@mgcrea/mcp-ios-simulator 0.2.1 → 0.3.1

package/dist/{config-D-Zn0z5X.js → config-D0JgmT_U.js}

@@ -1,8 +1,8 @@
 import { McpServer } from "@modelcontextprotocol/server";
 import { readFileSync } from "node:fs";
-import { CommandError, CommandTimeoutError, IosError, IosError as IosError$1, ToolchainError, WdaClient, WdaError, WdaUnavailableError, assertNoShellMetachars, createArgs, createExec, registerInputTools, registerScreenTools, wrap } from "@mgcrea/mcp-ios-core";
-import { dirname, join } from "node:path";
-import { mkdir, mkdtemp, open, readFile, rm, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { CommandError, CommandTimeoutError, DEFAULT_CRASH_KINDS, IosError, IosError as IosError$1, ToolchainError, WdaClient, WdaError, WdaUnavailableError, assertNoShellMetachars, crashKind, crashProcessName, createArgs, createExec, readLogFile, registerInputTools, registerScreenTools, summarizeCrashReport, wrap } from "@mgcrea/mcp-ios-core";
+import { mkdir, mkdtemp, open, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import { z } from "zod";
 import { spawn } from "node:child_process";
@@ -23,8 +23,8 @@ const pkg = readPackageJson();
 const BUILD_INFO = {
 	name: pkg.name,
 	version: pkg.version,
-	gitCommit: "98deba7",
-	gitCommitDate: "2026-09-26T14:53:12+02:00"
+	gitCommit: "b6a6636",
+	gitCommitDate: "2026-10-08T23:42:11+02:00"
 };
 //#endregion
 //#region src/client/errors.ts
@@ -206,6 +206,52 @@ const toDisplayInfo = (profile, capture) => {
 	};
 };
 //#endregion
+//#region src/client/logs.ts
+const defaultProcessAlive = (pid) => {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (err) {
+		return err.code === "EPERM";
+	}
+};
+var LaunchCaptures = class {
+	alive;
+	captures = /* @__PURE__ */ new Map();
+	latest;
+	constructor(alive = defaultProcessAlive) {
+		this.alive = alive;
+	}
+	key(udid, bundleId) {
+		return `${udid}\u0000${bundleId}`;
+	}
+	/**
+	* One capture per simulator and app. A relaunch replaces the record rather
+	* than adding a second, so a read never has to choose between two files of
+	* the same app — the older file stays on disk, it is just no longer "the" log.
+	*/
+	record(capture) {
+		this.captures.set(this.key(capture.udid, capture.bundleId), capture);
+		this.latest = capture;
+	}
+	find(udid, bundleId) {
+		if (udid && bundleId) return this.captures.get(this.key(udid, bundleId));
+		const all = [...this.captures.values()].filter((c) => (!udid || c.udid === udid) && (!bundleId || c.bundleId === bundleId));
+		if (all.length === 0) return void 0;
+		return this.latest && all.includes(this.latest) ? this.latest : all.toSorted((a, b) => b.startedAt.localeCompare(a.startedAt))[0];
+	}
+	/**
+	* Whether the app is still writing. A pid can be reused once the app exits,
+	* and that is accepted: the cost of a false "running" is only that a final
+	* half-written line waits for the next read.
+	*/
+	running(capture) {
+		return capture.pid !== void 0 && this.alive(capture.pid);
+	}
+};
+/** True when `path` exists on this Mac. */
+const exists = async (path) => stat(path).then(() => true, () => false);
+//#endregion
 //#region src/client/shape.ts
 /**
 * Flatten the runtime-keyed map `list devices` returns.
@@ -228,7 +274,8 @@ const summarizeDevices = (devices, runtimes, deviceTypes) => {
 		deviceTypeIdentifier: sim.deviceTypeIdentifier,
 		available: sim.isAvailable !== false,
 		...sim.availabilityError ? { unavailableReason: sim.availabilityError } : {},
-		...sim.lastBootedAt ? { lastBootedAt: sim.lastBootedAt } : {}
+		...sim.lastBootedAt ? { lastBootedAt: sim.lastBootedAt } : {},
+		...sim.dataPath ? { dataPath: sim.dataPath } : {}
 	})));
 };
 /** `file:///Users/…/Foo.app/` → `/Users/…/Foo.app`, which is what a person can use. */
@@ -291,6 +338,7 @@ const remedyFor = (stderr) => {
 	if (text.includes("unable to lookup in current state: shutdown")) return "The simulator is shut down. Boot it with ios_simulator_power {\"state\":\"booted\"}.";
 	if (text.includes("current state: booted")) return "The simulator is already booted, which for most operations means there is nothing to do.";
 	if (text.includes("no such file or directory")) return "Check the path exists and is a `.app` **bundle directory** built for the simulator — an `.ipa` or a device build will not install, and reports exactly this.";
+	if (text.includes("the request to open")) return "Check the app is installed with ios_simulator_list_apps: a bundle id that is not there fails exactly like this, with nothing in the message saying so.";
 	if (text.includes("failed to initialize io ports")) return "The simulator's runtime is not installed, so CoreSimulator cannot service it. Install the runtime, or clear the orphans with `xcrun simctl delete unavailable`.";
 };
 /**
@@ -399,17 +447,24 @@ var Simctl = class {
 	/**
 	* Put a window on a booted simulator. A `boot` alone is headless.
