Offer a writable database location instead of failing the open

`ida-tui /bin/ls` asked IDA to create /bin/ls.i64, which a normal user
cannot write, and what came back was the backend's account of it:

    idalib worker launcher 2425195 exited with status 1
    [ida-nexus] Failed to open database /usr/bin/ls

after a full analysis wait, naming neither the file it could not create
nor the reason. Nothing in the message points at permissions, and there
was no way forward from it.

idatui/idbpath.py answers the question before anything is opened: where
would the database go (mirroring ida_nexus's own derivation), can it go
there (os.access only — the pre-flight check must not create files), and
where instead. The proposal is stable per binary
(~/.local/share/idatui/db/<name>-<sha1(realpath)[:8]>.i64) so reopening
the same binary resumes the same names and comments, and hashed so two
busyboxes from different directories cannot collide. DATA_HOME rather
than CACHE_HOME on purpose: an .i64 holds the whole session, and cache
directories are something cleaners may empty.

The answer becomes NexusClient(output_database=...) — the option project
mode already uses to keep everything in its sidecar. `--idb PATH` (also
forwarded by `pane spawn`) says where without being asked. An RPC-driven
TUI is never asked: `pane spawn` polls for ready and would sit out its
whole timeout in front of a modal nobody can answer, so it relocates and
says so in the status line. A failed open re-offers relocation after a
real create probe, since os.access does not know about ACLs, a lying
network mount or a full disk.

tests/test_idbpath.py (pure, 32 checks) pins the path arithmetic, the two
properties of the proposal and that neither check touches the user's
directory; tests/test_idb_relocate_ui.py (textual, no worker, 24 checks)
drives the dialog, Esc, an edited path, the untouched common case, --idb,
the RPC path, and that output_database actually reaches the client.
Verified end to end against a real /bin/ls: 400 functions, and a rename
saved in one session comes back in the next.

4 files changed, 425 insertions, 6 deletions

diff --git a/idatui/app.py b/idatui/app.py
index 52f474b..64b1216 100644
--- a/idatui/app.py
+++ b/idatui/app.py
@@ -4498,6 +4498,104 @@ class ProjectPalette(OptionListNav, ModalScreen):
 
