feat(ida): add read-only GUI and headless MCP providers

[N0zoM1z0]

Summary

Fixes #747.

Reuse an existing mrexodia/ida-pro-mcp registration as REA's ida deep-analysis provider. An analyst connects to REA once, opens the original binary, and uses existing REA function/string tools. The attached profile reads the current GUI database; the headless profile opens and releases its own database automatically.

Problem and expected behavior

REA previously had no IDA provider, so agents had to configure and manage a second MCP surface. Existing IDA users should keep their upstream installation and select IDA through the same CLI/MCP contracts as other deep providers.

Change and scope

• Add src/ida/ boundaries for registration parsing, pinned SDK transport, upstream producer normalization, analysis operations, protected workspaces, and database ownership/cleanup.
• Support the legacy 1.4 attached profile and the modern database-supervisor headless profile. Admit read-only operations through a closed adapter map; upstream mutation, debugging, GUI navigation, and arbitrary Python tools are not forwarded.
• Reuse upstream installation/configuration and document both profiles. Setup retains only REA_IDA_MCP_CONFIG; doctor validates registration without launching IDA.
• Keep live IDA results out of snapshot replay. Preserve canonical function entries, raw observations, external callees, source locations, unknown facets, and upstream truncation reasons.
• Share function Evidence presentation between CLI and MCP, preserving actual provider identity, profile, raw result, locations, and limitations instead of replacing them with a derived wrapper.

Contract and boundary impact

• Semantic owner and earliest changed stage: provider configuration/admission and upstream MCP producer parsing in src/ida/; generic live-cache policy and function Evidence presentation in the application layer.
• CLI and MCP/tool-catalog contract: no new tools or required tool arguments. Select ida with --provider, REA_ANALYSIS_PROVIDER, or open_binary.provider_id. Existing named output schemas remain canonical; direct callers are unavailable in the modern profile because code xrefs do not prove call edges.
• Provider, bridge, target-format, or platform compatibility: upstream legacy GUI tools or modern supervisor tools are required. Admit original executable inputs, not .idb/.i64 files. Headless REA and upstream share native filesystem paths. Real workflows cover Windows; other engine/platform combinations are explicitly unverified.
• Evidence, artifact, provenance, or reconstruction contract: function Evidence now identifies the actual deep provider consistently in both adapters, including Hopper/Ghidra. Adapter version is distinct from unknown IDA/distribution versions. Database revision, patches, complete body ranges, typed edges, CFG, and other unsupported facets remain unknown.
• Process execution, authorization, cleanup, or containment impact: no new approval flags. Headless uses a digest-verified protected copy, force_headless, a unique requested session ID, verified worker ownership, explicit database arguments, and idb_close(save: false). Unconfirmed open/release retains the workspace and reports incomplete cleanup. Attached close releases the connection/proxy and leaves the GUI database open. Detached upstream workers do not have a REA Job Object containment claim.
• Generated metadata (docs/product-catalog.json), package, or installation impact: regenerate provider/configuration catalog and related metadata; update README, architecture, testing guide, and bundled skill. No new runtime dependencies, engine installation, activation changes, or vendored upstream server.

Evidence and regression coverage

• Tests added or updated: both profiles' named public output contracts; actual SDK loopback HTTP transport/authentication/redirect handling; malformed input/output; optional-null MCP projection; canonical entries versus call sites; external callees; pagination; target switches; cancellation draining; ownership failures; retained cleanup state; and live-cache exclusion. Existing Ghidra MCP Evidence regression now checks preserved provider observations.
• Base reproduction or other evidence: before this change, ida was not a registered deep candidate. Real upstream observations established the legacy call-site/interior-address semantics and the modern explicit-database lifecycle. Packaged Windows testing caught forward-slash workspace paths at the native boundary; normalization now occurs on the actual host.
• User-visible CLI/MCP output: the sanitized sequence below uses existing tool contracts. Function results include complete inline Evidence and explicit unsupported facets.
• Remaining proof gaps: real HTTP-supervisor operation, modern attached GUI tools, Linux/macOS headless engines, other IDA versions/architectures, and abrupt process-death cleanup are not established by this PR.

