[PR #1906] [MERGED] fix(ida): preserve non-x86 call edges and workflow uncertainty #4898

New issue

Closed

opened 2026-10-31 00:56:33 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:56:33 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1906
Author: @nikolay-dementiev
Created: 10/11/2026
Status: ✅ Merged
Merged: 10/11/2026
Merged by: @morluto

Base: main ← Head: fix/1794-ida-arm64-callees

📝 Commits (10+)

e04a67a test(ida): expect callee edges from the call graph on non-x86 targets
6a595df fix(ida): read callee edges from the call graph on non-x86 targets
9e1caf3 test(ida): pin address order of call graph additions
2bb9e31 docs(ida): describe the call graph source for non-x86 callees
491e276 test(ida): pin the x86 baseline, the call graph reader and its failure modes
f748b01 fix(ida): check the call graph root, scope truncation to the root and degrade without callgraph
41bd29b test(ida): expect managed PE off the x86 path, possible-truncation wording and a complete ARM64 traversal
165f914 fix(ida): keep managed PE and x86 reads off the call graph path and qualify truncation
1945d28 test(ida): answer only expected leaf roots and assert the requested call graph roots
bc2e40c test(ida): expect a call graph the producer cannot give consistently to fail the callee read

📊 Changes

17 files changed (+1410 additions, -32 deletions)

View changed files

📝 docs/ida-provider.md (+1 -1)
📝 docs/mcp-contracts.md (+7 -0)
📝 src/application/CallPathTracing.ts (+21 -3)
📝 src/application/EnhancedTools.ts (+24 -3)
📝 src/contracts/toolOutputSchemaPrimitives.ts (+1 -0)
📝 src/domain/callPath.test.ts (+71 -1)
📝 src/domain/callPath.ts (+13 -2)
➕ src/ida/IdaCallGraph.test.ts (+304 -0)
➕ src/ida/IdaCallGraph.ts (+153 -0)
➕ src/ida/IdaCalleeRelationships.test.ts (+222 -0)
📝 src/ida/IdaOperationRunner.ts (+43 -5)
📝 src/ida/IdaProtocolValues.ts (+32 -9)
📝 src/ida/IdaSessionClient.ts (+9 -2)
📝 tests/boundary/mcp/enhancedTools.callPathsAndBatches.test.ts (+64 -1)
➕ tests/boundary/providers/ida/calleeRelationships.test.ts (+291 -0)
➕ tests/fixtures/idaCallGraph.ts (+138 -0)
📝 tests/fixtures/idaMcp.ts (+16 -5)

📄 Description

Modern headless IDA reported missing or false callee edges on non-x86 targets because upstream callees checks x86 instruction IDs. This branch uses processor-neutral callgraph as the sole function-edge source for targets not proven x86-only. It also carries relationship limitations through graph and path workflows, so an empty unsupported observation no longer appears complete.

Fixes #1794

The contributor's original commits remain in the branch; the review follow-up completes the provider and workflow boundaries together.

Request only the root at depth zero, filter its outgoing call edges, and batch lookup_funcs once to enrich observed targets. Missing or typed failed name lookup retains the graph-observed address with a limitation.
Keep x86 and legacy relationship reads unchanged. Never merge non-x86 callees false positives into graph observations.
Keep missing graph capability, recognized-function-only coverage and producer caps explicit. Tool/protocol/transport graph failures, wrong roots, malformed replies and transport-truncated previews remain errors; cancellation propagates.
Add optional per-node limitations to get_call_graph, carry limited expansions into trace_call_path residual unknowns, and prevent limited function Evidence from establishing exhaustive call-path absence. Observed paths remain visible.
Remove 225 lines of duplicate session tests while preserving distinct x86/legacy/universal/cancellation/false-positive coverage and the stronger helper and workflow boundaries.

