@mmerterden/multi-agent-toolkit-mcp 3.7.1 → 3.11.0

package/index.js

@@ -16,9 +16,10 @@ import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 import { execSync, exec, spawn } from "child_process";
-import { writeFileSync, readFileSync, mkdirSync, existsSync, readdirSync, statSync } from "fs";
+import { writeFileSync, readFileSync, mkdirSync, existsSync, readdirSync, statSync, unlinkSync, renameSync } from "fs";
 import { join, dirname, basename, isAbsolute, resolve, sep } from "path";
-import { homedir } from "os";
+import { homedir, tmpdir } from "os";
+import { createHash } from "crypto";
 import { fileURLToPath } from "url";
 import { runAudit as runAppStoreAudit } from "./tools/ios-app-store-audit/index.js";
 import {
@@ -28,6 +29,15 @@ import {
   validateApp,
 } from "./tools/ios-testflight/index.js";
 import { DESIGN_TOOLS, handleDesign } from "./tools/design-check/index.js";
+import {
+  CODE_TOOLS,
+  handleCode,
+  CODE_READ_ONLY,
+  CODE_IDEMPOTENT,
+  CODE_OUTPUT_SCHEMAS,
+  shutdownAllLsp,
+} from "./tools/code-intel/index.js";
+import { PASS_TOOLS, handlePass, PASS_READ_ONLY, PASS_OUTPUT_SCHEMAS } from "./tools/pass-kit/index.js";
 import { parseLaunchOutput } from "./tools/launch-time/index.js";
 import { parseLeaksOutput, parseMeminfoOutput, diffMeminfo } from "./tools/memory/index.js";
 import { auditIosTree, auditAndroidDump, parseAuditResults } from "./tools/a11y/index.js";
@@ -37,11 +47,16 @@ import {
   offloadLargeText,
   queryOffloadedOutput,
   offloadedErrorSummary,
+  pruneWorkDir,
 } from "./tools/offload/index.js";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const SCREENSHOT_DIR = join(process.env.TMPDIR || "/tmp", "mobile-dev-mcp");
 if (!existsSync(SCREENSHOT_DIR)) mkdirSync(SCREENSHOT_DIR, { recursive: true });
+// Same retention as the offload dir: this directory collects screenshots, UI
+// dumps, push payloads, build logs and .xcresult bundles, and nothing else
+// ever removed them.
+pruneWorkDir(SCREENSHOT_DIR);
 
 // ── Helpers ──
 
@@ -80,6 +95,27 @@ function run(cmd, opts = {}) {
   }
 }
 
+// run() reports failure by returning a truthy marker string, so `run(a) || run(b)`
+// never falls back. This variant returns null on failure for exactly that shape.
+function runOrNull(cmd, opts = {}) {
+  const out = run(cmd, opts);
+  return isFailure(out) ? null : out;
+}
+
+// A capture that must be fresh: a file left by an earlier run would otherwise
+// pass the existence check and be returned as this run's result.
+function discardStale(path) {
+  try { if (statSync(path).isFile()) unlinkSync(path); } catch {}
+}
+
+// The files a result promises to the caller; retention never removes them.
+function promisedPaths(result) {
+  if (!result || typeof result !== "object") return [];
+  if (result.type === "file") return result.files.map((f) => f.path);
+  if (result.type === "image") return [result.path, result.source].filter(Boolean);
+  return [];
+}
+
 /**
  * Run a command whose non-zero exit is a RESULT, not a failure.
  *
@@ -215,6 +251,64 @@ function shq(value) {
   return `'${String(value ?? "").replace(/'/g, "'\\''")}'`;
 }
 
+// `adb shell <cmd>` is parsed twice: once by the host shell, again by the
+// device shell. One shq() layer survives only the first, so the device shell
+// saw `;`, `&` and `$()` in a text or URL as syntax. The inner layer is what
+// the device shell receives.
+function remoteShq(value) {
+  return shq(shq(value));
+}
+
+// The ui-tree dumper prints its failure as a JSON object on stdout (with the
+// remedy) and exits 1; a plain exit-status error keeps only stderr.
+function dumperErrorOf(text) {
+  const s = String(text ?? "");
+  try {
+    const parsed = JSON.parse(s);
+    return parsed && typeof parsed.error === "string" ? parsed.error : null;
+  } catch {}
+  const m = s.match(/"error"\s*:\s*("(?:[^"\\]|\\.)*")/);
+  if (!m) return null;
+  try { return JSON.parse(m[1]); } catch { return null; }
+}
+
+const DUMPER_SOURCE = join(__dirname, "ui-tree-dumper.swift");
+
+// `swift <script>` re-parses and JITs the dumper on every call (0.9-1.2 s); the
+// -O binary answers in 0.05 s. Compiled on first use, never at server start,
+// and keyed by source + toolchain so an edit or an Xcode update rebuilds it.
+// The directory comes from the environment and the home directory only, never
+// from a tool argument, the same rule the offload dir follows.
+function dumperCacheDir() {
+  const xdg = process.env.XDG_CACHE_HOME;
+  const base = xdg && isAbsolute(xdg) ? xdg
+    : process.platform === "darwin" ? join(homedir(), "Library", "Caches")
+    : join(homedir(), ".cache");
+  for (const dir of [join(base, "multi-agent-toolkit-mcp"), join(tmpdir(), "multi-agent-toolkit-mcp")]) {
+    try { mkdirSync(dir, { recursive: true }); return dir; } catch {}
+  }
+  return null;
+}
+
+let dumperPrefix = null;
+function dumperCommand() {
+  if (dumperPrefix) return dumperPrefix;
+  dumperPrefix = `swift ${shq(DUMPER_SOURCE)}`;
+  const version = runOrNull("swiftc --version", { timeout: 15000 });
+  const dir = version ? dumperCacheDir() : null;
+  if (!dir) return dumperPrefix;
+  const key = createHash("sha256").update(readFileSync(DUMPER_SOURCE)).update(version).digest("hex").slice(0, 16);
+  const binary = join(dir, `ui-tree-dumper-${key}`);
+  if (!existsSync(binary)) {
+    const staging = `${binary}.${process.pid}`;
+    const built = run(`swiftc -O -o ${shq(staging)} ${shq(DUMPER_SOURCE)}`, { timeout: 120000 });
+    if (isFailure(built) || !existsSync(staging)) return dumperPrefix;
+    try { renameSync(staging, binary); } catch { return dumperPrefix; }
+  }
+  dumperPrefix = shq(binary);
+  return dumperPrefix;
+}
+
 // Numeric coordinates / scales: reject anything that is not a plain number so it
 // can be interpolated bare.
 function num(value, label) {
@@ -249,6 +343,39 @@ function hasCommand(cmd) {
 }
 
 const HAS_XCRUN = hasCommand("xcrun");
+const HAS_SIPS = hasCommand("sips");
+
+// The inline image goes to the model on every capture, and a simulator PNG is
+// ~2.9 MB (3.9 MB as base64). sips turns it into an 800 px JPEG of ~60 KB in
+// 0.12 s, so that is the default; the full-resolution file stays on disk.
+function captureOptions(args) {
+  const format = args.format === "png" ? "png" : "jpeg";
+  const maxWidth = num(args.max_width ?? 800, "max_width");
+  const quality = num(args.quality ?? 80, "quality");
+  if (!Number.isInteger(maxWidth) || maxWidth < 0) throw new Error(`Invalid max_width: ${args.max_width} (0 or a positive pixel count)`);
+  if (!Number.isInteger(quality) || quality < 1 || quality > 100) throw new Error(`Invalid quality: ${args.quality} (1-100)`);
+  return { format, maxWidth, quality };
+}
+
+function inlineCapture(f, { format, maxWidth, quality }) {
+  const asIs = (note) => ({ type: "image", data: readFileSync(f).toString("base64"), mimeType: "image/png", path: f, note });
+  if (format === "png" && maxWidth === 0) return asIs("");
+  if (!HAS_SIPS) return asIs(" (sips unavailable, full-resolution PNG returned)");
+  const out = f.replace(/\.png$/, "") + (format === "jpeg" ? ".jpg" : `_${maxWidth}.png`);
+  discardStale(out);
+  const scale = maxWidth ? ` -Z ${maxWidth}` : "";
+  const options = format === "jpeg" ? ` -s formatOptions ${quality}` : "";
+  const converted = run(`sips${scale} -s format ${format}${options} ${shq(f)} --out ${shq(out)}`);
+  if (isFailure(converted) || !existsSync(out)) return asIs(" (sips failed, full-resolution PNG returned)");
+  return {
+    type: "image",
+    data: readFileSync(out).toString("base64"),
+    mimeType: format === "jpeg" ? "image/jpeg" : "image/png",
+    path: out,
+    source: f,
+    note: ` (full-resolution PNG: ${f})`,
+  };
+}
 