{"name":"open_binary","arguments":{"path":"/samples/program.exe","provider_id":"ida"}}
{"name":"analyze_function","arguments":{"procedure":"rea_fixture_add"}}
{"name":"search_strings","arguments":{"pattern":"license"}}
{"name":"close_binary","arguments":{}}

Sanitized response excerpt (omitted fields remain present in the actual response):

{
  "evidence": {
    "provider": {"id":"ida","name":"IDA Pro MCP adapter","version":"1"},
    "analysis_profile": {
      "parameters": {
        "version_scope":"rea-ida-adapter",
        "engine_version":null,
        "mode":"headless",
        "cache_policy":"live"
      }
    }
  },
  "result": {
    "procedure": {
      "name":"rea_fixture_add",
      "address":"0x1000",
      "body":{"available":false,"reason":"IDA MCP does not report complete function body ranges."}
    }
  }
}

• Observed, derived, and inferred claims remain distinguishable.
• Artifact identity, source provenance, and failed attempts remain preserved.
• Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

• npm run check:changed — typecheck/lint and 2,390 affected tests passed; one unrelated test skipped after integration with the fixed main snapshot.
• npm run test:focused -- <IDA conformance, SDK HTTP boundary, Ghidra/function Evidence, product catalog, direct-analysis filesystem tests> — 42 tests passed.
• npx vitest run src/ida/IdaSessionClient.test.ts --maxWorkers=1 — 15 tests passed, including rejected document selection before provider startup.
• npm run docs:check, npm run knip, npm run jscpd, npm run scan:todos, and npx oxfmt --check . — passed.
• node scripts/verify-real-ida.mjs --target <local-input> --procedure <function> — real Windows GUI through its existing legacy stdio proxy; production CLI/MCP contract validation and parity, all admitted operations, original-input preservation, and GUI still open after close.
• The same real-provider lane against a Windows-native npm-installed branch artifact — modern supervisor at upstream commit c133c3853faa111a9b00ee615c013b720d0c4acd, IDA 9.3 build 260213, a benign x64 PE fixture, protected workspace, owned database release, and workspace removal. Fixture never executed.
• Validation was sequential per engine, with two-core affinity, one headless worker, and a 1 GiB Node heap. Sampled process-family memory was approximately 0.6 GiB; sampled owned processes were gone after exit. D: remained above 43 GiB free; the isolated npm installation/cache and test archive were removed after verification. Public artifacts contain synthetic paths and no machine-specific registration, raw target output, or credentials.

Compatibility, safety, and release

• Breaking changes or migration steps: no tool schema or required-input migration. analyze_function Evidence provenance now preserves its actual provider instead of a workflow wrapper; consumers should use the returned provider/profile rather than assuming rea-workflow.
• Real Hopper/Ghidra, browser, or OS coverage: real IDA GUI and Windows-native headless/package workflows performed. Hopper/Ghidra engines and browser runtime were not executed for this provider change; relevant deterministic Ghidra/MCP regressions passed.
• Package or release metadata impact: additive provider/configuration/verification lane and updated bundled skill. The branch artifact is not the published package; documentation distinguishes repository support from released versions.
• Security, privacy, process, or containment review: existing GUI never closed/saved; original target unchanged; only verified owned workers receive close; POSIX 0700/Windows private DACL reused; transport authentication redacted from SDK diagnostics; ambient environment not persisted; no GUI/mutation/Python forwarding. Cleanup uncertainty remains visible rather than guessing ownership or deleting working files.

Review checklist

• The PR has one focused outcome and the title follows type(scope): outcome.
• Related issue is linked, or the reason for not linking one is stated above.
• Tests cover changed observable behavior and meaningful failure paths.
• Owning docs, contracts, and generated metadata are updated where needed.
• User-visible CLI/MCP changes include representative output.
• I checked the final diff for secrets, unrelated cleanup, and unsupported claims.