feat(mcp): return function-pointer calls apart from resolved callees

- grepnavi_callees lists member calls under indirect_calls with the
  member name, call line, receiver and source text, instead of
  resolving the member name and attaching a confidence to whatever
  same-named function the index returned first
- The list survives compact mode and deeper levels, so an agent cannot
  conclude that a function calls nothing through its ops table
- A one-line note points at grepnavi_references(word, assign: true)
  for the registration sites; the limits (positional and macro-built
  tables) are in the tool description

Author: Taka-S-dev

mcp/README.md

@@ -40,7 +40,7 @@ flowchart TD
 | `grepnavi_ifdef_context` | ある行を囲んでいる `#ifdef` / `#if` を外側から順に列挙 |
 | `grepnavi_path` | 関数 A から関数 B への**呼び出し経路を 1 本だけ**返す (callers を全部辿らずに繋がりを確かめる) |
 | `grepnavi_callers` | 関数を呼んでいる箇所一覧 (call tree を上に辿る、`depth` で再帰) |
-| `grepnavi_callees` | 関数内から呼ばれている識別子一覧 + 各定義解決 (call_line, kind, engine, **`confidence`** (high/medium/low — low は silent failure 警告), likely_macro / likely_non_callable, self 自動除外、`depth` で再帰)。**`exclude_macros` / `exclude_non_callable` はデフォルト true** (ノイズ除去)。`excluded.macros` / `excluded.non_callable` は**名前リスト** で返す → 再 query 無しで「捨てたもの」を確認可能。definitions は path proximity で **top 1** のみ surface、`definitions_total` で件数通知 |
+| `grepnavi_callees` | 関数内から呼ばれている識別子一覧 + 各定義解決。関数ポインタ経由 (`s->method->ssl_read(`) は `indirect_calls` に分けて返し、メンバ名で定義を引かない (call_line, kind, engine, **`confidence`** (high/medium/low — low は silent failure 警告), likely_macro / likely_non_callable, self 自動除外、`depth` で再帰)。**`exclude_macros` / `exclude_non_callable` はデフォルト true** (ノイズ除去)。`excluded.macros` / `excluded.non_callable` は**名前リスト** で返す → 再 query 無しで「捨てたもの」を確認可能。definitions は path proximity で **top 1** のみ surface、`definitions_total` で件数通知 |
 | `grepnavi_list_insertions` | **記録済みデバッグ行の一覧**（読み取りのみ）。`source` が `mcp` なら AI が撒いた行、空なら人が GUI で入れた行。`id` はソースに焼き込まれた `{tag}` そのものなので、実機やプログラムが吐いた `[GN9]` から file:line と行の中身を引ける (`tag: "GN9"`)。`group` / `file` で絞り込み。**出力に出なかった = その経路を通らなかった**の判断は `enabled: true` かつバイナリが挿入後にビルドされている場合にのみ成立する |
 | `grepnavi_graph_list` | 既存ノード一覧 (id / label / file:line / memo / children) |
 

mcp/skills/grepnavi/references/accuracy.md

@@ -28,9 +28,12 @@ gtags was right — which is why it goes first.
 These are invisible to `callers`, `callees`, and `path`. They are not bugs to be fixed; they are the
 boundary of the approach:
 
-- **Calls through function pointers.** `pol->pd_alloc_fn(...)` resolves to nothing. In callee
-  results these arrive with `kind: "member"`; grepnavi marks them and refuses to expand them,
-  because guessing would silently attach an unrelated function.
+- **Calls through function pointers.** `pol->pd_alloc_fn(...)` resolves to nothing. `callees`
+  returns them apart, under `indirect_calls` with the member `name` and its `receiver`
+  (`pol`), and never looks the member name up as a function — that would attach an unrelated
+  same-named function with a confidence on it. To see what may be stored there,
+  `references(word: name, assign: true)` lists `.name = fn` initializers and `x->name = fn`
+  assignments; tables filled positionally or by macros (OpenSSL method tables) stay invisible.
 - **Calls generated by macros.** A macro that expands into a call leaves no textual call site.
 - **Anything behind a preprocessor condition you did not check.** Text search sees all branches.
 

