@mmerterden/multi-agent-toolkit-mcp 3.7.0 → 3.9.0

package/CHANGELOG.md

@@ -15,6 +15,136 @@ Releases before this file exists are recorded in the git tags and commit history
 
 ---
 
+## 3.9.0
+
+### Changed
+
+- **Inline screenshots are compact.** `ios_screenshot` and `android_screenshot`
+  without `path` returned the raw PNG as base64: on a 3x simulator that is
+  2.9 MB per capture, 3.86 million characters on the wire, and the model reads
+  every one of them. That was the sluggishness people felt in an agent loop,
+  not the capture itself (0.5 s). The inline result is now an 800 px JPEG at
+  quality 80 (63 KB, 84 K characters), resized through `sips` in 0.1 s; the
+  full-resolution PNG still lands on disk and its path is in the text. New
+  optional inputs `max_width`, `format` and `quality` are the escape hatch
+  (`format: "png"` with `max_width: 0` returns the original bytes). `path`
+  behaviour is unchanged: full-resolution PNG, nothing inline, which is what
+  design-check and visual diff read.
+- **The UI-tree dumper runs compiled.** `swift ui-tree-dumper.swift` was
+  re-interpreted on every call, about a second each. It is now compiled once
+  with `swiftc -O` into the user cache, keyed by the source hash and the
+  toolchain version, and runs in 55 ms. No `swiftc`, or a failed compile, falls
+  back to the interpreted script and stays there for the process lifetime.
+  `ios_get_ui_tree`, `ios_accessibility_audit` and `design_ui_geometry` share
+  the path.
+
+### Note
+
+The README gained a Performance section: read the tree before taking a
+picture, batch a scripted sequence through `agent_run_steps`, write bulk
+captures to files and look only at the ones that changed. The pipeline's
+`/multi-agent:test` flow (16.19.0) now does exactly that.
+
+## 3.8.0
+
+### Added
+
+- **`ios_swipe` declares `duration_ms`.** The handler had read it since the
+  tool existed; the schema never said so, so no host ever offered it.
+- **Gate 9c and gate 14b.** 9c validates every probed tool's structured result
+  against its own declared `outputSchema` with ajv. 14b scans every shell
+  template for a `${args.x}` interpolation that no sanitizer wraps, the shape
+  gate 14 could not see because it only knew the double-quoted form.
+- **The work directory is pruned.** `.xcresult` bundles, build logs, push
+  payloads and audit dumps accumulated under the screenshot directory with
+  nothing to remove them. It now keeps the newest 200 entries for 7 days, the
+  offload directory's own rule, and never removes a path a caller was just
+  promised.
+
+### Fixed
+
+- **`agent_run_steps` skipped schema validation.** Batched steps went straight
+  to the handlers, so an enum or type guard that lived only in the schema was
+  void inside a batch. Every step is validated now and a failed validation is a
+  step error. `ios_get_app_container` also passes its `container` value through
+  `token()`, so the enum is not the only thing standing between an argument and
+  the shell.
+- **`android_type_text` and `android_open_url` were command injection on the
+  device.** `shq()` protected the host shell, and `adb shell` hands the string
+  to the device shell unquoted, where it is parsed again. Both are quoted twice
+  now; a test evaluates the composed argument through `/bin/sh` and checks the
+  original bytes come back.
+- **`android_meminfo mode=diff` always threw.** The snapshot emitted `pss_kb`
+  and the diff read `pss`, so the tool's own output was never a valid baseline.
+  The diff accepts both shapes.
+- **Three `outputSchema`s contradicted their payloads,** which a conforming
+  client rejects: audit findings carry `status: "info"`, `ios_visual_diff`
+  returns `diff_image: null` on a clean compare, `android_launch_time` returns
+  `cold_start: null` below Android 10. The schemas now allow what the handlers
+  emit, and gate 9c keeps them honest.
+- **`ios_app_store_audit` with an unknown rule id reported PASS** after running
+  nothing. Unknown ids are an error that lists the valid ones, and an empty
+  selection is never a pass.
+- **`ios_accessibility_audit_deep` and `ios_leaks` ran through `execSync`**
+  with the default 1 MB buffer, so a normal `xcodebuild test` log killed the
+  child and the tool blamed the build; the event loop was blocked for the whole
+  run. Both use the async spawn path with a 64 MB cap and a timeout.
+- **`android_apk_audit`'s `aapt2 || aapt` fallback never fired,** because a
+  failed `run()` returns a truthy error string; with aapt2 absent the report
+  said "Not debuggable - OK" and on Linux `apk_size` was `NaN MB` with status
+  pass. Failures are detected, the missing-tool branch is reachable, size comes
+  from `statSync`.
+- **Capture tools returned a stale file as a fresh capture.** `ios_screenshot`,
+  `android_screenshot` and `android_get_ui_tree` decided success by whether the
+  path existed, so a second run against a dropped device returned the previous
+  image with the real error replaced by a generic one. The subprocess result is
+  checked first and a pre-existing file is discarded before capturing.
+- **`ios_set_locale` reported success unconditionally.** Each of its three
+  steps is checked.
+- **`ios_xcodebuild action:"test"` used the generic simulator destination,**
+  which xcodebuild refuses for testing. Test defaults to the booted simulator
+  or fails with a clear message.
+- **`android_launch_time` and `android_launch_app` disagreed on `activity`.**
+  Both build the component the same way and describe the field identically.
+- **Pure-JS iOS tools were refused without Xcode.** `ios_visual_diff`,
+  `ios_list_crashes` and `ios_xcresult` need no xcrun and run on a Linux box.
+- **`design_report` leaked a Chromium on a failed PDF render.** The browser is
+  closed in `finally`.
+- **`ios_archive_audit` reported an unsigned bundle as signed,** because the
+  `codesign` failure text never reached the check; and its size used the
+  macOS-only `stat -f`.
+- **Smaller ones.** `ios_leaks` accepts a numeric-string pid and matches the
+  bundle id as a whole token instead of a regex prefix; the UI-tree dumper's
+  remedy text reaches the caller; `ensureBrowser` closes a half-launched browser
+  and honours a changed engine; `exportIpa` picks the export it just made rather
+  than the first `.ipa` in the directory, and the export options plist is
+  XML-escaped; `agent_run_steps` declares the `result` / `error` fields it
+  emits.
+
+## 3.7.1
+
+### Fixed
+
+- **`android_meminfo` never read the swap total on a real device.** The parser
+  was written from the documented output, which spells the line
+  `TOTAL SWAP (KB):`. An Android 35 Pixel emulator prints `TOTAL SWAP PSS:`, so
+  the regex matched nothing and `total_swap_kb` came back null on every real
+  run. Both spellings are accepted now, and the fixture is the emulator's own
+  output rather than a reconstruction.
+
+  This is the defect the 3.3.0 note predicted: that parser shipped marked "not
+  verified on a device", and the first real device broke it. Worth recording
+  plainly, because the note was right and the only thing that found the bug was
+  running it.
+
+### Note
+
+The Android checks are no longer unverified. `android_accessibility_audit` and
+`android_meminfo` were both run against a booted Android 35 emulator: the audit
+read 14 clickable elements off a real launcher, reported the reading order as
+correct with no false positive on the grid, and produced one critical and seven
+warnings; meminfo read the App Summary and, after the fix above, the swap total.
+
 ## 3.7.0
 
