@mgcrea/mcp-ios-simulator 0.2.2 → 0.4.0

package/dist/{config-qc0zwYZr.js → config-HmqayUrt.js}

@@ -1,13 +1,13 @@
 import { McpServer } from "@modelcontextprotocol/server";
-import { readFileSync } from "node:fs";
-import { CommandError, CommandTimeoutError, IosError, IosError as IosError$1, ToolchainError, WdaClient, WdaError, WdaUnavailableError, assertNoShellMetachars, createArgs, createExec, registerInputTools, registerScreenTools, wrap } from "@mgcrea/mcp-ios-core";
-import { dirname, join } from "node:path";
-import { mkdir, mkdtemp, open, readFile, rm, writeFile } from "node:fs/promises";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { CommandError, CommandTimeoutError, DEFAULT_CRASH_KINDS, IosError, IosError as IosError$1, ToolchainError, WdaClient, WdaError, WdaUnavailableError, assertNoShellMetachars, crashKind, crashProcessName, createArgs, createExec, readLogFile, registerInputTools, registerScreenTools, summarizeCrashReport, wrap } from "@mgcrea/mcp-ios-core";
+import { mkdir, mkdtemp, open, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import { z } from "zod";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
-//#region src/build-info.ts
+// src/build-info.ts
 const readPackageJson = () => {
 	try {
 		const pkgUrl = new URL("../package.json", import.meta.url);
@@ -23,11 +23,10 @@ const pkg = readPackageJson();
 const BUILD_INFO = {
 	name: pkg.name,
 	version: pkg.version,
-	gitCommit: "171096c",
-	gitCommitDate: "2026-09-26T17:16:08+02:00"
+	gitCommit: "5584c7c",
+	gitCommitDate: "2026-10-29T22:11:35+01:00"
 };
-//#endregion
-//#region src/client/errors.ts
+// src/client/errors.ts
 /** Raising the budget, or noticing the simulator died mid-call. */
 const TIMEOUT_REMEDY = "Raise IOS_SIMULATOR_TIMEOUT_MS if this is a slow operation (a boot or a large `install` genuinely takes tens of seconds), or check the simulator is still booted.";
 const TOOLCHAIN_REMEDY = "Install Xcode and run `xcode-select --install`, or point IOS_SIMULATOR_XCRUN_PATH at a different xcrun.";
@@ -99,8 +98,7 @@ var WritesDisabledError = class extends IosError {
 };
 /** A shut-down simulator captures nothing, and that is the usual cause here. */
 const EMPTY_SCREENSHOT_REMEDY = "The simulator produced an empty capture. Check it is actually booted with ios_simulator_diagnostics, and that its runtime is installed.";
-//#endregion
-//#region src/client/display.ts
+// src/client/display.ts
 /**
 * Screen geometry for a simulator, which has no `devicectl device info displays`.
 *
@@ -191,10 +189,11 @@ const pngDimensions = (png) => {
 * screen, so mapping it would be a lie.
 */
 const toDisplayInfo = (profile, capture) => {
-	const scale = profile.mainScreenScale ?? 1;
+	const scale = profile.mainScreenScale;
 	const pixelWidth = capture?.width ?? profile.mainScreenWidth;
 	const pixelHeight = capture?.height ?? profile.mainScreenHeight;
 	if (!pixelWidth || !pixelHeight) throw new IosError$1("Could not determine the simulator's screen geometry.", { remedy: "The device type's profile.plist could not be read and no screenshot was available. Run ios_simulator_diagnostics — an unavailable runtime is the usual cause." });
+	if (!scale) throw new IosError$1("Could not determine the simulator's screen scale.", { remedy: "The device type's profile.plist could not be read, so points cannot be told from pixels. Run ios_simulator_diagnostics — an unavailable runtime is the usual cause." });
 	const landscape = profile.mainScreenWidth !== void 0 && profile.mainScreenHeight !== void 0 ? pixelWidth > pixelHeight && profile.mainScreenWidth < profile.mainScreenHeight : pixelWidth > pixelHeight;
 	return {
 		pixelWidth,
@@ -205,8 +204,52 @@ const toDisplayInfo = (profile, capture) => {
 		orientation: capture ? landscape ? "landscape" : "portrait" : "unknown"
 	};
 };
-//#endregion
-//#region src/client/shape.ts
+// src/client/logs.ts
+const defaultProcessAlive = (pid) => {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (err) {
+		return err.code === "EPERM";
+	}
+};
+var LaunchCaptures = class {
+	alive;
+	captures = /* @__PURE__ */ new Map();
+	latest;
+	constructor(alive = defaultProcessAlive) {
+		this.alive = alive;
+	}
+	key(udid, bundleId) {
+		return `${udid}\u0000${bundleId}`;
+	}
+	/**
+	* One capture per simulator and app. A relaunch replaces the record rather
+	* than adding a second, so a read never has to choose between two files of
+	* the same app — the older file stays on disk, it is just no longer "the" log.
+	*/
+	record(capture) {
+		this.captures.set(this.key(capture.udid, capture.bundleId), capture);
+		this.latest = capture;
+	}
+	find(udid, bundleId) {
+		if (udid && bundleId) return this.captures.get(this.key(udid, bundleId));
+		const all = [...this.captures.values()].filter((c) => (!udid || c.udid === udid) && (!bundleId || c.bundleId === bundleId));
+		if (all.length === 0) return void 0;
+		return this.latest && all.includes(this.latest) ? this.latest : all.toSorted((a, b) => b.startedAt.localeCompare(a.startedAt))[0];
+	}
+	/**
+	* Whether the app is still writing. A pid can be reused once the app exits,
+	* and that is accepted: the cost of a false "running" is only that a final
+	* half-written line waits for the next read.
+	*/
+	running(capture) {
+		return capture.pid !== void 0 && this.alive(capture.pid);
+	}
+};
+/** True when `path` exists on this Mac. */
+const exists = async (path) => stat(path).then(() => true, () => false);
+// src/client/shape.ts
 /**
 * Flatten the runtime-keyed map `list devices` returns.
 *
@@ -228,7 +271,8 @@ const summarizeDevices = (devices, runtimes, deviceTypes) => {
 		deviceTypeIdentifier: sim.deviceTypeIdentifier,
 		available: sim.isAvailable !== false,
 		...sim.availabilityError ? { unavailableReason: sim.availabilityError } : {},
-		...sim.lastBootedAt ? { lastBootedAt: sim.lastBootedAt } : {}
+		...sim.lastBootedAt ? { lastBootedAt: sim.lastBootedAt } : {},
+		...sim.dataPath ? { dataPath: sim.dataPath } : {}
 	})));
 };
 /** `file:///Users/…/Foo.app/` → `/Users/…/Foo.app`, which is what a person can use. */
@@ -260,8 +304,7 @@ const toListRow = (sim) => ({
 	...sim.available ? {} : { available: false },
 	...sim.unavailableReason ? { unavailableReason: sim.unavailableReason } : {}
 });
-//#endregion
-//#region src/client/simctl.ts
+// src/client/simctl.ts
 /**
 * Pull the human sentence out of a CoreSimulator error envelope.