 
 # --------------------------------------------------------------------------- #
+# Where the database goes
+# --------------------------------------------------------------------------- #
+class IdbLocationScreen(ModalScreen):
+    """Where should the database go, when it can't go where IDA would put it?
+
+    ``ida-tui /bin/ls`` asks IDA to create ``/bin/ls.i64``, which a normal user
+    cannot write. The backend's answer is "idalib worker launcher 2425195 exited
+    with status 1" -- after a full analysis wait, naming neither the file nor the
+    reason. This is that failure, moved to before the open and turned into a
+    question with a working default.
+
+    Dismisses the chosen path (a str), or None to quit: there is no third option
+    that shows anything, and "carry on and fail exactly as before" is not worth a
+    keystroke.
+    """
+
+    BINDINGS = [
+        Binding("enter", "accept", "Use this path", priority=True),
+        Binding("escape", "cancel", "Quit"),
+    ]
+
+    def __init__(self, binary: str, reason: str, proposed: str) -> None:
+        super().__init__()
+        self._binary = binary
+        self._reason = reason
+        self._proposed = proposed
+
+    def compose(self) -> ComposeResult:
+        from . import idbpath
+
+        with Vertical(id="idb-box") as box:
+            box.border_title = Text("\u26a0 the database cannot be written there")
+            yield Static(
+                f" {idbpath.expected_idb(self._binary)}\n \u2014 {self._reason}.",
+                id="idb-msg",
+                markup=False,
+            )
+            yield Static(" Keep the database here instead:", id="idb-note")
+            yield Input(value=self._proposed, id="idb-path")
+            yield Static(
+                f" {idbpath.describe(self._binary, self._proposed)}",
+                id="idb-detail",
+                markup=False,
+            )
+            yield Static(
+                " [Enter] open it there      [Esc] quit",
+                id="idb-help",
+                markup=False,
+            )
+
+    def on_mount(self) -> None:
+        inp = self.query_one("#idb-path", Input)
+        inp.focus()
+        inp.cursor_position = len(inp.value)
+
+    def on_input_changed(self, event: Input.Changed) -> None:
+        """Keep the note honest: an edited path may already hold a database."""
+        from . import idbpath
+
+        event.stop()
+        value = event.value.strip()
+        self.query_one("#idb-detail", Static).update(
+            f" {idbpath.describe(self._binary, value)}" if value else ""
+        )
+
+    def on_input_submitted(self, event: Input.Submitted) -> None:
+        event.stop()
+        self.action_accept()
+
+    def action_accept(self) -> None:
+        from . import idbpath
+
+        value = self.query_one("#idb-path", Input).value.strip()
+        if not value:
+            return
+        target = os.path.abspath(os.path.expanduser(value))
+        if not target.lower().endswith(".i64"):
+            # IDA Nexus derives the scratch file names from this path, and a
+            # database that isn't named .i64 confuses every later lookup
+            # (including its own registry matching).
+            target += ".i64"
+        try:
+            idbpath.ensure_parent(target)
+        except OSError as e:
+            self.query_one("#idb-help", Static).update(f" {e.strerror}: {target}")
+            return
+        if not os.access(os.path.dirname(target), os.W_OK | os.X_OK):
+            self.query_one("#idb-help", Static).update(
+                f" not writable either: {os.path.dirname(target)}"
+            )
+            return
+        self.dismiss(target)
+
+    def action_cancel(self) -> None:
+        self.dismiss(None)
+
+
+# --------------------------------------------------------------------------- #
 # Confirmation dialog
 # --------------------------------------------------------------------------- #
 class ConfirmScreen(ModalScreen):
@@ -5397,7 +5495,7 @@ class IdaTui(App):
        only thing worth looking at. Size stays per-box; everything else is
        here, once. */
     #quit-box, #help-box, #xref-box, #pal-box, #se-box, #confirm-box,
-    #loading-box, #busy-box {
+    #idb-box, #loading-box, #busy-box {
         background: $panel;
         border: round $panel-lighten-3;
         border-title-color: $accent;
@@ -5475,6 +5573,13 @@ class IdaTui(App):
        instead of the old near-black bar. */
     #se-status { height: 1; background: $panel-darken-1; color: $text-muted;
                  padding: 0 1; }
+    #idb-box { width: 84; max-width: 92%; height: auto; padding: 1 1;
+               border: round $warning; border-title-color: $warning; }
+    #idb-msg { height: auto; padding: 0 1; }
+    #idb-note { height: 1; padding: 0 1; margin-top: 1; color: $text-muted; }
+    #idb-path { border: none; height: 1; margin: 0 1; background: $panel; color: $text; }
+    #idb-detail { height: auto; padding: 0 1; color: $text-muted; }
+    #idb-help { height: 1; padding: 0 1; margin-top: 1; color: $text-muted; }
     #confirm-box { width: 60; height: auto; padding: 1 2; }
     #confirm-msg { height: auto; }
     #confirm-help { height: 1; color: $text-muted; margin-top: 1; }
@@ -5537,6 +5642,7 @@ class IdaTui(App):
         project=None,
         load_args: str = "",
         trace_path: str = "",
+        idb_path: str | None = None,
     ) -> None:
         super().__init__()
         # Project mode is additive: with no project this is the plain
@@ -5572,6 +5678,12 @@ class IdaTui(App):
         self._open_path = open_path
         self._ttl = ttl
         self._load_args = load_args or ""  # first-open options for a headerless blob
+        #: Where the database lives, when not beside the binary (--idb, or the
+        #: answer to IdbLocationScreen). Project mode has its own answer: the
+        #: sidecar, decided by the pool.
+        self._idb_path = (
+            os.path.abspath(os.path.expanduser(idb_path)) if idb_path else None
+        )
         self._new_database = False  # Ctrl+L asks IDA Nexus for a fresh IDB
         self._title = os.path.basename(open_path) if open_path else ""
         #: Where we are in the execution trace, and everything that moves us.
@@ -5709,6 +5821,17 @@ class IdaTui(App):
         elif self._should_ask_load_options():
             self._ask_load_options(self._open_path)
             return
+        self._begin_connect()
+
+    def _begin_connect(self) -> None:
+        """Open the database, once every question about HOW has been answered.
+
+        The last of those questions is where the database may be written, asked
+        here rather than in ``on_mount`` because the load-options dialog returns
+        through this path too.
+        """
+        if self._ask_idb_location():
+            return
         # Show a loading overlay immediately so a slow open/analysis (big binary)
         # isn't just dead air behind empty panes; dismissed once we land.
         self._loading_screen = LoadingScreen(self._loading_title())
@@ -5729,17 +5852,106 @@ class IdaTui(App):
             return False
         from .formats import needs_load_options
 