 // idb (Facebook) is the real iOS Simulator UI driver - `simctl io` has NO tap/swipe/type
 // operation, so tap/swipe/type/geometry route through idb. Resolve its binary + set a PATH
@@ -325,9 +452,9 @@ function iosDevice(id) {
 const IOS_TOOLS = [
   { name: "ios_list_devices", description: "List all available iOS simulators and their state", inputSchema: { type: "object", properties: {} } },
   { name: "ios_boot_device", description: "Boot an iOS simulator by UDID or name", inputSchema: { type: "object", properties: { device: { type: "string", description: "Device UDID or name" } }, required: ["device"] } },
-  { name: "ios_screenshot", description: "Capture an iOS simulator screenshot. Returns a base64 PNG by default; pass `path` to write the file and return only its location, which is what a run taking many captures needs - a base64 image per capture exhausts the caller's context. Use when you need to see the screen, or to collect captures for a later comparison.", inputSchema: { type: "object", properties: { device_id: { type: "string" }, path: { type: "string", description: "Absolute file path to write the PNG to. The parent directory must already exist. Returns the path instead of the image." } } } },
+  { name: "ios_screenshot", description: "Capture an iOS simulator screenshot. Without `path` the image comes back inline, downscaled to 800 px on the longest side as a quality-80 JPEG (~60 KB instead of the ~3 MB full-resolution PNG, which is ~4 MB as base64 on every capture); `format: \"png\"` with `max_width: 0` returns the original PNG bytes. The full-resolution PNG stays on disk either way. Pass `path` to write the full-resolution PNG there and return only its location, which is what a run taking many captures needs - and what design-check and ios_visual_diff read. Use when you need to see the screen, or to collect captures for a later comparison.", inputSchema: { type: "object", properties: { device_id: { type: "string" }, path: { type: "string", description: "Absolute file path to write the PNG to. The parent directory must already exist. Returns the path instead of the image." }, max_width: { type: "integer", description: "Longest side of the inline image in pixels (default 800). 0 keeps the original size. Ignored with `path`." }, format: { type: "string", enum: ["jpeg", "png"], description: "Inline image format (default jpeg). Ignored with `path`." }, quality: { type: "integer", description: "JPEG quality 1-100 (default 80). Ignored for png and with `path`." } } } },
   { name: "ios_tap", description: "Tap at coordinates on iOS simulator", inputSchema: { type: "object", properties: { x: { type: "number" }, y: { type: "number" }, device_id: { type: "string" } }, required: ["x", "y"] } },
-  { name: "ios_swipe", description: "Swipe on iOS simulator", inputSchema: { type: "object", properties: { x1: { type: "number" }, y1: { type: "number" }, x2: { type: "number" }, y2: { type: "number" }, device_id: { type: "string" } }, required: ["x1", "y1", "x2", "y2"] } },
+  { name: "ios_swipe", description: "Swipe on iOS simulator", inputSchema: { type: "object", properties: { x1: { type: "number" }, y1: { type: "number" }, x2: { type: "number" }, y2: { type: "number" }, duration_ms: { type: "number", description: "Swipe duration in milliseconds" }, device_id: { type: "string" } }, required: ["x1", "y1", "x2", "y2"] } },
   { name: "ios_type_text", description: "Type text on iOS simulator", inputSchema: { type: "object", properties: { text: { type: "string" }, device_id: { type: "string" } }, required: ["text"] } },
   { name: "ios_launch_app", description: "Launch iOS app by bundle ID", inputSchema: { type: "object", properties: { bundle_id: { type: "string" }, device_id: { type: "string" } }, required: ["bundle_id"] } },
   { name: "ios_terminate_app", description: "Terminate iOS app", inputSchema: { type: "object", properties: { bundle_id: { type: "string" }, device_id: { type: "string" } }, required: ["bundle_id"] } },
@@ -357,7 +484,7 @@ const IOS_TOOLS = [
   { name: "ios_export_ipa", description: "Export a .xcarchive to a signed .ipa via xcodebuild -exportArchive. Generates the exportOptions.plist from the arguments (method defaults to app-store-connect), so callers do not have to hand-maintain one. Returns the .ipa path plus parsed errors; a run that exits 0 without producing an .ipa is reported as a failure. Pair with ios_testflight_validate for the pre-submission gate.", inputSchema: { type: "object", properties: { archive_path: { type: "string", description: "Absolute path to the .xcarchive" }, output_dir: { type: "string", description: "Directory to write the .ipa into" }, method: { type: "string", description: "Export method: app-store-connect (default) | release-testing | enterprise | development" }, team_id: { type: "string", description: "Apple Developer team ID" }, provisioning_profiles: { type: "object", description: "Map of bundleId -> provisioning profile name (manual signing)" }, signing_style: { type: "string", description: "automatic | manual" }, upload_symbols: { type: "boolean", description: "Include symbols (default true)" }, allow_provisioning_updates: { type: "boolean", description: "Off by default. Lets xcodebuild register devices and create/modify provisioning profiles in the developer account - a change on Apple's side, so it is opt-in" }, timeout_sec: { type: "number", description: "Default 900" } }, required: ["archive_path", "output_dir"] } },
   { name: "ios_testflight_validate", description: "Run Apple's own pre-submission validation on an .ipa via `xcrun altool --validate-app`, then map returned ITMS error codes onto the App Store rule each one implies. This is the authoritative gate: unlike the static ios_app_store_audit it can catch an unregistered bundle ID, a profile that does not match the App Store Connect app record, a version+build pair already used, and entitlements not provisioned for the app ID. Auth is a 3-tier chain: ASC API key (api_key_id + api_issuer_id), else Apple ID + app-specific password referenced indirectly through a keychain item or env var (never passed by value), else the gate returns verdict SKIPPED with a reason. SKIPPED is not a pass - it means Apple was never asked. Set list_providers=true for a pre-flight that reports which teams the credentials can deliver for (needed when a corporate Apple ID belongs to several).", inputSchema: { type: "object", properties: { ipa_path: { type: "string", description: "Absolute path to the .ipa" }, platform: { type: "string", description: "ios (default) | appletvos | visionos | macos" }, api_key_id: { type: "string", description: "App Store Connect API key ID (tier 1)" }, api_issuer_id: { type: "string", description: "App Store Connect issuer ID (tier 1)" }, p8_path: { type: "string", description: "Explicit path to AuthKey_<id>.p8; otherwise altool's search dirs are used" }, apple_id: { type: "string", description: "Apple ID (tier 2)" }, keychain_item: { type: "string", description: "Keychain item holding the app-specific password (tier 2, preferred)" }, password_env_var: { type: "string", description: "Env var holding the app-specific password (tier 2 fallback)" }, provider_public_id: { type: "string", description: "Required when the account belongs to multiple providers" }, list_providers: { type: "boolean", description: "Pre-flight only: list deliverable providers and return" }, timeout_sec: { type: "number", description: "Default 900" } }, required: [] } },