 *
@@ -291,6 +334,7 @@ const remedyFor = (stderr) => {
 	if (text.includes("unable to lookup in current state: shutdown")) return "The simulator is shut down. Boot it with ios_simulator_power {\"state\":\"booted\"}.";
 	if (text.includes("current state: booted")) return "The simulator is already booted, which for most operations means there is nothing to do.";
 	if (text.includes("no such file or directory")) return "Check the path exists and is a `.app` **bundle directory** built for the simulator — an `.ipa` or a device build will not install, and reports exactly this.";
+	if (text.includes("the request to open")) return "Check the app is installed with ios_simulator_list_apps: a bundle id that is not there fails exactly like this, with nothing in the message saying so.";
 	if (text.includes("failed to initialize io ports")) return "The simulator's runtime is not installed, so CoreSimulator cannot service it. Install the runtime, or clear the orphans with `xcrun simctl delete unavailable`.";
 };
 /**
@@ -310,6 +354,12 @@ var Simctl = class {
 	exec;
 	/** Device types change only when Xcode is updated; re-reading is pure cost. */
 	deviceTypes;
+	/**
+	* Read once, like device types: both change only when Xcode or a runtime is
+	* installed, and every tool call resolves a simulator. The cost is that a
+	* runtime added or deleted while this server runs is seen after a restart.
+	*/
+	runtimes;
 	constructor(opts) {
 		this.opts = opts;
 		this.exec = opts.exec ?? createExec({
@@ -319,9 +369,9 @@ var Simctl = class {
 		});
 	}
 	/** Raw stdout, for the subcommands that answer in prose. */
-	async run(args) {
+	async run(args, timeoutMs = this.opts.timeoutMs) {
 		this.opts.logger?.debug?.("simctl", ...args);
-		const { stdout } = await this.exec(this.opts.xcrunPath, ["simctl", ...args], this.opts.timeoutMs);
+		const { stdout } = await this.exec(this.opts.xcrunPath, ["simctl", ...args], timeoutMs);
 		return stdout;
 	}
 	/**
@@ -378,7 +428,8 @@ var Simctl = class {
 		return (await this.runJson(["list", "devices"])).devices ?? {};
 	}
 	async listRuntimes() {
-		return (await this.runJson(["list", "runtimes"])).runtimes ?? [];
+		this.runtimes ??= (await this.runJson(["list", "runtimes"])).runtimes ?? [];
+		return this.runtimes;
 	}
 	async listDeviceTypes() {
 		this.deviceTypes ??= (await this.runJson(["list", "devicetypes"])).devicetypes ?? [];
@@ -388,6 +439,16 @@ var Simctl = class {
 		assertNotBulkTarget(udid);
 		await this.run(["boot", udid]);
 	}
+	/**
+	* Wait until a booting simulator has finished, or `timeoutMs` passes (a
+	* `CommandTimeoutError`). Not the state in `list`: measured on an iOS 27.0
+	* runtime, that reads "Booted" 0.4s after `boot` returns, while this returns
+	* 17s later, once the system is up.
+	*/
+	async bootstatus(udid, timeoutMs) {
+		assertNotBulkTarget(udid);
+		await this.run(["bootstatus", udid], timeoutMs);
+	}
 	async shutdown(udid) {
 		assertNotBulkTarget(udid);
 		await this.run(["shutdown", udid]);
@@ -454,23 +515,55 @@ var Simctl = class {
 	* Launch, optionally replacing a running copy.
 	*
 	* Environment variables do not go on the command line: simctl reads them from
-	* its **own** environment under a `SIMCTL_CHILD_` prefix. `ExecImpl` pins a
-	* minimal environment on purpose, so a caller wanting them has to say so, and
-	* this is where that would be threaded through.
+	* its **own** environment under a `SIMCTL_CHILD_` prefix. `ExecImpl` takes
+	* argv and pins a minimal environment on purpose, so the variables reach
+	* simctl through `/usr/bin/env` as `SIMCTL_CHILD_NAME=value` argv entries in
+	* front of xcrun — still no shell, and still one argv entry per value. Names
+	* are checked here because `env` reads everything up to the first entry with
+	* no `=` as an assignment, so a name holding one would shift the command.
+	*
+	* `stdout` and `stderr` may be the same path, and that is how a log capture
+	* uses them: measured on Xcode 27.0 with an iOS 27.0 runtime, a probe app
+	* writing to `print`, to stderr and to `Logger` in turn left one file with all
+	* three interleaved in order, nothing overwritten. The redirect *appends* — a
+	* second launch into the same file kept the first one's lines — and where it
+	* lands is not always the path given; see `SimulatorClient.locateRedirect`.
 	*/
 	async launch(udid, bundleId, opts = {}) {
 		assertNotBulkTarget(udid);
-		const flags = [
-			...opts.terminateExisting ? ["--terminate-running-process"] : [],
-			...opts.stdout ? [`--stdout=${opts.stdout}`] : [],
-			...opts.stderr ? [`--stderr=${opts.stderr}`] : []
-		];
-		return this.run([
+		const argv = [
+			"simctl",
 			"launch",
-			...flags,
+			...[
+				...opts.terminateExisting ? ["--terminate-running-process"] : [],
+				...opts.stdout ? [`--stdout=${opts.stdout}`] : [],
+				...opts.stderr ? [`--stderr=${opts.stderr}`] : []
+			],
 			udid,
 			bundleId,
 			...opts.args ?? []
+		];
+		const env = Object.entries(opts.env ?? {});
+		if (env.length === 0) return this.run(argv.slice(1));
+		for (const [name] of env) if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) throw new IosError$1(`Refusing environment variable name "${name}".`, { remedy: "Use letters, digits and underscores only, e.g. OS_ACTIVITY_DT_MODE." });
+		this.opts.logger?.debug?.("simctl", ...argv.slice(1), `(env: ${env.map(([k]) => k).join(" ")})`);
+		const { stdout } = await this.exec(this.opts.envPath, [
+			...env.map(([name, value]) => `SIMCTL_CHILD_${name}=${value}`),
+			this.opts.xcrunPath,
+			...argv
+		], this.opts.timeoutMs);
+		return stdout;
+	}
+	/**
+	* Remove an app and its data container. Irreversible, which is why the tool
+	* in front of this takes `confirm`.
+	*/
+	async uninstall(udid, bundleId) {
+		assertNotBulkTarget(udid);
+		await this.run([
+			"uninstall",
+			udid,
+			bundleId
 		]);
 	}
 	async terminate(udid, bundleId) {
@@ -622,8 +715,7 @@ var Simctl = class {
 		}
 	}
 };
-//#endregion
-//#region src/client/simulator.ts
+// src/client/simulator.ts
 /**
 * What to say when WebDriverAgent fails, on a simulator.
 *
@@ -645,6 +737,7 @@ var SimulatorClient = class {
 	plutilPath;
 	openPath;
 	execTimeoutMs;
+	captures;
 	opts;
 	wdaClients = /* @__PURE__ */ new Map();
 	/** `simctl list` is ~80ms and most tools want it twice; 2s collapses that. */
@@ -660,9 +753,11 @@ var SimulatorClient = class {
 		this.plutilPath = opts.plutilPath;
 		this.openPath = opts.openPath;
 		this.execTimeoutMs = opts.execTimeoutMs;
+		this.captures = new LaunchCaptures(opts.processAlive);
 		this.simctl = new Simctl({
 			xcrunPath: opts.xcrunPath,
 			plutilPath: opts.plutilPath,
+			envPath: opts.envPath ?? "/usr/bin/env",
 			timeoutMs: opts.execTimeoutMs,
 			...opts.exec ? { exec: opts.exec } : {},
 			...opts.logger ? { logger: opts.logger } : {}
@@ -684,6 +779,13 @@ var SimulatorClient = class {
 		return simulators;
 	}
 	/**
+	* Drop the cached list. Called after a tool changes a simulator's state, so
+	* the next call within the cache window does not act on the state before it.
+	*/
+	forgetSimulators() {
+		this.cache = void 0;
+	}
+	/**
 	* Resolve a hint to exactly one simulator, or refuse.
