@slack/radar-mcp 1.2.0 → 1.4.0

package/dist/mcp/snapshot.d.ts

@@ -0,0 +1,63 @@
+import type { DeviceTransport } from "../shared/transport.js";
+export interface SnapshotOptions {
+    includeLogs?: boolean;
+    includeScreenshot?: boolean;
+    logTailLines?: number;
+}
+export interface SnapshotResult {
+    path: string;
+    files: string[];
+    zip_path: string | null;
+    timestamp: number;
+    counts: {
+        network: number;
+        rtm: number;
+        clogs: number;
+        log_lines: number;
+        log_lines_truncated: boolean;
+        screenshot: boolean;
+    };
+    fetched: {
+        network: boolean;
+        rtm: boolean;
+        clogs: boolean;
+    };
+    errors: string[];
+    privacy_notice: string;
+}
+/**
+ * Resolve the output directory for a snapshot. Exported for tests.
+ */
+export declare function buildSnapshotDir(now?: number, root?: string): string;
+/**
+ * Build the device-side URL for a given buffer kind. Extracted so the
+ * mapping is testable without standing up a device. `limit=1000` is
+ * intentionally larger than point-query defaults — snapshots are bulk
+ * exports and the device-side ring buffers cap their own responses.
+ */
+export declare function buildBufferPath(kind: "network" | "rtm" | "clogs"): string;
+export interface LogTailResult {
+    text: string;
+    truncated: boolean;
+}
+/**
+ * Take the last N lines from the active capture file. Returns an empty
+ * result if no capture is active or the file is unreadable. Bounded read
+ * so we do not load a 100 MB capture into memory.
+ *
+ * `truncated` is true when the 1 MB file-read cap was the limiting factor
+ * (i.e. the user asked for more lines than fit), so the caller can tell
+ * the user they got fewer lines than requested.
+ */
+export declare function readRecentLogTail(requestedLimit?: number): LogTailResult;
+/**
+ * Write a snapshot bundle to disk. The caller supplies `fetchBuffer` (a
+ * callback that hits the device's HTTP endpoint for a given buffer name)
+ * so this module does not need to know how `radarRequest` works — easier
+ * to test and keeps the device-HTTP plumbing in `index.ts`.
+ *
+ * On partial failure (e.g. screenshot fails because ADB is flaky), the
+ * snapshot still lands on disk with whatever succeeded; failures are
+ * collected in `result.errors` so the model can tell the user.
+ */
+export declare function createSnapshot(device: DeviceTransport, fetchBuffer: (kind: "network" | "rtm" | "clogs") => Promise<unknown>, opts?: SnapshotOptions, now?: number, snapshotRoot?: string): Promise<SnapshotResult>;

package/dist/mcp/snapshot.js

@@ -0,0 +1,301 @@
+import { spawnSync } from "child_process";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { getCaptureFilePath, readTailBytes } from "../shared/logcat-capture.js";
+/**
+ * `capture_snapshot` composer: bundles everything Radar has seen into a
+ * single on-disk artifact so a user can attach it to a Jira, drop it in a
+ * Slack thread, or share it with a teammate without copying individual
+ * tool outputs.
+ *
+ * Snapshot contents:
+ *   - `bundle.json` — device-side buffers (net + RTM + clogs) plus metadata
+ *   - `screenshot.png` — current screen (optional)
+ *   - `logcat.tail.log` — last N lines of the active capture file (optional)
+ *
+ * Written to `~/.slack-radar/snapshots/snapshot-<ts>/`. No cleanup: snapshots
+ * are user-triggered, small, and should persist for post-hoc inspection.
+ * If that becomes a disk-growth concern, add a TTL GC like `logcat-capture.ts`.