 	*
-	* Xcode 27 ships no Simulator.app — the window belongs to DeviceHub, which
-	* answers `devices://device/<UDID>` — while Xcode 26 and earlier only have
-	* Simulator.app. Try the old app first, since on a Mac with both the one the
-	* user already has open is the one they expect; fall back to DeviceHub.
+	* Xcode 27 ships no Simulator.app — the window belongs to DeviceHub — while
+	* Xcode 26 and earlier only have Simulator.app. Try the old app first, since
+	* on a Mac with both the one the user already has open is the one they
+	* expect; fall back to DeviceHub.
+	*
+	* DeviceHub is opened by bundle id, never by URL. Measured on Xcode 27.0: no
+	* `devices://` form selects a device — `device/<UDID>`, a bare UDID and
+	* `simulator/<UDID>` all leave the window on whatever it showed — and a query
+	* form it did not recognise made DeviceHub quit, which shuts down every
+	* booted simulator on the Mac. So it cannot be told which device to show;
+	* the caller is told that instead.
 	*/
-	async openApp(openPath, udid) {
+	async openApp(openPath) {
 		try {
 			await this.exec(openPath, ["-a", "Simulator"], this.opts.timeoutMs);
 			return "Simulator";
 		} catch {
-			await this.exec(openPath, [`devices://device/${udid}`], this.opts.timeoutMs);
+			await this.exec(openPath, ["-b", "com.apple.dt.Devices"], this.opts.timeoutMs);
 			return "DeviceHub";
 		}
 	}
@@ -447,23 +502,55 @@ var Simctl = class {
 	* Launch, optionally replacing a running copy.
 	*
 	* Environment variables do not go on the command line: simctl reads them from
-	* its **own** environment under a `SIMCTL_CHILD_` prefix. `ExecImpl` pins a
-	* minimal environment on purpose, so a caller wanting them has to say so, and
-	* this is where that would be threaded through.
+	* its **own** environment under a `SIMCTL_CHILD_` prefix. `ExecImpl` takes
+	* argv and pins a minimal environment on purpose, so the variables reach
+	* simctl through `/usr/bin/env` as `SIMCTL_CHILD_NAME=value` argv entries in
+	* front of xcrun — still no shell, and still one argv entry per value. Names
+	* are checked here because `env` reads everything up to the first entry with
+	* no `=` as an assignment, so a name holding one would shift the command.
+	*
+	* `stdout` and `stderr` may be the same path, and that is how a log capture
+	* uses them: measured on Xcode 27.0 with an iOS 27.0 runtime, a probe app
+	* writing to `print`, to stderr and to `Logger` in turn left one file with all
+	* three interleaved in order, nothing overwritten. The redirect *appends* — a
+	* second launch into the same file kept the first one's lines — and where it
+	* lands is not always the path given; see `SimulatorClient.locateRedirect`.
 	*/
 	async launch(udid, bundleId, opts = {}) {
 		assertNotBulkTarget(udid);
-		const flags = [
-			...opts.terminateExisting ? ["--terminate-running-process"] : [],
-			...opts.stdout ? [`--stdout=${opts.stdout}`] : [],
-			...opts.stderr ? [`--stderr=${opts.stderr}`] : []
-		];
-		return this.run([
+		const argv = [
+			"simctl",
 			"launch",
-			...flags,
+			...[
+				...opts.terminateExisting ? ["--terminate-running-process"] : [],
+				...opts.stdout ? [`--stdout=${opts.stdout}`] : [],
+				...opts.stderr ? [`--stderr=${opts.stderr}`] : []
+			],
 			udid,
 			bundleId,
 			...opts.args ?? []
+		];
+		const env = Object.entries(opts.env ?? {});
+		if (env.length === 0) return this.run(argv.slice(1));
+		for (const [name] of env) if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) throw new IosError$1(`Refusing environment variable name "${name}".`, { remedy: "Use letters, digits and underscores only, e.g. OS_ACTIVITY_DT_MODE." });
+		this.opts.logger?.debug?.("simctl", ...argv.slice(1), `(env: ${env.map(([k]) => k).join(" ")})`);
+		const { stdout } = await this.exec(this.opts.envPath, [
+			...env.map(([name, value]) => `SIMCTL_CHILD_${name}=${value}`),
+			this.opts.xcrunPath,
+			...argv
+		], this.opts.timeoutMs);
+		return stdout;
+	}
+	/**
+	* Remove an app and its data container. Irreversible, which is why the tool
+	* in front of this takes `confirm`.
+	*/
+	async uninstall(udid, bundleId) {
+		assertNotBulkTarget(udid);
+		await this.run([
+			"uninstall",
+			udid,
+			bundleId
 		]);
 	}
 	async terminate(udid, bundleId) {
@@ -638,6 +725,7 @@ var SimulatorClient = class {
 	plutilPath;
 	openPath;
 	execTimeoutMs;
+	captures;
 	opts;
 	wdaClients = /* @__PURE__ */ new Map();
 	/** `simctl list` is ~80ms and most tools want it twice; 2s collapses that. */
@@ -653,9 +741,11 @@ var SimulatorClient = class {
 		this.plutilPath = opts.plutilPath;
 		this.openPath = opts.openPath;
 		this.execTimeoutMs = opts.execTimeoutMs;
+		this.captures = new LaunchCaptures(opts.processAlive);
 		this.simctl = new Simctl({
 			xcrunPath: opts.xcrunPath,
 			plutilPath: opts.plutilPath,
+			envPath: opts.envPath ?? "/usr/bin/env",
 			timeoutMs: opts.execTimeoutMs,
 			...opts.exec ? { exec: opts.exec } : {},
 			...opts.logger ? { logger: opts.logger } : {}
@@ -750,6 +840,41 @@ var SimulatorClient = class {
 		const capture = capturePng ? pngDimensions(Buffer.from(capturePng, "base64")) : void 0;
 		return toDisplayInfo(profile, capture);
 	}
+	/**
+	* Where a `simctl launch --stdout/--stderr` file actually landed.
