@slack/radar-mcp 1.5.0 → 1.6.0

package/README.md

@@ -185,4 +185,4 @@ The MCP server auto-detects the Android user ID via `ps` and targets the broadca
 Restart your Claude Code session. MCP servers are registered at session start.
 
 **Port already in use (web dashboard)**
-Another instance may be running. Kill it with `lsof -ti :8100 | xargs kill` or set a different port with `SLACK_RADAR_WEB_PORT=8101 npx @slack/radar-mcp web`.
+If a Radar dashboard is already running on the port, launching again just opens it. If the port is held by another program, run Radar on a different port with `SLACK_RADAR_WEB_PORT=8101 npx @slack/radar-mcp web`.

package/dist/mcp/db-tools.d.ts

@@ -0,0 +1,46 @@
+/**
+ * MCP tool handlers for the on-device SQLite browser.
+ *
+ * These expose the same read-only DB access the web dashboard already has (src/web/server.ts),
+ * but over MCP so terminal Claude can inspect the device store during a debugging session
+ * without opening the dashboard. All the work lives in shared/db.ts; these handlers are thin
+ * wrappers that resolve the bound profile and shape the result for MCP.
+ *
+ * Read-only is enforced in shared/db.ts: the copy-based design (the device file is `cat`'d to
+ * a throwaway local copy and never written back) plus `sqlite3 -safe` (blocks ATTACH/readfile/
+ * writefile/load_extension at the engine level) plus the single-statement read-only gate
+ * (assertReadOnlyQuery). NOTE: the copy is opened WITHOUT `-readonly` on purpose, so SQLite
+ * replays the WAL sidecar; the read-only guarantee does not depend on the open mode. This
+ * handler calls assertReadOnlyQuery() up front so a bad query is rejected BEFORE the device
+ * pull, and results are capped by both row count and serialized bytes (see capQueryRows) so
+ * neither a `SELECT *` nor a one-row `group_concat` dump can stream the whole plaintext store
+ * into the model context.
+ */
+import type { DeviceTransport } from "../shared/transport.js";
+/**
+ * Bound a result set for the model context by BOTH row count and serialized bytes. Pure (no
+ * I/O) so it is unit-testable without a device. Returns the rows to actually return plus the
+ * honest counters. truncated is true if EITHER ceiling trips. A single row larger than the
+ * byte budget cannot be split, so it is dropped (returnedRows 0) rather than blowing the
+ * budget — the note says so, and total_rows still reports the true count so the model knows
+ * data exists and can re-query a narrower projection.
+ */
+export declare function capQueryRows(rows: unknown[]): {
+    rows: unknown[];
+    rowCount: number;
+    totalRows: number;
+    truncated: boolean;
+    note?: string;
+};
+export declare function handleListDatabases(transport: DeviceTransport): {
+    data: unknown;
+    isError: boolean;
+};
+export declare function handleListTables(transport: DeviceTransport, db: string, refresh?: boolean): Promise<{
+    data: unknown;
+    isError: boolean;
+}>;
+export declare function handleQueryDatabase(transport: DeviceTransport, db: string, sql: string, refresh?: boolean): Promise<{
+    data: unknown;
+    isError: boolean;
+}>;