 	*
 	* The device server's rule — never guess between two — transfers, but
@@ -752,11 +854,46 @@ var SimulatorClient = class {
 				exec: this.exec,
 				timeoutMs: this.execTimeoutMs
 			}) : {};
-			if (id) this.profiles.set(id, profile);
+			if (id && profile.mainScreenScale !== void 0) this.profiles.set(id, profile);
 		}
 		const capture = capturePng ? pngDimensions(Buffer.from(capturePng, "base64")) : void 0;
 		return toDisplayInfo(profile, capture);
 	}
+	/**
+	* Where a `simctl launch --stdout/--stderr` file actually landed.
+	*
+	* Not necessarily where it was asked to. The redirect is opened by the
+	* simulator's own launchd, which sees the simulator's filesystem, and that
+	* has its own `/tmp` and `/var/folders`. Measured on an iOS 27.0 runtime:
+	* `--stdout=/tmp/x/a.out` created `<dataPath>/tmp/x/a.out`, and a path under
+	* `/var/folders/…/T` — which is where `os.tmpdir()`, and so this server's
+	* default output directory, points — landed under `<dataPath>/var/folders/…`,
+	* the `/private` prefix of either making no difference. A path under `/Users`
+	* was written exactly where it said, missing directories created.
+	*
+	* Rather than encode which prefixes are remapped, which is a property of a
+	* runtime and can change with the next one, this looks: the path as given
+	* first, then the same path under the simulator's data root. Neither existing
+	* means the redirect went somewhere unforeseen, and the path as given is
+	* returned with `found: false` so the caller can say so.
+	*/
+	async locateRedirect(target, path) {
+		if (await exists(path)) return {
+			path,
+			found: true
+		};
+		if (target.dataPath) {
+			const inside = join(target.dataPath, path.replace(/^\/private(?=\/)/, ""));
+			if (await exists(inside)) return {
+				path: inside,
+				found: true
+			};
+		}
+		return {
+			path,
+			found: false
+		};
+	}
 	/** The capture lane that needs no runner — the whole reason this server is cheap to start. */
 	async screenshotPng(target) {
 		this.requireBooted(target);
@@ -776,6 +913,10 @@ var SimulatorClient = class {
 	wdaUrl() {
 		return this.opts.wdaUrl ?? `http://127.0.0.1:${this.opts.wdaPort}`;
 	}
+	/** The simulator `resolveTarget` falls back to when no hint is given. */
+	get defaultSimulatorId() {
+		return this.opts.defaultSimulatorId;
+	}
 	get wdaPort() {
 		return this.opts.wdaPort;
 	}
@@ -794,8 +935,7 @@ var SimulatorClient = class {
 		return client;
 	}
 };
-//#endregion
-//#region src/tools/util.ts
+// src/tools/util.ts
 /**
 * How the shared tools name themselves and each other in this server.
 *
@@ -826,8 +966,26 @@ const { bundleIdArg, confirmArg, detailArg, screenshotArg, settleArg, xArg, yArg
 * worse than either alone.
 */
 const deviceArg = args.targetArg;
-//#endregion
-//#region src/tools/apps.ts
+// src/tools/apps.ts
+/** `io.mgcrea.Canopy: 12345` is the whole of what `simctl launch` prints. */
+const parsePid = (output) => {
+	const pid = /:\s*(\d+)\s*$/.exec(output.trim())?.[1];
+	return pid ? Number(pid) : void 0;
+};
+const NOT_FOUND_WARNING = "The log file is neither where it was asked for nor under the simulator's data directory. Set IOS_SIMULATOR_OUTPUT_DIR to a directory under your home folder, which the simulator writes to as-is.";
+/**
+* Find the redirect, giving the simulator a moment to create it. `simctl
+* launch` returns once the app is spawned, and the file is opened as part of
+* that spawn, so the first look nearly always finds it; the retries only cover
+* a slow spawn rather than a known race.
+*/
+const locate = async (client, target, path) => {
+	for (let attempt = 0;; attempt += 1) {
+		const found = await client.locateRedirect(target, path);
+		if (found.found || attempt >= 4) return found;
+		await new Promise((resolve) => setTimeout(resolve, 100));
+	}
+};
 const registerListAppsTool = (server, client) => {
 	server.registerTool("ios_simulator_list_apps", {
 		title: "iOS Simulator: List Apps",
@@ -867,39 +1025,95 @@ const registerAppTools = (server, client, launchArgs, outputDir) => {
 	}));
 	server.registerTool("ios_simulator_launch", {
 		title: "iOS Simulator: Launch",
-		description: "Launch an installed app. Pass `arguments` to put it into a fixture or demo mode — that is what IOS_SIMULATOR_LAUNCH_ARGS sets as the default for every launch that does not override it. Standard output and error are captured to files under the output directory, so an app that dies on launch leaves something readable behind.",
+		description: "Launch an installed app. Pass `arguments` to put it into a fixture or demo mode — that is what IOS_SIMULATOR_LAUNCH_ARGS sets as the default for every launch that does not override it. Standard output and error are captured to files under the output directory, so an app that dies on launch leaves something readable behind. Pass `capture_logs: true` to also get its Logger/os_log output, in one file read with ios_simulator_read_logs.",
 		inputSchema: z.object({
 			device: deviceArg,
 			bundle_id: bundleIdArg,
 			arguments: z.array(z.string()).optional().describe("Launch arguments, e.g. [\"-DemoMode\", \"YES\"]. Overrides IOS_SIMULATOR_LAUNCH_ARGS rather than adding to it."),
-			terminate_first: z.boolean().default(true).describe("Replace a running copy rather than attaching to it. On by default so a launch means a fresh process and a predictable first screen.")
+			terminate_first: z.boolean().default(true).describe("Replace a running copy rather than attaching to it. On by default so a launch means a fresh process and a predictable first screen."),
+			capture_logs: z.boolean().default(false).describe("Write stdout, stderr and every Logger/os_log message to one fresh file, for ios_simulator_read_logs. Sets OS_ACTIVITY_DT_MODE=YES in the app's environment, which is what Xcode sets to mirror unified logging onto stderr; without it an app's Logger output reaches no file at all.")