Validation on macOS, Node 24.18.0:

Six focused files: 59 passed in 2.74 seconds, including provider protocol boundaries, MCP graph/path behavior, domain Evidence search and advertised JSON Schema validation after catalog generation.
Runtime build, fast typecheck/lint, and documentation checks passed.

Upstream semantics were checked against pinned source c133c3853faa111a9b00ee615c013b720d0c4acd: callgraph appends root edges before recursing, so depth zero skips child scans while retaining root edges. DeepWiki incorrectly claimed the depth-zero test asserts empty edges; the actual test only asserts the root node. Primary source: github.com/mrexodia/ida-pro-mcp@c133c3853f/src/ida_pro_mcp/ida_mcp/api_analysis.py (L2469-L2595)

Real-provider scope: the original contributor reported IDA 9.1 macOS ARM64/x86 runs before this follow-up. This follow-up was verified with the production adapter over controlled protocol boundaries, not a licensed IDA engine. Depth-zero behavior and name enrichment still need a real IDA run; Windows/Linux and other IDA versions were not executed. No GUI database is saved or closed, and no process ownership authority changes.

Review follow-up e5764d0b5: a valid depth-zero callgraph with per_func_capped: true now reports definite root truncation even below the edge cap. Focused selector/provider workflow checks pass (28 tests), preserving the signal through direct callees, call graph and call trace; fast and docs checks pass. No additional real IDA verification.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1906 **Author:** [@nikolay-dementiev](https://github.com/nikolay-dementiev) **Created:** 10/11/2026 **Status:** ✅ Merged **Merged:** 10/11/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/1794-ida-arm64-callees` --- ### 📝 Commits (10+) - [`e04a67a`](https://github.com/morluto/rea/commit/e04a67a1c49d06e3eb3171e42c3de90ab757ea07) test(ida): expect callee edges from the call graph on non-x86 targets - [`6a595df`](https://github.com/morluto/rea/commit/6a595dfca0b205351306078a4866552aa79c5ffb) fix(ida): read callee edges from the call graph on non-x86 targets - [`9e1caf3`](https://github.com/morluto/rea/commit/9e1caf32212ef066ac8ba49c415521d46cc2cdb7) test(ida): pin address order of call graph additions - [`2bb9e31`](https://github.com/morluto/rea/commit/2bb9e31165976e4f8fb48dc7b60565310be202c1) docs(ida): describe the call graph source for non-x86 callees - [`491e276`](https://github.com/morluto/rea/commit/491e276a2b1e37d45cc7cd56f550d29cc7226e11) test(ida): pin the x86 baseline, the call graph reader and its failure modes - [`f748b01`](https://github.com/morluto/rea/commit/f748b013faf836987adfb3cb279c039fd6b090d1) fix(ida): check the call graph root, scope truncation to the root and degrade without callgraph - [`41bd29b`](https://github.com/morluto/rea/commit/41bd29bb47b2015a92ae024c0f6353f997186d08) test(ida): expect managed PE off the x86 path, possible-truncation wording and a complete ARM64 traversal - [`165f914`](https://github.com/morluto/rea/commit/165f9145cf414dbf91cb9c2775a149d63de8fa53) fix(ida): keep managed PE and x86 reads off the call graph path and qualify truncation - [`1945d28`](https://github.com/morluto/rea/commit/1945d2860652572a6d4f8b7ba8fa44a95681812e) test(ida): answer only expected leaf roots and assert the requested call graph roots - [`bc2e40c`](https://github.com/morluto/rea/commit/bc2e40c78d99abcfbb4f4bcdf9907b1b41bff41a) test(ida): expect a call graph the producer cannot give consistently to fail the callee read ### 📊 Changes **17 files changed** (+1410 additions, -32 deletions) <details> <summary>View changed files</summary> 📝 `docs/ida-provider.md` (+1 -1) 📝 `docs/mcp-contracts.md` (+7 -0) 📝 `src/application/CallPathTracing.ts` (+21 -3) 📝 `src/application/EnhancedTools.ts` (+24 -3) 📝 `src/contracts/toolOutputSchemaPrimitives.ts` (+1 -0) 📝 `src/domain/callPath.test.ts` (+71 -1) 📝 `src/domain/callPath.ts` (+13 -2) ➕ `src/ida/IdaCallGraph.test.ts` (+304 -0) ➕ `src/ida/IdaCallGraph.ts` (+153 -0) ➕ `src/ida/IdaCalleeRelationships.test.ts` (+222 -0) 📝 `src/ida/IdaOperationRunner.ts` (+43 -5) 📝 `src/ida/IdaProtocolValues.ts` (+32 -9) 📝 `src/ida/IdaSessionClient.ts` (+9 -2) 📝 `tests/boundary/mcp/enhancedTools.callPathsAndBatches.test.ts` (+64 -1) ➕ `tests/boundary/providers/ida/calleeRelationships.test.ts` (+291 -0) ➕ `tests/fixtures/idaCallGraph.ts` (+138 -0) 📝 `tests/fixtures/idaMcp.ts` (+16 -5) </details> ### 📄 Description Modern headless IDA reported missing or false callee edges on non-x86 targets because upstream `callees` checks x86 instruction IDs. This branch uses processor-neutral `callgraph` as the sole function-edge source for targets not proven x86-only. It also carries relationship limitations through graph and path workflows, so an empty unsupported observation no longer appears complete. Fixes #1794 The contributor's original commits remain in the branch; the review follow-up completes the provider and workflow boundaries together. - Request only the root at depth zero, filter its outgoing call edges, and batch `lookup_funcs` once to enrich observed targets. Missing or typed failed name lookup retains the graph-observed address with a limitation. - Keep x86 and legacy relationship reads unchanged. Never merge non-x86 `callees` false positives into graph observations. - Keep missing graph capability, recognized-function-only coverage and producer caps explicit. Tool/protocol/transport graph failures, wrong roots, malformed replies and transport-truncated previews remain errors; cancellation propagates. - Add optional per-node `limitations` to `get_call_graph`, carry limited expansions into `trace_call_path` residual unknowns, and prevent limited function Evidence from establishing exhaustive call-path absence. Observed paths remain visible. - Remove 225 lines of duplicate session tests while preserving distinct x86/legacy/universal/cancellation/false-positive coverage and the stronger helper and workflow boundaries. Validation on macOS, Node 24.18.0: - Six focused files: 59 passed in 2.74 seconds, including provider protocol boundaries, MCP graph/path behavior, domain Evidence search and advertised JSON Schema validation after catalog generation. - Runtime build, fast typecheck/lint, and documentation checks passed. Upstream semantics were checked against pinned source `c133c3853faa111a9b00ee615c013b720d0c4acd`: `callgraph` appends root edges before recursing, so depth zero skips child scans while retaining root edges. DeepWiki incorrectly claimed the depth-zero test asserts empty edges; the actual test only asserts the root node. Primary source: https://github.com/mrexodia/ida-pro-mcp/blob/c133c3853faa111a9b00ee615c013b720d0c4acd/src/ida_pro_mcp/ida_mcp/api_analysis.py#L2469-L2595 Real-provider scope: the original contributor reported IDA 9.1 macOS ARM64/x86 runs before this follow-up. This follow-up was verified with the production adapter over controlled protocol boundaries, not a licensed IDA engine. Depth-zero behavior and name enrichment still need a real IDA run; Windows/Linux and other IDA versions were not executed. No GUI database is saved or closed, and no process ownership authority changes. Review follow-up e5764d0b5: a valid depth-zero callgraph with `per_func_capped: true` now reports definite root truncation even below the edge cap. Focused selector/provider workflow checks pass (28 tests), preserving the signal through direct callees, call graph and call trace; fast and docs checks pass. No additional real IDA verification. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 00:56:33 +00:00