {path}", file=sys.stderr) +- return 0 +- +- +-if __name__ == "__main__": +- raise SystemExit(main()) +diff --git a/tests/test_codemode_client.py b/tests/test_codemode_client.py +new file mode 100644 +index 0000000..6303eb9 +--- /dev/null ++++ b/tests/test_codemode_client.py +@@ -0,0 +1,137 @@ ++"""IDA-free contract tests for the Code Mode client adapter.""" ++from __future__ import annotations ++ ++import os ++import sys ++import tempfile ++from dataclasses import dataclass ++ ++sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__)))) ++ ++import idatui.codemode_client as module # noqa: E402 ++from idatui.codemode_client import CodeModeClient, _parse_load_args # noqa: E402 ++from idatui.errors import IDAToolError # noqa: E402 ++ ++PASS = FAIL = 0 ++ ++ ++def check(name: str, condition: bool, detail="") -> None: ++ global PASS, FAIL ++ if condition: ++ PASS += 1 ++ print(f" ok {name}") ++ else: ++ FAIL += 1 ++ print(f" FAIL {name} {detail}") ++ ++ ++@dataclass(frozen=True) ++class FakeEntry: ++ pid: int = 123 ++ backend: str = "gui" ++ record_id: str = "123-abcdef" ++ exe_path: str = "" ++ idb_path: str = "" ++ ++ ++class FakeHandle: ++ def __init__(self, path: str) -> None: ++ self.connected = True ++ self.entry = FakeEntry(exe_path=path, idb_path=path + ".i64") ++ self.waited = None ++ self.saved = 0 ++ self.closed = False ++ self.code = "" ++ self.code_timeout = None ++ ++ def wait_autoanalysis(self, timeout=None): ++ self.waited = timeout ++ return {"complete": True, "status": "complete"} ++ ++ def execute_python(self, code, timeout=None): ++ self.code = code ++ self.code_timeout = timeout ++ return {"result": {"sentinel": 7}, "stdout": "", "stderr": ""} ++ ++ def save_database(self): ++ self.saved += 1 ++ return {"saved": True, "idb_path": self.entry.idb_path} ++ ++ def close(self): ++ self.connected = False ++ self.closed = True ++ ++ ++class FakeDatabaseHandle: ++ opened = None ++ kwargs = None ++ ++ @classmethod ++ def open(cls, path, **kwargs): ++ cls.opened = path ++ cls.kwargs = kwargs ++ return FakeHandle(path) ++ ++ ++def main() -> int: ++ proc, base, file_type = _parse_load_args("-parm:ARMv7-M -b800000 -TRaw") ++ check("legacy switches map to typed Code Mode options", ++ (proc, base, file_type) == ("arm:ARMv7-M", 0x8000000, "Raw"), ++ (proc, base, file_type)) ++ try: ++ _parse_load_args("-parm -zcustom") ++ except ValueError as exc: ++ check("arbitrary IDA switches fail loudly", "cannot represent" in str(exc), exc) ++ else: ++ check("arbitrary IDA switches fail loudly", False) ++ ++ original = module.DatabaseHandle ++ module.DatabaseHandle = FakeDatabaseHandle ++ try: ++ with tempfile.TemporaryDirectory() as tmp: ++ path = os.path.join(tmp, "sample.bin") ++ with open(path, "wb") as file: ++ file.write(b"sample") ++ client = CodeModeClient(path, load_args="-parm:ARMv7-A -b100") ++ notes = [] ++ client.connect(timeout=42, progress=notes.append) ++ handle = client._handle ++ check("connect delegates database discovery to DatabaseHandle.open", ++ FakeDatabaseHandle.opened == path and handle is not None) ++ check("typed loader options cross the dependency boundary", ++ FakeDatabaseHandle.kwargs["processor"] == "arm:ARMv7-A" ++ and FakeDatabaseHandle.kwargs["loading_address"] == 0x1000, ++ FakeDatabaseHandle.kwargs) ++ check("connect waits for Code Mode autoanalysis", ++ handle.waited == 42, getattr(handle, "waited", None)) ++ check("progress distinguishes discovery and backend attachment", ++ len(notes) == 2 and "gui" in notes[-1], notes) ++ result = client.invoke("list_funcs", queries=[{"offset": 0, "count": 2}]) ++ check("invoke returns execute_python's result", result == {"sentinel": 7}, result) ++ check("operation scripts use the preloaded ida-domain database", ++ "db.functions.get_all()" in handle.code, handle.code[:200]) ++ check("health exposes registry identity", ++ client.health()["record_id"] == "123-abcdef") ++ client.save_database() ++ check("save uses the public Code Mode save route", handle.saved == 1) ++ client.close() ++ check("close releases only the