 		}),
 		annotations: {
 			readOnlyHint: false,
 			destructiveHint: false,
 			idempotentHint: false
 		}
-	}, async ({ device, bundle_id, arguments: args, terminate_first }) => wrap(async () => {
+	}, async ({ device, bundle_id, arguments: args, terminate_first, capture_logs }) => wrap(async () => {
 		const target = client.requireBooted(await client.resolveTarget(device));
 		const effective = args ?? launchArgs;
-		const stdout = `${outputDir}/${bundle_id}.out.log`;
-		const stderr = `${outputDir}/${bundle_id}.err.log`;
+		const said = {
+			...effective.length > 0 ? { arguments: effective } : {},
+			...args === void 0 && launchArgs.length > 0 ? { argumentsFrom: "IOS_SIMULATOR_LAUNCH_ARGS" } : {}
+		};
+		if (capture_logs) {
+			const stamp = (/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-");
+			const requested = join(outputDir, "logs", `${bundle_id}-${stamp}.log`);
+			const output = await client.simctl.launch(target.id, bundle_id, {
+				args: effective,
+				terminateExisting: terminate_first,
+				stdout: requested,
+				stderr: requested,
+				env: { OS_ACTIVITY_DT_MODE: "YES" }
+			});
+			const pid = parsePid(output);
+			const log = await locate(client, target, requested);
+			client.captures.record({
+				udid: target.id,
+				simulatorName: target.name,
+				bundleId: bundle_id,
+				path: log.path,
+				pid,
+				startedAt: (/* @__PURE__ */ new Date()).toISOString()
+			});
+			return {
+				launched: bundle_id,
+				...pid !== void 0 ? { pid } : {},
+				...said,
+				capturingLogs: true,
+				log: log.path,
+				...log.found ? {} : { warning: NOT_FOUND_WARNING }
+			};
+		}
+		const stdout = join(outputDir, `${bundle_id}.out.log`);
+		const stderr = join(outputDir, `${bundle_id}.err.log`);
 		const output = await client.simctl.launch(target.id, bundle_id, {
 			args: effective,
 			terminateExisting: terminate_first,
 			stdout,
 			stderr
 		});
-		const pid = /:\s*(\d+)\s*$/.exec(output.trim())?.[1];
+		const pid = parsePid(output);
+		const [out, err] = await Promise.all([locate(client, target, stdout), locate(client, target, stderr)]);
 		return {
 			launched: bundle_id,
-			...pid ? { pid: Number(pid) } : {},
-			...effective.length > 0 ? { arguments: effective } : {},
-			...args === void 0 && launchArgs.length > 0 ? { argumentsFrom: "IOS_SIMULATOR_LAUNCH_ARGS" } : {},
+			...pid !== void 0 ? { pid } : {},
+			...said,
 			logs: {
-				stdout,
-				stderr
-			}
+				stdout: out.path,
+				stderr: err.path
+			},
+			...out.found && err.found ? {} : { warning: NOT_FOUND_WARNING }
+		};
+	}));
+	server.registerTool("ios_simulator_uninstall", {
+		title: "iOS Simulator: Uninstall",
+		description: "Remove an app from the simulator, **with its data container** — documents, databases and preferences all go, and nothing brings them back. To get back to a cold start while keeping the data, use ios_simulator_terminate. To test a genuine first launch of one app, this is narrower than ios_simulator_erase, which wipes every app on the simulator. Uninstalling an app that is not installed also succeeds, so success does not prove it was there.",
+		inputSchema: z.object({
+			device: deviceArg,
+			bundle_id: bundleIdArg,
+			confirm: z.literal(true).describe("Must be true. Explicit acknowledgement that the app's data is deleted.")
+		}),
+		annotations: {
+			readOnlyHint: false,
+			destructiveHint: true,
+			idempotentHint: true
+		}
+	}, async ({ device, bundle_id }) => wrap(async () => {
+		const target = client.requireBooted(await client.resolveTarget(device));
+		await client.simctl.uninstall(target.id, bundle_id);
+		return {
+			uninstalled: bundle_id,
+			udid: target.id
 		};
 	}));
 	server.registerTool("ios_simulator_terminate", {
@@ -937,8 +1151,7 @@ const registerAppTools = (server, client, launchArgs, outputDir) => {
 		return { opened: url };
 	}));
 };
-//#endregion
-//#region src/tools/diagnostics.ts
+// src/tools/diagnostics.ts
 /**
 * Which simulator owns the WebDriverAgent port.
 *
@@ -1026,7 +1239,7 @@ const diagnose = async (client, ctx, deviceHint) => {
 	try {
 		target = await client.resolveTarget(deviceHint);
 	} catch (err) {
-		if (booted.length > 0) {
+		if (booted.length > 0 || (deviceHint ?? client.defaultSimulatorId) !== void 0) {
 			problems.push(err instanceof Error ? err.message : String(err));
 			const remedy = err.remedy;
 			if (remedy) nextSteps.push(remedy);
@@ -1096,8 +1309,7 @@ const registerDiagnosticsTools = (server, client, ctx) => {
 		text: JSON.stringify(await diagnose(client, ctx))
 	}] }));
 };
-//#endregion
-//#region src/tools/environment.ts
+// src/tools/environment.ts
 /** simctl's own list, verbatim — a value it does not accept is not worth guessing at. */
 const PRIVACY_SERVICES = [
 	"all",
@@ -1173,6 +1385,26 @@ const registerEnvironmentTools = (server, client) => {
 		}
 	}, async ({ device, appearance, content_size, increase_contrast, status_bar, clear_status_bar, location, clear_location, permission }) => wrap(async () => {
 		const target = client.requireBooted(await client.resolveTarget(device));
+		const statusBarFlags = status_bar ? [
+			...status_bar.time ? ["--time", status_bar.time] : [],
+			...status_bar.wifi_bars !== void 0 ? [
+				"--wifiMode",
+				"active",
+				"--wifiBars",
+				String(status_bar.wifi_bars)
+			] : [],
+			...status_bar.cellular_bars !== void 0 ? [
+				"--cellularMode",
+				"active",
+				"--cellularBars",
+				String(status_bar.cellular_bars)
+			] : [],
+			...status_bar.operator_name !== void 0 ? ["--operatorName", status_bar.operator_name] : [],
+			...status_bar.battery_level !== void 0 ? ["--batteryLevel", String(status_bar.battery_level)] : [],
+			...status_bar.battery_state ? ["--batteryState", status_bar.battery_state] : []
+		] : [];
+		if (status_bar && statusBarFlags.length === 0) throw new IosError$1("`status_bar` was given with no fields to override.", { remedy: "Set at least one field, or use `clear_status_bar` to drop the overrides." });
+		if (permission && permission.action !== "reset" && !permission.bundle_id) throw new IosError$1(`\`${permission.action}\` needs a bundle_id.`, { remedy: "Pass the app's bundle id, or use `reset`, which does not need one." });
 		const applied = [];
 		if (appearance) {
 			await client.simctl.uiSet(target.id, "appearance", appearance);
@@ -1191,26 +1423,7 @@ const registerEnvironmentTools = (server, client) => {
 			applied.push("status_bar cleared");
 		}
 		if (status_bar) {
-			const flags = [
-				...status_bar.time ? ["--time", status_bar.time] : [],
-				...status_bar.wifi_bars !== void 0 ? [
-					"--wifiMode",
-					"active",
-					"--wifiBars",
-					String(status_bar.wifi_bars)
-				] : [],
-				...status_bar.cellular_bars !== void 0 ? [
-					"--cellularMode",
-					"active",
-					"--cellularBars",
-					String(status_bar.cellular_bars)
-				] : [],
-				...status_bar.operator_name !== void 0 ? ["--operatorName", status_bar.operator_name] : [],
-				...status_bar.battery_level !== void 0 ? ["--batteryLevel", String(status_bar.battery_level)] : [],
-				...status_bar.battery_state ? ["--batteryState", status_bar.battery_state] : []
-			];
-			if (flags.length === 0) throw new IosError$1("`status_bar` was given with no fields to override.", { remedy: "Set at least one field, or use `clear_status_bar` to drop the overrides." });