package/dist/mcp/db-tools.js

@@ -0,0 +1,160 @@
+/**
+ * MCP tool handlers for the on-device SQLite browser.
+ *
+ * These expose the same read-only DB access the web dashboard already has (src/web/server.ts),
+ * but over MCP so terminal Claude can inspect the device store during a debugging session
+ * without opening the dashboard. All the work lives in shared/db.ts; these handlers are thin
+ * wrappers that resolve the bound profile and shape the result for MCP.
+ *
+ * Read-only is enforced in shared/db.ts: the copy-based design (the device file is `cat`'d to
+ * a throwaway local copy and never written back) plus `sqlite3 -safe` (blocks ATTACH/readfile/
+ * writefile/load_extension at the engine level) plus the single-statement read-only gate
+ * (assertReadOnlyQuery). NOTE: the copy is opened WITHOUT `-readonly` on purpose, so SQLite
+ * replays the WAL sidecar; the read-only guarantee does not depend on the open mode. This
+ * handler calls assertReadOnlyQuery() up front so a bad query is rejected BEFORE the device
+ * pull, and results are capped by both row count and serialized bytes (see capQueryRows) so
+ * neither a `SELECT *` nor a one-row `group_concat` dump can stream the whole plaintext store
+ * into the model context.
+ */
+import { assertReadOnlyQuery, listDatabases, pullDatabase, queryDatabase, pulledSize, } from "../shared/db.js";
+/**
+ * Caps on what query_database streams into the MODEL CONTEXT. The on-device store holds tens
+ * of thousands of plaintext message/PII rows; an unbounded result would dump the whole store
+ * into the transcript (db.ts only bounds the raw sqlite output at 64MB).
+ *
+ * Two independent ceilings, because bounding rows alone is not enough: a single
+ * `SELECT group_concat(text) FROM messages` collapses the entire table into ONE row whose
+ * lone column is every message body — that sails past a row-count cap untouched. So we cap
+ * BOTH the row count AND the serialized byte size of the returned payload.
+ *
+ * The web dashboard is intentionally exempt (handleDbQuery in web/server.ts returns the
+ * uncapped set): it renders to a consenting local human behind a privacy banner, not into an
+ * LLM transcript, so a large render is a UI annoyance, not the context/PII harm this guards.
+ * (It does not paginate; the exemption is about WHO consumes the rows, not how they are shown.)
+ */
+const MAX_QUERY_ROWS = 500;
+const MAX_QUERY_BYTES = 256 * 1024; // serialized cap on rows returned to the model (~256KB)
+/**
+ * Bound a result set for the model context by BOTH row count and serialized bytes. Pure (no
+ * I/O) so it is unit-testable without a device. Returns the rows to actually return plus the
+ * honest counters. truncated is true if EITHER ceiling trips. A single row larger than the
+ * byte budget cannot be split, so it is dropped (returnedRows 0) rather than blowing the
+ * budget — the note says so, and total_rows still reports the true count so the model knows
+ * data exists and can re-query a narrower projection.
+ */
+export function capQueryRows(rows) {
+    const total = rows.length;
+    const byCount = rows.length > MAX_QUERY_ROWS ? rows.slice(0, MAX_QUERY_ROWS) : rows.slice();
+    // Then trim by serialized size: keep prefix rows until the JSON budget is hit. Measure UTF-8
+    // BYTES (Buffer.byteLength), not String.length: the MCP layer emits this payload as UTF-8 over
+    // stdio, and .length counts UTF-16 code units, so an emoji/CJK row (surrogate pairs: 2 code
+    // units, 4 UTF-8 bytes) would otherwise pass at up to ~2x the real wire size.
+    const kept = [];
+    let bytes = 0;
+    for (const r of byCount) {
+        const sz = Buffer.byteLength(JSON.stringify(r) ?? "", "utf8");
+        if (kept.length > 0 && bytes + sz > MAX_QUERY_BYTES)
+            break;
+        kept.push(r);
+        bytes += sz;
+        if (bytes > MAX_QUERY_BYTES)
+            break; // a single oversized first row trips here; dropped below
+    }
+    // If even the first kept row blew the budget, drop it: do not stream a >256KB blob.
+    const overBudget = kept.length === 1 && bytes > MAX_QUERY_BYTES;
+    const finalRows = overBudget ? [] : kept;