+ */
+const SNAPSHOT_DIR = path.join(os.homedir(), ".slack-radar", "snapshots");
+const DEFAULT_LOG_TAIL_LINES = 500;
+const MAX_LOG_TAIL_LINES = 10_000;
+const DEFAULT_LOG_TAIL_BYTES = 1 * 1024 * 1024; // 1 MB bound on file read
+// Restrictive permissions on the snapshot dir and its files. The bundle
+// contains network request/response bodies (including auth headers),
+// message content, and user IDs — readable only by the owning user.
+const DIR_MODE = 0o700;
+const FILE_MODE = 0o600;
+const BUNDLE_README = `Slack Radar snapshot
+====================
+
+This directory is a point-in-time bundle of Radar state.
+
+Files:
+- bundle.json: device-side network/RTM/clog buffers, counts, and metadata.
+- logcat.tail.log (optional): last N lines of the on-device logcat capture.
+- screenshot.png (optional): current screen.
+
+Privacy: bundle.json contains raw API request/response bodies (auth headers,
+tokens), RTM message content, user IDs, channel IDs, and clog payloads.
+Review before sharing externally. This bundle lives on your local disk only;
+nothing is uploaded anywhere by Radar.
+
+To inspect: cat bundle.json | jq .
+To share: zip -r snapshot.zip . then attach the zip.
+`;
+const PRIVACY_NOTICE = "bundle.json contains raw API request/response bodies (including auth headers), RTM message content, user IDs, and clog payloads. Review before sharing externally.";
+/**
+ * Resolve the output directory for a snapshot. Exported for tests.
+ */
+export function buildSnapshotDir(now = Date.now(), root = SNAPSHOT_DIR) {
+    return path.join(root, `snapshot-${now}`);
+}
+/**
+ * Build the device-side URL for a given buffer kind. Extracted so the
+ * mapping is testable without standing up a device. `limit=1000` is
+ * intentionally larger than point-query defaults — snapshots are bulk
+ * exports and the device-side ring buffers cap their own responses.
+ */
+export function buildBufferPath(kind) {
+    return `/api/${kind}?limit=1000`;
+}
+/**
+ * Take the last N lines from the active capture file. Returns an empty
+ * result if no capture is active or the file is unreadable. Bounded read
+ * so we do not load a 100 MB capture into memory.
+ *
+ * `truncated` is true when the 1 MB file-read cap was the limiting factor
+ * (i.e. the user asked for more lines than fit), so the caller can tell
+ * the user they got fewer lines than requested.
+ */
+export function readRecentLogTail(requestedLimit = DEFAULT_LOG_TAIL_LINES) {
+    // Defensive clamp — caller validates at the handler boundary too, but
+    // a direct caller cannot accidentally get "entire file" by passing NaN.
+    const limit = Number.isFinite(requestedLimit) &&
+        requestedLimit > 0 &&
+        requestedLimit <= MAX_LOG_TAIL_LINES
+        ? Math.floor(requestedLimit)
+        : DEFAULT_LOG_TAIL_LINES;
+    const filePath = getCaptureFilePath();
+    if (!filePath)
+        return { text: "", truncated: false };
+    const raw = readTailBytes(filePath, DEFAULT_LOG_TAIL_BYTES);
+    if (!raw)
+        return { text: "", truncated: false };
+    const lines = raw.split("\n");
+    // If the raw read hit the 1 MB byte cap, the FIRST line is likely
+    // partial — readTailBytes drops it — and the user got whatever fits.
+    // "Truncated" means "user asked for more lines than the byte cap can
+    // contain AND we delivered fewer lines than requested."
+    const truncated = lines.length < limit && raw.length >= DEFAULT_LOG_TAIL_BYTES;
+    const tail = lines.slice(Math.max(0, lines.length - limit));
+    return { text: tail.join("\n"), truncated };
+}
+/**
+ * Write a snapshot bundle to disk. The caller supplies `fetchBuffer` (a
+ * callback that hits the device's HTTP endpoint for a given buffer name)
+ * so this module does not need to know how `radarRequest` works — easier
+ * to test and keeps the device-HTTP plumbing in `index.ts`.