-			await client.simctl.statusBarOverride(target.id, flags);
+			await client.simctl.statusBarOverride(target.id, statusBarFlags);
 			applied.push("status_bar overridden");
 		}
 		if (clear_location) {
@@ -1222,17 +1435,21 @@ const registerEnvironmentTools = (server, client) => {
 			applied.push(`location=${location.latitude},${location.longitude}`);
 		}
 		if (permission) {
-			if (permission.action !== "reset" && !permission.bundle_id) throw new IosError$1(`\`${permission.action}\` needs a bundle_id.`, { remedy: "Pass the app's bundle id, or use `reset`, which does not need one." });
 			await client.simctl.privacy(target.id, permission.action, permission.service, permission.bundle_id);
 			applied.push(`permission ${permission.action} ${permission.service}`);
 		}
 		if (applied.length === 0) throw new IosError$1("Nothing to do — no field was given.", { remedy: "Set at least one of appearance, content_size, status_bar, location, permission." });
+		const [appearanceNow, contentSize, statusBar] = await Promise.all([
+			client.simctl.uiGet(target.id, "appearance"),
+			client.simctl.uiGet(target.id, "content_size"),
+			client.simctl.statusBarList(target.id)
+		]);
 		return {
 			applied,
 			state: {
-				appearance: await client.simctl.uiGet(target.id, "appearance"),
-				contentSize: await client.simctl.uiGet(target.id, "content_size"),
-				statusBar: await client.simctl.statusBarList(target.id)
+				appearance: appearanceNow,
+				contentSize,
+				statusBar
 			}
 		};
 	}));
@@ -1282,11 +1499,7 @@ const registerEnvironmentTools = (server, client) => {
 		};
 	}));
 };
-//#endregion
-//#region src/tools/lifecycle.ts
-/** Booting is slow and visible; this is how long `power` waits to see it land. */
-const BOOT_POLL_MS = 500;
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+// src/tools/lifecycle.ts
 const registerListTool = (server, client) => {
 	server.registerTool("ios_simulator_list", {
 		title: "iOS Simulator: List",
@@ -1331,13 +1544,14 @@ const registerLifecycleTools = (server, client) => {
 	}, async ({ device, state, open_window, wait_ms }) => wrap(async () => {
 		const target = await client.resolveTarget(device);
 		if (state === "shutdown") {
-			if (target.state !== "Booted") return {
+			if (target.state === "Shutdown") return {
 				udid: target.id,
 				name: target.name,
 				state: "Shutdown",
 				alreadyThere: true
 			};
 			await client.simctl.shutdown(target.id);
+			client.forgetSimulators();
 			return {
 				udid: target.id,
 				name: target.name,
@@ -1345,7 +1559,10 @@ const registerLifecycleTools = (server, client) => {
 			};
 		}
 		const already = target.state === "Booted";
-		if (!already) await client.simctl.boot(target.id);
+		if (!already) {
+			await client.simctl.boot(target.id);
+			client.forgetSimulators();
+		}
 		let windowWarning;
 		let windowNote;
 		if (open_window) await client.simctl.openApp(client.openPath).then((app) => {
@@ -1353,25 +1570,27 @@ const registerLifecycleTools = (server, client) => {
 		}).catch((err) => {
 			windowWarning = `Booted, but no window could be opened: ${err instanceof Error ? err.message : String(err)}`;
 		});
-		const deadline = Date.now() + wait_ms;
-		let observed = target.state;
-		while (Date.now() < deadline) {
-			observed = (await client.listSimulators({ fresh: true })).find((sim) => sim.id === target.id)?.state ?? observed;
-			if (observed === "Booted") break;
-			await sleep(BOOT_POLL_MS);
+		let ready = already;
+		let waitWarning = `Not waited for, since wait_ms is 0: it may still be starting up.`;
+		if (!already && wait_ms > 0) try {
+			await client.simctl.bootstatus(target.id, wait_ms);
+			ready = true;
+		} catch (err) {
+			waitWarning = err instanceof CommandTimeoutError ? `Not finished booting after ${wait_ms}ms. Raise wait_ms, or check Xcode.` : `Booted, but could not confirm it finished: ${err instanceof Error ? err.message : String(err)}`;
 		}
+		const observed = Object.values(await client.simctl.listDevices()).flat().find((sim) => sim.udid === target.id)?.state ?? target.state;
 		return {
 			udid: target.id,
 			name: target.name,
 			state: observed,
 			...already ? { alreadyThere: true } : {},
 			...windowNote ? { note: windowNote } : {},
-			...observed === "Booted" ? windowWarning ? { warning: windowWarning } : {} : { warning: `Still ${observed} after ${wait_ms}ms. Raise wait_ms, or check Xcode.` }
+			...ready ? windowWarning ? { warning: windowWarning } : {} : { warning: waitWarning }
 		};
 	}));
 	server.registerTool("ios_simulator_erase", {
 		title: "iOS Simulator: Erase",
-		description: "Wipe a simulator back to a factory state: installed apps, their data, the keychain and every granted permission. The only irreversible tool here, and the reason it is the only one behind `confirm`. Use it to test a genuine first launch. A booted simulator is shut down first and booted again afterwards, because simctl refuses to erase a running one.",
+		description: "Wipe a simulator back to a factory state: installed apps, their data, the keychain and every granted permission. Irreversible, hence `confirm`; ios_simulator_uninstall is the narrower way to a first launch of one app. A booted simulator is shut down first and booted again afterwards, because simctl refuses to erase a running one.",
 		inputSchema: z.object({
 			device: deviceArg,
 			confirm: confirmArg
@@ -1387,6 +1606,7 @@ const registerLifecycleTools = (server, client) => {
 		if (wasBooted) await client.simctl.shutdown(target.id);
 		await client.simctl.erase(target.id);
 		if (wasBooted) await client.simctl.boot(target.id);
+		client.forgetSimulators();
 		return {
 			udid: target.id,
 			name: target.name,
@@ -1395,8 +1615,261 @@ const registerLifecycleTools = (server, client) => {
 		};
 	}));
 };
-//#endregion
-//#region src/tools/runner.ts
+// src/client/crash.ts
+/**
+* Simulator crash reports, out of this Mac's own DiagnosticReports.
+*
+* A simulator app is a Mac process, so when it crashes the Mac's ReportCrash
+* writes the `.ips` — into `~/Library/Logs/DiagnosticReports`, older ones under
+* `Retired/`, mixed in with every Mac app's and daemon's. On the machine this
+* was written against that was 593 `.ips` files, 464 of them from simulators,
+* and nearly all of those were the simulators' own daemons rather than an app
+* anyone was debugging.
+*
+* Telling the two apart, as measured on Xcode 27.0 with an iOS 27.0 runtime:
+*
+* - The header line's `platform` is the Mach-O platform of the crashed binary.
+*   Every simulator report had 7 (`PLATFORM_IOSSIMULATOR` in
+*   `<mach-o/loader.h>`) and every Mac report had 1, with no exceptions either
+*   way. That is one line of a few hundred bytes, so it is the filter.
+* - The header's `is_simulated` is **not** the marker, despite the name: it
+*   was set on 13 reports, every one a Mac process with platform 1 — Safari,
+*   Mail and two of their helpers.
+* - `procPath` does not say either: it is anonymised to `/Volumes/VOLUME/…` or
+*   `/Users/USER/…` with the middle starred out, so no device path survives.
+* - Which simulator is in the report body, as `coalitionName`:
+*   `com.apple.CoreSimulator.SimDevice.<UDID>`. Its key ended by byte 1,731 in
+*   every one of the 464, so reading the first `HEAD_BYTES` finds it without
+*   parsing reports that run to 80 KB.