+    const truncated = finalRows.length < total;
+    let note;
+    if (overBudget) {
+        note = `first row alone exceeds the ${Math.round(MAX_QUERY_BYTES / 1024)}KB response budget; returned no rows. Select fewer/narrower columns (avoid group_concat/blob dumps).`;
+    }
+    else if (truncated) {
+        note = `result truncated to ${finalRows.length} of ${total} rows (row or byte budget); narrow with WHERE/LIMIT or fewer columns.`;
+    }
+    return { rows: finalRows, rowCount: finalRows.length, totalRows: total, truncated, note };
+}
+/** Resolve the Android profile Radar is bound to. Returns undefined so db.ts falls back to its first available user. */
+function resolveUser(transport) {
+    try {
+        return transport.resolveActiveUser();
+    }
+    catch {
+        return undefined;
+    }
+}
+export function handleListDatabases(transport) {
+    try {
+        const { user, availableUsers, names } = listDatabases(resolveUser(transport));
+        return { data: { user, available_users: availableUsers, databases: names }, isError: false };
+    }
+    catch (e) {
+        return { data: { error: e.message, databases: [] }, isError: true };
+    }
+}
+export async function handleListTables(transport, db, refresh = false) {
+    if (!db)
+        return { data: { error: "db is required" }, isError: true };
+    const user = resolveUser(transport);
+    try {
+        // force=refresh re-pulls the live device copy; default reuses the cached pull so a
+        // multi-MB store is not re-streamed on every call.
+        await pullDatabase(db, user, refresh);
+        const tableRows = (await queryDatabase(db, "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' ORDER BY name", user));
+        const tables = [];
+        for (const t of tableRows) {
+            let rows = "?";
+            try {
+                rows = (await queryDatabase(db, `SELECT COUNT(*) c FROM "${t.name}"`, user))[0].c;
+            }
+            catch {
+                // a view or virtual table may not COUNT cleanly; leave "?"
+            }
+            tables.push({ name: t.name, rows });
+        }
+        return { data: { db, size_bytes: pulledSize(db, user), tables }, isError: false };
+    }
+    catch (e) {
+        return { data: { error: e.message, tables: [] }, isError: true };
+    }
+}
+export async function handleQueryDatabase(transport, db, sql, refresh = false) {
+    if (!db)
+        return { data: { error: "db is required" }, isError: true };
+    if (!sql)
+        return { data: { error: "sql is required" }, isError: true };
+    // Gate the SQL BEFORE the device pull: a rejected write/exfil query must not trigger a
+    // multi-MB `exec-out cat` first. queryDatabase re-checks, so this is an early-out, not the
+    // sole boundary. Running device-free, it also makes the read-only gate unit-testable here.
+    try {
+        assertReadOnlyQuery(sql);
+    }
+    catch (e) {
+        return { data: { error: e.message, rows: [] }, isError: true };
+    }
+    const user = resolveUser(transport);
+    try {
+        // force=refresh re-pulls the live device copy; default reuses the cached pull. Pass
+        // refresh:true when the device state may have changed since the first query this session.
+        await pullDatabase(db, user, refresh);
+        const rows = await queryDatabase(db, sql, user);
+        // Cap what goes into the model context by BOTH row count and serialized bytes: the store
+        // is plaintext PII and a broad SELECT (or a group_concat that collapses the table into one
+        // huge row) would otherwise dump it into the transcript. See capQueryRows.
+        const capped = capQueryRows(rows);
+        return {
+            data: {
+                db,
+                sql,
+                row_count: capped.rowCount,
+                total_rows: capped.totalRows,
+                truncated: capped.truncated,
+                ...(capped.note ? { note: capped.note } : {}),
+                rows: capped.rows,
+            },
+            isError: false,
+        };
+    }
+    catch (e) {
+        return { data: { error: e.message, rows: [] }, isError: true };
+    }
+}