handle lease", handle.closed) ++ check("GUI lifetime is never claimed by the client", ++ client.wait_released(0) is False) ++ finally: ++ module.DatabaseHandle = original ++ ++ client = CodeModeClient(__file__) ++ try: ++ client.invoke("not-an-operation") ++ except IDAToolError as exc: ++ check("unknown adapter operations are explicit", exc.tool == "not-an-operation") ++ else: ++ check("unknown adapter operations are explicit", False) ++ ++ print(f"\n{PASS} passed, {FAIL} failed") ++ return 1 if FAIL else 0 ++ ++ ++if __name__ == "__main__": ++ raise SystemExit(main()) +diff --git a/tests/test_pool.py b/tests/test_pool.py +index 5c6e2c4..ff0c016 100644 +--- a/tests/test_pool.py ++++ b/tests/test_pool.py +@@ -1,8 +1,7 @@ + #!/usr/bin/env python3 +-"""Unit tests for idatui.pool (worker residency: LRU + memory budget). ++"""Unit tests for idatui.pool (Code Mode lease residency and LRU budget). + +-Pure stdlib with a fake client injected, so the eviction policy is testable +-without spawning real idalib workers. ++A fake client keeps the policy testable without IDA or Textual. + + python tests/test_pool.py + """ +@@ -11,7 +10,7 @@ import sys + import tempfile + + sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__)))) +-from idatui.pool import WorkerPool # noqa: E402 ++from idatui.pool import DatabasePool # noqa: E402 + from idatui.project import Project # noqa: E402 + + PASS = FAIL = 0 +@@ -28,11 +27,12 @@ def check(name, cond, detail=""): + + + class FakeClient: +- """Stands in for a WorkerClient: records saves/closes, reports fixed memory.""" ++ """Stands in for a CodeModeClient lease and records saves/closes.""" + +- def __init__(self, ref, mem=100): ++ def __init__(self, ref, mem=100, backend="idalib"): + self.ref = ref + self.mem = mem ++ self.backend = backend + self.saved = 0 + self.closed = False + self.connected = False +@@ -41,10 +41,9 @@ class FakeClient: + self.connected = True + return self + +- def call(self, tool, **kw): +- if tool == "idb_save": +- self.saved += 1 +- return {} ++ def save_database(self): ++ self.saved += 1 ++ return {"saved": True} + + def close(self, grace=None): + self.closed = True +@@ -72,15 +71,15 @@ def main() -> int: + made[ref.label] = c + return c + +- pool = WorkerPool(proj, budget_mb=350, spawn=spawn, ++ pool = DatabasePool(proj, budget_mb=350, spawn=spawn, + mem_fn=lambda c: c.mem) + + # -- lazy spawn + reuse -------------------------------------------- # + a = pool.get("bin0") +- check("get() spawns a worker on first use", a is made["bin0"] and a.connected) ++ check("get() spawns a database lease on first use", a is made["bin0"] and a.connected) + check("get() stages the binary first", + os.path.isfile(proj.by_label("bin0").staged)) +- check("get() reuses the resident worker", pool.get("bin0") is a) ++ check("get() reuses the resident lease", pool.get("bin0") is a) + check("resident() reports it", pool.resident() == ["bin0"], pool.resident()) + + # -- LRU ordering ---------------------------------------------------- # +@@ -96,9 +95,9 @@ def main() -> int: + check("exceeding the budget evicts the least-recently-used", + pool.evicted == ["bin1"] and not pool.is_resident("bin1"), + f"evicted={pool.evicted} resident={pool.resident()}") +- check("the just-spawned worker is never the victim", pool.is_resident("bin3")) ++ check("the just-attached lease is never the victim", pool.is_resident("bin3")) + check("eviction saves the database first", made["bin1"].saved == 1) +- check("eviction closes the worker", made["bin1"].closed) ++ check("eviction closes the lease", made["bin1"].closed) + check("pool is back within budget", pool.memory_mb() <= pool.budget_mb, + f"{pool.memory_mb()}/{pool.budget_mb}") + +@@ -112,7 +111,7 @@ def main() -> int: + + # -- pinning ---------------------------------------------------------- # + pool.close_all() +- pool2 = WorkerPool(proj, budget_mb=250, spawn=spawn, mem_fn=lambda c: c.mem) ++ pool2 = DatabasePool(proj, budget_mb=250, spawn=spawn, mem_fn=lambda c: c.mem) + pool2.get("bin0") + pool2.pin("bin0") + pool2.get("bin1") +@@ -139,7 +138,7 @@ def main() -> int: + + # -- teardown ----------------------------------------------------------- # + pool2.close_all() +- check("close_all() closes every worker", ++ check("close_all() closes every lease", + not pool2.resident() and all(c.closed for c in made.values())) + check("close_all() clears the active binary", pool2.active is None) + +@@ -151,8 +150,8 @@ def main() -> int: + check("an unknown label raises KeyError", True) + + # -- default budget comes from the project's memory_pct ------------------- # +- pool3 = WorkerPool(proj, spawn=spawn, mem_fn=lambda c: c.mem) +- check("default budget is derived, not a fixed worker count", ++ pool3 = DatabasePool(proj, spawn=spawn, mem_fn=lambda c: c.mem) ++ check("default budget is derived, not a fixed lease count", + pool3.budget_mb >= 256, pool3.budget_mb) + + # -- prewarm: speculative, and never at the cost of a real binary ------ # +@@ -165,7 +164,7 @@ def main() -> int: + made2[ref.label] = c + return c + +- pool = WorkerPool(proj, budget_mb=250, spawn=spawn2, ++ pool = DatabasePool(proj, budget_mb=250, spawn=spawn2, + mem_fn=lambda c: c.mem) + labels = [r.label for r in proj.refs] + a, b, c_ = labels[0], labels[1], labels[2] +@@ -184,6 +183,28 @@ def main() -> int: + check("prewarm ignores a label outside the project", + pool.prewarm("nope") is False) + ++ # Budget eviction releases GUI leases but must not save somebody's open IDA ++ # implicitly. An explicit save-and-close remains authoritative. ++ with tempfile.TemporaryDirectory() as tmp: ++ proj = _mkproject(tmp, n=1) ++ made_gui = [] ++ ++ def spawn_gui(ref, ttl): ++ client = FakeClient(ref, backend="gui") ++ made_gui.append(client) ++ return client ++ ++ pool = DatabasePool(proj, spawn=spawn_gui, mem_fn=lambda c: c.mem) ++ label = proj.refs[0].label ++ pool.get(label) ++ pool.evict(label) ++ check("LRU release does not implicitly save a GUI database", ++ made_gui[-1].saved == 0) ++ pool.get(label) ++ pool.close_all(save=True) ++ check("explicit close_all(save=True) does save a GUI database", ++ made_gui[-1].saved == 1) ++ + print(f"\n{PASS} passed, {FAIL} failed") + return 1 if FAIL else 0 + +diff --git a/tests/test_project.py b/tests/test_project.py +index 91fd250..7c0dcba 100644 +--- a/tests/test_project.py ++++ b/tests/test_project.py +@@ -1,7 +1,7 @@ + #!/usr/bin/env python3 + """Unit tests for idatui.project (the multi-binary project model + staging). + +-Pure stdlib: no IDA, no textual, no worker — runs anywhere in under a second. ++IDA-free: exercises staging plus Code Mode ownership checks without opening a database. + + python tests/test_project.py + """ +diff --git a/tests/test_scenarios.py b/tests/test_scenarios.py +index 9d77680..ab510f4 100644 +--- a/tests/test_scenarios.py ++++ b/tests/test_scenarios.py +@@ -2316,7 +2316,13 @@ async def _build_pristine(binary, cache): + await pilot.pause(0.05) + if app._func_index is not None and app._func_index.complete: + break +- app.program.client.call("idb_save", timeout=600.0) ++ app.program.client.save_database() ++ # Textual's headless run_test context does not reliably emit App.Unmount on ++ # every platform/version; release the Code Mode lease explicitly. ++ if app.program is not None: ++ app.program.close() ++ if app.client is not None: ++ app.client.close() + db = binary + ".i64" + if os.path.exists(db): + shutil.copy2(db, cache) +@@ -2346,7 +2352,7 @@ async def run(binary, only=None): + + + async def _run_on(binary, only=None): +- # Own idalib worker: opens the binary in-process over a unix socket. ++ # Code Mode attaches a registered GUI or starts/reuses a managed worker. + app = IdaTui(open_path=binary, keepalive=False) + async with app.run_test(size=(140, 44)) as pilot: + c = Ctx(app, pilot) +@@ -2366,6 +2372,14 @@ async def _run_on(binary, only=None): + print(f"── {name} ({asyncio.get_event_loop().time() - _t0:.1f}s) CRASHED") + c.check("scenario did not crash", False, f"{type(e).