   { name: "ios_app_store_audit", description: "Deep App Store Review compliance audit for .xcarchive bundles. 18-rule catalog covering privacy manifest, code signing, embedded SDKs, entitlements, asset hygiene, IPv6 compliance, debug-tool leak detection, Swift ABI compatibility, SDK floor (ITMS-90725), and more. Returns structured JSON with severity-ranked violations and ITMS error code mappings. Replaces ios_archive_audit (deprecated). Pass rules='core' for the 6 baseline checks (code-signing, entitlements, info-plist, privacy-manifest, binary-size, sdk-floor); 'all'|'deep' for the full 18-rule scan; CSV like 'binary-size,ipv6-compliance' for an explicit subset.", inputSchema: { type: "object", properties: { archive_path: { type: "string", description: "Absolute path to the .xcarchive bundle" }, rules: { type: "string", description: "'all' (default) | 'core' | 'deep' | comma-separated ruleIDs" } }, required: ["archive_path"] } },
-  { name: "ios_xcodebuild", description: "Build / test / clean an Xcode project with progressive disclosure. Returns one-line summary plus xcresult ID; drill in via ios_xcresult. Token-efficient - full log stays out of context unless requested.", inputSchema: { type: "object", properties: { project: { type: "string", description: "Path to .xcodeproj (mutually exclusive with workspace)" }, workspace: { type: "string", description: "Path to .xcworkspace (mutually exclusive with project)" }, scheme: { type: "string" }, configuration: { type: "string", description: "Debug / Release (default: Release)" }, destination: { type: "string", description: "Xcode destination string. Default: generic iOS Simulator" }, action: { type: "string", enum: ["build", "test", "clean", "archive", "clean-build"], description: "Default: build" }, derived_data_path: { type: "string" }, extra_args: { type: "string", description: "Additional raw xcodebuild args appended verbatim" }, timeout_sec: { type: "number", description: "Build timeout in seconds (default 600)" } }, required: ["scheme"] } },
+  { name: "ios_xcodebuild", description: "Build / test / clean an Xcode project with progressive disclosure. Returns one-line summary plus xcresult ID; drill in via ios_xcresult. Token-efficient - full log stays out of context unless requested.", inputSchema: { type: "object", properties: { project: { type: "string", description: "Path to .xcodeproj (mutually exclusive with workspace)" }, workspace: { type: "string", description: "Path to .xcworkspace (mutually exclusive with project)" }, scheme: { type: "string" }, configuration: { type: "string", description: "Debug / Release (default: Release)" }, destination: { type: "string", description: "Xcode destination string. Default: generic iOS Simulator; for action test, the booted simulator (xcodebuild refuses a generic destination for test)" }, action: { type: "string", enum: ["build", "test", "clean", "archive", "clean-build"], description: "Default: build" }, derived_data_path: { type: "string" }, extra_args: { type: "string", description: "Additional raw xcodebuild args appended verbatim" }, timeout_sec: { type: "number", description: "Build timeout in seconds (default 600)" } }, required: ["scheme"] } },
   { name: "ios_xcresult", description: "Drill into a previous ios_xcodebuild result by xcresult ID. Modes: summary (counts), errors (file:line + message), warnings, log (last N lines), tests (failed), metrics (XCTMetric performance results as JSON). Use this instead of dumping the whole build log into context.", inputSchema: { type: "object", properties: { id: { type: "string", description: "xcresult ID returned by ios_xcodebuild" }, mode: { type: "string", enum: ["summary", "errors", "warnings", "log", "tests", "metrics"], description: "Default: summary" }, log_lines: { type: "number", description: "Lines of raw log to return when mode=log (default 200)" }, test_id: { type: "string", description: "mode=metrics only: scope to one test case or suite instead of every measured test" } }, required: ["id"] } },
   { name: "ios_visual_diff", description: "Compare two PNG screenshots. Returns JSON with diff_pct, pass/fail vs threshold, and an optional diff image. Use for snapshot regression checks across light/dark, locale, dynamic type variants.", inputSchema: { type: "object", properties: { baseline: { type: "string", description: "Path to baseline PNG" }, current: { type: "string", description: "Path to current PNG" }, threshold: { type: "number", description: "Per-pixel color threshold 0..1 (default 0.1, lower = stricter)" }, max_diff_pct: { type: "number", description: "Fail if diff exceeds this percent (default 1.0)" }, output: { type: "string", description: "Path to write diff PNG (optional)" } }, required: ["baseline", "current"] } },
   { name: "ios_leaks", description: "Look for leaked memory in a running simulator (or host) process with /usr/bin/leaks. mode=snapshot reports the current leak count and bytes; mode=diff reports only leaks new since a saved memory graph, which is the shape a regression gate wants. Reports measurable:false when the target lacks get-task-allow rather than reporting it as clean - leaks exits 0 in that case, so an unmeasurable target and a clean one are indistinguishable by exit status. Debug builds are debuggable; Apple-signed apps are not.", inputSchema: { type: "object", properties: { pid: { type: "number", description: "Process id. Either this or bundle_id." }, bundle_id: { type: "string", description: "Bundle id of an app running on the booted simulator; its pid is resolved for you." }, device_id: { type: "string" }, mode: { type: "string", enum: ["snapshot", "diff"], description: "Default: snapshot" }, baseline_graph: { type: "string", description: "mode=diff: path to the memory graph saved by an earlier call" }, output_graph: { type: "string", description: "Save a memory graph here to use as a later baseline" } }, required: [] } },
@@ -365,8 +492,12 @@ const IOS_TOOLS = [
   { name: "ios_list_crashes", description: "List recent crash reports from the host's ~/Library/Logs/DiagnosticReports - where simulator app crashes land. Filter by process name, bound by age and count.", inputSchema: { type: "object", properties: { app: { type: "string", description: "Only reports whose file name (the crashed process) contains this substring" }, since_min: { type: "number", description: "Only reports newer than this many minutes" }, limit: { type: "number", description: "Max reports returned, newest first (default 20)" } } } },
 ];
 