+*/
+/** `PLATFORM_*SIMULATOR` in `<mach-o/loader.h>`: iOS, tvOS, watchOS, visionOS. Only 7 was seen. */
+const SIMULATOR_PLATFORMS = /* @__PURE__ */ new Set([
+	7,
+	8,
+	9,
+	12
+]);
+/** Enough for the header and the body's `coalitionName`, with room to spare. */
+const HEAD_BYTES = 8192;
+const COALITION = /"coalitionName"\s*:\s*"com\.apple\.CoreSimulator\.SimDevice\.([0-9A-Fa-f-]{36})"/;
+/** Opened at once. The directory holds hundreds of files; this keeps clear of EMFILE. */
+const CONCURRENCY = 32;
+const readHead = async (path) => {
+	const handle = await open(path, "r");
+	try {
+		const buffer = Buffer.alloc(HEAD_BYTES);
+		const { bytesRead } = await handle.read(buffer, 0, HEAD_BYTES, 0);
+		return buffer.subarray(0, bytesRead).toString("utf8");
+	} finally {
+		await handle.close();
+	}
+};
+const parseHeader = (text) => {
+	const newline = text.indexOf("\n");
+	try {
+		return JSON.parse(newline === -1 ? text : text.slice(0, newline));
+	} catch {
+		return;
+	}
+};
+/** `2026-10-08 23:28:26.00 +0200` → epoch ms, for ordering. File mtimes are not reliable here. */
+const timestampMs = (value) => {
+	const m = /^(\d{4}-\d{2}-\d{2}) (\d{2}:\d{2}:\d{2}(?:\.\d+)?) ([+-]\d{2})(\d{2})$/.exec(value ?? "");
+	return m ? Date.parse(`${m[1]}T${m[2]}${m[3]}:${m[4]}`) : 0;
+};
+const listIps = async (dir) => {
+	const top = await readdir(dir).catch((err) => {
+		if (err.code === "ENOENT") return [];
+		throw err;
+	});
+	const retired = await readdir(join(dir, "Retired")).catch(() => []);
+	return [...top.filter((name) => name.endsWith(".ips")), ...retired.filter((name) => name.endsWith(".ips")).map((name) => `Retired/${name}`)];
+};
+/**
+* What each report's head said, by path; `null` for one that is not from a
+* simulator. A written `.ips` never changes and its name carries a timestamp,
+* so after the first list only new reports cost a read. A Mac with Xcode
+* holds hundreds of them, and every list used to open each one.
+*/
+const scanned = /* @__PURE__ */ new Map();
+/**
+* Every simulator report in `dir`, newest first. Reads the first 8 KB of each
+* `.ips`, never the whole file, except to find the UDID in the rare report
+* whose `coalitionName` did not fit in that.
+*/
+const listSimulatorCrashReports = async (dir) => {
+	const names = await listIps(dir);
+	const rows = [];
+	for (let i = 0; i < names.length; i += CONCURRENCY) {
+		const batch = await Promise.all(names.slice(i, i + CONCURRENCY).map(async (name) => {
+			const path = join(dir, name);
+			const known = scanned.get(path);
+			if (known !== void 0) return known ?? void 0;
+			const head = await readHead(path).catch(() => "");
+			const header = parseHeader(head);
+			if (!header) return void 0;
+			if (!SIMULATOR_PLATFORMS.has(Number(header.platform))) {
+				scanned.set(path, null);
+				return;
+			}
+			let udid = COALITION.exec(head)?.[1];
+			if (!udid) udid = COALITION.exec(await readFile(path, "utf8").catch(() => ""))?.[1];
+			const row = {
+				name,
+				process: header.app_name || header.name || crashProcessName(name),
+				bundleId: header.bundleID,
+				kind: crashKind(header.bug_type),
+				timestamp: header.timestamp,
+				udid: udid?.toUpperCase()
+			};
+			scanned.set(path, row);
+			return row;
+		}));
+		for (const row of batch) if (row) rows.push(row);
+	}
+	return rows.toSorted((a, b) => timestampMs(b.timestamp) - timestampMs(a.timestamp));
+};
+/**
+* The absolute path of a report named by `ios_simulator_list_crash_logs`, or a
+* refusal. The schema already rejects `..` and absolute names; this is the
+* check that cannot be argued with, made on the resolved path.
+*/
+const crashReportPath = (dir, name) => {
+	const root = resolve(dir);
+	const path = resolve(root, name);
+	const rel = relative(root, path);
+	if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) throw new IosError$1(`"${name}" is not inside the crash reports directory.`, { remedy: "Pass a `name` exactly as ios_simulator_list_crash_logs returned it." });
+	return path;
+};
+/** Whether a report's header says it came from a simulator. */
+const isSimulatorReport = (text) => {
+	const header = parseHeader(text);
+	return header !== void 0 && SIMULATOR_PLATFORMS.has(Number(header.platform));
+};
+/** The simulator a full report came from, when its body says. */
+const reportUdid = (text) => COALITION.exec(text)?.[1]?.toUpperCase();
+// src/tools/logs.ts
+/** UDID → name, for labelling reports. Best effort: a Mac with no Xcode still has reports. */
+const simulatorNames = async (client) => {
+	try {
+		return new Map((await client.listSimulators()).map((sim) => [sim.id.toUpperCase(), sim.name]));
+	} catch {
+		return /* @__PURE__ */ new Map();
+	}
+};
+/**
+* Crash reports: the half of "logs" that needs nothing launched. Observing, so
+* registered whatever the write gate says — reading a report changes nothing
+* on the simulator, the same way a screenshot does not.
+*/
+const registerCrashLogTools = (server, client, ctx) => {
+	const dir = ctx.config.crashReportsDir;
+	server.registerTool("ios_simulator_list_crash_logs", {
+		title: "iOS Simulator: List Crash Logs",
+		description: "List crash reports from simulator processes, newest first. A simulator app's crash is written by this Mac into ~/Library/Logs/DiagnosticReports alongside the Mac's own crashes; this keeps only the simulators' and says which simulator each came from. Most of them are the simulators' own system daemons, so pass `process` to find your app's. Read one with ios_simulator_get_crash_log. Nothing needs to be booted.",
+		inputSchema: z.object({
+			device: deviceArg.describe("Only reports from this simulator, by UDID or name as shown by ios_simulator_list. Omit for every simulator's — unlike the other tools, this does not default to the booted one, since a crash often outlives the boot it happened in."),
+			process: z.string().optional().describe("Case-insensitive substring of the process name or bundle id, e.g. \"Canopy\" or \"io.mgcrea\". The process name is the app's executable name, usually but not always its display name."),
+			kinds: z.array(z.string()).optional().describe("Report kinds to include, e.g. [\"crash\"]. Defaults to [\"crash\", \"jetsam\", \"user_fault\"]; kinds without a name come back as \"bug_type_<n>\". Pass [\"all\"] for everything."),
+			limit: z.number().int().min(1).max(200).default(20).describe("Maximum reports to return, newest first (1-200). Defaults to 20.")
