xrefs: show fine-grained kind (call/jump/read/write/offset) in the dialog

ida-pro-mcp's xref_query only classifies xrefs as code/data (xr.iscode). Add an
injected `xref_types` tool (server/patch_server.py) that mirrors xref_query's
query/envelope shape but derives a fine `kind` from the IDA xref type:
call/jump/flow for code (fl_CF/CN/JF/JN/F), read/write/offset/text/info for data
(dr_R/W/O/T/I). The worker self-injects it on startup like the other custom tools.

* domain: Xref gains a `kind` field; _parse_xrefs reads it; xrefs_to() now calls
  xref_types (falling back to xref_query if absent). xrefs_from is unchanged.
* app: the `x` dialog shows the kind as an aligned column after the address
  (`000034F4  read    sub_34F0+0x4`).
* rpc: the structured xrefs_to read carries `kind` too.

Verified live over the worker/RPC harness on targets/echo: sub_2C00 callers ->
call; __progname -> offset (GOT), read (sub_34F0), write (sub_3500); stdout ->
read/offset.

3 files changed, 14 insertions, 8 deletions

diff --git a/idatui/app.py b/idatui/app.py
index ce07cd0..07325a1 100644
--- a/idatui/app.py
+++ b/idatui/app.py
@@ -3164,7 +3164,8 @@ class IdaTui(App):
                 # not inside a function: name the section it lives in (a GOT/reloc
                 # data slot or a loose thunk) instead of a bare '?'.
                 loc = self.program.section_of(x.frm) or "<no seg>"
-            items.append((x.frm, f"{x.frm:08X}  {loc:<26}  [{x.type}]"))
+            kind = x.kind or x.type or "?"
+            items.append((x.frm, f"{x.frm:08X}  {kind:<6}  {loc}"))
         preselect = self._xref_preselect(xr, here_ea, here_end)
         self.app.call_from_thread(self._present_xrefs, label, items, focus, preselect)
 
diff --git a/idatui/domain.py b/idatui/domain.py
index d7ebf3c..8a127d7 100644
--- a/idatui/domain.py
+++ b/idatui/domain.py
@@ -127,9 +127,10 @@ class Ref:
 class Xref:
     frm: int              # the referencing address
     to: int | None        # the referenced address
-    type: str             # "code" | "data" | ...
+    type: str             # coarse: "code" | "data"
     fn_name: str | None   # function containing `frm`
     fn_addr: int | None
+    kind: str | None = None  # fine: call/jump/flow/read/write/offset/text/info
 
 
 @dataclass(frozen=True)
@@ -1260,11 +1261,14 @@ class Program:
         return _parse_xrefs(payload)
 
     def xrefs_to(self, ea: int, limit: int = 2000) -> list[Xref]:
-        payload = self.client.call(
-            "xref_query",
-            queries=[{"addr": hex(ea), "direction": "to", "include_fn": True,
-                      "dedup": True, "count": limit}],
-        )
+        q = [{"addr": hex(ea), "direction": "to", "include_fn": True,
+              "dedup": True, "count": limit}]
+        try:
+            # xref_types adds a fine-grained `kind` (call/read/write/...) for the
+            # xref dialog; fall back to xref_query (code/data only) if absent.
+            payload = self.client.call("xref_types", queries=q)
+        except IDAToolError:
+            payload = self.client.call("xref_query", queries=q)
         return _parse_xrefs(payload)
 
     # -- address resolution ------------------------------------------------ #
@@ -1365,6 +1369,7 @@ def _parse_xrefs(payload) -> list[Xref]:
             type=d.get("type", "?"),
             fn_name=fn.get("name"),
             fn_addr=_as_int(fn["addr"]) if fn.get("addr") else None,
+            kind=d.get("kind"),
         ))
     return out
 
diff --git a/idatui/rpc.py b/idatui/rpc.py
index 908a26c..59eec86 100644
--- a/idatui/rpc.py
+++ b/idatui/rpc.py
@@ -310,7 +310,7 @@ def disassembly(app, target=None, max_lines: int = 2000) -> dict[str, Any]:
 
 
 def _xref_dicts(xs, limit: int) -> list[dict[str, Any]]:
-    return [{"frm": x.frm, "to": x.to, "type": x.type,
+    return [{"frm": x.frm, "to": x.to, "type": x.type, "kind": x.kind,
              "fn_addr": x.fn_addr, "fn_name": x.fn_name} for x in xs[:limit]]