+ *
+ * On partial failure (e.g. screenshot fails because ADB is flaky), the
+ * snapshot still lands on disk with whatever succeeded; failures are
+ * collected in `result.errors` so the model can tell the user.
+ */
+export async function createSnapshot(device, fetchBuffer, opts = {}, now = Date.now(), snapshotRoot = SNAPSHOT_DIR) {
+    const includeLogs = opts.includeLogs !== false;
+    const includeScreenshot = opts.includeScreenshot !== false;
+    // Clamp log_tail_lines at the composer boundary. The handler and schema
+    // validate too; this is defense-in-depth so no downstream consumer sees
+    // a pathological value.
+    const logTailLines = typeof opts.logTailLines === "number" &&
+        Number.isFinite(opts.logTailLines) &&
+        opts.logTailLines > 0 &&
+        opts.logTailLines <= MAX_LOG_TAIL_LINES
+        ? Math.floor(opts.logTailLines)
+        : DEFAULT_LOG_TAIL_LINES;
+    const dir = buildSnapshotDir(now, snapshotRoot);
+    fs.mkdirSync(dir, { recursive: true, mode: DIR_MODE });
+    // `mkdirSync({ recursive: true, mode })` only applies the mode to
+    // directories it CREATES. If `~/.slack-radar/` or `.../snapshots/`
+    // already existed (e.g. created by a pre-R1 build or by the logcat
+    // capture module with default umask → 0o755), they keep old perms.
+    // Tighten them to 0o700 on every snapshot so the parent tree cannot
+    // leak directory-listing on a shared host.
+    for (const p of [snapshotRoot, path.dirname(snapshotRoot)]) {
+        try {
+            if (fs.existsSync(p))
+                fs.chmodSync(p, DIR_MODE);
+        }
+        catch {
+            // Best effort; not fatal.
+        }
+    }
+    const files = [];
+    const errors = [];
+    let network = null;
+    let rtm = null;
+    let clogs = null;
+    const fetched = { network: false, rtm: false, clogs: false };
+    // Device-side buffers. Failures are individually caught so one failing
+    // buffer does not nuke the whole snapshot. `fetched` distinguishes
+    // "empty because the buffer was empty" from "null because the fetch
+    // failed" — counts alone cannot tell these apart.
+    try {
+        network = await fetchBuffer("network");
+        fetched.network = true;
+    }
+    catch (e) {
+        errors.push(`network buffer: ${e.message}`);
+    }
+    try {
+        rtm = await fetchBuffer("rtm");
+        fetched.rtm = true;
+    }
+    catch (e) {
+        errors.push(`rtm buffer: ${e.message}`);
+    }
+    try {
+        clogs = await fetchBuffer("clogs");
+        fetched.clogs = true;
+    }
+    catch (e) {
+        errors.push(`clog buffer: ${e.message}`);
+    }
+    // Logcat tail.
+    let logTail = { text: "", truncated: false };
+    if (includeLogs) {
+        try {
+            logTail = readRecentLogTail(logTailLines);
+            if (logTail.text) {
+                const logFile = path.join(dir, "logcat.tail.log");
+                fs.writeFileSync(logFile, logTail.text, { mode: FILE_MODE });
+                files.push(logFile);
+            }
+        }
+        catch (e) {
+            errors.push(`logcat tail: ${e.message}`);
+        }
+    }
+    // Screenshot. 720px default is plenty for bug reports; full-res is
+    // 5-8x larger on disk and rarely adds forensic value.
+    let screenshotCaptured = false;
+    if (includeScreenshot) {
+        try {
+            const tmp = device.screenshot(false);
+            const dest = path.join(dir, "screenshot.png");
+            fs.copyFileSync(tmp, dest);
+            // copyFileSync preserves source mode by default on POSIX; chmod to
+            // 0600 so the copy is owner-only regardless of source permissions.
+            try {
+                fs.chmodSync(dest, FILE_MODE);
+            }
+            catch (e) {
+                // Non-fatal (worst case: screenshot has source mode, typically
+                // 0644 on macOS /tmp pulls) but user should know — a bundle they
+                // share externally has a world-readable PNG file if this path
+                // hits.