+	*
+	* Not necessarily where it was asked to. The redirect is opened by the
+	* simulator's own launchd, which sees the simulator's filesystem, and that
+	* has its own `/tmp` and `/var/folders`. Measured on an iOS 27.0 runtime:
+	* `--stdout=/tmp/x/a.out` created `<dataPath>/tmp/x/a.out`, and a path under
+	* `/var/folders/…/T` — which is where `os.tmpdir()`, and so this server's
+	* default output directory, points — landed under `<dataPath>/var/folders/…`,
+	* the `/private` prefix of either making no difference. A path under `/Users`
+	* was written exactly where it said, missing directories created.
+	*
+	* Rather than encode which prefixes are remapped, which is a property of a
+	* runtime and can change with the next one, this looks: the path as given
+	* first, then the same path under the simulator's data root. Neither existing
+	* means the redirect went somewhere unforeseen, and the path as given is
+	* returned with `found: false` so the caller can say so.
+	*/
+	async locateRedirect(target, path) {
+		if (await exists(path)) return {
+			path,
+			found: true
+		};
+		if (target.dataPath) {
+			const inside = join(target.dataPath, path.replace(/^\/private(?=\/)/, ""));
+			if (await exists(inside)) return {
+				path: inside,
+				found: true
+			};
+		}
+		return {
+			path,
+			found: false
+		};
+	}
 	/** The capture lane that needs no runner — the whole reason this server is cheap to start. */
 	async screenshotPng(target) {
 		this.requireBooted(target);
@@ -821,6 +946,25 @@ const { bundleIdArg, confirmArg, detailArg, screenshotArg, settleArg, xArg, yArg
 const deviceArg = args.targetArg;
 //#endregion
 //#region src/tools/apps.ts
+/** `io.mgcrea.Canopy: 12345` is the whole of what `simctl launch` prints. */
+const parsePid = (output) => {
+	const pid = /:\s*(\d+)\s*$/.exec(output.trim())?.[1];
+	return pid ? Number(pid) : void 0;
+};
+const NOT_FOUND_WARNING = "The log file is neither where it was asked for nor under the simulator's data directory. Set IOS_SIMULATOR_OUTPUT_DIR to a directory under your home folder, which the simulator writes to as-is.";
+/**
+* Find the redirect, giving the simulator a moment to create it. `simctl
+* launch` returns once the app is spawned, and the file is opened as part of
+* that spawn, so the first look nearly always finds it; the retries only cover
+* a slow spawn rather than a known race.
+*/
+const locate = async (client, target, path) => {
+	for (let attempt = 0;; attempt += 1) {
+		const found = await client.locateRedirect(target, path);
+		if (found.found || attempt >= 4) return found;
+		await new Promise((resolve) => setTimeout(resolve, 100));
+	}
+};
 const registerListAppsTool = (server, client) => {
 	server.registerTool("ios_simulator_list_apps", {
 		title: "iOS Simulator: List Apps",
@@ -860,39 +1004,95 @@ const registerAppTools = (server, client, launchArgs, outputDir) => {
 	}));
 	server.registerTool("ios_simulator_launch", {
 		title: "iOS Simulator: Launch",
-		description: "Launch an installed app. Pass `arguments` to put it into a fixture or demo mode — that is what IOS_SIMULATOR_LAUNCH_ARGS sets as the default for every launch that does not override it. Standard output and error are captured to files under the output directory, so an app that dies on launch leaves something readable behind.",
+		description: "Launch an installed app. Pass `arguments` to put it into a fixture or demo mode — that is what IOS_SIMULATOR_LAUNCH_ARGS sets as the default for every launch that does not override it. Standard output and error are captured to files under the output directory, so an app that dies on launch leaves something readable behind. Pass `capture_logs: true` to also get its Logger/os_log output, in one file read with ios_simulator_read_logs.",
 		inputSchema: z.object({
 			device: deviceArg,
 			bundle_id: bundleIdArg,
 			arguments: z.array(z.string()).optional().describe("Launch arguments, e.g. [\"-DemoMode\", \"YES\"]. Overrides IOS_SIMULATOR_LAUNCH_ARGS rather than adding to it."),
-			terminate_first: z.boolean().default(true).describe("Replace a running copy rather than attaching to it. On by default so a launch means a fresh process and a predictable first screen.")
+			terminate_first: z.boolean().default(true).describe("Replace a running copy rather than attaching to it. On by default so a launch means a fresh process and a predictable first screen."),
+			capture_logs: z.boolean().default(false).describe("Write stdout, stderr and every Logger/os_log message to one fresh file, for ios_simulator_read_logs. Sets OS_ACTIVITY_DT_MODE=YES in the app's environment, which is what Xcode sets to mirror unified logging onto stderr; without it an app's Logger output reaches no file at all.")