+		}),
+		annotations: { readOnlyHint: true }
+	}, async ({ device, process, kinds, limit }) => wrap(async () => {
+		const target = device ? await client.resolveTarget(device) : void 0;
+		const wanted = kinds ?? DEFAULT_CRASH_KINDS;
+		const needle = process?.toLowerCase();
+		const [all, names] = await Promise.all([listSimulatorCrashReports(dir), target ? void 0 : simulatorNames(client)]);
+		const matching = all.filter((report) => (!target || report.udid === target.id.toUpperCase()) && (wanted.includes("all") || wanted.includes(report.kind)) && (!needle || report.process.toLowerCase().includes(needle) || (report.bundleId?.toLowerCase().includes(needle) ?? false)));
+		return {
+			...target ? {
+				simulator: target.name,
+				udid: target.id
+			} : {},
+			reports: matching.slice(0, limit).map(({ udid, bundleId, ...row }) => ({
+				...row,
+				...bundleId ? { bundleId } : {},
+				...names && udid ? {
+					udid,
+					...names.get(udid) ? { simulator: names.get(udid) } : {}
+				} : {}
+			})),
+			total: matching.length
+		};
+	}));
+	server.registerTool("ios_simulator_get_crash_log", {
+		title: "iOS Simulator: Get Crash Log",
+		description: "Read one simulator crash report and return what matters in it: the exception, why the process was terminated, any application-specific message, and the faulting thread's top frames with library names resolved. The full report's path is returned too; it is often tens of kilobytes, so read it only when the summary is not enough. A Swift fatalError's message may not be in the report at all — on a simulator it goes to the app's stderr.",
+		inputSchema: z.object({ name: z.string().regex(/^[^/][^\0]*\.ips$/, "Pass a `name` exactly as ios_simulator_list_crash_logs returned it.").refine((value) => !value.split("/").includes(".."), "`name` cannot contain `..`.").describe("The report's `name` from ios_simulator_list_crash_logs, e.g. \"Canopy-2026-10-08-101500.ips\" or \"Retired/Canopy-2026-10-02-213409.ips\". Older reports move under Retired/, so a name that worked yesterday may need listing again.") }),
+		annotations: { readOnlyHint: true }
+	}, async ({ name }) => wrap(async () => {
+		const path = crashReportPath(dir, name);
+		let text;
+		try {
+			text = await readFile(path, "utf8");
+		} catch {
+			throw new IosError$1(`No crash report named ${name}.`, { remedy: "Run ios_simulator_list_crash_logs again: reports move to Retired/ as they age, and the system deletes old ones." });
+		}
+		if (!isSimulatorReport(text)) throw new IosError$1(`${name} is a crash report from this Mac, not from a simulator.`, { remedy: "Pick a report from ios_simulator_list_crash_logs, which lists only simulators'." });
+		const summary = summarizeCrashReport(text);
+		const udid = reportUdid(text);
+		const simulator = udid ? (await simulatorNames(client)).get(udid) : void 0;
+		const asi = summary.crash?.["applicationSpecificInfo"];
+		return {
+			name,
+			path,
+			...udid ? { udid } : {},
+			...simulator ? { simulator } : {},
+			...summary,
+			...summary.crash ? asi ? {} : { note: "The report carries no application-specific message. A Swift fatalError's text goes to the app's stderr on a simulator" + (ctx.allowWrites ? ", so relaunch with ios_simulator_launch `capture_logs: true` and read it with ios_simulator_read_logs." : ".") } : { note: "Not a crash report with a faulting thread; read the file at `path`." }
+		};
+	}));
+};
+/**
+* Reading an app's captured log. Registered with the launch tool it depends on,
+* behind the write gate: without `ios_simulator_launch` there is never anything
+* to read.
+*/
+const registerLogReadTools = (server, client) => {
+	server.registerTool("ios_simulator_read_logs", {
+		title: "iOS Simulator: Read Logs",
+		description: "Read an app's log output: stdout, stderr and every Logger/os_log message the process emits, interleaved in one file. Only available for an app started with ios_simulator_launch `capture_logs: true`. Returns the newest `limit` lines plus a `next` cursor; pass it back to get only what arrived since, which is how to see what one tap logged. `capturing` turns false once the app's process has exited, and what it wrote stays readable. A crash's backtrace is not in here — see ios_simulator_list_crash_logs — but its fatalError message is.",
+		inputSchema: z.object({
+			device: deviceArg,
+			bundle_id: z.string().optional().describe("Which app's capture, e.g. \"io.mgcrea.Canopy\". Defaults to the most recent capture."),
+			cursor: z.number().int().min(0).optional().describe("The `next` value from the previous read, to get only newer lines. Omit to read from the start of the capture."),
+			filter: z.string().optional().describe("Case-insensitive regular expression a line must match, e.g. \"error|fail\" or \"\\[Sync\\]\". Applied before `limit`, so it finds matches across the whole range."),
+			limit: z.number().int().min(1).max(2e3).default(200).describe("Most lines to return; the newest are kept and the rest counted in `omitted`. Defaults to 200 — filter rather than raising this.")
+		}),
+		annotations: { readOnlyHint: true }
+	}, async ({ device, bundle_id, cursor, filter, limit }) => wrap(async () => {
+		const target = device ? await client.resolveTarget(device) : void 0;
+		const capture = client.captures.find(target?.id, bundle_id);
+		if (!capture) throw new IosError$1(bundle_id ? `No log capture for ${bundle_id}.` : "No log capture has been started.", { remedy: "Launch the app with ios_simulator_launch {\"bundle_id\":\"…\",\"capture_logs\":true}. A capture belongs to this server process, so one started before it restarted is not known here, though its file is still under the output directory." });
+		const running = client.captures.running(capture);
+		let result;
+		try {
+			result = await readLogFile(capture.path, {
+				cursor,
+				filter,
+				limit,
+				complete: !running
+			});
+		} catch (err) {
+			if (err.code !== "ENOENT") throw err;
+			throw new IosError$1(`The log file for ${capture.bundleId} is gone: ${capture.path}`, { remedy: "Erasing the simulator deletes it when it was written under the simulator's data directory. Launch again with `capture_logs: true`." });
+		}
+		return {
+			bundleId: capture.bundleId,
+			simulator: capture.simulatorName,
+			capturing: running,
+			...capture.pid !== void 0 ? { pid: capture.pid } : {},
+			...result,
+			path: capture.path,
+			...result.skippedBytes > 0 ? { note: `${result.skippedBytes} bytes before this window were not read. Pass the returned \`next\` sooner, or read the file at \`path\`.` } : {}
+		};
+	}));
+};
+// src/tools/runner.ts
 const defaultSpawnRunner = async (command, args, { env, logPath }) => {
 	await mkdir(dirname(logPath), { recursive: true });
 	const log = await open(logPath, "a");
@@ -1418,9 +1891,22 @@ const defaultSpawnRunner = async (command, args, { env, logPath }) => {
 };
 const scriptPath = () => {
 	const here = dirname(fileURLToPath(import.meta.url));
-	for (const candidate of [join(here, "..", "scripts", "wda.sh"), join(here, "..", "..", "scripts", "wda.sh")]) return candidate;
+	for (const candidate of [join(here, "..", "scripts", "wda.sh"), join(here, "..", "..", "scripts", "wda.sh")]) if (existsSync(candidate)) return candidate;
 	throw new IosError$1("Could not find `scripts/wda.sh` beside this module.");
 };
+/**
+* Whether `wda.sh run` has anything to run: the same directory and glob it
+* looks in. Without a build it exits with "no build found" into a log nobody
+* reads, while a detached spawn has already been reported as started.
+*/
+const runnerBuilt = async () => {
+	const wdaDir = process.env["WDA_DIR"] || join(homedir(), ".cache", "mcp-ios-simulator", "WebDriverAgent");
+	const products = join(wdaDir, ".build", "Build", "Products");
+	return {
+		built: (await readdir(products).catch(() => [])).some((name) => name.startsWith("WebDriverAgentRunner_iphonesimulator") && name.endsWith(".xctestrun")),
+		products
+	};
+};
 const registerRunnerTools = (server, client, outputDir, spawnRunner = defaultSpawnRunner) => {
 	server.registerTool("ios_simulator_restart_wda", {
 		title: "iOS Simulator: Restart WebDriverAgent",
@@ -1437,12 +1923,16 @@ const registerRunnerTools = (server, client, outputDir, spawnRunner = defaultSpa
 	}, async ({ device, port }) => wrap(async () => {
 		const target = client.requireBooted(await client.resolveTarget(device));
 		const usePort = port ?? client.wdaPort;
+		const { built, products } = await runnerBuilt();
+		if (!built) throw new IosError$1(`No WebDriverAgent build in ${products}, so there is nothing to start.`, { remedy: "Build it once with `scripts/wda.sh setup` (or `npx -p @mgcrea/mcp-ios-simulator ios-simulator-wda setup` from an npm install), then call ios_simulator_restart_wda again." });
 		const logPath = join(outputDir, "wda.log");
 		const pid = await spawnRunner("/bin/bash", [scriptPath(), "run"], {
 			env: {
 				IOS_SIMULATOR_ID: target.id,
 				IOS_SIMULATOR_WDA_PORT: String(usePort),
-				USE_PORT: String(usePort)
+				USE_PORT: String(usePort),
+				NODE: process.execPath,
+				PATH: `${dirname(process.execPath)}:${process.env["PATH"] ?? ""}`
 			},
 			logPath
 		});
@@ -1457,8 +1947,7 @@ const registerRunnerTools = (server, client, outputDir, spawnRunner = defaultSpa
 		};
 	}));
 };
-//#endregion
-//#region src/tools/index.ts
+// src/tools/index.ts
 /**
 * All capability decisions in one place, so "why can't I call that" is answered
 * by one file.