+                errors.push(`screenshot chmod failed: ${e.message} (file keeps source mode)`);
+            }
+            files.push(dest);
+            screenshotCaptured = true;
+        }
+        catch (e) {
+            errors.push(`screenshot: ${e.message}`);
+        }
+    }
+    // README. One-paragraph explainer so a receiver who opens the dir for
+    // the first time knows what each file is and what privacy exposure it
+    // carries.
+    try {
+        const readmeFile = path.join(dir, "README.txt");
+        fs.writeFileSync(readmeFile, BUNDLE_README, { mode: FILE_MODE });
+        files.push(readmeFile);
+    }
+    catch (e) {
+        errors.push(`README: ${e.message}`);
+    }
+    // Bundle JSON. Written last so counts reflect everything captured.
+    const counts = {
+        network: countItems(network),
+        rtm: countItems(rtm),
+        clogs: countItems(clogs),
+        log_lines: logTail.text
+            ? logTail.text.split("\n").filter(Boolean).length
+            : 0,
+        log_lines_truncated: logTail.truncated,
+        screenshot: screenshotCaptured,
+    };
+    const bundle = {
+        version: 1,
+        timestamp: now,
+        platform: device.platform,
+        active_user_id: device.getActiveUserId(),
+        capture_file: getCaptureFilePath(),
+        buffers: { network, rtm, clogs },
+        counts,
+        fetched,
+        errors,
+        privacy_notice: PRIVACY_NOTICE,
+    };
+    const bundleFile = path.join(dir, "bundle.json");
+    fs.writeFileSync(bundleFile, JSON.stringify(bundle, null, 2), {
+        mode: FILE_MODE,
+    });
+    files.unshift(bundleFile);
+    // Auto-zip: collapse the 4-file directory into a single shareable
+    // artifact. Users universally want to attach ONE file to Jira or drop
+    // ONE file in Slack, not drag a directory. Best-effort: if `zip` is
+    // missing on the user's PATH (rare — ships with macOS and most Linux
+    // distros) we just record the failure and the user can zip manually.
+    let zipPath = null;
+    const zipCandidate = `${dir}.zip`;
+    try {
+        const zipResult = spawnSync("zip", ["-rq", zipCandidate, "."], {
+            cwd: dir,
+            timeout: 10000,
+        });
+        if (zipResult.status === 0) {
+            try {
+                fs.chmodSync(zipCandidate, FILE_MODE);
+            }
+            catch {
+                // Leave mode as-is; already a zip copy of owner-readable files.
+            }
+            zipPath = zipCandidate;
+        }
+        else {
+            errors.push(`zip failed with status ${zipResult.status ?? "null"}${zipResult.stderr ? ": " + zipResult.stderr.toString().trim() : ""}`);
+        }
+    }
+    catch (e) {
+        errors.push(`zip not available: ${e.message}`);
+    }
+    return {
+        path: dir,
+        files,
+        zip_path: zipPath,
+        timestamp: now,
+        counts,
+        fetched,
+        errors,
+        privacy_notice: PRIVACY_NOTICE,
+    };
+}
+/**
+ * Count items inside a buffer response. Handles the `{ calls: [...] }`,
+ * `{ events: [...] }`, `{ clogs: [...] }` shapes the radar HTTP server
+ * uses. Falls back to 0 on malformed responses.