 		}),
 		annotations: {
 			readOnlyHint: false,
 			destructiveHint: false,
 			idempotentHint: false
 		}
-	}, async ({ device, bundle_id, arguments: args, terminate_first }) => wrap(async () => {
+	}, async ({ device, bundle_id, arguments: args, terminate_first, capture_logs }) => wrap(async () => {
 		const target = client.requireBooted(await client.resolveTarget(device));
 		const effective = args ?? launchArgs;
-		const stdout = `${outputDir}/${bundle_id}.out.log`;
-		const stderr = `${outputDir}/${bundle_id}.err.log`;
+		const said = {
+			...effective.length > 0 ? { arguments: effective } : {},
+			...args === void 0 && launchArgs.length > 0 ? { argumentsFrom: "IOS_SIMULATOR_LAUNCH_ARGS" } : {}
+		};
+		if (capture_logs) {
+			const stamp = (/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-");
+			const requested = join(outputDir, "logs", `${bundle_id}-${stamp}.log`);
+			const output = await client.simctl.launch(target.id, bundle_id, {
+				args: effective,
+				terminateExisting: terminate_first,
+				stdout: requested,
+				stderr: requested,
+				env: { OS_ACTIVITY_DT_MODE: "YES" }
+			});
+			const pid = parsePid(output);
+			const log = await locate(client, target, requested);
+			client.captures.record({
+				udid: target.id,
+				simulatorName: target.name,
+				bundleId: bundle_id,
+				path: log.path,
+				pid,
+				startedAt: (/* @__PURE__ */ new Date()).toISOString()
+			});
+			return {
+				launched: bundle_id,
+				...pid !== void 0 ? { pid } : {},
+				...said,
+				capturingLogs: true,
+				log: log.path,
+				...log.found ? {} : { warning: NOT_FOUND_WARNING }
+			};
+		}
+		const stdout = join(outputDir, `${bundle_id}.out.log`);
+		const stderr = join(outputDir, `${bundle_id}.err.log`);
 		const output = await client.simctl.launch(target.id, bundle_id, {
 			args: effective,
 			terminateExisting: terminate_first,
 			stdout,
 			stderr
 		});
-		const pid = /:\s*(\d+)\s*$/.exec(output.trim())?.[1];
+		const pid = parsePid(output);
+		const [out, err] = await Promise.all([locate(client, target, stdout), locate(client, target, stderr)]);
 		return {
 			launched: bundle_id,
-			...pid ? { pid: Number(pid) } : {},
-			...effective.length > 0 ? { arguments: effective } : {},
-			...args === void 0 && launchArgs.length > 0 ? { argumentsFrom: "IOS_SIMULATOR_LAUNCH_ARGS" } : {},
+			...pid !== void 0 ? { pid } : {},
+			...said,
 			logs: {
-				stdout,
-				stderr
-			}
+				stdout: out.path,
+				stderr: err.path
+			},
+			...out.found && err.found ? {} : { warning: NOT_FOUND_WARNING }
+		};
+	}));
+	server.registerTool("ios_simulator_uninstall", {
+		title: "iOS Simulator: Uninstall",
+		description: "Remove an app from the simulator, **with its data container** — documents, databases and preferences all go, and nothing brings them back. To get back to a cold start while keeping the data, use ios_simulator_terminate. To test a genuine first launch of one app, this is narrower than ios_simulator_erase, which wipes every app on the simulator. Uninstalling an app that is not installed also succeeds, so success does not prove it was there.",
+		inputSchema: z.object({
+			device: deviceArg,
+			bundle_id: bundleIdArg,
+			confirm: z.literal(true).describe("Must be true. Explicit acknowledgement that the app's data is deleted.")
+		}),
+		annotations: {
+			readOnlyHint: false,
+			destructiveHint: true,
+			idempotentHint: true
+		}
+	}, async ({ device, bundle_id }) => wrap(async () => {
+		const target = client.requireBooted(await client.resolveTarget(device));
+		await client.simctl.uninstall(target.id, bundle_id);
+		return {
+			uninstalled: bundle_id,
+			udid: target.id
 		};
 	}));
 	server.registerTool("ios_simulator_terminate", {
@@ -1340,7 +1540,10 @@ const registerLifecycleTools = (server, client) => {
 		const already = target.state === "Booted";
 		if (!already) await client.simctl.boot(target.id);
 		let windowWarning;
-		if (open_window) await client.simctl.openApp(client.openPath, target.id).catch((err) => {
+		let windowNote;
+		if (open_window) await client.simctl.openApp(client.openPath).then((app) => {
+			if (app === "DeviceHub") windowNote = `Opened DeviceHub. It may still be showing another device: select ${target.name} in its sidebar to watch this one.`;
+		}).catch((err) => {
 			windowWarning = `Booted, but no window could be opened: ${err instanceof Error ? err.message : String(err)}`;
 		});
 		const deadline = Date.now() + wait_ms;
@@ -1355,12 +1558,13 @@ const registerLifecycleTools = (server, client) => {
 			name: target.name,
 			state: observed,
 			...already ? { alreadyThere: true } : {},
+			...windowNote ? { note: windowNote } : {},
 			...observed === "Booted" ? windowWarning ? { warning: windowWarning } : {} : { warning: `Still ${observed} after ${wait_ms}ms. Raise wait_ms, or check Xcode.` }
 		};
 	}));
 	server.registerTool("ios_simulator_erase", {
 		title: "iOS Simulator: Erase",
-		description: "Wipe a simulator back to a factory state: installed apps, their data, the keychain and every granted permission. The only irreversible tool here, and the reason it is the only one behind `confirm`. Use it to test a genuine first launch. A booted simulator is shut down first and booted again afterwards, because simctl refuses to erase a running one.",
+		description: "Wipe a simulator back to a factory state: installed apps, their data, the keychain and every granted permission. Irreversible, hence `confirm`; ios_simulator_uninstall is the narrower way to a first launch of one app. A booted simulator is shut down first and booted again afterwards, because simctl refuses to erase a running one.",
 		inputSchema: z.object({
 			device: deviceArg,
 			confirm: confirmArg
@@ -1385,6 +1589,247 @@ const registerLifecycleTools = (server, client) => {
 	}));
 };
 //#endregion
+//#region src/client/crash.ts
+/**
+* Simulator crash reports, out of this Mac's own DiagnosticReports.
