rpc: stop lying to the driver about renames, modals and teardown

Five defects found while an agent drove a long RE session over the socket.
Each one was reproduced on a live spawned pane first (an in-process pilot
would not have shown any of them), then fixed:

pane stop truncated the save. `stop` asked the app to quit, slept 400 ms, then
unconditionally killed the pane. Quitting runs App.on_unmount, which writes
every dirty database; a 90 MB .i64 takes tens of seconds, so the kill landed
mid-write and a whole session's annotations went to /dev/null with a cheerful
{"stopped": [...]} on stdout. Now it waits for the pane to actually exit
(--timeout, default 600 s) and only force-kills on timeout, saying so.

The quit verb bypassed the dirty check. It called app.exit() directly rather
than the path a human gets, so the "unsaved changes" logic never ran. It now
routes through _on_quit_choice and reports {saving, dirty}.

Naming a function start from the listing never reached the function index.
`goto <addr>` puts the cursor on the address token, so `n` takes the
name-an-address path, which called bump_items() but left FunctionIndex holding
the old name. Result: the rename response snapshot showed the section label,
and functions()/names()/the palette all reported the rename had not happened —
so a driver that trusts its readbacks redoes work it already did. Twice, in
the session that prompted this. _do_name_addr now updates the index, the nav
stack and the table cell when the address is a function start.

A stripped binary with no entry function started up *inside a modal*.
_auto_land pushed the symbol palette when main() was missing, while ping still
answered ready:true. Every keystroke an RPC driver injected went into the
palette's search box and was silently swallowed. It now lands on the first
function instead and hints at Ctrl+N.

Verbs that inject keystrokes now refuse when a modal is on top, naming it,
instead of failing with "'goto' prompt did not open (word under cursor?)" —
a message that blamed the cursor for what was always a focus problem.

Also: `drive raw` passes k=v values through as strings, so `view lines=8` died
with "'<' not supported between instances of 'int' and 'str'". Numeric params
are now coerced centrally rather than at each call site.

tests/test_scenarios.py: 212 passed, 0 failed.

1 files changed, 77 insertions, 3 deletions

diff --git a/idatui/rpc.py b/idatui/rpc.py
index 7741f48..28d9aba 100644
--- a/idatui/rpc.py
+++ b/idatui/rpc.py
@@ -104,6 +104,33 @@ def _active_widget(app):
 
 _MODALS = ("XrefsScreen", "SymbolPalette", "StructEditor", "ConfirmScreen")
 
+#: ``drive raw`` (and any k=v CLI) hands every param through as a *string*.
+#: Handlers that did ``int(...)`` coped; the ones that compared directly blew up
+#: with e.g. "'<' not supported between instances of 'int' and 'str'". Coerce the
+#: known-numeric names once, centrally, instead of at every call site.
+_INT_PARAMS = ("lines", "limit", "max", "n", "index", "line", "col",
+               "occurrence", "delay_ms", "direction", "addr", "count")
+_FLOAT_PARAMS = ("timeout",)
+
+
+def _coerce_params(params: dict[str, Any]) -> dict[str, Any]:
+    out = dict(params)
+    for k in _INT_PARAMS:
+        v = out.get(k)
+        if isinstance(v, str) and v.strip():
+            try:
+                out[k] = int(v, 0)
+            except ValueError:
+                pass
+    for k in _FLOAT_PARAMS:
+        v = out.get(k)
+        if isinstance(v, str) and v.strip():
+            try:
+                out[k] = float(v)
+            except ValueError:
+                pass
+    return out
+
 
 def _modal_snapshot(app) -> dict[str, Any] | None:
     """Describe the top modal screen, if any, enough to drive it."""
@@ -466,7 +493,14 @@ class RpcServer:
         await settle(app, lambda: app.query_one(f"#{input_id}", Input).display, timeout=10)
         inp = app.query_one(f"#{input_id}", Input)
         if not inp.display:
-            raise RuntimeError(f"{input_id!r} prompt did not open (word under cursor?)")
+            # Say *why*. The old message always blamed the word under the cursor,
+            # which sent readers hunting for a cursor problem when the real cause
+            # was usually a modal eating the opening keystroke.
+            modal = type(app.screen).__name__
+            why = (f"modal {modal!r} has focus and ate the {open_key!r} keystroke"
+                   if modal in _MODALS or modal != "Screen"
+                   else "no renameable token under the cursor")
+            raise RuntimeError(f"{input_id!r} prompt did not open: {why}")
         if clear:
             inp.value = ""
         await app._press_keys(_text_to_keys(value, delay_ms))
@@ -485,8 +519,32 @@ class RpcServer:
         want = fn.addr if fn else ea
         return lambda: app._cur is not None and app._cur.ea == want
 
+    #: Verbs that drive the *main* app by injecting keystrokes. If a modal is on
+    #: top it eats those keys, so they must refuse rather than silently no-op.
+    _NEEDS_NO_MODAL = {
+        "goto", "open", "rename", "comment", "retype", "follow", "back",
+        "toggle_view", "hex", "save", "search", "move", "cursor", "cursor_on",
+    }
+    #: Modals the driver is expected to interact with (they have their own verbs).
+    _DRIVABLE_MODALS = {"XrefsScreen", "SymbolPalette", "StructEditor",
+                        "ProjectPalette", "QuitScreen"}
+
+    def _modal_kind(self) -> str | None:
+        scr = self.app.screen
+        name = type(scr).__name__
+        return name if name in _MODALS or name in self._DRIVABLE_MODALS else None
+
     async def _dispatch(self, method: str, params: dict[str, Any]) -> Any:
         app = self.app
+        params = _coerce_params(params)
+        if method in self._NEEDS_NO_MODAL:
+            modal = self._modal_kind()
+            if modal is not None:
+                raise RuntimeError(
+                    f"modal {modal!r} is on top and will swallow this verb's "
+                    f"keystrokes; dismiss it first (close) or use its own verb "
+                    f"(select/symbols/xrefs). Note: a binary with no entry "
+                    f"function can land in the symbol palette on startup.")
         if method in (None, "ping"):
             module = None
             try:
@@ -498,9 +556,25 @@ class RpcServer:
         if method == "methods":
             return METHODS
         if method == "quit":
+            # Route through the same teardown a human gets, so a dirty database
+            # is written instead of dropped. `app.exit()` alone skips the dirty
+            # check entirely, and the caller (pane stop) then kills the pane --
+            # which used to destroy a whole session's annotations.
+            dirty = list(app._dirty_labels())
+            save = params.get("save", True)
+            if isinstance(save, str):
+                save = save.lower() not in ("0", "false", "no", "")
+
+            def _go():
+                if dirty and save:
+                    app._on_quit_choice("save")   # saves, then exits
+                else:
+                    app._on_quit_choice("discard")
+
             # answer first, then tear down (so this response still gets written)
-            asyncio.get_running_loop().call_later(0.2, app.exit)
-            return {"ok": True, "quitting": True}
+            asyncio.get_running_loop().call_later(0.2, _go)
+            return {"ok": True, "quitting": True, "saving": bool(dirty and save),
+                    "dirty": dirty}
 
         if method in _PROGRAM_METHODS and app.program is None:
             raise ValueError("not ready: still connecting / loading functions")