+// Pure-JS members of the ios_* family: comparing two PNGs or listing crash
+// reports needs no simulator, so a missing Xcode must not refuse them.
+const IOS_TOOLS_WITHOUT_XCRUN = new Set(["ios_visual_diff", "ios_list_crashes", "ios_xcresult"]);
+
 async function handleIOS(name, args, ctx = {}) {
-  if (!HAS_XCRUN) return `${ERROR_PREFIX}Xcode not installed - iOS tools unavailable. Install Xcode and run: xcode-select --install`;
+  if (!HAS_XCRUN && !IOS_TOOLS_WITHOUT_XCRUN.has(name)) return `${ERROR_PREFIX}Xcode not installed - iOS tools unavailable. Install Xcode and run: xcode-select --install`;
   const did = (n) => { try { return iosDevice(n); } catch (e) { return null; } };
 
   switch (name) {
@@ -393,11 +524,13 @@ async function handleIOS(name, args, ctx = {}) {
         const parent = dirname(f);
         if (!existsSync(parent)) return `ERROR: directory does not exist: ${parent}`;
       }
-      run(`xcrun simctl io ${d} screenshot ${shq(f)}`);
+      const inline = args.path ? null : captureOptions(args);
+      discardStale(f);
+      const shot = run(`xcrun simctl io ${d} screenshot ${shq(f)}`);
+      if (isFailure(shot)) return shot;
       if (!existsSync(f)) return "ERROR: Screenshot failed";
       if (args.path) return fileResult(`Screenshot written: ${f}`, f);
-      const buf = readFileSync(f);
-      return { type: "image", data: buf.toString("base64"), mimeType: "image/png", path: f };
+      return inlineCapture(f, inline);
     }
     case "ios_tap": { const d = iosDevice(args.device_id); const r = idb(`ui tap --udid ${d} ${num(args.x, "x")} ${num(args.y, "y")}`); return (typeof r === "string" && r.startsWith("ERROR")) ? r : `Tapped (${args.x}, ${args.y})`; }
     case "ios_swipe": { const d = iosDevice(args.device_id); const dur = args.duration_ms ? ` --duration ${(args.duration_ms / 1000).toFixed(2)}` : ""; const r = idb(`ui swipe --udid ${d} ${num(args.x1, "x1")} ${num(args.y1, "y1")} ${num(args.x2, "x2")} ${num(args.y2, "y2")}${dur}`); return isFailure(r) ? r : "Swiped"; }
@@ -416,7 +549,19 @@ async function handleIOS(name, args, ctx = {}) {
     }
     case "ios_set_appearance": { const d = iosDevice(args.device_id); return run(`xcrun simctl ui ${d} appearance ${token(args.mode, "appearance mode")}`) || `Appearance: ${args.mode}`; }
     case "ios_set_content_size": { const d = iosDevice(args.device_id); return run(`xcrun simctl ui ${d} content_size ${token(args.size, "content size")}`) || `Content size: ${args.size}`; }
-    case "ios_set_locale": { const d = iosDevice(args.device_id); const bid = sanitizeId(args.bundle_id); run(`xcrun simctl spawn ${d} defaults write ${bid} AppleLanguages -array ${shq(args.language)}`); run(`xcrun simctl terminate ${d} ${bid}`); run(`xcrun simctl launch ${d} ${bid}`); return `Locale: ${args.language}`; }
+    case "ios_set_locale": {
+      const d = iosDevice(args.device_id);
+      const bid = sanitizeId(args.bundle_id);
+      const written = run(`xcrun simctl spawn ${d} defaults write ${bid} AppleLanguages -array ${shq(args.language)}`);
+      if (isFailure(written)) return written;
+      // An app that is not running has nothing to terminate; that is not a
+      // failure of the locale change, which applies at the next launch.
+      const stopped = run(`xcrun simctl terminate ${d} ${bid}`);
+      if (isFailure(stopped) && !/No such process|found nothing to terminate|not running/i.test(stopped)) return stopped;
+      const launched = run(`xcrun simctl launch ${d} ${bid}`);
+      if (isFailure(launched)) return launched;
+      return `Locale: ${args.language} (${bid} relaunched)`;
+    }
     case "ios_open_url": { const d = iosDevice(args.device_id); return run(`xcrun simctl openurl ${d} ${shq(args.url)}`) || `Opened: ${args.url}`; }
     case "ios_status_bar": {
       const d = iosDevice(args.device_id);
@@ -481,11 +626,10 @@ async function handleIOS(name, args, ctx = {}) {
     }
     case "ios_add_media": { const d = iosDevice(args.device_id); return run(`xcrun simctl addmedia ${d} ${shq(args.file_path)}`) || "Media added"; }
     case "ios_keychain_reset": { const d = iosDevice(args.device_id); return run(`xcrun simctl keychain ${d} reset`) || "Keychain reset"; }
-    case "ios_get_app_container": { const d = iosDevice(args.device_id); return run(`xcrun simctl get_app_container ${d} ${sanitizeId(args.bundle_id)} ${args.container || "app"}`); }
+    case "ios_get_app_container": { const d = iosDevice(args.device_id); return run(`xcrun simctl get_app_container ${d} ${sanitizeId(args.bundle_id)} ${token(args.container || "app", "container")}`); }
     case "ios_erase_device": { const d = iosDevice(args.device_id); return run(`xcrun simctl erase ${d}`) || "Device erased"; }
     case "ios_get_ui_tree": {
-      const script = join(__dirname, "ui-tree-dumper.swift");
-      if (!existsSync(script)) return "ui-tree-dumper.swift not found";
+      if (!existsSync(DUMPER_SOURCE)) return "ui-tree-dumper.swift not found";
       // Path check first, matching the Android sibling: the AX dump takes up to
       // 15s, too expensive to spend before rejecting a bad destination.
       if (args.path) {
@@ -493,16 +637,18 @@ async function handleIOS(name, args, ctx = {}) {
         if (!existsSync(parent)) return `${ERROR_PREFIX}directory does not exist: ${parent}`;
       }
       const depth = num(args.max_depth ?? 10, "max_depth");
-      const tree = run(`swift ${shq(script)} ${depth}`, { timeout: 15000 });
-      if (!args.path || isFailure(tree)) return tree;
+      const tree = runCapture(`${dumperCommand()} ${depth}`, { timeout: 15000 });
+      if (isFailure(tree)) return tree;
+      const dumperError = dumperErrorOf(tree);
+      if (dumperError) return `${ERROR_PREFIX}${dumperError}`;
+      if (!args.path) return tree;
       writeFileSync(String(args.path), tree);
       return fileResult(`UI tree written: ${args.path}`, String(args.path));
     }
     case "ios_accessibility_audit": {
-      const script = join(__dirname, "ui-tree-dumper.swift");
-      if (!existsSync(script)) return "ui-tree-dumper.swift not found";
+      if (!existsSync(DUMPER_SOURCE)) return "ui-tree-dumper.swift not found";
       const depth = num(args.max_depth ?? 10, "max_depth");
-      const treeJson = run(`swift ${shq(script)} ${depth}`, { timeout: 30000 });
+      const treeJson = run(`${dumperCommand()} ${depth}`, { timeout: 30000 });
       let tree = null;
       try {
         tree = JSON.parse(treeJson);
@@ -553,14 +699,14 @@ async function handleIOS(name, args, ctx = {}) {
       const binaryName = appName.replace(".app", "");
       const binaryPath = `${appDir}/${binaryName}`;
       // 2. Binary size
-      const sizeOut = run(`stat -f "%z" ${shq(binaryPath)} 2>/dev/null`);
-      if (sizeOut) { const sizeMB = parseInt(sizeOut) / 1048576; findings.push({ check: "binary_size", value: `${sizeMB.toFixed(1)} MB`, status: sizeMB > 500 ? "warning" : "pass", detail: sizeMB > 500 ? "Binary exceeds 500MB - may hit App Store limits" : "OK" }); }
+      try { const sizeMB = statSync(binaryPath).size / 1048576; findings.push({ check: "binary_size", value: `${sizeMB.toFixed(1)} MB`, status: sizeMB > 500 ? "warning" : "pass", detail: sizeMB > 500 ? "Binary exceeds 500MB - may hit App Store limits" : "OK" }); } catch {}
       // 3. Debug tool leak check
       const debugSymbols = run(`nm ${shq(binaryPath)} 2>/dev/null | grep -iE "FLEX|Reveal|Stetho|Flipper|CocoaDebug|Pulse" | head -10`);
       findings.push({ check: "debug_tools", status: debugSymbols ? "critical" : "pass", detail: debugSymbols ? `Debug tools found in binary: ${debugSymbols}` : "No debug tools detected" });
-      // 4. Code signing
-      const codesign = run(`codesign -dvv ${shq(appDir)} 2>&1`);
-      const hasSignature = codesign && !codesign.includes("not signed");
+      // 4. Code signing. codesign exits 1 on an unsigned bundle, and run()'s
+      // failure marker does not carry its "not signed" line; runCapture does.
+      const codesign = runCapture(`codesign -dvv ${shq(appDir)} 2>&1`);
+      const hasSignature = codesign && !isFailure(codesign) && !codesign.includes("not signed");
       findings.push({ check: "code_signing", status: hasSignature ? "pass" : "critical", detail: hasSignature ? "Signed" : "NOT SIGNED - will be rejected" });
       // 5. Provisioning profile
       const provProfile = run(`ls ${shq(appDir + "/embedded.mobileprovision")} 2>/dev/null`);
@@ -689,7 +835,16 @@ async function handleIOS(name, args, ctx = {}) {
       if (args.project && args.workspace) return "ERROR: pass project OR workspace, not both";
       const action = args.action || "build";
       const config = args.configuration || "Release";
-      const dest = args.destination || "generic/platform=iOS Simulator";
+      let dest = args.destination;
+      if (!dest) {
+        if (action === "test") {
+          const d = did();
+          if (!d) return `${ERROR_PREFIX}action "test" needs a booted simulator: xcodebuild refuses generic/platform=iOS Simulator for test. Boot one with ios_boot_device, or pass destination explicitly.`;
+          dest = `platform=iOS Simulator,id=${d}`;
+        } else {
+          dest = "generic/platform=iOS Simulator";
+        }
+      }
       const id = `xcresult-${new Date().toISOString().replace(/[-:.TZ]/g, "").slice(0, 14)}-${Math.random().toString(36).slice(2, 8)}`;
       const xcresultPath = join(SCREENSHOT_DIR, `${id}.xcresult`);
       const logPath = join(SCREENSHOT_DIR, `${id}.log`);
@@ -804,13 +959,21 @@ async function handleIOS(name, args, ctx = {}) {
       return diffImagePath ? fileResult(report, diffImagePath) : report;
     }
     case "ios_leaks": {
-      let pid = Number.isInteger(args.pid) ? args.pid : null;
+      // The schema validator accepts a numeric string for `pid`, so coerce
+      // rather than re-check the raw type here.
+      const pidNum = args.pid === undefined || args.pid === null || args.pid === "" ? NaN : Number(args.pid);
+      let pid = Number.isInteger(pidNum) && pidNum > 0 ? pidNum : null;
       if (!pid && args.bundle_id) {
         const d = iosDevice(args.device_id);
-        const out = run(`xcrun simctl spawn ${d} launchctl list 2>/dev/null | grep ${shq(sanitizeId(args.bundle_id))}`);
-        const m = out && out.match(/^(\d+)\s/m);
-        if (!m) return `ERROR: no running process for ${args.bundle_id} on the booted simulator; launch it first`;
-        pid = parseInt(m[1], 10);
+        const id = sanitizeId(args.bundle_id);
+        const out = run(`xcrun simctl spawn ${d} launchctl list 2>/dev/null`);
+        if (isFailure(out)) return out;
+        // Whole-token match: a substring grep of com.x also matched com.xy, and
+        // the dots were regex wildcards.
+        const label = new RegExp(`(^|[^A-Za-z0-9._-])${id.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&")}($|[^A-Za-z0-9._-])`);
+        const line = out.split("\n").find((l) => /^\d+\s/.test(l) && label.test(l));
+        if (!line) return `ERROR: no running process for ${args.bundle_id} on the booted simulator; launch it first`;
+        pid = parseInt(line, 10);
       }
       if (!pid) return "ERROR: pass pid or bundle_id";
 