-        if os.path.exists(self._open_path + ".i64") or os.path.exists(
+        # Including a relocated database: it records the answer just as well as
+        # an .i64 beside the binary would.
+        if os.path.exists(self._planned_idb()) or os.path.exists(
             os.path.splitext(self._open_path)[0] + ".i64"
         ):
             return False
         try:
-            if registered_database(self._open_path):
+            if registered_database(self._open_path, output_database=self._idb_path):
                 return False
         except Exception:
             pass  # connect() will surface registry failures with full diagnostics
         return needs_load_options(self._open_path)
 
+    def _planned_idb(self) -> str:
+        """The database path this binary is heading for.
+
+        Not always ``binary + ".i64"``: an explicit ``--idb`` wins, and a binary
+        whose own directory cannot hold a database is about to be offered the
+        relocated path, so that is where an earlier session's work will be.
+        """
+        from . import idbpath
+
+        if self._idb_path:
+            return self._idb_path
+        if self._open_path and idbpath.blocked_reason(self._open_path) is not None:
+            return idbpath.relocated_idb(self._open_path)
+        return idbpath.expected_idb(self._open_path or "")
+
+    def _blocked_idb_reason(self) -> str | None:
+        """Why IDA can't write this binary's database beside it, if it can't.
+
+        None in every ordinary case, including: project mode (the sidecar is
+        already somewhere writable), a location we were told to use (--idb or an
+        earlier answer), and a database some other client already has open --
+        that one exists and is being written by its owner, not by us.
+        """
+        if self._project is not None or self._idb_path is not None:
+            return None
+        if not self._open_path:
+            return None
+        from . import idbpath
+
+        reason = idbpath.blocked_reason(self._open_path)
+        if reason is None:
+            return None
+        try:
+            if registered_database(self._open_path):
+                return None
+        except Exception:  # noqa: BLE001 -- connect() reports registry failures
+            pass
+        return reason
+
+    def _ask_idb_location(self, reason: str | None = None) -> bool:
+        """Offer a writable database location. True when the dialog is up."""
+        reason = reason or self._blocked_idb_reason()
+        if reason is None or not self._open_path:
+            return False
+        from . import idbpath
+
+        if self._rpc_path:
+            # Nobody is watching this one. An RPC-driven TUI is waited on by
+            # `pane spawn`, which polls for ready and would sit through its whole
+            # timeout in front of a modal nobody can answer -- so take the
+            # proposal, which destroys nothing, and say where it went.
+            self._idb_path = idbpath.ensure_parent(
+                idbpath.relocated_idb(self._open_path)
+            )
+            self._status(f"{reason} \u2014 database kept at {self._idb_path}")
+            return False
+        self.push_screen(
+            IdbLocationScreen(
+                self._open_path, reason, idbpath.relocated_idb(self._open_path)
+            ),
+            self._on_idb_location,
+        )
+        return True
+
+    def _offer_idb_relocation(self, why: str) -> None:
+        """After a failed open, ask about the database if that could be the cause."""
+        if (
+            self._project is not None
+            or self._idb_path is not None
+            or not self._open_path
+        ):
+            return
+        from . import idbpath
+
+        if idbpath.can_create(idbpath.expected_idb(self._open_path)):
+            return  # the database was creatable; the failure is something else
+        self._ask_idb_location(f"cannot create it ({why.splitlines()[0]})")
+
+    def _on_idb_location(self, target) -> None:  # type: ignore[no-untyped-def]
+        """Esc means quit: with nowhere to put the database there is no session."""
+        if not target:
+            self._save_on_exit = False
+            self.exit(message="no writable location for the database")
+            return
+        self._idb_path = target
+        self._begin_connect()  # asks nothing more now that _idb_path is set
+
     def action_load_options(self) -> None:
         """Ctrl+L: re-open this binary with different load options.
 