mcp/src/client.ts

@@ -50,6 +50,17 @@ export interface CallSite {
   text?: string;
 }
 
+/** /api/callees の 1 件。indirect は `s->method->ssl_read(` のようなメンバ呼び出し。 */
+export interface RawCallee {
+  name: string;
+  call_line: number;
+  kind?: string;
+  text?: string;
+  indirect?: boolean;
+  /** メンバの持ち主の式 (`s->method`)。戻り値のメンバなど名前で追えない形では無い。 */
+  receiver?: string;
+}
+
 export interface SearchMatch {
   file: string;
   line: number;
@@ -527,16 +538,12 @@ export class GrepnaviClient {
   // /api/callees は (file, line) で「その関数定義の中から呼ばれる識別子と呼び出し行」を返す。
   // 新しい server は [{name, call_line}]、古い server は []string を返すので両形式を吸収する
   // (古い server に当たっても crash させない)。
-  async callees(file: string, line: number): Promise<Array<{ name: string; call_line: number }>> {
+  async callees(file: string, line: number): Promise<RawCallee[]> {
     const params = new URLSearchParams({ file, line: String(line) });
     const r = await this.req("/api/callees?" + params.toString());
     const data = (await r.json()) as unknown;
     if (!Array.isArray(data)) return [];
-    return data.map((c) =>
-      typeof c === "string"
-        ? { name: c, call_line: 0 }
-        : (c as { name: string; call_line: number }),
-    );
+    return data.map((c) => (typeof c === "string" ? { name: c, call_line: 0 } : (c as RawCallee)));
   }
 
   async graph(): Promise<GraphResponse> {

mcp/src/helpers.ts

@@ -1,5 +1,5 @@
 import { annotateMemo, likelyTrivial, inCallerSubtree } from "./client.js";
-import type { DefHit, GrepnaviClient, MemoCategory } from "./client.js";
+import type { DefHit, GrepnaviClient, MemoCategory, RawCallee } from "./client.js";
 import { client } from "./shared.js";
 import type { BatchNodeInput, CallerTreeNode } from "./shared.js";
 
@@ -492,10 +492,41 @@ export async function enrichCallee(name: string, callerFile?: string) {
 export type EnrichedCallee = Awaited<ReturnType<typeof enrichCallee>> & {
   call_line: number;
   children?: EnrichedCallee[];
+  indirect_calls?: IndirectCall[];
   recursion_stopped?: "depth_limit" | "non_callable" | "already_visited" | "no_definition";
   body_preview?: string;
 };
 