@@ -823,8 +986,12 @@ async function handleIOS(name, args, ctx = {}) {
       const diffArg = mode === "diff" ? ` --diffFrom=${shq(args.baseline_graph)}` : "";
       // leaks exits 1 when it FINDS leaks, so a non-zero status is a result and
       // not a failure. Everything below is decided from the parsed output.
-      const raw = runCapture(`leaks ${pid}${diffArg}${graphOut} 2>&1`, { timeout: 120000 });
-      const parsed = parseLeaksOutput(raw);
+      // spawnCollect rather than execSync: a two-minute scan must not block the
+      // event loop, and its output is capped instead of killing the child.
+      const res = await spawnCollect(`leaks ${pid}${diffArg}${graphOut} 2>&1`, { timeout: 120000, signal: ctx.signal });
+      if (res.timedOut) return `${ERROR_PREFIX}leaks did not finish within 120s for pid ${pid}`;
+      if (res.aborted) return `${ERROR_PREFIX}leaks cancelled`;
+      const parsed = parseLeaksOutput(res.output);
       return JSON.stringify({
         pid,
         mode,
@@ -847,14 +1014,28 @@ async function handleIOS(name, args, ctx = {}) {
       const only = args.test_identifier ? ` -only-testing:${shq(args.test_identifier)}` : "";
       // xcodebuild exits non-zero when the audit finds anything, because each
       // finding is an XCTest failure. That is a result, not a failure to run.
-      runCapture(
-        `xcodebuild test ${container} -scheme ${shq(args.scheme)} -destination ${shq(`platform=iOS Simulator,id=${d}`)} -resultBundlePath ${shq(bundle)}${only} 2>&1`,
-        { timeout: 900000 },
-      );
+      // spawnCollect: a 15-minute test run through execSync blocked the event
+      // loop for its whole duration, and its 1MB maxBuffer killed the child on
+      // any real build log.
+      const stopHeartbeat = startHeartbeat(ctx, "xcodebuild test (accessibility audit)");
+      let build;
+      try {
+        build = await spawnCollect(
+          `xcodebuild test ${container} -scheme ${shq(args.scheme)} -destination ${shq(`platform=iOS Simulator,id=${d}`)} -resultBundlePath ${shq(bundle)}${only} 2>&1`,
+          { timeout: 900000, signal: ctx.signal },
+        );
+      } finally {
+        stopHeartbeat();
+      }
       if (!existsSync(bundle)) {
-        return JSON.stringify({ measurable: false, reason: "xcodebuild produced no result bundle; the build failed before any test ran", test_ran: false, findings: [] }, null, 2);
+        const reason = build.timedOut
+          ? "xcodebuild did not finish within 900s; no result bundle was written"
+          : build.aborted
+            ? "the request was cancelled before xcodebuild finished"
+            : "xcodebuild produced no result bundle; the build failed before any test ran";
+        return JSON.stringify({ measurable: false, reason, test_ran: false, findings: [] }, null, 2);
       }
-      const json = runCapture(`xcrun xcresulttool get test-results tests --path ${shq(bundle)} --format json 2>&1`, { timeout: 60000 });
+      const json = (await spawnCollect(`xcrun xcresulttool get test-results tests --path ${shq(bundle)} --format json 2>&1`, { timeout: 60000, signal: ctx.signal })).output;
       const r = parseAuditResults(json, args.test_identifier || null);
       return JSON.stringify({
         measurable: r.measurable,
@@ -897,14 +1078,23 @@ async function handleIOS(name, args, ctx = {}) {
 // model-controlled device_id a command injection.
 function adbFlag(id) { return id ? `-s ${deviceSerial(id)}` : ""; }
 
+// One rule for both launchers: `activity` is the class, relative or fully
+// qualified, and the component is package/activity. A value that already
+// carries the package (com.x/.Main) is used as it is.
+function androidComponent(packageName, activity) {
+  const pkg = sanitizeId(packageName);
+  const act = sanitizeId(activity);
+  return act.includes("/") ? act : `${pkg}/${act}`;
+}
+
 const ANDROID_TOOLS = [
   { name: "android_list_devices", description: "List connected Android devices and emulators", inputSchema: { type: "object", properties: {} } },
-  { name: "android_screenshot", description: "Capture an Android screenshot. Returns a base64 PNG by default; pass `path` to write the file and return only its location - a base64 image per capture exhausts the caller's context on multi-capture runs.", inputSchema: { type: "object", properties: { device_id: { type: "string" }, path: { type: "string", description: "Absolute file path to write the PNG to. The parent directory must already exist. Returns the path instead of the image." } } } },
+  { name: "android_screenshot", description: "Capture an Android screenshot. Without `path` the image comes back inline, downscaled to 800 px on the longest side as a quality-80 JPEG (~60 KB instead of a multi-MB full-resolution PNG on every capture); `format: \"png\"` with `max_width: 0` returns the original PNG bytes. Downscaling needs sips (macOS); without it the original PNG is returned and the result says so. Pass `path` to write the full-resolution PNG there and return only its location - what a multi-capture run and the design tools need.", inputSchema: { type: "object", properties: { device_id: { type: "string" }, path: { type: "string", description: "Absolute file path to write the PNG to. The parent directory must already exist. Returns the path instead of the image." }, max_width: { type: "integer", description: "Longest side of the inline image in pixels (default 800). 0 keeps the original size. Ignored with `path`." }, format: { type: "string", enum: ["jpeg", "png"], description: "Inline image format (default jpeg). Ignored with `path`." }, quality: { type: "integer", description: "JPEG quality 1-100 (default 80). Ignored for png and with `path`." } } } },
   { name: "android_tap", description: "Tap at coordinates on Android", inputSchema: { type: "object", properties: { x: { type: "number" }, y: { type: "number" }, device_id: { type: "string" } }, required: ["x", "y"] } },
   { name: "android_swipe", description: "Swipe on Android", inputSchema: { type: "object", properties: { x1: { type: "number" }, y1: { type: "number" }, x2: { type: "number" }, y2: { type: "number" }, duration_ms: { type: "number" }, device_id: { type: "string" } }, required: ["x1", "y1", "x2", "y2"] } },
-  { name: "android_type_text", description: "Type text on Android", inputSchema: { type: "object", properties: { text: { type: "string" }, device_id: { type: "string" } }, required: ["text"] } },
+  { name: "android_type_text", description: "Type text on Android via `adb shell input text`. The text reaches the device shell as a quoted literal, so shell characters are typed, not interpreted. Platform limit: `input text` drops non-ASCII characters and some symbols; use the keyboard for those.", inputSchema: { type: "object", properties: { text: { type: "string" }, device_id: { type: "string" } }, required: ["text"] } },
   { name: "android_key_event", description: "Send Android key event (HOME=3, BACK=4, ENTER=66)", inputSchema: { type: "object", properties: { keycode: { type: "number" }, device_id: { type: "string" } }, required: ["keycode"] } },
-  { name: "android_launch_app", description: "Launch Android app by package name", inputSchema: { type: "object", properties: { package_name: { type: "string" }, activity: { type: "string" }, device_id: { type: "string" } }, required: ["package_name"] } },
+  { name: "android_launch_app", description: "Launch Android app by package name", inputSchema: { type: "object", properties: { package_name: { type: "string" }, activity: { type: "string", description: "Activity class, relative (.MainActivity) or fully qualified (com.example.MainActivity); started as package_name/activity. Omit to launch through the LAUNCHER intent." }, device_id: { type: "string" } }, required: ["package_name"] } },
   { name: "android_stop_app", description: "Force-stop Android app", inputSchema: { type: "object", properties: { package_name: { type: "string" }, device_id: { type: "string" } }, required: ["package_name"] } },
   { name: "android_list_packages", description: "List installed Android packages", inputSchema: { type: "object", properties: { filter: { type: "string" }, device_id: { type: "string" } } } },
   { name: "android_go_home", description: "Press Android home button", inputSchema: { type: "object", properties: { device_id: { type: "string" } } } },
@@ -924,13 +1114,26 @@ const ANDROID_TOOLS = [
   { name: "android_open_url", description: "Open URL or deep link on Android", inputSchema: { type: "object", properties: { url: { type: "string" }, device_id: { type: "string" } }, required: ["url"] } },
   { name: "android_clear_app_data", description: "Clear all data for Android app", inputSchema: { type: "object", properties: { package_name: { type: "string" }, device_id: { type: "string" } }, required: ["package_name"] } },
   { name: "android_accessibility_audit", description: "Audit Android app accessibility on the connected device: missing contentDescription, clickable nodes TalkBack cannot focus, touch targets under 48dp, missing resource-ids, and whether the reading order follows the visual layout. Reports measurable:false with a reason rather than a clean result when the dump could not be read.", inputSchema: { type: "object", properties: { device_id: { type: "string" }, scope: { type: "string", description: "Filter: only audit elements whose resource-id contains this prefix (e.g. 'login_', 'com.example:id/login_'). Omit to audit all." }, rtl: { type: "boolean", description: "Expect right-to-left reading within a row. Default false." } } } },
-  { name: "android_launch_time", description: "Measure Android app launch time: force-stops the package, starts it with am start -W, and reports TotalTime/WaitTime in ms plus the platform's own LaunchState (COLD/WARM/HOT). Below Android 10 there is no LaunchState and cold_start is null rather than assumed.", inputSchema: { type: "object", properties: { package_name: { type: "string" }, activity: { type: "string" }, device_id: { type: "string" } }, required: ["package_name"] } },
+  { name: "android_launch_time", description: "Measure Android app launch time: force-stops the package, starts it with am start -W, and reports TotalTime/WaitTime in ms plus the platform's own LaunchState (COLD/WARM/HOT). Below Android 10 there is no LaunchState and cold_start is null rather than assumed.", inputSchema: { type: "object", properties: { package_name: { type: "string" }, activity: { type: "string", description: "Activity class, relative (.MainActivity) or fully qualified (com.example.MainActivity); started as package_name/activity. Default .MainActivity." }, device_id: { type: "string" } }, required: ["package_name"] } },
   { name: "android_apk_audit", description: "Audit APK/AAB for Play Store compliance: debug flag, target SDK, permissions, signing, ProGuard", inputSchema: { type: "object", properties: { apk_path: { type: "string", description: "Path to .apk file" } }, required: ["apk_path"] } },
   { name: "android_meminfo", description: "Read an Android app's memory via `adb shell dumpsys meminfo` (KB, no root). mode=snapshot returns the App Summary rows and totals; mode=diff compares two snapshots so growth across the same flow is visible, which is the signal a leak actually produces - a single absolute number says almost nothing. Reports measurable:false when the package has no running process rather than returning zeros.", inputSchema: { type: "object", properties: { package_name: { type: "string" }, device_id: { type: "string" }, mode: { type: "string", enum: ["snapshot", "diff"], description: "Default: snapshot" }, baseline_json: { type: "string", description: "mode=diff: the JSON returned by an earlier snapshot call" } }, required: ["package_name"] } },
   { name: "android_list_crashes", description: "Dump the Android crash log buffer (`adb logcat -b crash -d`), tail-bounded. Empty output means no crashes since the buffer was last cleared.", inputSchema: { type: "object", properties: { lines: { type: "number", description: "Max lines returned, from the end (default 200)" }, device_id: { type: "string" } } } },
   { name: "android_set_orientation", description: "Rotate the Android screen to portrait or landscape. Disables accelerometer rotation and pins user_rotation, so the device stays put until rotation is re-enabled. Accounts for the device's natural orientation (detected via wm size), so landscape-natural tablets rotate correctly too. No iOS counterpart: simctl exposes no rotation lever.", inputSchema: { type: "object", properties: { orientation: { type: "string", enum: ["portrait", "landscape"] }, device_id: { type: "string" } }, required: ["orientation"] } },
 ];
 