@@ -5893,9 +6105,7 @@ class IdaTui(App):
             label2, self._pending_switch = self._pending_switch, None
             self._switch_binary(label2)
             return
-        self._loading_screen = LoadingScreen(self._loading_title())
-        self.push_screen(self._loading_screen)
-        self._connect()
+        self._begin_connect()
 
     def _loading_title(self) -> str:
         return os.path.basename(self._open_path) if self._open_path else "database"
@@ -6210,6 +6420,7 @@ class IdaTui(App):
                     self._open_path,
                     ttl=self._ttl,
                     load_args=self._load_args,
+                    output_database=self._idb_path,
                     spawn=False,
                 )
             client.connect(
@@ -6272,6 +6483,14 @@ class IdaTui(App):
             # cost one more keypress, not a restart.
             if "load options" in str(e):
                 self.app.call_from_thread(self._retry_load_options)
+                return
+            # Belt and braces for the unwritable-database case. `blocked_reason`
+            # is an os.access answer and os.access does not know about ACLs, a
+            # lying network mount or a full disk; an open that failed anyway,
+            # where we cannot then create the database ourselves, is the same
+            # problem discovered the expensive way. Offer the same way out
+            # instead of dead-ending on the backend's "worker exited with 1".
+            self.app.call_from_thread(self._offer_idb_relocation, str(e))
             return
         self.client = client
         self.program = program
@@ -6308,6 +6527,7 @@ class IdaTui(App):
             self._open_path,
             ttl=self._ttl,
             load_args=self._load_args,
+            output_database=self._idb_path,
             new_database=self._new_database,
         )
         client.connect(progress=lambda m: self.app.call_from_thread(self._status, m))
diff --git a/idatui/idbpath.py b/idatui/idbpath.py
new file mode 100644
index 0000000..a9614b3
--- /dev/null
+++ b/idatui/idbpath.py
@@ -0,0 +1,158 @@
+"""Where the database goes when the binary's own directory can't hold it.
+
+IDA puts its database beside the binary: ``/bin/ls`` becomes ``/bin/ls.i64``,
+plus ``.id0/.id1/.id2/.nam/.til`` scratch files unpacked into the same directory
+while it is open. For anything the user doesn't own -- ``/bin``, ``/usr/lib``, a
+read-only mount, a root-owned firmware drop -- that write is denied, and the only
+thing to see is the backend's account of it::
+
+    idalib worker launcher 2425195 exited with status 1
+    [ida-nexus] Failed to open database /usr/bin/ls
+
+which names neither the file it failed to create nor the reason. Worse, the
+failure costs a full analysis wait first. So: check whether the database can be
+written BEFORE opening anything, and when it can't, propose a path that works.
+
+IDA Nexus takes ``output_database`` for exactly this, and project mode already
+relies on it (everything lands in the project's sidecar). This is the
+single-binary equivalent, and the proposed location is *stable per binary* --
+reopening ``/bin/ls`` tomorrow finds yesterday's names and comments, which a
+temporary directory would not.
+
+Pure stdlib: no IDA, no IDA Nexus, no Textual. Nothing here writes anything.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import os
+
+#: Overrides where relocated databases are kept.
+DB_DIR_ENV = "IDATUI_DB_DIR"
+
+#: Deliberately under XDG_DATA_HOME, not XDG_CACHE_HOME. An .i64 looks like a
+#: cache -- it is derived from the binary and can be rebuilt -- but it also holds
+#: every name, comment and type the session produced, and cache directories are
+#: something cleaners are entitled to empty.
+_XDG_DEFAULT = os.path.join("~", ".local", "share", "idatui", "db")
+
+
+def expected_idb(binary: str) -> str:
+    """The database IDA would create for ``binary``, byte for byte as Nexus does.
+
+    Mirrors ``ida_nexus._resolver.expected_idb_path``: a path that is already an
+    ``.i64`` is the database, anything else gets ``.i64`` appended (IDA 9 is
+    64-bit only, so there is no ``.idb`` case to consider).
+    """
+    path = os.path.abspath(os.path.expanduser(binary))
+    return path if path.lower().endswith(".i64") else path + ".i64"
+
+
+def db_root() -> str:
+    """Directory holding relocated databases."""
+    override = os.environ.get(DB_DIR_ENV)
+    if override:
+        return os.path.abspath(os.path.expanduser(override))
+    xdg = os.environ.get("XDG_DATA_HOME")
+    if xdg:
+        return os.path.join(os.path.abspath(os.path.expanduser(xdg)), "idatui", "db")
+    return os.path.abspath(os.path.expanduser(_XDG_DEFAULT))
+
+
+def _slug(name: str) -> str:
+    """``name`` reduced to something safe to paste into a shell command."""
+    out = "".join(c if (c.isalnum() or c in "._-") else "_" for c in name)
+    return out.strip("._-")[:64] or "binary"
+
+