 ### Added

package/README.md

@@ -293,6 +293,13 @@ Mock-mode vs Figma design audit. Generic and platform-agnostic - the heavy orche
 - **App Store screenshots** - Clean status bar + automated navigation
 - **Regression testing** - Tap through flows, verify behavior
 
+### Performance
+
+- **Inline captures are small.** `ios_screenshot` / `android_screenshot` without `path` return an 800 px JPEG, about 60 KB instead of the ~3 MB full-resolution PNG a simulator produces (which is ~4 MB as base64 on every capture). `max_width`, `format` and `quality` tune it; `format: "png"` with `max_width: 0` returns the original bytes. The full-resolution PNG stays on disk, and `path` writes it where you say.
+- **The iOS UI-tree dumper is compiled once.** `ui-tree-dumper.swift` is built with `swiftc -O` on first use and cached per source and toolchain, so a call drops from ~1 s to ~0.05 s. Without `swiftc` it runs interpreted as before.
+- **Batch a scripted sequence.** `agent_run_steps` runs tap, type, wait and screenshot steps in one round trip instead of one call per step.
+- **Read the tree when text is enough.** `ios_get_ui_tree` / `android_get_ui_tree` cost a fraction of a screenshot and return tappable coordinates.
+
 ### How It Works
 
 ```mermaid

package/README.tr.md

@@ -292,6 +292,13 @@ Mock-mode vs Figma tasarım denetimi. Jenerik ve platform-bağımsız - ağır o
 - **App Store screenshot'ları** - Temiz status bar + otomatik navigasyon
 - **Regresyon testi** - Akışlarda tap'le gez, davranışı doğrula
 
+### Performans
+
+- **Inline capture'lar küçük.** `path` verilmeyen `ios_screenshot` / `android_screenshot` 800 px JPEG döner: simülatörün ürettiği ~3 MB tam çözünürlüklü PNG (her capture'da base64 olarak ~4 MB) yerine yaklaşık 60 KB. `max_width`, `format` ve `quality` ile ayarlanır; `format: "png"` + `max_width: 0` orijinal byte'ları döner. Tam çözünürlüklü PNG diskte kalır, `path` onu istediğin yere yazar.
+- **iOS UI-tree dumper bir kez derlenir.** `ui-tree-dumper.swift` ilk kullanımda `swiftc -O` ile derlenir, kaynak + toolchain başına önbelleğe alınır; bir çağrı ~1 s'den ~0.05 s'ye iner. `swiftc` yoksa eskisi gibi yorumlanarak çalışır.
+- **Senaryoyu tek çağrıda koş.** `agent_run_steps` tap, type, wait ve screenshot adımlarını adım başına bir çağrı yerine tek round trip'te çalıştırır.
+- **Metin yetiyorsa tree oku.** `ios_get_ui_tree` / `android_get_ui_tree` bir screenshot'ın çok küçük bir maliyetiyle tap'lenebilir koordinatlar döner.
+
 ### Nasıl Çalışır
 
 ```mermaid