package/dist/mcp/index.js

@@ -12,6 +12,8 @@ import { RADAR_HOST, RADAR_PORT, WEB_PORT_DEFAULT } from "../shared/constants.js
 import { stopCapture } from "../shared/logcat-capture.js";
 import { connectStream, destroyStream, waitForEvents, clearLocalBuffers, isStreamConnected, localNetworkBuffer, localRtmBuffer, setTransport, } from "../shared/stream.js";
 import { buildBufferPath, createSnapshot } from "./snapshot.js";
+import { handleListDatabases, handleListTables, handleQueryDatabase, } from "./db-tools.js";
+import { cleanupPulledDatabases, initializeDatabasePath, resetDbState, } from "../shared/db.js";
 import { TOOL_DEFINITIONS, SERVER_INSTRUCTIONS, sessionGate } from "./tools.js";
 // --- Subcommand + bin-name dispatch ---
 //
@@ -164,7 +166,8 @@ async function openDashboardSpec(spec) {
     return r.json;
 }
 if (wantsWeb) {
-    await import("../web/bin.js");
+    const { startWebServer } = await import("../web/bin.js");
+    startWebServer();
 }
 else {
     await runMcpServer();
@@ -183,6 +186,17 @@ async function runMcpServer() {
     }
     const device = createTransport();
     setTransport(device);
+    // Scope pulled-DB copies to THIS process by pid, then clean them on exit (mirrors the web
+    // server's lifecycle). The DB tools write plaintext message-store copies to a 0600 tmp dir;
+    // pid-scoping keeps two concurrent Radar MCP servers from sharing a dir and clobbering each
+    // other's live pulls (a fixed port would collide, since every MCP uses the same RADAR_PORT).
+    // A hard crash leaks this process's dir until the OS sweeps tmp; the files stay 0600 in a
+    // 0700 dir, so that is a bounded exposure, not a cross-user leak.
+    initializeDatabasePath(process.pid);
+    cleanupPulledDatabases();
+    for (const sig of ["SIGINT", "SIGTERM", "exit"]) {
+        process.once(sig, cleanupPulledDatabases);
+    }
     let sessionEnabled = false;
     function radarRequest(requestPath) {
         return new Promise((resolve, reject) => {
@@ -260,6 +274,10 @@ async function runMcpServer() {
     async function handleSessionEnable(args) {
         const timeout = args?.timeout_minutes || 5;
         sessionEnabled = true;
+        // A re-enable may be a different device or a re-armed profile, so drop the cached DB
+        // user set + sqlite path; the next DB tool call re-detects the profiles fresh. Mirrors
+        // the web server's handleEnable (server.ts), which resets for the same reason.
+        resetDbState();
         const forwarded = device.ensureForward();
         if (!forwarded) {
             sessionEnabled = false;
@@ -562,7 +580,7 @@ async function runMcpServer() {
         }
     }
     // --- MCP Server ---
-    const server = new Server({ name: "slack-radar", version: "1.5.0" }, { capabilities: { tools: {} }, instructions: SERVER_INSTRUCTIONS });
+    const server = new Server({ name: "slack-radar", version: "1.6.0" }, { capabilities: { tools: {} }, instructions: SERVER_INSTRUCTIONS });
     server.setRequestHandler(ListToolsRequestSchema, async () => ({
         tools: TOOL_DEFINITIONS,
     }));
@@ -617,6 +635,20 @@ async function runMcpServer() {
         if (name === "ping") {
             return handlePing(toolArgs);
         }
+        if (name === "list_databases") {
+            const { data, isError } = handleListDatabases(device);
+            return textResult(data, isError);
+        }
+        if (name === "list_tables") {
+            const { db, refresh } = toolArgs;
+            const { data, isError } = await handleListTables(device, db ?? "", refresh === true);
+            return textResult(data, isError);
+        }
+        if (name === "query_database") {
+            const { db, sql, refresh } = toolArgs;
+            const { data, isError } = await handleQueryDatabase(device, db ?? "", sql ?? "", refresh === true);
+            return textResult(data, isError);
+        }
         const apiPath = buildApiPath(name, toolArgs);
         if (apiPath === null) {
             return textResult(`Unknown tool: ${name}`, true);