+def relocated_idb(binary: str) -> str:
+    """A writable database path for ``binary``, stable across runs.
+
+    Keyed by the resolved source path so the same binary always maps to the same
+    database (your work comes back), and hashed so two ``busybox``es from
+    different directories cannot collide. Flat rather than one directory per
+    binary: IDA unpacks its scratch files alongside the ``.i64`` under the same
+    stem, and the hash already makes that stem unique.
+    """
+    real = os.path.normcase(os.path.realpath(os.path.expanduser(binary)))
+    digest = hashlib.sha1(real.encode("utf-8", "surrogateescape")).hexdigest()[:8]
+    stem = os.path.basename(real.rstrip(os.sep) or real)
+    if stem.lower().endswith(".i64"):
+        stem = stem[:-4]
+    return os.path.join(db_root(), f"{_slug(stem)}-{digest}.i64")
+
+
+def blocked_reason(binary: str) -> str | None:
+    """Why IDA could not write ``binary``'s database here, or None if it can.
+
+    A short phrase that completes "can't open this binary because ...", meant to
+    be shown to a human. ``None`` is the common answer and must stay cheap: only
+    ``os.access`` calls, no probe files in the user's directories.
+
+    ``os.access`` is not the whole truth (ACLs, an NFS mount that lies, a full
+    disk), which is why the caller also treats a failed open as a candidate for
+    relocation. It is right about the case that actually happens -- a binary in a
+    system directory -- and being right there is worth a syscall.
+    """
+    idb = expected_idb(binary)
+    src = os.path.abspath(os.path.expanduser(binary))
+    if not os.path.exists(src):
+        return None  # not ours to judge: a registered database, or a typo
+    parent = os.path.dirname(idb) or "."
+    if not os.path.isdir(parent):
+        return f"{parent} is not a directory"
+    if not os.access(parent, os.W_OK | os.X_OK):
+        return f"{parent} is not writable"
+    if os.path.exists(idb) and not os.access(idb, os.W_OK):
+        # The directory is fine but the database itself isn't ours -- someone
+        # else's analysis, or a root-owned .i64 shipped with the firmware. IDA
+        # rewrites the .i64 on save, so read-only is a dead end, not a view.
+        return f"{idb} exists but is not writable"
+    return None
+
+
+def can_create(target: str) -> bool:
+    """Whether ``target`` can really be created right now, by trying it.
+
+    The truthful version of ``blocked_reason``'s ``os.access`` check, and the
+    only one that knows about ACLs, a read-only remount or a full disk. It costs
+    a create + unlink in the user's directory, so it is for the path where an
+    open has ALREADY failed and the question is what to blame -- never for the
+    pre-flight check, which must not touch anything.
+
+    An existing ``target`` is left strictly alone: this must never truncate a
+    database.
+    """
+    target = os.path.abspath(os.path.expanduser(target))
+    if os.path.exists(target):
+        return True
+    try:
+        fd = os.open(target, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
+    except OSError:
+        return False
+    os.close(fd)
+    try:
+        os.unlink(target)
+    except OSError:  # created it but cannot remove it: still "creatable"
+        pass
+    return True
+
+
+def describe(binary: str, target: str) -> str:
+    """One line about what relocating ``binary`` to ``target`` will do."""
+    if os.path.exists(target):
+        return "resuming the database already kept there (your names and comments)"
+    return f"a new database; the original {expected_idb(binary)} is never written"
+
+
+def ensure_parent(target: str) -> str:
+    """Create ``target``'s directory (private) and return ``target``.
+
+    0700 because a database exposes the whole binary plus whatever the session
+    recorded about it, and this directory accumulates one for every binary
+    opened from a place that could not hold its own.
+    """
+    parent = os.path.dirname(os.path.abspath(os.path.expanduser(target)))
+    if parent:
+        os.makedirs(parent, mode=0o700, exist_ok=True)
+    return os.path.abspath(os.path.expanduser(target))
diff --git a/idatui/launch.py b/idatui/launch.py
index 6e3b432..01778f3 100644
--- a/idatui/launch.py
+++ b/idatui/launch.py
@@ -103,6 +103,12 @@ def main(argv: list[str] | None = None) -> int:
         metavar="FILE",
         help="Tenet execution trace to explore alongside the binary",
     )
+    p.add_argument(
+        "--idb",
+        metavar="FILE",
+        help="keep the database here instead of beside the binary (an .i64 path; "
+        "the default for a binary in a directory you cannot write)",
+    )
     g = p.add_argument_group(
         "loading a headerless blob",
         "An ELF/PE/Mach-O says what it is. A raw firmware dump doesn't, and IDA "
@@ -145,6 +151,27 @@ def main(argv: list[str] | None = None) -> int:
     if args.ida_args:
         load["ida_args"] = args.ida_args
 