+// 関数ポインタ経由の呼び出し。名前で定義を引くと同名の別関数に当たるので、
+// 定義解決の列には混ぜず、「メンバ名」「持ち主」「行」だけを別の列で返す。
+export type IndirectCall = {
+  name: string;
+  call_line: number;
+  receiver?: string;
+  text?: string;
+};
+
+// 関数ポインタ経由の列に添える一行。手段と限界の説明はツール説明文にあり、
+// 応答は呼ぶたびに読まれるので、ここは次の一手だけを言う。
+export const indirectCallsNote =
+  "The target is whatever `receiver`.`name` holds, not decidable from text. Candidates: grepnavi_references(word: name, assign: true).";
+
+export function splitIndirectCallees(raw: RawCallee[]): { direct: RawCallee[]; indirect: IndirectCall[] } {
+  const direct: RawCallee[] = [];
+  const indirect: IndirectCall[] = [];
+  for (const c of raw) {
+    if (!c.indirect) {
+      direct.push(c);
+      continue;
+    }
+    const e: IndirectCall = { name: c.name, call_line: c.call_line };
+    if (c.receiver) e.receiver = c.receiver;
+    if (c.text) e.text = c.text.trim();
+    indirect.push(e);
+  }
+  return { direct, indirect };
+}
+
 // callees に optional な func body preview を付ける。
 // 各 callee の top definition (kind=func 推奨) に対して /api/func-body を呼び、
 // 先頭 N 行を抜き出して body_preview に入れる。
@@ -529,14 +560,18 @@ export async function fetchEnrichedCallees(
   selfName: string,
   filters: { exclude_macros?: boolean; exclude_non_callable?: boolean },
 ): Promise<{
-  raw: Array<{ name: string; call_line: number }>;
-  filtered: Array<{ name: string; call_line: number }>;
+  raw: RawCallee[];
+  filtered: RawCallee[];
   enriched: EnrichedCallee[];
+  indirect: IndirectCall[];
   excludedMacroNames: string[];
   excludedNonCallableNames: string[];
 }> {
   const raw = await client.callees(file, line);
-  const filtered = selfName ? raw.filter((c) => c.name !== selfName) : raw;
+  // 関数ポインタ経由は定義解決に掛けない: メンバ名で definition を引くと同名の
+  // 別関数 (`read`) が top に立ち、confidence まで付いて本物に見える。
+  const { direct, indirect } = splitIndirectCallees(raw);
+  const filtered = selfName ? direct.filter((c) => c.name !== selfName) : direct;
   const enriched = await Promise.all(
     filtered.map(async (c) => ({ ...c, ...(await enrichCallee(c.name, file)) })),
   );
@@ -560,6 +595,7 @@ export async function fetchEnrichedCallees(
     raw,
     filtered,
     enriched: kept,
+    indirect,
     excludedMacroNames,
     excludedNonCallableNames,
   };
@@ -653,10 +689,15 @@ export async function resolveAndEnrichCallees(args: {
     depth: maxDepth,
     total: top.raw.length,
     excluded: {
-      self: top.raw.length - top.filtered.length,
+      self: top.raw.length - top.filtered.length - top.indirect.length,
       macros: top.excludedMacroNames,
       non_callable: top.excludedNonCallableNames,
     },
+    // 関数ポインタ経由は callees の列に混ぜない。混ぜると同名の別関数に
+    // 解決された「本物らしい」行が並び、読む側は辿っているつもりで別の実装へ行く
+    ...(top.indirect.length
+      ? { indirect_calls: { count: top.indirect.length, note: indirectCallsNote, calls: top.indirect } }
+      : {}),
   };
   if (args.compact !== undefined) {
     return { ...base, callees: args.compact ? toCompactCallees(top.enriched) : top.enriched };
@@ -696,6 +737,9 @@ export type CompactCallee = {
   pin?: boolean;
   def?: string; // "file:line"。定義が引けなかったときは省略
   children?: CompactCallee[];
+  // 関数ポインタ経由は compact でも落とさない: 落とすと「この関数は ops 経由で
+  // 何も呼んでいない」と読めてしまう。行と受け手だけに畳む
+  indirect_calls?: Array<{ name: string; call_line: number; receiver?: string }>;
   recursion_stopped?: string;
 };
 
@@ -708,6 +752,11 @@ export function toCompactCallees(nodes: EnrichedCallee[]): CompactCallee[] {
     if (def) c.def = `${def.file}:${def.line}`;
     if (n.recursion_stopped) c.recursion_stopped = n.recursion_stopped;
     if (n.children?.length) c.children = toCompactCallees(n.children);
+    if (n.indirect_calls?.length) {
+      c.indirect_calls = n.indirect_calls.map(({ name, call_line, receiver }) =>
+        receiver ? { name, call_line, receiver } : { name, call_line },
+      );
+    }
     return c;
   });
 }
@@ -742,6 +791,7 @@ export async function expandCalleeRecursive(
 
   const sub = await fetchEnrichedCallees(target.file, target.line, node.name, filters);
   node.children = sub.enriched;
+  if (sub.indirect.length) node.indirect_calls = sub.indirect;
   for (const child of sub.enriched) {
     await expandCalleeRecursive(child, maxDepth, currentDepth + 1, visited, filters);
   }