+ */
+function countItems(body) {
+    if (!body || typeof body !== "object")
+        return 0;
+    const b = body;
+    for (const key of ["calls", "events", "clogs", "items"]) {
+        const v = b[key];
+        if (Array.isArray(v))
+            return v.length;
+    }
+    return 0;
+}

package/dist/mcp/tools.js

@@ -1,3 +1,4 @@
+import { SOURCES, VIZ, SERIES_METRICS } from "../web/spec.js";
 export const SERVER_INSTRUCTIONS = [
     "Slack Radar provides on-device debugging tools for the Slack Android app via ADB.",
     "",
@@ -22,6 +23,7 @@ export const SERVER_INSTRUCTIONS = [
     '- "what API call was that" -> get_recent_network_calls then get_network_call_detail',
     '- "did I get X" / "did X happen" -> search(query="X") across ALL buffers, not just one',
     '- "check the debug logs" -> get_recent_logs(tag="...")',
+    '- "save this" / "file this as a bug" / "share this" / "bundle this" / "attach to ticket" / "give me a repro" / "snapshot this" / "preserve this" / "hold this state" / "save what you just saw" -> capture_snapshot',
     "",
     "Key behaviors:",
     "- Network/RTM buffers clear on shutdown. Clogs persist from app start.",
@@ -30,29 +32,80 @@ export const SERVER_INSTRUCTIONS = [
     "- RTM event types use subtypes when available (e.g. message_changed, not message).",
     "- Use wait_for_events with idle_timeout_ms instead of polling loops.",
     "- Use ping(timeout_minutes=N) to extend sessions. Monitor remaining_minutes proactively.",
+    "- ping reports which app/profile is bound (android_user_id, profile, package). The debug",
+    "  build can run on more than one user (personal=0, plus a work profile or secondary user),",
+    "  and only the first to bind the socket wins. If events seem to come from the wrong app, tell",
+    "  the user which profile is bound and use list_profiles + activate_for_user to switch.",
     "- Screenshots default to 720px. Use full_res=true only when detail matters.",
     "- Setup: /slack-radar-setup",
     "- Manual enable (no skill): adb shell am broadcast -a slack.debug.ENABLE_RADAR --ei timeout_minutes 5 -p com.Slack.internal.debug",
     "  Then: adb forward tcp:8099 localabstract:slack-radar",
     "",
     "WEB DASHBOARD (/radar-ui):",
-    "A browser-based dashboard (http://localhost:8100) shows the same live device data in a",
-    "visual UI. Launched via the /radar-ui skill, which wraps `npx -p @slack/radar-mcp slack-radar-web`.",
+    "A browser-based dashboard (http://localhost:8100) shows the same live device data as",
+    "tabs: Live (everything), Network, RTM, Clogs, and Logs, each with counters, a graph, a",
+    "filterable feed, and a payload inspector. Launched via the /radar-ui skill, which runs",
+    "`npx @slack/radar-mcp web` (a global install also exposes it as `slack-radar`).",
     "",
-    "When to suggest /radar-ui (mention it ONCE per thread, do not auto-invoke):",
+    "PROACTIVELY offer the dashboard when it would help — do not wait to be asked. The moment a",
+    "device session turns visual or multi-step, say so and offer to open it, e.g.: \"This is",
+    "easier to watch live — want me to open the Radar dashboard?\" Offer (once per thread) when:",
     '- User says "watch", "monitor", "let me see", "show me live" about device traffic',
     "- User wants to share traffic with a colleague, pair, or teammate",
     "- User is doing a multi-minute investigation and the transcript is getting noisy",
     '- User explicitly asks about a GUI, UI, browser view, or dashboard',
     "",
-    "DO NOT invoke /radar-ui yourself. Opening a browser window is a user-visible action.",
-    "DO NOT suggest /radar-ui for single-query debugging or when the user is happy reading",
-    "results in the transcript. Suggest it when visual inspection adds real value.",
+    "OFFER, then open ONLY AFTER THE USER AGREES — opening a browser window is a user-visible",
+    "action; never pop one unbidden. On a yes, run the /radar-ui skill (or tell them to run",
+    "`npx @slack/radar-mcp web`) and hand over the URL. Nudge, do not auto-open.",
+    "DO NOT offer for single-query debugging or when the user is happy reading results in the",
+    "transcript. Offer when visual inspection adds real value.",
+    "",
+    "CUSTOM DASHBOARD (open_radar_dashboard):",
+    "The pre-built tabs (Live/Network/RTM/Clogs/Logs) cover the common cases. When the user",
+    "describes a live view the tabs do not show, SUGGEST building it; invoke open_radar_dashboard",
+    "only after they agree or explicitly ask for a custom view/dashboard (same discipline as",