__name__}: {e}") + traceback.print_exc() ++ # Headless run_test does not reliably emit App.Unmount; explicitly release ++ # the lease. Then wait through the managed worker's final-lease grace and ++ # IDB close so Windows can remove this suite's TemporaryDirectory safely. ++ if app.program is not None: ++ app.program.close() ++ if app.client is not None: ++ app.client.close() ++ await asyncio.to_thread(app.client.wait_released, 45.0) + + + def main(argv): +diff --git a/uv.lock b/uv.lock +index 91414b5..392ebf0 100644 +--- a/uv.lock ++++ b/uv.lock +@@ -11,27 +11,69 @@ wheels = [ + { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" }, + ] + ++[[package]] ++name = "ida-codemode-mcp" ++version = "0.2.0" ++source = { editable = "../ida-codemode-mcp" } ++dependencies = [ ++ { name = "ida-domain" }, ++ { name = "zeromcp" }, ++] ++ ++[package.metadata] ++requires-dist = [ ++ { name = "ida-domain", git = "https://github.com/HexRaysSA/ida-domain?branch=main" }, ++ { name = "zeromcp", specifier = ">=1.5.0" }, ++] ++ ++[package.metadata.requires-dev] ++dev = [ ++ { name = "pytest", specifier = ">=9.0.3" }, ++ { name = "ruff", specifier = ">=0.12.0" }, ++] ++ ++[[package]] ++name = "ida-domain" ++version = "0.5.1.dev1" ++source = { git = "https://github.com/HexRaysSA/ida-domain?branch=main#8f36bbce94f0dd55e4ad5f7c8b5f0ef59b9c557a" } ++dependencies = [ ++ { name = "idapro" }, ++ { name = "packaging" }, ++ { name = "typing-extensions" }, ++] ++ ++[[package]] ++name = "idapro" ++version = "0.0.10" ++source = { registry = "https://pypi.org/simple" } ++sdist = { url = "https://files.pythonhosted.org/packages/f8/75/249c605cc144a6b3778c48381d31ff9242f3e0b7ae23a9ca9c27224e641a/idapro-0.0.10.tar.gz", hash = "sha256:417c03c4605d18417e470f6a748e397b39d6d5829ebd3bbdedd92ff5b9092d11", size = 1060989, upload-time = "2026-07-15T12:55:22.313Z" } ++wheels = [ ++ { url = "https://files.pythonhosted.org/packages/e8/83/7b02832cc8b057f686cccdb771fe80282f801a9b798961f8070bb468c73c/idapro-0.0.10-py3-none-any.whl", hash = "sha256:43f227953a0e348ced21c050d277b7ce34103e2ce05fc739b7d8c186ef0e1542", size = 2194897, upload-time = "2026-07-15T12:55:20.88Z" }, ++] ++ + [[package]] + name = "idatui" + version = "0.0.1" + source = { editable = "." } ++dependencies = [ ++ { name = "ida-codemode-mcp" }, ++ { name = "pygments" }, ++ { name = "textual" }, ++] + + [package.optional-dependencies] + dev = [ + { name = "pytest" }, + ] +-tui = [ +- { name = "pygments" }, +- { name = "textual" }, +-] + + [package.metadata] + requires-dist = [ +- { name = "pygments", marker = "extra == 'tui'", specifier = ">=2" }, ++ { name = "ida-codemode-mcp", editable = "../ida-codemode-mcp" }, ++ { name = "pygments", specifier = ">=2" }, + { name = "pytest", marker = "extra == 'dev'", specifier = ">=8" }, +- { name = "textual", marker = "extra == 'tui'", specifier = ">=8" }, ++ { name = "textual", specifier = ">=8" }, + ] +-provides-extras = ["tui", "dev"] ++provides-extras = ["dev"] + + [[package]] + name = "iniconfig" +@@ -191,3 +233,12 @@ sdist = { url = "https://files.pythonhosted.org/packages/78/67/9a363818028526e2d + wheels = [ + { url = "https://files.pythonhosted.org/packages/61/73/d21edf5b204d1467e06500080a50f79d49ef2b997c79123a536d4a17d97c/uc_micro_py-2.0.0-py3-none-any.whl", hash = "sha256:3603a3859af53e5a39bc7677713c78ea6589ff188d70f4fee165db88e22b242c", size = 6383, upload-time = "2026-03-01T06:31:26.257Z" }, + ] ++ ++[[package]] ++name = "zeromcp" ++version = "1.5.0" ++source = { registry = "https://pypi.org/simple" } ++sdist = { url = "https://files.pythonhosted.org/packages/95/10/0c5018221766413c808b62f229a3b6b2cd0e4b10bc9ac25fee6152c22938/zeromcp-1.5.0.tar.gz", hash = "sha256:ef4e590ddb20a30a2ceaee86dbf893c9edb5d3e583c22a0ea7025e94763e59d2", size = 95257, upload-time = "2026-07-22T13:39:29.535Z" } ++wheels = [ ++ { url = "https://files.pythonhosted.org/packages/8c/46/aa0e0941b511969a3eb70ea19add43b22c7336a4bf65a4fe4ea2176faf25/zeromcp-1.5.0-py3-none-any.whl", hash = "sha256:ca3b67687850ed463a255c180a286901ea69343612dc84ef279ec75b460f77ee", size = 21875, upload-time = "2026-07-22T13:39:28.44Z" }, ++] +-- +2.53.0.windows.2 + |