@@ -1473,6 +1962,12 @@ const registerRunnerTools = (server, client, outputDir, spawnRunner = defaultSpa
 * refused, because a refusal still lets a model try, retry and reason about a
 * way around it.
 *
+* Reading logs splits across the line. Crash reports are files this Mac
+* already wrote, so listing and reading them is observing and survives the
+* gate. `ios_simulator_read_logs` is read-only too, but it only ever reads what
+* `ios_simulator_launch` started capturing, so it goes where launch goes — a
+* tool that can only answer "no capture" is noise in the list.
+*
 * The observe half is unusually capable here: `screenshot` goes through simctl,
 * so seeing the screen needs no WebDriverAgent and no setup of any kind. Only
 * `ui_tree` does, and that is a runtime fact reported by
@@ -1494,21 +1989,23 @@ const registerTools = (server, client, ctx, spawnRunner) => {
 	registerListTool(server, client);
 	registerListAppsTool(server, client);
 	registerScreenTools(server, shared);
+	registerCrashLogTools(server, client, ctx);
 	if (!ctx.allowWrites) return;
 	registerInputTools(server, shared);
 	registerLifecycleTools(server, client);
 	registerAppTools(server, client, ctx.config.launchArgs, ctx.config.outputDir);
+	registerLogReadTools(server, client);
 	registerEnvironmentTools(server, client);
 	registerRunnerTools(server, client, ctx.config.outputDir, spawnRunner);
 };
-//#endregion
-//#region src/server.ts
+// src/server.ts
 const SERVER_NAME = BUILD_INFO.name;
 const SERVER_VERSION = BUILD_INFO.version;
 /**
-* A pure factory. The injectable seams — `exec`, `fetch` and `spawnRunner` —
-* are the whole reason the test suite can drive real tools through the real SDK
-* with no simulator, no Xcode, no WebDriverAgent and no process left running.
+* A pure factory. The injectable seams — `exec`, `fetch`, `spawnRunner` and
+* `processAlive`, plus `crashReportsDir` in the config — are the whole reason
+* the test suite can drive real tools through the real SDK with no simulator,
+* no Xcode, no WebDriverAgent and no process left running.
 * Nothing below `config.ts` reads `process.env`.
 */
 const createServer = (opts) => {
@@ -1530,6 +2027,7 @@ const createServer = (opts) => {
 		...config.simulatorId ? { defaultSimulatorId: config.simulatorId } : {},
 		...opts.exec ? { exec: opts.exec } : {},
 		...opts.fetch ? { fetch: opts.fetch } : {},
+		...opts.processAlive ? { processAlive: opts.processAlive } : {},
 		...opts.logger ? { logger: opts.logger } : {}
 	});
 	registerTools(server, client, {
@@ -1541,8 +2039,7 @@ const createServer = (opts) => {
 		client
 	};
 };
-//#endregion
-//#region src/config.ts
+// src/config.ts
 /**
 * There are no credentials here, and unlike the device server there is barely
 * any setup either. Two lanes reach a simulator and both are local:
@@ -1575,14 +2072,24 @@ const ConfigSchema = z.object({
 	* **On by default**, which is the one place this server deliberately breaks
 	* the fleet convention. What makes the device server read-only is that a
 	* phone belongs to a real person; a simulator is disposable and holds
-	* nobody's data. `ios_simulator_erase` still requires an explicit `confirm`
-	* because it is the only irreversible tool here.
+	* nobody's data. `ios_simulator_erase` and `ios_simulator_uninstall` still
+	* require an explicit `confirm`, because they are the irreversible ones.
 	*/
 	allowWrites: z.boolean().default(true),
 	/** Applied by `launch` when the call passes no `arguments` of its own. */
 	launchArgs: z.array(z.string()).default([]),
-	/** Saved screenshots, launch logs and the runner log. */
+	/**
+	* Saved screenshots, launch logs and the runner log. A launch log is opened
+	* by the simulator rather than by this server, and a simulator has its own
+	* `/tmp` and `/var/folders` — under this default it lands in the
+	* simulator's data directory, and `launch` reports where it really is.
+	*/
 	outputDir: z.string().min(1).default(join(tmpdir(), "mcp-ios-simulator")),
+	/**
+	* Where this Mac's ReportCrash writes `.ips` files, simulator apps' included.
+	* Configurable for tests and for a report folder copied off another Mac.
+	*/
+	crashReportsDir: z.string().min(1).default(join(homedir(), "Library", "Logs", "DiagnosticReports")),
 	maxTreeBytes: z.number().int().min(1e3).max(5e5).default(24e3),
 	xcrunPath: z.string().min(1).default("/usr/bin/xcrun"),
 	sipsPath: z.string().min(1).default("/usr/bin/sips"),
@@ -1650,6 +2157,7 @@ const loadConfig = (env = process.env, configPath = defaultConfigPath(env)) => {
 		allowWrites: pick(parseBool(env.IOS_SIMULATOR_ALLOW_WRITES), "allowWrites"),
 		launchArgs: pick(parseArgs(env.IOS_SIMULATOR_LAUNCH_ARGS), "launchArgs"),
 		outputDir: pick(trimmed(env.IOS_SIMULATOR_OUTPUT_DIR), "outputDir"),
+		crashReportsDir: pick(trimmed(env.IOS_SIMULATOR_CRASH_REPORTS_DIR), "crashReportsDir"),
 		maxTreeBytes: pick(parseIntOpt(env.IOS_SIMULATOR_MAX_TREE_BYTES), "maxTreeBytes"),
 		xcrunPath: pick(trimmed(env.IOS_SIMULATOR_XCRUN_PATH), "xcrunPath"),
 		sipsPath: pick(trimmed(env.IOS_SIMULATOR_SIPS_PATH), "sipsPath"),
@@ -1657,7 +2165,6 @@ const loadConfig = (env = process.env, configPath = defaultConfigPath(env)) => {
 		openPath: pick(trimmed(env.IOS_SIMULATOR_OPEN_PATH), "openPath")
 	});
 };
-//#endregion
 export { WritesDisabledError as A, SimulatorNotBootedError as C, ToolchainError as D, TOOLCHAIN_REMEDY as E, wdaUnavailableRemedy as M, BUILD_INFO as N, WdaError as O, START_RUNNER_TOOL_REMEDY as S, TIMEOUT_REMEDY as T, CommandTimeoutError as _, createServer as a, RuntimeUnavailableError as b, assertNotBulkTarget as c, summarizeDevices as d, toListRow as f, CommandError as g, toDisplayInfo as h, SERVER_VERSION as i, startRunnerRemedy as j, WdaUnavailableError as k, parseSimctlError as l, readScreenProfile as m, loadConfig as n, SimulatorClient as o, pngDimensions as p, SERVER_NAME as r, Simctl as s, defaultConfigPath as t, summarizeApps as u, EMPTY_SCREENSHOT_REMEDY as v, SimulatorNotFoundError as w, START_RUNNER_SCRIPT_REMEDY as x, IosError$1 as y };
 
-//# sourceMappingURL=config-qc0zwYZr.js.map
+//# sourceMappingURL=config-HmqayUrt.js.map