+*
+* A simulator app is a Mac process, so when it crashes the Mac's ReportCrash
+* writes the `.ips` — into `~/Library/Logs/DiagnosticReports`, older ones under
+* `Retired/`, mixed in with every Mac app's and daemon's. On the machine this
+* was written against that was 593 `.ips` files, 464 of them from simulators,
+* and nearly all of those were the simulators' own daemons rather than an app
+* anyone was debugging.
+*
+* Telling the two apart, as measured on Xcode 27.0 with an iOS 27.0 runtime:
+*
+* - The header line's `platform` is the Mach-O platform of the crashed binary.
+*   Every simulator report had 7 (`PLATFORM_IOSSIMULATOR` in
+*   `<mach-o/loader.h>`) and every Mac report had 1, with no exceptions either
+*   way. That is one line of a few hundred bytes, so it is the filter.
+* - The header's `is_simulated` is **not** the marker, despite the name: it
+*   was set on 13 reports, every one a Mac process with platform 1 — Safari,
+*   Mail and two of their helpers.
+* - `procPath` does not say either: it is anonymised to `/Volumes/VOLUME/…` or
+*   `/Users/USER/…` with the middle starred out, so no device path survives.
+* - Which simulator is in the report body, as `coalitionName`:
+*   `com.apple.CoreSimulator.SimDevice.<UDID>`. Its key ended by byte 1,731 in
+*   every one of the 464, so reading the first `HEAD_BYTES` finds it without
+*   parsing reports that run to 80 KB.
+*/
+/** `PLATFORM_*SIMULATOR` in `<mach-o/loader.h>`: iOS, tvOS, watchOS, visionOS. Only 7 was seen. */
+const SIMULATOR_PLATFORMS = /* @__PURE__ */ new Set([
+	7,
+	8,
+	9,
+	12
+]);
+/** Enough for the header and the body's `coalitionName`, with room to spare. */
+const HEAD_BYTES = 8192;
+const COALITION = /"coalitionName"\s*:\s*"com\.apple\.CoreSimulator\.SimDevice\.([0-9A-Fa-f-]{36})"/;
+/** Opened at once. The directory holds hundreds of files; this keeps clear of EMFILE. */
+const CONCURRENCY = 32;
+const readHead = async (path) => {
+	const handle = await open(path, "r");
+	try {
+		const buffer = Buffer.alloc(HEAD_BYTES);
+		const { bytesRead } = await handle.read(buffer, 0, HEAD_BYTES, 0);
+		return buffer.subarray(0, bytesRead).toString("utf8");
+	} finally {
+		await handle.close();
+	}
+};
+const parseHeader = (text) => {
+	const newline = text.indexOf("\n");
+	try {
+		return JSON.parse(newline === -1 ? text : text.slice(0, newline));
+	} catch {
+		return;
+	}
+};
+/** `2026-10-08 23:28:26.00 +0200` → epoch ms, for ordering. File mtimes are not reliable here. */
+const timestampMs = (value) => {
+	const m = /^(\d{4}-\d{2}-\d{2}) (\d{2}:\d{2}:\d{2}(?:\.\d+)?) ([+-]\d{2})(\d{2})$/.exec(value ?? "");
+	return m ? Date.parse(`${m[1]}T${m[2]}${m[3]}:${m[4]}`) : 0;
+};
+const listIps = async (dir) => {
+	const top = await readdir(dir).catch((err) => {
+		if (err.code === "ENOENT") return [];
+		throw err;
+	});
+	const retired = await readdir(join(dir, "Retired")).catch(() => []);
+	return [...top.filter((name) => name.endsWith(".ips")), ...retired.filter((name) => name.endsWith(".ips")).map((name) => `Retired/${name}`)];
+};
+/**
+* Every simulator report in `dir`, newest first. Reads the first 8 KB of each
+* `.ips`, never the whole file, except to find the UDID in the rare report
+* whose `coalitionName` did not fit in that.
+*/
+const listSimulatorCrashReports = async (dir) => {
+	const names = await listIps(dir);
+	const rows = [];
+	for (let i = 0; i < names.length; i += CONCURRENCY) {
+		const batch = await Promise.all(names.slice(i, i + CONCURRENCY).map(async (name) => {
+			const path = join(dir, name);
+			const head = await readHead(path).catch(() => "");
+			const header = parseHeader(head);
+			if (!header || !SIMULATOR_PLATFORMS.has(Number(header.platform))) return void 0;
+			let udid = COALITION.exec(head)?.[1];
+			if (!udid) udid = COALITION.exec(await readFile(path, "utf8").catch(() => ""))?.[1];
+			return {
+				name,
+				process: header.app_name || header.name || crashProcessName(name),
+				bundleId: header.bundleID,
+				kind: crashKind(header.bug_type),
+				timestamp: header.timestamp,
+				udid: udid?.toUpperCase()
+			};
+		}));
+		for (const row of batch) if (row) rows.push(row);
+	}
+	return rows.toSorted((a, b) => timestampMs(b.timestamp) - timestampMs(a.timestamp));
+};
+/**
+* The absolute path of a report named by `ios_simulator_list_crash_logs`, or a
+* refusal. The schema already rejects `..` and absolute names; this is the
+* check that cannot be argued with, made on the resolved path.