package/dist/mcp/tools.js

@@ -239,11 +239,11 @@ export const TOOL_DEFINITIONS = [
     },
     {
         name: "get_recent_logs",
-        description: "Get recent logcat entries from the connected device, filtered by tag.",
+        description: "Get recent device logs for the Slack debug build, filtered by tag. Reads the app's own log buffer first (the DEBUG-and-above Timber lines the in-app Log Viewer shows, this app only), and falls back to an adb logcat snapshot when that buffer cannot be read. For native crashes, VERBOSE lines, or non-Slack processes, use adb logcat directly.",
         inputSchema: {
             type: "object",
             properties: {
-                tag: { type: "string", description: "Logcat tag to filter by" },
+                tag: { type: "string", description: "Substring to filter log lines by (matched anywhere in the line, not an exact tag-column match)" },
                 limit: { type: "number", description: "Max number of lines to return (default: 50)" },
                 grep: { type: "string", description: "Optional text to grep within the filtered output" },
             },
@@ -418,6 +418,45 @@ export const TOOL_DEFINITIONS = [
         // Not read-only: it starts a local web server and pushes a spec to it.
         annotations: { readOnlyHint: false, idempotentHint: true },
     },
+    {
+        name: "list_databases",
+        description: "List the app's on-device SQLite databases (the message store, telemetry, etc.) for the bound profile.",
+        inputSchema: { type: "object", properties: {} },
+        annotations: { readOnlyHint: true },
+    },
+    {
+        name: "list_tables",
+        description: "List the tables (with row counts) in one on-device database. Pass a name from list_databases.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                db: { type: "string", description: "Database name from list_databases" },
+                refresh: {
+                    type: "boolean",
+                    description: "Re-pull a fresh copy from the device instead of reusing the cached pull (default false)",
+                },
+            },
+            required: ["db"],
+        },
+        annotations: { readOnlyHint: true },
+    },
+    {
+        name: "query_database",
+        description: "Run a read-only SQL query against an on-device database and get the rows back. SELECT/PRAGMA/WITH only (writes and file access are blocked). Use it to answer 'is this row actually in the DB?' during a debug session. Results are capped by row count and total size (the store is plaintext PII); when trimmed the response sets truncated:true with total_rows, so narrow with WHERE/LIMIT and avoid group_concat/blob dumps.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                db: { type: "string", description: "Database name from list_databases" },
+                sql: { type: "string", description: "A single read-only statement (SELECT, WITH, PRAGMA, EXPLAIN)" },
+                refresh: {
+                    type: "boolean",
+                    description: "Re-pull a fresh copy from the device before querying (default false reuses this session's cached pull)",
+                },
+            },
+            required: ["db", "sql"],
+        },
+        annotations: { readOnlyHint: true },
+    },
 ];
 /**
  * Check whether a tool call should be blocked by the session gate.

package/dist/shared/android.js

@@ -2,7 +2,8 @@ import { execSync } from "child_process";
 import fs from "fs";
 import os from "os";
 import path from "path";
-import { getCaptureFilePath, isCapturing, readRecentLogs, registerCleanup, rotateCaptureIfNeeded, startCapture, stopCapture, } from "./logcat-capture.js";
+import { readDebugLogBuffer } from "./debug-log.js";
+import { filterLogLines, getCaptureFilePath, isCapturing, readRecentLogs, registerCleanup, rotateCaptureIfNeeded, startCapture, stopCapture, } from "./logcat-capture.js";
 const RADAR_PORT = 8099;
 const SOCKET_NAME = "slack-radar";
 const ENABLE_ACTION = "slack.debug.ENABLE_RADAR";
@@ -199,8 +200,19 @@ export class AndroidTransport {
     getRecentLogs(tag, limit, grep) {
         if (!ADB)
             throw new Error("adb not found on PATH or common SDK locations");
-        // Preferred path: read from the session capture file so lines cannot
-        // have been evicted from the device ring buffer between enable and now.
+        // Primary source: the app's own DebugLogger buffer, read off the sandbox via
+        // run-as. This is the app's structured log (exact tags, no logcat column
+        // padding) and survives the radar enable/disable cycle, so it does not lose
+        // lines to device-logcat ring eviction between enable and read. Target the
+        // profile Radar is bound to (resolveActiveUser prefers the non-zero/work
+        // profile), not a blind user 0, so a dual-profile device reads the right
+        // sandbox -- matching how the DB browser threads its user.
+        const appLog = readDebugLogBuffer(ADB, this.resolveActiveUser());
+        if (appLog !== null) {
+            return filterLogLines(appLog, tag, limit, grep);
+        }
+        // Fallback: read from the session capture file so lines cannot have been
+        // evicted from the device ring buffer between enable and now.
         if (isCapturing()) {
             // Opportunistic rotation. Stop+rename+restart when the file grows
             // past the threshold so the child never writes past a truncated EOF.