+// The snapshot shape the tool emits, and the shape diffMeminfo accepts back
+// as a baseline. One function so the two cannot drift apart again.
+function meminfoPayload(snapshot) {
+  return {
+    measurable: snapshot.measurable,
+    reason: snapshot.reason,
+    pss_kb: snapshot.pss,
+    total_pss_kb: snapshot.totalPssKb,
+    total_rss_kb: snapshot.totalRssKb,
+    total_swap_kb: snapshot.totalSwapKb,
+  };
+}
+
 async function handleAndroid(name, args, ctx = {}) {
   if (!HAS_ADB) return `${ERROR_PREFIX}Android SDK not installed - adb not on PATH, so Android tools cannot run. Install platform-tools and ensure adb is on PATH.`;
   const df = adbFlag(args.device_id);
@@ -943,21 +1146,24 @@ async function handleAndroid(name, args, ctx = {}) {
         const parent = dirname(f);
         if (!existsSync(parent)) return `${ERROR_PREFIX}directory does not exist: ${parent}`;
       }
-      run(`adb ${df} shell screencap -p /sdcard/_mcp_screen.png`);
-      run(`adb ${df} pull /sdcard/_mcp_screen.png ${shq(f)}`);
+      const inline = args.path ? null : captureOptions(args);
+      discardStale(f);
+      const cap = run(`adb ${df} shell screencap -p /sdcard/_mcp_screen.png`);
+      if (isFailure(cap)) return cap;
+      const pulled = run(`adb ${df} pull /sdcard/_mcp_screen.png ${shq(f)}`);
       run(`adb ${df} shell rm /sdcard/_mcp_screen.png`);
+      if (isFailure(pulled)) return pulled;
       if (!existsSync(f)) return "ERROR: Screenshot failed";
       if (args.path) return fileResult(`Screenshot written: ${f}`, f);
-      const buf = readFileSync(f);
-      return { type: "image", data: buf.toString("base64"), mimeType: "image/png", path: f };
+      return inlineCapture(f, inline);
     }
     case "android_tap": return run(`adb ${df} shell input tap ${num(args.x, "x")} ${num(args.y, "y")}`) || `Tapped (${args.x}, ${args.y})`;
     case "android_swipe": return run(`adb ${df} shell input swipe ${num(args.x1, "x1")} ${num(args.y1, "y1")} ${num(args.x2, "x2")} ${num(args.y2, "y2")} ${num(args.duration_ms || 300, "duration_ms")}`) || "Swiped";
     // `adb shell input text` wants spaces as %s; single-quote the result so the
     // remaining characters cannot reach the shell as syntax.
-    case "android_type_text": return run(`adb ${df} shell input text ${shq(String(args.text ?? "").replace(/ /g, "%s"))}`) || `Typed: ${args.text}`;
+    case "android_type_text": return run(`adb ${df} shell input text ${remoteShq(String(args.text ?? "").replace(/ /g, "%s"))}`) || `Typed: ${args.text}`;
     case "android_key_event": return run(`adb ${df} shell input keyevent ${token(args.keycode, "keycode")}`) || `Key ${args.keycode}`;
-    case "android_launch_app": return args.activity ? run(`adb ${df} shell am start -n ${sanitizeId(args.package_name)}/${sanitizeId(args.activity)}`) : run(`adb ${df} shell monkey -p ${sanitizeId(args.package_name)} -c android.intent.category.LAUNCHER 1`) || `Launched`;
+    case "android_launch_app": return args.activity ? run(`adb ${df} shell am start -n ${androidComponent(args.package_name, args.activity)}`) : run(`adb ${df} shell monkey -p ${sanitizeId(args.package_name)} -c android.intent.category.LAUNCHER 1`) || `Launched`;
     case "android_stop_app": return run(`adb ${df} shell am force-stop ${sanitizeId(args.package_name)}`) || "Stopped";
     case "android_list_packages": { const out = run(`adb ${df} shell pm list packages`); return args.filter ? out.split("\n").filter(l => l.toLowerCase().includes(args.filter.toLowerCase())).join("\n") : out; }
     case "android_go_home": return run(`adb ${df} shell input keyevent 3`) || "Home";
@@ -968,9 +1174,12 @@ async function handleAndroid(name, args, ctx = {}) {
         const parent = dirname(f);
         if (!existsSync(parent)) return `${ERROR_PREFIX}directory does not exist: ${parent}`;
       }
-      run(`adb ${df} shell uiautomator dump /sdcard/_mcp_ui.xml`);
-      run(`adb ${df} pull /sdcard/_mcp_ui.xml ${shq(f)}`);
+      discardStale(f);
+      const dumped = run(`adb ${df} shell uiautomator dump /sdcard/_mcp_ui.xml`);
+      if (isFailure(dumped)) return dumped;
+      const pulled = run(`adb ${df} pull /sdcard/_mcp_ui.xml ${shq(f)}`);
       run(`adb ${df} shell rm /sdcard/_mcp_ui.xml`);
+      if (isFailure(pulled)) return pulled;
       if (!existsSync(f)) return "ERROR: UI dump failed";
       if (args.filter === "interactive") {
         const elements = interactiveElements(readFileSync(f, "utf-8"));
@@ -1076,7 +1285,7 @@ async function handleAndroid(name, args, ctx = {}) {
     case "android_uninstall_app": return run(`adb ${df} shell pm uninstall ${sanitizeId(args.package_name)}`) || "Uninstalled";
     case "android_logcat": { const lines = args.lines !== undefined ? num(args.lines, "lines") : 50; const tf = args.tag ? `| grep -i ${shq(args.tag)}` : ""; return run(`adb ${df} logcat -d ${tf} | tail -${lines}`); }
     case "android_get_screen_size": return run(`adb ${df} shell wm size`);
-    case "android_open_url": return run(`adb ${df} shell am start -a android.intent.action.VIEW -d ${shq(args.url)}`) || `Opened: ${args.url}`;
+    case "android_open_url": return run(`adb ${df} shell am start -a android.intent.action.VIEW -d ${remoteShq(args.url)}`) || `Opened: ${args.url}`;
     case "android_clear_app_data": return run(`adb ${df} shell pm clear ${sanitizeId(args.package_name)}`) || "Cleared";
     case "android_accessibility_audit": {
       run(`adb ${df} shell uiautomator dump /sdcard/_mcp_a11y.xml`);
@@ -1101,8 +1310,8 @@ async function handleAndroid(name, args, ctx = {}) {
     }
     case "android_launch_time": {
       run(`adb ${df} shell am force-stop ${sanitizeId(args.package_name)}`);
-      const activity = sanitizeId(args.activity || `${args.package_name}/.MainActivity`);
-      const result = run(`adb ${df} shell am start -W -n ${activity} 2>&1`);
+      const component = androidComponent(args.package_name, args.activity || ".MainActivity");
+      const result = run(`adb ${df} shell am start -W -n ${component} 2>&1`);
       const parsed = parseLaunchOutput(result);
       return JSON.stringify({
         package: args.package_name,
@@ -1122,7 +1331,7 @@ async function handleAndroid(name, args, ctx = {}) {
       if (!existsSync(p)) return `ERROR: APK not found at ${p}`;
       const findings = [];
       // 1. Basic info via aapt2
-      const aapt = run(`aapt2 dump badging ${shq(p)} 2>/dev/null`) || run(`aapt dump badging ${shq(p)} 2>/dev/null`);
+      const aapt = runOrNull(`aapt2 dump badging ${shq(p)} 2>/dev/null`) || runOrNull(`aapt dump badging ${shq(p)} 2>/dev/null`);
       if (aapt) {
         const pkg = aapt.match(/package: name='([^']*)'/)?.[1];
         const versionName = aapt.match(/versionName='([^']*)'/)?.[1];
@@ -1143,19 +1352,29 @@ async function handleAndroid(name, args, ctx = {}) {
       } else {
         findings.push({ check: "aapt", status: "warning", detail: "aapt2/aapt not found - install Android SDK Build-Tools for full audit" });
       }
-      // 2. Signing check
-      const signingInfo = run(`apksigner verify --print-certs ${shq(p)} 2>&1`);
-      if (signingInfo && !signingInfo.includes("ERROR")) {
-        const hasV2 = signingInfo.includes("v2 scheme") || run(`apksigner verify -v ${shq(p)} 2>&1`)?.includes("Verified using v2");
+      // 2. Signing check. apksigner exits 1 on a failed verification with the
+      // verdict on stdout, so the output is captured whatever the status.
+      const signingInfo = runCapture(`apksigner verify --print-certs ${shq(p)} 2>&1`);
+      if (/DOES NOT VERIFY/.test(signingInfo)) {
+        findings.push({ check: "signing", status: "critical", detail: signingInfo.slice(0, 500) });
+      } else if (isFailure(signingInfo) || /command not found|No such file or directory/i.test(signingInfo)) {
+        findings.push({ check: "signing", status: "warning", detail: "apksigner not found - install Android SDK Build-Tools to verify the signature" });
+      } else if (/^(ERROR|Exception)/m.test(signingInfo)) {
+        findings.push({ check: "signing", status: "warning", detail: signingInfo.slice(0, 500) });
+      } else {
+        const hasV2 = signingInfo.includes("v2 scheme") || (runOrNull(`apksigner verify -v ${shq(p)} 2>&1`) || "").includes("Verified using v2");
         findings.push({ check: "signing", status: "pass", detail: "APK is signed" });
         findings.push({ check: "signing_v2", status: hasV2 ? "pass" : "warning", detail: hasV2 ? "v2+ signature present" : "Only v1 signature - consider v2+ for tamper protection" });
-      } else {
-        findings.push({ check: "signing", status: signingInfo?.includes("DOES NOT VERIFY") ? "critical" : "warning", detail: signingInfo || "apksigner not found" });
       }
       // 3. File size
-      try { const stat = run(`stat -f "%z" ${shq(p)} 2>/dev/null`) || run(`stat -c "%s" ${shq(p)} 2>/dev/null`); if (stat) { const mb = parseInt(stat) / 1048576; findings.push({ check: "apk_size", value: `${mb.toFixed(1)} MB`, status: mb > 150 ? "warning" : "pass", detail: mb > 150 ? "APK > 150MB - consider App Bundle (.aab)" : "OK" }); } } catch {}
+      try {
+        const mb = statSync(p).size / 1048576;
+        findings.push({ check: "apk_size", value: `${mb.toFixed(1)} MB`, status: mb > 150 ? "warning" : "pass", detail: mb > 150 ? "APK > 150MB - consider App Bundle (.aab)" : "OK" });
+      } catch (e) {
+        findings.push({ check: "apk_size", status: "warning", detail: `could not read the file size: ${e.message}` });
+      }
       // 4. ProGuard/R8 check
-      const hasMapping = run(`unzip -l ${shq(p)} 2>/dev/null | grep -c "classes.dex"`)?.trim();
+      const hasMapping = runOrNull(`unzip -l ${shq(p)} 2>/dev/null | grep -c "classes.dex"`);
       const dexCount = parseInt(hasMapping) || 0;
       findings.push({ check: "dex_files", value: `${dexCount} dex file(s)`, status: dexCount > 3 ? "warning" : "info", detail: dexCount > 3 ? "Many DEX files - ensure R8/ProGuard minification is enabled" : "OK" });
       // Summary
@@ -1177,18 +1396,9 @@ async function handleAndroid(name, args, ctx = {}) {
           return "ERROR: baseline_json is not valid JSON";
         }
         const d = diffMeminfo(before, snapshot);
-        return JSON.stringify({ package: args.package_name, mode, comparable: d.comparable, reason: d.reason, delta_kb: d.deltaKb, total_pss_delta_kb: d.totalPssDeltaKb, after: snapshot }, null, 2);
+        return JSON.stringify({ package: args.package_name, mode, comparable: d.comparable, reason: d.reason, delta_kb: d.deltaKb, total_pss_delta_kb: d.totalPssDeltaKb, after: meminfoPayload(snapshot) }, null, 2);
       }
-      return JSON.stringify({
-        package: args.package_name,
-        mode,
-        measurable: snapshot.measurable,
-        reason: snapshot.reason,
-        pss_kb: snapshot.pss,
-        total_pss_kb: snapshot.totalPssKb,
-        total_rss_kb: snapshot.totalRssKb,
-        total_swap_kb: snapshot.totalSwapKb,
-      }, null, 2);
+      return JSON.stringify({ package: args.package_name, mode, ...meminfoPayload(snapshot) }, null, 2);
     }
     case "android_list_crashes": {
       const lines = args.lines !== undefined ? num(args.lines, "lines") : 200;
@@ -1224,9 +1434,15 @@ async function handleAndroid(name, args, ctx = {}) {
 
 let _browser = null;
 let _page = null;
-
-async function ensureBrowser(browserType = "chromium") {
-  if (_browser && _page) return _page;
+let _engine = null;
+
+// A request for a different engine closes the current browser and relaunches;
+// a partial launch (newContext/newPage threw) is closed rather than left as a
+// browser with no page that the next call would launch beside.
+async function ensureBrowser(browserType) {
+  const wanted = browserType || _engine || "chromium";
+  if (_browser && _page && _engine === wanted) return _page;
+  if (_browser || _page) await closeBrowser();
   let pw;
   try {
     pw = await import("playwright");
@@ -1234,10 +1450,17 @@ async function ensureBrowser(browserType = "chromium") {
     throw new Error("Web tools require Playwright. Install once with: npm i -g playwright && npx playwright install chromium");
   }
   const engines = { chromium: pw.chromium, webkit: pw.webkit, firefox: pw.firefox };
-  const engine = engines[browserType] || pw.chromium;
+  const engine = engines[wanted];
+  if (!engine) throw new Error(`unknown browser engine: ${wanted}`);
   _browser = await engine.launch({ headless: true });
-  const ctx = await _browser.newContext();
-  _page = await ctx.newPage();
+  try {
+    const ctx = await _browser.newContext();
+    _page = await ctx.newPage();
+  } catch (e) {
+    await closeBrowser();
+    throw e;
+  }
+  _engine = wanted;
   return _page;
 }
 