+    "/radar-ui). To build, translate their words into a spec and call the tool; it renders your",
+    "spec as a 'Custom' tab on the dashboard (default http://localhost:8100) and returns the URL",
+    "for you to share. Cases worth suggesting it for:",
+    '- "graph calls per second vs average response time and flag the slow ones"',
+    '- "count every DM I receive and beep when one arrives"',
+    '- "show only RTM events on channel C... and let me click each for its payload"',
+    '- "watch network calls whose body contains <substring>"',
+    "Authoring rules:",
+    "- source is one of network/rtm/clog/log/all ('all' = one unified timeline).",
+    "- match filters on SUMMARY fields only, by source: network=url/method/status_code,",
+    "  rtm=event_type/direction/channel, clog=event_name, log=tag/level/message/pid/package.",
+    "  NEVER invent a field; a match on a field the stream does not carry silently matches",
+    "  nothing. To filter on body text use bodyContains (network/all only), which fetches detail.",
+    "- viz composes counter/rate/sparkline/feed/inspector/graph. graph needs a series array",
+    "  (1-2 entries; metric ratePerSec/count/avg/errorRate; avg needs a field like duration_ms).",
+    "- highlight {field, op, value} flags rows breaching a numeric threshold; alert {sound,flash,",
+    "  say, at} fires on each live match (or once at the Nth). Author an honest one-line `summary`.",
+    "Calling it again replaces/refines the live custom dashboard. The dashboard reads a connected",
+    "device, so Radar must be armed to show data (it has its own Reconnect button). Debug builds",
+    "only; local only. Does not open a browser window for you; surface the returned URL to the user.",
+    "",
+    "CAPTURE_SNAPSHOT OUTPUT:",
+    "When capture_snapshot returns, tell the user:",
+    "  1. The result.zip_path if non-null (the single shareable file). Fall back to",
+    "     result.path (a directory) if zip_path is null.",
+    "  2. A one-line summary of counts (network/rtm/clogs/log_lines/screenshot).",
+    "  3. Print this EXACT sentence as the privacy line, verbatim — no paraphrase, no",
+    "     compression, no skipping even under time pressure:",
+    '     "Privacy: bundle.json contains raw API request/response bodies (including auth headers), RTM message content, user IDs, and clog payloads. Review before sharing externally."',
+    "  4. If result.log_lines_truncated is true, say: 'you got fewer log lines than",
+    "     requested because the 1 MB read cap was the limiting factor.'",
+    "  5. If the user's original ask was 'file this as a bug' / 'attach to ticket' /",
+    "     similar, offer to attach result.zip_path via the Jira MCP or Slack MCP as",
+    "     the next step. Do NOT invoke the attach without asking. Just offer.",
+    "  6. If result.errors is non-empty, enumerate which parts failed so the user",
+    "     knows what is missing before they ship the bundle.",
 ].join("\n");
 export const TOOL_DEFINITIONS = [
     {
         name: "ping",
-        description: "Check if Slack Radar is running. Returns uptime, buffer sizes, remaining session time, and stream status.",
+        description: "Check if Slack Radar is running. Returns uptime, buffer sizes, remaining session time, stream status, and which app/profile is bound: android_user_id (0 = personal, non-zero = a secondary user such as a work profile), profile ('personal'/'secondary'), and package.",
         inputSchema: {
             type: "object",
             properties: {
@@ -189,19 +242,19 @@ export const TOOL_DEFINITIONS = [
     },
     {
         name: "list_profiles",
-        description: "List Android user profiles that have the Slack debug build running. Use this before activate_for_user when the user asks to switch profiles (personal vs work) or when logs/app state seem to point at the wrong profile. Returns each profile's userId (e.g. '0' for personal, '10' for work) and a human label.",
+        description: "List Android user profiles that have the Slack debug build running. Use this before activate_for_user when the user asks to switch profiles (personal vs a secondary user such as a work profile) or when logs/app state seem to point at the wrong profile. Returns each profile's userId (e.g. '0' for personal, '10' for a secondary user) and a human label.",
         inputSchema: { type: "object", properties: {} },
         annotations: { readOnlyHint: true },
     },
     {
         name: "activate_for_user",