+    # Where the database goes, for a binary whose own directory cannot hold one
+    # (``/bin/ls`` -> ``/bin/ls.i64``). Validated HERE, before anything is staged
+    # or imported, so a contradictory invocation costs nothing.
+    idb_path = None
+    if args.idb:
+        from . import idbpath
+
+        if args.project:
+            # A project already keeps every database in its sidecar, so the two
+            # options mean contradictory things. Refusing beats ignoring one.
+            _log(
+                "--idb is for a single binary; a project keeps its databases in "
+                "its sidecar"
+            )
+            return 2
+        try:
+            idb_path = idbpath.ensure_parent(args.idb)
+        except OSError as e:
+            _log(f"cannot create the directory for --idb {args.idb}: {e}")
+            return 2
+
     project = None
     binary = None
     if args.project:
@@ -249,6 +276,7 @@ def main(argv: list[str] | None = None) -> int:
         trace_path=(
             os.path.abspath(os.path.expanduser(args.trace)) if args.trace else ""
         ),
+        idb_path=idb_path,
     ).run()
     return 0
 
diff --git a/idatui/pane.py b/idatui/pane.py
index 67b462b..51028ae 100644
--- a/idatui/pane.py
+++ b/idatui/pane.py
@@ -361,6 +361,13 @@ def spawn(args) -> int:
             inner += ["--" + opt.replace("_", "-"), str(val)]
     if getattr(args, "trace", None):
         inner += ["--trace", os.path.abspath(os.path.expanduser(args.trace))]
+    # Where the database goes, for a binary whose own directory cannot hold one
+    # (/bin/ls). Without it the TUI picks a writable location itself and says so
+    # in the status line -- an RPC-driven pane is never asked, because nothing
+    # would answer and spawn would wait out its whole timeout in front of the
+    # dialog. Pass it when the location matters.
+    if getattr(args, "idb", None):
+        inner += ["--idb", os.path.abspath(os.path.expanduser(args.idb))]
 
     if args.size and mux == "zellij":
         print(
@@ -651,6 +658,12 @@ def main(argv: list[str]) -> int:
         help="extra IDA command-line switches, passed through",
     )
     sp.add_argument(
+        "--idb",
+        metavar="FILE",
+        help="keep the database at this .i64 path instead of beside the binary "
+        "(passed to idatui.launch)",
+    )
+    sp.add_argument(
         "--sock", help="RPC socket path (default: auto in $XDG_RUNTIME_DIR)"
     )
     sp.add_argument(