@@ -1246,6 +1469,7 @@ async function closeBrowser() {
   try { await _browser?.close(); } catch {}
   _page = null;
   _browser = null;
+  _engine = null;
 }
 
 const WEB_TOOLS = [
@@ -1350,11 +1574,17 @@ const AGENT_TOOLS = [
 // a batch able to nest itself has no recursion bound.
 async function dispatchStep(tool, stepArgs) {
   if (tool.startsWith("agent_")) throw new Error(`Nested batch steps are not supported: ${tool}`);
+  // The same boundary check a direct call gets: a batched step used to reach
+  // the handler with its enum/type/required contract unenforced.
+  const schemaError = validateArgs(tool, stepArgs);
+  if (schemaError) throw new Error(`invalid arguments: ${schemaError}`);
   let result;
   if (tool.startsWith("ios_")) result = await handleIOS(tool, stepArgs);
   else if (tool.startsWith("android_")) result = await handleAndroid(tool, stepArgs);
   else if (tool.startsWith("web_")) result = await handleWeb(tool, stepArgs);
   else if (tool.startsWith("design_")) result = await handleDesign(tool, stepArgs, designCtx);
+  else if (tool.startsWith("code_")) result = await handleCode(tool, stepArgs, {});
+  else if (tool.startsWith("pass_")) result = await handlePass(tool, stepArgs);
   else throw new Error(`Unknown tool: ${tool}`);
   // Every handler's `default:` arm returns null, and that is its only source of
   // null, so null means "I do not recognise this tool". The throw below used to
@@ -1433,7 +1663,15 @@ async function handleAgent(name, args) {
 
 // ── Server ──
 
-const ALL_TOOLS = [...IOS_TOOLS, ...ANDROID_TOOLS, ...WEB_TOOLS, ...AGENT_TOOLS, ...DESIGN_TOOLS];
+const ALL_TOOLS = [
+  ...IOS_TOOLS,
+  ...ANDROID_TOOLS,
+  ...WEB_TOOLS,
+  ...AGENT_TOOLS,
+  ...DESIGN_TOOLS,
+  ...CODE_TOOLS,
+  ...PASS_TOOLS,
+];
 
 // Name -> inputSchema, so the CallTool boundary can enforce the declared shape.
 const TOOL_SCHEMAS = new Map(ALL_TOOLS.map((t) => [t.name, t.inputSchema || {}]));
@@ -1497,6 +1735,11 @@ const READ_ONLY_TOOLS = new Set([
   "android_list_crashes",
   "web_screenshot", "web_get_text",
   "design_mock_detect", "design_scenario_inventory", "design_ui_geometry", "design_visual_compare",
+  // Seven of the eight. Every code_* tool reads source and answers; the one
+  // that is not here stops a cached server.
+  ...CODE_READ_ONLY,
+  // pass_build writes a file the caller named; the other three only read.
+  ...PASS_READ_ONLY,
 ]);
 
 // Irreversible on the target device: data loss the caller cannot undo.
@@ -1518,6 +1761,7 @@ const IDEMPOTENT_TOOLS = new Set([
   "android_set_locale", "android_set_location", "android_grant_permission", "android_revoke_permission",
   "android_set_orientation",
   "web_close",
+  ...CODE_IDEMPOTENT,
 ]);
 
 // Web tools reach arbitrary sites; everything else talks to a local simulator,
@@ -1611,7 +1855,7 @@ const bundleAuditSchema = (pathKey) => ({
       items: {
         type: "object",
         properties: {
-          status: { type: "string", enum: ["pass", "warning", "critical"] },
+          status: { type: "string", enum: ["pass", "warning", "critical", "info"] },
           rule: { type: "string" },
           message: { type: "string" },
         },
@@ -1621,6 +1865,10 @@ const bundleAuditSchema = (pathKey) => ({
 });
 
 const OUTPUT_SCHEMAS = {
+  // Every code_* root is an object. A `{type:"array"}` root on ONE tool once
+  // made all 78 unavailable in Claude Code - see the note further down.
+  ...CODE_OUTPUT_SCHEMAS,
+  ...PASS_OUTPUT_SCHEMAS,
   ios_accessibility_audit: ACCESSIBILITY_AUDIT_SCHEMA,
   android_accessibility_audit: ACCESSIBILITY_AUDIT_SCHEMA,
 
@@ -1664,7 +1912,7 @@ const OUTPUT_SCHEMAS = {
       max_diff_pct: { type: "number" },
       baseline: { type: "string" },
       current: { type: "string" },
-      diff_image: { type: "string" },
+      diff_image: { type: ["string", "null"] },
     },
   },
 
@@ -1694,9 +1942,11 @@ const OUTPUT_SCHEMAS = {
     required: ["package", "cold_start"],
     properties: {
       package: { type: "string" },
-      cold_start: { type: "boolean" },
+      launch_state: { type: ["string", "null"] },
+      cold_start: { type: ["boolean", "null"] },
       total_time_ms: { type: ["integer", "null"] },
       wait_time_ms: { type: ["integer", "null"] },
+      error: { type: ["string", "null"] },
       raw: { type: "string" },
     },
   },
@@ -1733,9 +1983,11 @@ const OUTPUT_SCHEMAS = {
         items: {
           type: "object",
           properties: {
+            step: { type: "integer" },
             tool: { type: "string" },
             status: { type: "string", enum: ["ok", "error"] },
-            output: { type: "string" },
+            result: { type: "string" },
+            error: { type: "string" },
           },
         },
       },
@@ -1773,7 +2025,8 @@ const designCtx = {
   adbFlag,
   idb,
   hasIdb: HAS_IDB,
-  dumperScript: join(__dirname, "ui-tree-dumper.swift"),
+  dumperScript: DUMPER_SOURCE,
+  dumperCommand,
 };
 
 server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: ANNOTATED_TOOLS }));
@@ -1813,6 +2066,10 @@ server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
     else if (name.startsWith("web_")) result = await handleWeb(name, args || {});
     else if (name.startsWith("agent_")) result = await handleAgent(name, args || {});
     else if (name.startsWith("design_")) result = await handleDesign(name, args || {}, designCtx);
+    // ...ctx, unlike the design_ line above: code-intel needs `signal` so an
+    // aborted call cancels the in-flight LSP request instead of orphaning it.
+    else if (name.startsWith("code_")) result = await handleCode(name, args || {}, ctx);
+    else if (name.startsWith("pass_")) result = await handlePass(name, args || {});
     else return { content: [{ type: "text", text: `Unknown tool: ${name}` }], isError: true };
     // Same reason as dispatchStep: a handler returns null only from its
     // `default:` arm, so an unrecognised name that happens to carry a known
@@ -1821,11 +2078,12 @@ server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
     if (result === null || result === undefined) {
       return { content: [{ type: "text", text: `Unknown tool: ${name}` }], isError: true };
     }
+    pruneWorkDir(SCREENSHOT_DIR, { keep: promisedPaths(result) });
     if (typeof result === "object" && result?.type === "image") {
       return {
         content: [
           { type: "image", data: result.data, mimeType: result.mimeType },
-          { type: "text", text: `Screenshot: ${result.path}` },
+          { type: "text", text: `Screenshot: ${result.path}${result.note ?? ""}` },
           ...(result.path ? [{ type: "resource_link", uri: `file://${result.path}`, name: basename(result.path), mimeType: result.mimeType }] : []),
         ],
       };
@@ -1882,8 +2140,8 @@ function stopRecorders() {
   }
 }
 
-process.on("SIGTERM", async () => { stopRecorders(); await closeBrowser(); process.exit(0); });
-process.on("SIGINT", async () => { stopRecorders(); await closeBrowser(); process.exit(0); });
+process.on("SIGTERM", async () => { stopRecorders(); shutdownAllLsp(); await closeBrowser(); process.exit(0); });
+process.on("SIGINT", async () => { stopRecorders(); shutdownAllLsp(); await closeBrowser(); process.exit(0); });
 
 const transport = new StdioServerTransport();
 await server.connect(transport);