-        description: "Activate Slack Radar on a specific Android user profile. Use after list_profiles to switch between personal and work profile targets. Switching profiles restarts log capture with a new session-scoped file and reconnects the SSE event stream so events come from the newly activated profile; old captures remain on disk for up to 7 days. Call this when already connected and only the target profile needs to change.",
+        description: "Activate Slack Radar on a specific Android user profile. Use after list_profiles to switch between the personal user and a secondary user (such as a work profile). Switching profiles restarts log capture with a new session-scoped file and reconnects the SSE event stream so events come from the newly activated profile; old captures remain on disk for up to 7 days. Call this when already connected and only the target profile needs to change.",
         inputSchema: {
             type: "object",
             properties: {
                 user_id: {
                     type: "string",
-                    description: "Android user ID from list_profiles (e.g. '0' for personal, '10' for work).",
+                    description: "Android user ID from list_profiles (e.g. '0' for personal, '10' for a secondary user).",
                 },
                 timeout_minutes: {
                     type: "number",
@@ -212,6 +265,30 @@ export const TOOL_DEFINITIONS = [
         },
         annotations: {},
     },
+    {
+        name: "capture_snapshot",
+        description: "Bundle the current Radar state into a single on-disk artifact for sharing. Writes four files to ~/.slack-radar/snapshots/snapshot-<ts>/: bundle.json (network + RTM + clog buffers, up to 1000 items each — a bulk export, much larger than point queries like get_network_call_detail), logcat.tail.log (last N lines of the active capture), screenshot.png (current screen), and README.txt (receiver-facing explainer). Use when the user says 'save this', 'file this as a bug', 'share this', 'bundle this up', 'attach to a ticket', 'make me a repro', or otherwise wants a shareable reproducible handoff. PRIVACY: bundle.json contains raw API request/response bodies including auth headers, RTM message content, user/team/channel IDs, and clog payloads — review before sharing externally.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                include_logs: {
+                    type: "boolean",
+                    description: "Include last N lines of the active logcat capture (default: true). No-op when no capture is active.",
+                },
+                include_screenshot: {
+                    type: "boolean",
+                    description: "Include a current screenshot (default: true). Requires a connected device.",
+                },
+                log_tail_lines: {
+                    type: "number",
+                    description: "How many trailing lines of the capture file to include (default: 500, min: 1, max: 10000). Truncation flagged in counts.log_lines_truncated.",
+                    minimum: 1,
+                    maximum: 10000,
+                },
+            },
+        },
+        annotations: { readOnlyHint: false },
+    },
     {
         name: "screenshot",
         description: "Capture a screenshot from the connected Android device.",
@@ -257,6 +334,79 @@ export const TOOL_DEFINITIONS = [
         inputSchema: { type: "object", properties: {} },
         annotations: { readOnlyHint: false, idempotentHint: true },
     },
+    {
+        name: "open_radar_dashboard",
+        description: "Build or refine a custom live dashboard tab in the Slack Radar web UI from a spec YOU author. " +
+            "Suggest this when the user describes a live view the pre-built tabs (Live/Network/RTM/Clogs/Logs) do not cover " +
+            "(e.g. 'graph calls per second vs response time and flag slow ones', 'beep when I get a DM'); invoke it once they agree. " +
+            "Translate the request into the spec fields below and call this tool; it ensures the web dashboard is " +
+            "running (default http://localhost:8100) and renders your spec as a 'Custom' tab, then returns the URL to share. " +
+            "Calling again replaces/refines it. Does not open a browser window for the user. The dashboard reads a connected " +
+            "device, so Radar must be armed to show data (the dashboard has its own Reconnect button). Debug builds only, local only.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                title: { type: "string", description: "Short 1-3 word dashboard title; also the Custom tab label." },