+*/
+const crashReportPath = (dir, name) => {
+	const root = resolve(dir);
+	const path = resolve(root, name);
+	const rel = relative(root, path);
+	if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) throw new IosError$1(`"${name}" is not inside the crash reports directory.`, { remedy: "Pass a `name` exactly as ios_simulator_list_crash_logs returned it." });
+	return path;
+};
+/** Whether a report's header says it came from a simulator. */
+const isSimulatorReport = (text) => {
+	const header = parseHeader(text);
+	return header !== void 0 && SIMULATOR_PLATFORMS.has(Number(header.platform));
+};
+/** The simulator a full report came from, when its body says. */
+const reportUdid = (text) => COALITION.exec(text)?.[1]?.toUpperCase();
+//#endregion
+//#region src/tools/logs.ts
+/** UDID → name, for labelling reports. Best effort: a Mac with no Xcode still has reports. */
+const simulatorNames = async (client) => {
+	try {
+		return new Map((await client.listSimulators()).map((sim) => [sim.id.toUpperCase(), sim.name]));
+	} catch {
+		return /* @__PURE__ */ new Map();
+	}
+};
+/**
+* Crash reports: the half of "logs" that needs nothing launched. Observing, so
+* registered whatever the write gate says — reading a report changes nothing
+* on the simulator, the same way a screenshot does not.
+*/
+const registerCrashLogTools = (server, client, ctx) => {
+	const dir = ctx.config.crashReportsDir;
+	server.registerTool("ios_simulator_list_crash_logs", {
+		title: "iOS Simulator: List Crash Logs",
+		description: "List crash reports from simulator processes, newest first. A simulator app's crash is written by this Mac into ~/Library/Logs/DiagnosticReports alongside the Mac's own crashes; this keeps only the simulators' and says which simulator each came from. Most of them are the simulators' own system daemons, so pass `process` to find your app's. Read one with ios_simulator_get_crash_log. Nothing needs to be booted.",
+		inputSchema: z.object({
+			device: deviceArg.describe("Only reports from this simulator, by UDID or name as shown by ios_simulator_list. Omit for every simulator's — unlike the other tools, this does not default to the booted one, since a crash often outlives the boot it happened in."),
+			process: z.string().optional().describe("Case-insensitive substring of the process name or bundle id, e.g. \"Canopy\" or \"io.mgcrea\". The process name is the app's executable name, usually but not always its display name."),
+			kinds: z.array(z.string()).optional().describe("Report kinds to include, e.g. [\"crash\"]. Defaults to [\"crash\", \"jetsam\", \"user_fault\"]; kinds without a name come back as \"bug_type_<n>\". Pass [\"all\"] for everything."),
+			limit: z.number().int().min(1).max(200).default(20).describe("Maximum reports to return, newest first (1-200). Defaults to 20.")
+		}),
+		annotations: { readOnlyHint: true }
+	}, async ({ device, process, kinds, limit }) => wrap(async () => {
+		const target = device ? await client.resolveTarget(device) : void 0;
+		const wanted = kinds ?? DEFAULT_CRASH_KINDS;
+		const needle = process?.toLowerCase();
+		const matching = (await listSimulatorCrashReports(dir)).filter((report) => (!target || report.udid === target.id.toUpperCase()) && (wanted.includes("all") || wanted.includes(report.kind)) && (!needle || report.process.toLowerCase().includes(needle) || (report.bundleId?.toLowerCase().includes(needle) ?? false)));
+		const names = target ? void 0 : await simulatorNames(client);
+		return {
+			...target ? {
+				simulator: target.name,
+				udid: target.id
+			} : {},
+			reports: matching.slice(0, limit).map(({ udid, bundleId, ...row }) => ({
+				...row,
+				...bundleId ? { bundleId } : {},
+				...names && udid ? {
+					udid,
+					...names.get(udid) ? { simulator: names.get(udid) } : {}
+				} : {}
+			})),
+			total: matching.length
+		};
+	}));
+	server.registerTool("ios_simulator_get_crash_log", {
+		title: "iOS Simulator: Get Crash Log",
+		description: "Read one simulator crash report and return what matters in it: the exception, why the process was terminated, any application-specific message, and the faulting thread's top frames with library names resolved. The full report's path is returned too; it is often tens of kilobytes, so read it only when the summary is not enough. A Swift fatalError's message may not be in the report at all — on a simulator it goes to the app's stderr.",
+		inputSchema: z.object({ name: z.string().regex(/^[^/][^\0]*\.ips$/, "Pass a `name` exactly as ios_simulator_list_crash_logs returned it.").refine((value) => !value.split("/").includes(".."), "`name` cannot contain `..`.").describe("The report's `name` from ios_simulator_list_crash_logs, e.g. \"Canopy-2026-10-08-101500.ips\" or \"Retired/Canopy-2026-10-02-213409.ips\". Older reports move under Retired/, so a name that worked yesterday may need listing again.") }),
+		annotations: { readOnlyHint: true }
+	}, async ({ name }) => wrap(async () => {
+		const path = crashReportPath(dir, name);
+		let text;
+		try {
+			text = await readFile(path, "utf8");
+		} catch {
+			throw new IosError$1(`No crash report named ${name}.`, { remedy: "Run ios_simulator_list_crash_logs again: reports move to Retired/ as they age, and the system deletes old ones." });
+		}
+		if (!isSimulatorReport(text)) throw new IosError$1(`${name} is a crash report from this Mac, not from a simulator.`, { remedy: "Pick a report from ios_simulator_list_crash_logs, which lists only simulators'." });
+		const summary = summarizeCrashReport(text);
+		const udid = reportUdid(text);
+		const simulator = udid ? (await simulatorNames(client)).get(udid) : void 0;
+		const asi = summary.crash?.["applicationSpecificInfo"];
+		return {
+			name,
+			path,
+			...udid ? { udid } : {},
+			...simulator ? { simulator } : {},
+			...summary,
+			...summary.crash ? asi ? {} : { note: "The report carries no application-specific message. A Swift fatalError's text goes to the app's stderr on a simulator" + (ctx.allowWrites ? ", so relaunch with ios_simulator_launch `capture_logs: true` and read it with ios_simulator_read_logs." : ".") } : { note: "Not a crash report with a faulting thread; read the file at `path`." }
+		};
+	}));
+};
+/**
+* Reading an app's captured log. Registered with the launch tool it depends on,
+* behind the write gate: without `ios_simulator_launch` there is never anything
+* to read.