package/dist/shared/constants.d.ts

@@ -1,3 +1,11 @@
+/**
+ * Package version, read once from package.json at load — NOT a hardcoded copy, so it cannot
+ * drift from the published version. Surfaced as the `X-Radar-Version` header on /spec so a
+ * second launcher can tell whether the dashboard already holding the port is a different
+ * Radar version than itself (the adopt path notices a mismatch; it still adopts, never kills).
+ * Falls back to "unknown" if package.json cannot be read (should not happen in a real install).
+ */
+export declare const RADAR_VERSION: string;
 /** Port used to reach the on-device radar HTTP server via forwarding. */
 export declare const RADAR_PORT = 8099;
 /** Host address for the forwarded connection. */
@@ -24,3 +32,10 @@ export declare const MAX_LOG_SESSION_BUFFER = 20000;
  * `SLACK_RADAR_WEB_PORT` env override.
  */
 export declare const WEB_PORT_DEFAULT = 8100;
+/**
+ * The Slack debug build whose sandbox the host can `run-as` into. Both the
+ * on-device SQLite browser (db.ts) and the app log-buffer reader (debug-log.ts)
+ * read sandbox files through `adb exec-out "run-as <pkg> ..."`, which only works
+ * on a debuggable build. Defined once here so the two readers cannot drift.
+ */
+export declare const SLACK_DEBUG_PKG = "com.Slack.internal.debug";

package/dist/shared/constants.js

@@ -1,3 +1,20 @@
+import { createRequire } from "module";
+/**
+ * Package version, read once from package.json at load — NOT a hardcoded copy, so it cannot
+ * drift from the published version. Surfaced as the `X-Radar-Version` header on /spec so a
+ * second launcher can tell whether the dashboard already holding the port is a different
+ * Radar version than itself (the adopt path notices a mismatch; it still adopts, never kills).
+ * Falls back to "unknown" if package.json cannot be read (should not happen in a real install).
+ */
+export const RADAR_VERSION = (() => {
+    try {
+        const require = createRequire(import.meta.url);
+        return require("../../package.json").version ?? "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+})();
 /** Port used to reach the on-device radar HTTP server via forwarding. */
 export const RADAR_PORT = 8099;
 /** Host address for the forwarded connection. */
@@ -24,3 +41,10 @@ export const MAX_LOG_SESSION_BUFFER = 20000;
  * `SLACK_RADAR_WEB_PORT` env override.
  */
 export const WEB_PORT_DEFAULT = 8100;
+/**
+ * The Slack debug build whose sandbox the host can `run-as` into. Both the
+ * on-device SQLite browser (db.ts) and the app log-buffer reader (debug-log.ts)
+ * read sandbox files through `adb exec-out "run-as <pkg> ..."`, which only works
+ * on a debuggable build. Defined once here so the two readers cannot drift.
+ */
+export const SLACK_DEBUG_PKG = "com.Slack.internal.debug";

package/dist/shared/db.d.ts

@@ -13,8 +13,12 @@
  * cleaned on server start/stop (see `cleanupPulledDatabases`). The DB names are learned
  * live from the device (`listDatabases`); none are baked into this file.
  */
-/** Initialize DB_TMP with a port-scoped path. Call from the web server on startup. */
-export declare function initializeDatabasePath(port: number): void;
+/**
+ * Initialize DB_TMP with a per-process-unique path. Call on startup. The web server scopes
+ * by its port; the MCP server scopes by process.pid (every MCP shares one fixed port, so a
+ * port key would collide between two concurrent MCP servers).
+ */
+export declare function initializeDatabasePath(scopeKey: number): void;
 export declare function availableUsers(): string[];
 /**
  * Reset cached device state. Clears the sqlite-binary path so a device swap
@@ -50,20 +54,33 @@ export declare function listDatabases(user?: string | null): {
  */
 export declare function pullDatabase(name: string, user?: string | null, force?: boolean): Promise<string>;
 /**
- * Run a read-only query against a (lazily pulled) local copy.
+ * