@houwert/conductor 0.24.1 → 0.26.0

package/dist/drivers/bootstrap.js

@@ -5,6 +5,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectPlatform = detectPlatform;
 exports.getDriverPort = getDriverPort;
+exports.getInputPort = getInputPort;
+exports.getStreamPort = getStreamPort;
+exports.getInprocDylibPath = getInprocDylibPath;
+exports.getHidBinaryPath = getHidBinaryPath;
+exports.getCaptureBinaryPath = getCaptureBinaryPath;
 exports.installDriver = installDriver;
 exports.isSimulatorBooted = isSimulatorBooted;
 exports.isPortOpen = isPortOpen;
@@ -89,6 +94,8 @@ const TVOS_BASE_PORT = 2075;
 const ANDROID_BASE_PORT = 3763;
 const WEB_BASE_PORT = 4075;
 const VEGA_BASE_PORT = 5075;
+const INPUT_BASE_PORT = 7075;
+const STREAM_BASE_PORT = 8075;
 const PORT_FILE = path_1.default.join(os_1.default.homedir(), '.conductor', 'ports.json');
 const PORT_LOCK = PORT_FILE + '.lock';
 const PORT_LOCK_TIMEOUT_MS = 5000;
@@ -175,6 +182,48 @@ async function getDriverPort(platform, deviceId) {
         return port;
     });
 }
+/**
+ * Assign and persist a streaming-input WebSocket port for a device. Kept in a
+ * separate namespace from the driver port (a device has both): the driver port
+ * serves the XCUITest/gRPC HTTP surface, this one the persistent input socket.
+ */
+async function getInputPort(deviceId) {
+    return withPortLock(() => {
+        const state = readPortState();
+        if (!state.inputAssignments)
+            state.inputAssignments = {};
+        if (state.nextInputPort === undefined)
+            state.nextInputPort = INPUT_BASE_PORT;
+        if (state.inputAssignments[deviceId] !== undefined) {
+            return state.inputAssignments[deviceId];
+        }
+        const port = state.nextInputPort++;
+        state.inputAssignments[deviceId] = port;
+        writePortState(state);
+        return port;
+    });
+}
+/**
+ * Assign and persist a streaming-video WebSocket port for a device. Its own
+ * namespace: a device has a driver port (control), an input port (pointer/key
+ * frames), and this stream port (H.264 video fan-out).
+ */
+async function getStreamPort(deviceId) {
+    return withPortLock(() => {
+        const state = readPortState();
+        if (!state.streamAssignments)
+            state.streamAssignments = {};
+        if (state.nextStreamPort === undefined)
+            state.nextStreamPort = STREAM_BASE_PORT;
+        if (state.streamAssignments[deviceId] !== undefined) {
+            return state.streamAssignments[deviceId];
+        }
+        const port = state.nextStreamPort++;
+        state.streamAssignments[deviceId] = port;
+        writePortState(state);
+        return port;
+    });
+}
 // ── Driver paths (bundled dev fallback + runtime download cache) ──────────────
 /**
  * Walk up from __dirname to find the package root (the directory containing
@@ -225,6 +274,44 @@ async function getDriversDir() {
     });
     return _driversDirPromise;
 }
+/**
+ * Absolute path to the injectable in-process control library
+ * (`<platform>-inproc/Conductor.framework/Conductor`), built by
+ * `packages/ios-inproc/tools/build-inproc-dylib.sh`. Passed to the target app
+ * via SIMCTL_CHILD_DYLD_INSERT_LIBRARIES at launch. iOS and tvOS ship separate
+ * builds (different simulator SDK).
+ */
+async function getInprocDylibPath(platform = 'ios') {
+    const dir = await getDriversDir();
+    return path_1.default.join(dir, `${platform}-inproc`, 'Conductor.framework', 'Conductor');
+}
+/**
+ * Absolute path to the host-side CoreSimulator HID injector (`ios-hid/conductor-hid`),
+ * built by `packages/ios-hid/tools/build-hid.sh`. Optional: only used for live
+ * held-touch drags when CONDUCTOR_IOS_HID=1 and the binary is present. Returns
+ * null if it hasn't been built.
+ */
+async function getHidBinaryPath() {
+    const dir = await getDriversDir().catch(() => null);
+    if (!dir)
+        return null;
+    const p = path_1.default.join(dir, 'ios-hid', 'conductor-hid');
+    return fs_1.default.existsSync(p) ? p : null;
+}
+/**
+ * Absolute path to the host-side Simulator video capture binary
+ * (`ios-capture/conductor-capture`), built by
+ * `packages/ios-capture/tools/build-capture.sh`. Captures the framebuffer via
+ * SimulatorKit and serves a VideoToolbox H.264 Annex B stream. Returns null if
+ * it hasn't been built (streaming falls back to unavailable).
+ */
+async function getCaptureBinaryPath() {
+    const dir = await getDriversDir().catch(() => null);
+    if (!dir)
+        return null;
+    const p = path_1.default.join(dir, 'ios-capture', 'conductor-capture');
+    return fs_1.default.existsSync(p) ? p : null;
+}
 async function ensureDriversCache(pkgRoot) {
     const pkgJsonPath = path_1.default.join(pkgRoot, 'package.json');
     const pkg = JSON.parse(fs_1.default.readFileSync(pkgJsonPath, 'utf-8'));

package/dist/drivers/eval-compiler.js

@@ -0,0 +1,131 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compileEval = compileEval;
+/**
+ * Compiles user Swift into a fresh dylib exporting `conductor_eval`, then drops
+ * it into the target app's container so the injected library can dlopen it.
+ *
+ * `expr` mode wraps an expression; `full` mode takes the whole function body.
+ * Each build is a uniquely-named dylib to avoid dlopen caching.
+ */
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const crypto_1 = __importDefault(require("crypto"));
+const promises_1 = __importDefault(require("fs/promises"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const run = (0, util_1.promisify)(child_process_1.execFile);
+const EXPR_TEMPLATE = (code) => `import Foundation
+import UIKit
+import SwiftUI
+
+@_cdecl("conductor_eval")
+public func conductor_eval() -> UnsafePointer<CChar> {
+    let __result: Any = {
+${code}
+    }()
+    return UnsafePointer(strdup(String(describing: __result))!)
+}
+`;
+const FULL_TEMPLATE = (code) => `import Foundation
+import UIKit
+import SwiftUI
+
+@_cdecl("conductor_eval")
+public func conductor_eval() -> UnsafePointer<CChar> {
+${code}
+}
+`;
+async function detectTarget(platform) {
+    const sdkName = platform === 'tvos' ? 'appletvsimulator' : 'iphonesimulator';
+    const sdkPlatform = platform === 'tvos' ? 'tvos' : 'ios';
+    const [{ stdout: sdkPath }, { stdout: sdkVer }] = await Promise.all([
+        run('xcrun', ['--sdk', sdkName, '--show-sdk-path']),
+        run('xcrun', ['--sdk', sdkName, '--show-sdk-version']),
+    ]);
+    const major = sdkVer.trim().split('.')[0];
+    const arch = os_1.default.arch() === 'arm64' ? 'arm64' : 'x86_64';
+    return {
+        sdkName,
+        sdkPath: sdkPath.trim(),
+        target: `${arch}-apple-${sdkPlatform}${major}.0-simulator`,
+    };
+}
+/**
+ * Compile `code` and place the dylib inside the app container's tmp so the
+ * sandboxed app can dlopen it. Returns the container-relative host path (which,
+ * on the simulator, is the same path the app opens).
+ */
+async function compileEval(code, mode, platform, deviceId, bundleId) {
+    const start = Date.now();
+    const { sdkName, sdkPath, target } = await detectTarget(platform);
+    const source = (mode === 'full' ? FULL_TEMPLATE : EXPR_TEMPLATE)(code);
+    const hash = crypto_1.default.createHash('md5').update(source).digest('hex').slice(0, 10);
+    const workDir = path_1.default.join(os_1.default.tmpdir(), 'conductor-eval');
+    await promises_1.default.mkdir(workDir, { recursive: true });
+    const swiftFile = path_1.default.join(workDir, `eval_${hash}.swift`);
+    const dylibName = `eval_${hash}_${Date.now()}.dylib`;
+    const dylibPath = path_1.default.join(workDir, dylibName);
+    await promises_1.default.writeFile(swiftFile, source, 'utf-8');
+    try {
+        await run('xcrun', [
+            '-sdk',
+            sdkName,
+            'swiftc',
+            '-target',
+            target,
+            '-sdk',
+            sdkPath,
+            '-emit-library',
+            '-Onone',
+            '-enable-testing',
+            '-o',
+            dylibPath,
+            // Unresolved symbols (app/system) resolve at dlopen time in the host process.
+            '-Xlinker',
+            '-undefined',
+            '-Xlinker',
+            'dynamic_lookup',
+            swiftFile,
+        ]);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            error: `compile failed:\n${err.stderr ?? String(err)}`,
+        };
+    }
+    // Ad-hoc sign (sim rejects unsigned dylibs for dlopen on newer runtimes).
+    await run('codesign', ['--force', '--sign', '-', dylibPath]).catch(() => { });
+    // Copy into the app's data container tmp so the sandboxed app can read it.
+    try {
+        const { stdout } = await run('xcrun', [
+            'simctl',
+            'get_app_container',
+            deviceId,
+            bundleId,
+            'data',
+        ]);
+        const container = stdout.trim();
+        // System apps (and any without a data container) print "(null)"; use the raw
+        // path there — simulator apps are host processes and can dlopen it directly.
+        if (!container.startsWith('/'))
+            throw new Error('no data container');
+        const containerTmp = path_1.default.join(container, 'tmp');
+        await promises_1.default.mkdir(containerTmp, { recursive: true });
+        const dest = path_1.default.join(containerTmp, dylibName);
+        await promises_1.default.copyFile(dylibPath, dest);
+        return { ok: true, dylibPath: dest, info: `compiled in ${Date.now() - start}ms` };
+    }
+    catch {
+        // Fall back to the raw temp path — simulator apps can usually open it directly.
+        return {
+            ok: true,
+            dylibPath,
+            info: `compiled in ${Date.now() - start}ms (container copy skipped)`,
+        };
+    }
+}

package/dist/drivers/ios-hid.js

@@ -0,0 +1,95 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IOSHidClient = void 0;
+/**
+ * Node client for the host-side CoreSimulator HID injector
+ * (`packages/ios-hid`, built to `drivers/ios-hid/conductor-hid`).
+ *
+ * This is the streaming pointer backend: unlike XCUITest's atomic
+ * `_XCT_synthesizeEvent`, it holds a touch DOWN and streams moves, so a live
+ * drag animates on-device as the finger moves. Opt-in (CONDUCTOR_IOS_HID=1) and
+ * single-touch — multitouch/discrete gestures stay on the XCUITest path.
+ *
+ * Talks newline-delimited JSON over the binary's stdio, one request in flight
+ * at a time (FIFO correlation, mirroring the XCTest driver's simplicity).
+ */
+const child_process_1 = require("child_process");
+const readline_1 = __importDefault(require("readline"));
+const PHASE_TO_TYPE = {
+    down: 0,
+    move: 1,
+    up: 2,
+    cancel: 2, // release the held touch
+};
+class IOSHidClient {
+    constructor(binaryPath, udid) {
+        this.binaryPath = binaryPath;
+        this.udid = udid;
+        this.proc = null;
+        this.rl = null;
+        this.pending = [];
+    }
+    start() {
+        if (this.proc)
+            return;
+        this.proc = (0, child_process_1.spawn)(this.binaryPath, [], { stdio: ['pipe', 'pipe', 'inherit'] });
+        this.rl = readline_1.default.createInterface({ input: this.proc.stdout });
+        this.rl.on('line', (line) => {
+            const resolve = this.pending.shift();
+            if (!resolve)
+                return;
+            try {
+                resolve(JSON.parse(line));
+            }
+            catch {
+                resolve({ ok: false, error: `bad response: ${line}` });
+            }
+        });
+        this.proc.on('exit', () => {
+            this.proc = null;
+            this.rl = null;
+            // Fail any in-flight requests so callers don't hang.
+            while (this.pending.length)
+                this.pending.shift()({ ok: false, error: 'hid process exited' });
+        });
+    }
+    stop() {
+        this.proc?.kill();
+        this.proc = null;
+        this.rl = null;
+    }
+    send(req) {
+        if (!this.proc)
+            this.start();
+        return new Promise((resolve) => {
+            this.pending.push(resolve);
+            this.proc.stdin.write(JSON.stringify(req) + '\n');
+        });
+    }
+    async ping() {
+        const r = await this.send({ cmd: 'ping' });
+        return r.ok;
+    }
+    /** Inject a touch phase at normalized coords. */
+    async touch(nx, ny, phase) {
+        const r = await this.send({
+            cmd: 'touch',
+            udid: this.udid,
+            x: nx,
+            y: ny,
+            type: PHASE_TO_TYPE[phase],
+        });
+        if (!r.ok)
+            throw new Error(`hid touch failed (rc=${r.rc ?? '?'}) ${r.error ?? ''}`.trim());
+    }
+    /** Adapter for the router's live-pointer path (single finger; id ignored). */
+    asLivePointer() {
+        return {
+            pointer: (_id, phase, nx, ny) => this.touch(nx, ny, phase),
+        };
+    }
+}
+exports.IOSHidClient = IOSHidClient;

package/dist/drivers/ios-inproc.js

@@ -0,0 +1,198 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InprocClient = void 0;
+exports.getInprocPort = getInprocPort;
+/**
+ * Client + port allocation for the injected in-process control library
+ * (`packages/ios-inproc`). This is a second inspection plane that runs *inside*
+ * the target app — distinct from the external XCUITest driver in `ios.ts`.
+ *
+ * The dylib is injected at launch (see IOSDriver.launchApp `inject` option). The
+ * CLI allocates a loopback port per device, hands it to the app via
+ * SIMCTL_CHILD_CONDUCTOR_INPROC_PORT, and connects here. Simulator apps share
+ * the host loopback, so 127.0.0.1:<port> reaches the in-process server — the same
+ * mechanism the XCUITest driver uses on :1075.
+ */
+const http_1 = __importDefault(require("http"));
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const INPROC_BASE_PORT = 6075;
+const PORT_FILE = path_1.default.join(os_1.default.homedir(), '.conductor', 'inproc-ports.json');
+function readState() {
+    try {
+        return JSON.parse(fs_1.default.readFileSync(PORT_FILE, 'utf-8'));
+    }
+    catch {
+        return { assignments: {}, nextPort: INPROC_BASE_PORT };
+    }
+}
+/**
+ * Deterministic in-process control port for a device. Stable across calls so
+ * the launcher and any later `native-*` command agree without a discovery file.
+ */
+function getInprocPort(deviceId) {
+    const state = readState();
+    const existing = state.assignments[deviceId];
+    if (existing !== undefined)
+        return existing;
+    const port = state.nextPort;
+    state.assignments[deviceId] = port;
+    state.nextPort = port + 1;
+    fs_1.default.mkdirSync(path_1.default.dirname(PORT_FILE), { recursive: true });
+    fs_1.default.writeFileSync(PORT_FILE, JSON.stringify(state, null, 2));
+    return port;
+}
+/** HTTP/JSON client for the in-process control server. */
+class InprocClient {
+    constructor(port, host = '127.0.0.1') {
+        this.port = port;
+        this.host = host;
+    }
+    get(reqPath, timeoutMs = 5000) {
+        return new Promise((resolve, reject) => {
+            const req = http_1.default.request({ hostname: this.host, port: this.port, path: reqPath, method: 'GET' }, (res) => {
+                const chunks = [];
+                res.on('data', (c) => chunks.push(c));
+                res.on('end', () => {
+                    try {
+                        resolve(JSON.parse(Buffer.concat(chunks).toString('utf-8')));
+                    }
+                    catch (err) {
+                        reject(err);
+                    }
+                });
+                res.on('error', reject);
+            });
+            req.setTimeout(timeoutMs, () => req.destroy(new Error('in-proc request timed out')));
+            req.on('error', reject);
+            req.end();
+        });
+    }
+    ping(timeoutMs = 5000) {
+        return this.get('/ping', timeoutMs);
+    }
+    /** Full native view hierarchy with colors, fonts, text, and layer visuals. */
+    inspect(timeoutMs = 15000) {