+*/
+const registerLogReadTools = (server, client) => {
+	server.registerTool("ios_simulator_read_logs", {
+		title: "iOS Simulator: Read Logs",
+		description: "Read an app's log output: stdout, stderr and every Logger/os_log message the process emits, interleaved in one file. Only available for an app started with ios_simulator_launch `capture_logs: true`. Returns the newest `limit` lines plus a `next` cursor; pass it back to get only what arrived since, which is how to see what one tap logged. `capturing` turns false once the app's process has exited, and what it wrote stays readable. A crash's backtrace is not in here — see ios_simulator_list_crash_logs — but its fatalError message is.",
+		inputSchema: z.object({
+			device: deviceArg,
+			bundle_id: z.string().optional().describe("Which app's capture, e.g. \"io.mgcrea.Canopy\". Defaults to the most recent capture."),
+			cursor: z.number().int().min(0).optional().describe("The `next` value from the previous read, to get only newer lines. Omit to read from the start of the capture."),
+			filter: z.string().optional().describe("Case-insensitive regular expression a line must match, e.g. \"error|fail\" or \"\\[Sync\\]\". Applied before `limit`, so it finds matches across the whole range."),
+			limit: z.number().int().min(1).max(2e3).default(200).describe("Most lines to return; the newest are kept and the rest counted in `omitted`. Defaults to 200 — filter rather than raising this.")
+		}),
+		annotations: { readOnlyHint: true }
+	}, async ({ device, bundle_id, cursor, filter, limit }) => wrap(async () => {
+		const target = device ? await client.resolveTarget(device) : void 0;
+		const capture = client.captures.find(target?.id, bundle_id);
+		if (!capture) throw new IosError$1(bundle_id ? `No log capture for ${bundle_id}.` : "No log capture has been started.", { remedy: "Launch the app with ios_simulator_launch {\"bundle_id\":\"…\",\"capture_logs\":true}. A capture belongs to this server process, so one started before it restarted is not known here, though its file is still under the output directory." });
+		const running = client.captures.running(capture);
+		let result;
+		try {
+			result = await readLogFile(capture.path, {
+				cursor,
+				filter,
+				limit,
+				complete: !running
+			});
+		} catch (err) {
+			if (err.code !== "ENOENT") throw err;
+			throw new IosError$1(`The log file for ${capture.bundleId} is gone: ${capture.path}`, { remedy: "Erasing the simulator deletes it when it was written under the simulator's data directory. Launch again with `capture_logs: true`." });
+		}
+		return {
+			bundleId: capture.bundleId,
+			simulator: capture.simulatorName,
+			capturing: running,
+			...capture.pid !== void 0 ? { pid: capture.pid } : {},
+			...result,
+			path: capture.path,
+			...result.skippedBytes > 0 ? { note: `${result.skippedBytes} bytes before this window were not read. Pass the returned \`next\` sooner, or read the file at \`path\`.` } : {}
+		};
+	}));
+};
+//#endregion
 //#region src/tools/runner.ts
 const defaultSpawnRunner = async (command, args, { env, logPath }) => {
 	await mkdir(dirname(logPath), { recursive: true });
@@ -1462,6 +1907,12 @@ const registerRunnerTools = (server, client, outputDir, spawnRunner = defaultSpa
 * refused, because a refusal still lets a model try, retry and reason about a
 * way around it.
 *
+* Reading logs splits across the line. Crash reports are files this Mac
+* already wrote, so listing and reading them is observing and survives the
+* gate. `ios_simulator_read_logs` is read-only too, but it only ever reads what
+* `ios_simulator_launch` started capturing, so it goes where launch goes — a
+* tool that can only answer "no capture" is noise in the list.
+*
 * The observe half is unusually capable here: `screenshot` goes through simctl,
 * so seeing the screen needs no WebDriverAgent and no setup of any kind. Only
 * `ui_tree` does, and that is a runtime fact reported by
@@ -1483,10 +1934,12 @@ const registerTools = (server, client, ctx, spawnRunner) => {
 	registerListTool(server, client);
 	registerListAppsTool(server, client);
 	registerScreenTools(server, shared);
+	registerCrashLogTools(server, client, ctx);
 	if (!ctx.allowWrites) return;
 	registerInputTools(server, shared);
 	registerLifecycleTools(server, client);
 	registerAppTools(server, client, ctx.config.launchArgs, ctx.config.outputDir);
+	registerLogReadTools(server, client);
 	registerEnvironmentTools(server, client);
 	registerRunnerTools(server, client, ctx.config.outputDir, spawnRunner);
 };
@@ -1495,9 +1948,10 @@ const registerTools = (server, client, ctx, spawnRunner) => {
 const SERVER_NAME = BUILD_INFO.name;
 const SERVER_VERSION = BUILD_INFO.version;
 /**
-* A pure factory. The injectable seams — `exec`, `fetch` and `spawnRunner` —
-* are the whole reason the test suite can drive real tools through the real SDK
-* with no simulator, no Xcode, no WebDriverAgent and no process left running.