mcp/src/tools/search.ts

@@ -307,6 +307,7 @@ export const definitions: ToolDef[] = [
       "Pass `word` (caller name) for auto-resolve via grepnavi_definition; errors on ambiguity with candidate list, then disambiguate via `file`+`line`. Or pass `file`+`line` directly.\n\n" +
       "Each result: `name`, `call_line`, `kind`, `engine`, `confidence` ('high'|'medium'|'low' for the picked top definition — **'low' means the pick may be wrong**), `likely_macro`, `likely_non_callable`, `likely_trivial` (well-known primitives: locking / atomics / mem-str / printk / le_to_cpu / container_of etc — definition lookup is **skipped entirely** for these to avoid bogus picks like spin_lock → selftests/.../spinlock.c), `in_caller_subtree` (def shares caller's dir tree = same subsystem), `recommended_for_tree` (= !macro && !non_callable && !trivial — **the simple filter for 'what to actually pin'**), `definitions` (top 1, proximity-ranked), `definitions_total`. Caller itself auto-excluded.\n\n" +
       "**Defaults**: `exclude_macros: true`, `exclude_non_callable: true` (noise filtered out; pass false to see). The response's `excluded.macros` / `excluded.non_callable` are **arrays of NAMES** that were dropped — eyeball them to confirm they're real noise, no re-query needed.\n\n" +
+      "**Calls through function pointers come back separately as `indirect_calls`** (`s->method->ssl_read(...)`, `ops.read(...)`): each has `name` (the member), `call_line`, `receiver` (`s->method`) and `text`. They are kept out of `callees` on purpose — resolving the member name as a function would pick an unrelated same-named function and dress it in a confidence. What the member holds is not decidable from text; grepnavi_references(word: name, assign: true) shows `.name = fn` initializers and `x->name = fn` assignments, but not tables built positionally or by macros.\n\n" +
       "`compact: true` drops the judgement fields and returns name / call_line / kind / `pin` (= recommended_for_tree) / `def` only — a fraction of the tokens when you only need the list to pick from.\n\n" +
       "**A large answer compacts itself.** When you pass neither value and the full form would be over ~8 KB, the response comes back compact with a `compacted` field naming what was dropped and how to get it — a function with 38 callees is 12.5 KB full and 5 KB compact, and past that size the answer tends to be set aside unread rather than used. Pass `compact: false` when you actually need the judgement fields, ideally with `depth: 1` or a narrower caller.\n\n" +
       "`depth` > 1 recurses (max 5). Macros / no-def / cycles don't recurse further. **Cost note**: each extra level fans out and can take seconds; start at depth 1 unless you need more.\n\n" +

mcp/test/callees.test.js

@@ -0,0 +1,37 @@
+// callees の関数ポインタ経由の分離。
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+import { splitIndirectCallees, toCompactCallees } from "../dist/helpers.js";
+
+test("callees - メンバ呼び出しは定義解決の列から外れる", () => {
+  const { direct, indirect } = splitIndirectCallees([
+    { name: "plain", call_line: 3, text: "plain(x);" },
+    { name: "ssl_read", call_line: 5, indirect: true, receiver: "s->method", text: "  return s->method->ssl_read(s, buf, num);" },
+    { name: "write", call_line: 7, indirect: true, text: "get(s)->write(f);" },
+  ]);
+  assert.deepEqual(direct.map((c) => c.name), ["plain"]);
+  assert.deepEqual(indirect, [
+    { name: "ssl_read", call_line: 5, receiver: "s->method", text: "return s->method->ssl_read(s, buf, num);" },
+    { name: "write", call_line: 7, text: "get(s)->write(f);" },
+  ]);
+});
+
+test("callees - compact でもメンバ呼び出しは残る", () => {
+  const compact = toCompactCallees([
+    {
+      name: "f", call_line: 1, kind: "func", engine: "gtags",
+      likely_macro: false, likely_non_callable: false, likely_trivial: false,
+      in_caller_subtree: true, confidence: "high", recommended_for_tree: true,
+      definitions_total: 1, definitions: [{ file: "/a.c", line: 10, kind: "func" }],
+      indirect_calls: [
+        { name: "read", call_line: 12, receiver: "f->f_op", text: "f->f_op->read(f);" },
+        { name: "cb", call_line: 13, text: "get()->cb();" },
+      ],
+    },
+  ]);
+  assert.deepEqual(compact[0].indirect_calls, [
+    { name: "read", call_line: 12, receiver: "f->f_op" },
+    { name: "cb", call_line: 13 },
+  ]);
+});