+                summary: {
+                    type: "string",
+                    description: "ONE honest plain-English line describing what this shows, including any active filter.",
+                },
+                source: {
+                    type: "string",
+                    enum: [...SOURCES],
+                    description: "Which device stream to read. 'all' is a unified timeline mixing network, RTM, and clog.",
+                },
+                match: {
+                    type: "object",
+                    description: "Case-insensitive substring filter on SUMMARY fields, keyed by source. network: url/method/status_code; " +
+                        "rtm: event_type/direction/channel; clog: event_name; log: tag/level/package. NEVER invent a field " +
+                        "(a match on an absent field silently matches nothing). For body text use bodyContains instead.",
+                },
+                bodyContains: {
+                    type: "string",
+                    description: "network/all only: keep calls whose request/response BODY contains this substring (fetches each call's detail).",
+                },
+                viz: {
+                    type: "array",
+                    items: { type: "string", enum: [...VIZ] },
+                    description: "Widgets to compose. 'graph' requires a series array.",
+                },
+                rateWindowSec: {
+                    type: "number",
+                    description: "Sliding window in seconds for the rate widget (default 10).",
+                },
+                series: {
+                    type: "array",
+                    description: "Required when viz includes 'graph'. 1-2 entries.",
+                    items: {
+                        type: "object",
+                        properties: {
+                            label: { type: "string" },
+                            metric: { type: "string", enum: [...SERIES_METRICS] },
+                            field: { type: "string", description: "Required for the 'avg' metric, e.g. duration_ms." },
+                            unit: { type: "string" },
+                        },
+                        required: ["metric"],
+                    },
+                },
+                extract: {
+                    type: "object",
+                    description: "Pull CONTENT from a record body into the feed: {parse:'response_body'|'request_body'|'data', field:'dot.path', label}.",
+                },
+                highlight: {
+                    type: "object",
+                    description: "Flag feed rows whose numeric field breaches a threshold: {field, op:'>'|'>='|'<'|'<='|'==', value, label}.",
+                },
+                alert: {
+                    type: "object",
+                    description: "Sentry mode: {sound, flash, say, at}. 'at':N fires once when the match count reaches N; omit to fire on every match.",
+                },
+            },
+            required: ["title", "summary", "source", "viz"],
+        },
+        // Not read-only: it starts a local web server and pushes a spec to it.
+        annotations: { readOnlyHint: false, idempotentHint: true },
+    },
 ];
 /**
  * Check whether a tool call should be blocked by the session gate.
@@ -271,6 +421,11 @@ export function sessionGate(toolName, sessionEnabled) {
     if (toolName === "ping") {
         return null;
     }
+    // open_radar_dashboard launches an independent local web process with its own
+    // device-enable (Reconnect) button, so it does not require the MCP session enabled.
+    if (toolName === "open_radar_dashboard") {
+        return null;
+    }
     if (!sessionEnabled) {
         return {
             content: [

package/dist/shared/android.d.ts

@@ -13,8 +13,9 @@ export declare function resolveAdbPath(): string | null;
 /**
  * Parse the output of `ps -A -o USER,NAME` to extract the Android user ID
  * for the debug build process. When multiple profiles are running, prefers
- * the work profile (user ID > 0) since that's the typical debugging target.
- * Returns "0" for primary user, "10" for work profile, etc.
+ * a secondary user (user ID > 0) since that's the typical debugging target.
+ * Returns "0" for the primary user, or the first secondary user id (commonly
+ * "10", which is often a work profile, but the id alone cannot prove that).
  */
 export declare function parseUserFromPsOutput(psOutput: string): string;
 export declare class AndroidTransport implements DeviceTransport {