+* A pure factory. The injectable seams — `exec`, `fetch`, `spawnRunner` and
+* `processAlive`, plus `crashReportsDir` in the config — are the whole reason
+* the test suite can drive real tools through the real SDK with no simulator,
+* no Xcode, no WebDriverAgent and no process left running.
 * Nothing below `config.ts` reads `process.env`.
 */
 const createServer = (opts) => {
@@ -1519,6 +1973,7 @@ const createServer = (opts) => {
 		...config.simulatorId ? { defaultSimulatorId: config.simulatorId } : {},
 		...opts.exec ? { exec: opts.exec } : {},
 		...opts.fetch ? { fetch: opts.fetch } : {},
+		...opts.processAlive ? { processAlive: opts.processAlive } : {},
 		...opts.logger ? { logger: opts.logger } : {}
 	});
 	registerTools(server, client, {
@@ -1564,14 +2019,24 @@ const ConfigSchema = z.object({
 	* **On by default**, which is the one place this server deliberately breaks
 	* the fleet convention. What makes the device server read-only is that a
 	* phone belongs to a real person; a simulator is disposable and holds
-	* nobody's data. `ios_simulator_erase` still requires an explicit `confirm`
-	* because it is the only irreversible tool here.
+	* nobody's data. `ios_simulator_erase` and `ios_simulator_uninstall` still
+	* require an explicit `confirm`, because they are the irreversible ones.
 	*/
 	allowWrites: z.boolean().default(true),
 	/** Applied by `launch` when the call passes no `arguments` of its own. */
 	launchArgs: z.array(z.string()).default([]),
-	/** Saved screenshots, launch logs and the runner log. */
+	/**
+	* Saved screenshots, launch logs and the runner log. A launch log is opened
+	* by the simulator rather than by this server, and a simulator has its own
+	* `/tmp` and `/var/folders` — under this default it lands in the
+	* simulator's data directory, and `launch` reports where it really is.
+	*/
 	outputDir: z.string().min(1).default(join(tmpdir(), "mcp-ios-simulator")),
+	/**
+	* Where this Mac's ReportCrash writes `.ips` files, simulator apps' included.
+	* Configurable for tests and for a report folder copied off another Mac.
+	*/
+	crashReportsDir: z.string().min(1).default(join(homedir(), "Library", "Logs", "DiagnosticReports")),
 	maxTreeBytes: z.number().int().min(1e3).max(5e5).default(24e3),
 	xcrunPath: z.string().min(1).default("/usr/bin/xcrun"),
 	sipsPath: z.string().min(1).default("/usr/bin/sips"),
@@ -1639,6 +2104,7 @@ const loadConfig = (env = process.env, configPath = defaultConfigPath(env)) => {
 		allowWrites: pick(parseBool(env.IOS_SIMULATOR_ALLOW_WRITES), "allowWrites"),
 		launchArgs: pick(parseArgs(env.IOS_SIMULATOR_LAUNCH_ARGS), "launchArgs"),
 		outputDir: pick(trimmed(env.IOS_SIMULATOR_OUTPUT_DIR), "outputDir"),
+		crashReportsDir: pick(trimmed(env.IOS_SIMULATOR_CRASH_REPORTS_DIR), "crashReportsDir"),
 		maxTreeBytes: pick(parseIntOpt(env.IOS_SIMULATOR_MAX_TREE_BYTES), "maxTreeBytes"),
 		xcrunPath: pick(trimmed(env.IOS_SIMULATOR_XCRUN_PATH), "xcrunPath"),
 		sipsPath: pick(trimmed(env.IOS_SIMULATOR_SIPS_PATH), "sipsPath"),
@@ -1649,4 +2115,4 @@ const loadConfig = (env = process.env, configPath = defaultConfigPath(env)) => {
 //#endregion
 export { WritesDisabledError as A, SimulatorNotBootedError as C, ToolchainError as D, TOOLCHAIN_REMEDY as E, wdaUnavailableRemedy as M, BUILD_INFO as N, WdaError as O, START_RUNNER_TOOL_REMEDY as S, TIMEOUT_REMEDY as T, CommandTimeoutError as _, createServer as a, RuntimeUnavailableError as b, assertNotBulkTarget as c, summarizeDevices as d, toListRow as f, CommandError as g, toDisplayInfo as h, SERVER_VERSION as i, startRunnerRemedy as j, WdaUnavailableError as k, parseSimctlError as l, readScreenProfile as m, loadConfig as n, SimulatorClient as o, pngDimensions as p, SERVER_NAME as r, Simctl as s, defaultConfigPath as t, summarizeApps as u, EMPTY_SCREENSHOT_REMEDY as v, SimulatorNotFoundError as w, START_RUNNER_SCRIPT_REMEDY as x, IosError$1 as y };
 
-//# sourceMappingURL=config-D-Zn0z5X.js.map
+//# sourceMappingURL=config-D0JgmT_U.js.map