+        return this.get('/inspect', timeoutMs);
+    }
+    /** Navigation / view-controller hierarchy (stacks, tabs, presented, titles). */
+    nav(timeoutMs = 15000) {
+        return this.get('/nav', timeoutMs);
+    }
+    /** Full property detail for one view (by id from inspect). */
+    view(id, timeoutMs = 8000) {
+        return this.get(`/view?id=${encodeURIComponent(id)}`, timeoutMs);
+    }
+    /** Live-set a whitelisted property on a view (alpha, backgroundColor, text, frame, …). */
+    set(id, key, value, timeoutMs = 8000) {
+        const q = `id=${encodeURIComponent(id)}&key=${encodeURIComponent(key)}&value=${encodeURIComponent(value)}`;
+        return this.get(`/set?${q}`, timeoutMs);
+    }
+    /** React Native Fabric props: typed ViewProps + the raw JS prop bag. */
+    props(id, timeoutMs = 8000) {
+        return this.get(`/props?id=${encodeURIComponent(id)}`, timeoutMs);
+    }
+    /** Auto Layout constraints affecting a view + ambiguity flag. */
+    constraints(id, timeoutMs = 8000) {
+        return this.get(`/constraints?id=${encodeURIComponent(id)}`, timeoutMs);
+    }
+    /** Topmost view at a window point, plus its ancestor chain. */
+    hittest(x, y, timeoutMs = 8000) {
+        return this.get(`/hittest?x=${x}&y=${y}`, timeoutMs);
+    }
+    /** Flash a highlight overlay over a view on the device. */
+    highlight(id, timeoutMs = 8000) {
+        return this.get(`/highlight?id=${encodeURIComponent(id)}`, timeoutMs);
+    }
+    /** Search views by class-name substring and/or text substring. */
+    find(q, timeoutMs = 10000) {
+        const parts = [];
+        if (q.className)
+            parts.push(`class=${encodeURIComponent(q.className)}`);
+        if (q.text)
+            parts.push(`text=${encodeURIComponent(q.text)}`);
+        return this.get(`/find?${parts.join('&')}`, timeoutMs);
+    }
+    /** PNG of the whole key window. */
+    screenshot(timeoutMs = 20000) {
+        return this.getBuffer('/screenshot', timeoutMs);
+    }
+    /**
+     * PNG of a single view in isolation — the texture for a 3D exploded-layer
+     * viewer. Default (`includeSubviews=false`) captures only this view's own
+     * content, so each node is a distinct transparent layer plane.
+     */
+    snapshot(id, includeSubviews = false, timeoutMs = 15000) {
+        const q = `id=${encodeURIComponent(id)}&subviews=${includeSubviews ? 'true' : 'false'}`;
+        return this.getBuffer(`/snapshot?${q}`, timeoutMs);
+    }
+    /**
+     * PNG crop of a window-absolute rect (use a node's `absFrame` from inspect).
+     * Composites whatever is drawn there — works for UIImageView, RN Fabric, etc.
+     */
+    image(frame, timeoutMs = 15000) {
+        return this.getBuffer(`/image?frame=${frame.x},${frame.y},${frame.w},${frame.h}`, timeoutMs);
+    }
+    /** Raw GET to any endpoint, parsed as JSON. */
+    rawJson(reqPath, timeoutMs = 15000) {
+        const path = reqPath.startsWith('/') ? reqPath : `/${reqPath}`;
+        return this.get(path, timeoutMs);
+    }
+    /** Raw GET to any endpoint — returns the content-type and bytes (json or image). */
+    rawRequest(reqPath, timeoutMs = 20000) {
+        const path = reqPath.startsWith('/') ? reqPath : `/${reqPath}`;
+        return new Promise((resolve, reject) => {
+            const req = http_1.default.request({ hostname: this.host, port: this.port, path, method: 'GET' }, (res) => {
+                const chunks = [];
+                res.on('data', (c) => chunks.push(c));
+                res.on('end', () => resolve({ contentType: res.headers['content-type'] ?? '', body: Buffer.concat(chunks) }));
+                res.on('error', reject);
+            });
+            req.setTimeout(timeoutMs, () => req.destroy(new Error('in-proc request timed out')));
+            req.on('error', reject);
+            req.end();
+        });
+    }
+    getBuffer(reqPath, timeoutMs) {
+        return new Promise((resolve, reject) => {
+            const req = http_1.default.request({ hostname: this.host, port: this.port, path: reqPath, method: 'GET' }, (res) => {
+                const chunks = [];
+                res.on('data', (c) => chunks.push(c));
+                res.on('end', () => {
+                    const buf = Buffer.concat(chunks);
+                    const type = res.headers['content-type'] ?? '';
+                    if (!type.startsWith('image/')) {
+                        reject(new Error(`expected an image, got: ${buf.toString('utf-8').slice(0, 200)}`));
+                        return;
+                    }
+                    resolve(buf);
+                });
+                res.on('error', reject);
+            });
+            req.setTimeout(timeoutMs, () => req.destroy(new Error('in-proc image request timed out')));
+            req.on('error', reject);
+            req.end();
+        });
+    }
+    /** True once the in-process server answers a ping (poll after an injected launch). */
+    async waitUntilReady(timeoutMs = 10000) {
+        const deadline = Date.now() + timeoutMs;
+        while (Date.now() < deadline) {
+            try {
+                const res = await this.ping(1500);
+                if (res.status === 'ok')
+                    return true;
+            }
+            catch {
+                /* not up yet */
+            }
+            await new Promise((r) => setTimeout(r, 300));
+        }
+        return false;
+    }
+}
+exports.InprocClient = InprocClient;

package/dist/drivers/ios.js

@@ -89,14 +89,35 @@ class IOSDriver {
     invalidateHierarchyCache() {
         this.hierarchyCache = null;
     }
-    simctl(args) {
+    simctl(args, childEnv) {
         const _id = this.requireDeviceId();
         return new Promise((resolve, reject) => {
-            const proc = (0, child_process_1.spawn)('xcrun', ['simctl', ...args], { stdio: 'ignore' });
+            const proc = (0, child_process_1.spawn)('xcrun', ['simctl', ...args], {
+                stdio: 'ignore',
+                env: childEnv ? this.launchEnv(childEnv) : undefined,
+            });
             proc.on('close', (code) => code === 0 ? resolve() : reject(new Error(`xcrun simctl ${args[0]} failed (exit ${code})`)));
             proc.on('error', reject);
         });
     }
+    /**
+     * Build the env for a `simctl launch` that must forward vars into the target
+     * app. `simctl` copies `SIMCTL_CHILD_*` vars into the app's real environment at
+     * exec() — the only path dyld honours for restricted vars like
+     * DYLD_INSERT_LIBRARIES. Inherited SIMCTL_CHILD_* are stripped first so stale
+     * values (from a parent shell) can't override ours and silently break injection.
+     */
+    launchEnv(childEnv) {
+        const env = { ...process.env };
+        for (const key of Object.keys(env)) {
+            if (key.startsWith('SIMCTL_CHILD_'))
+                delete env[key];
+        }
+        for (const [key, value] of Object.entries(childEnv)) {
+            env[`SIMCTL_CHILD_${key}`] = value;
+        }
+        return env;
+    }
     simctlCapture(args) {
         this.requireDeviceId();
         return new Promise((resolve, reject) => {
@@ -167,15 +188,25 @@ class IOSDriver {
         });
         this.invalidateHierarchyCache();
     }
-    async launchApp(bundleId, args) {
-        if (args && Object.keys(args).length > 0) {
+    async launchApp(bundleId, args, inject) {
+        const argPairs = [];
+        for (const [key, value] of Object.entries(args ?? {})) {
+            argPairs.push(`-${key}`, value);
+        }
+        if (inject) {
+            // Injection requires simctl launch with SIMCTL_CHILD_ env — the XCTest
+            // /launchApp path only activates and can't set environment.
+            const deviceId = this.requireDeviceId();
+            await this.simctl(['terminate', deviceId, bundleId]).catch(() => { });
+            await this.simctl(['launch', '--terminate-running-process', deviceId, bundleId, ...argPairs], {
+                DYLD_INSERT_LIBRARIES: inject.dylibPath,
+                CONDUCTOR_INPROC_PORT: String(inject.inprocPort),
+            });
+        }
+        else if (argPairs.length > 0) {
             const deviceId = this.requireDeviceId();
             // xctest /launchApp doesn't support launch args — use simctl
             await this.simctl(['terminate', deviceId, bundleId]).catch(() => { });
-            const argPairs = [];
-            for (const [key, value] of Object.entries(args)) {
-                argPairs.push(`-${key}`, value);
-            }
             await this.simctl(['launch', '--terminate-running-process', deviceId, bundleId, ...argPairs]);
         }
         else {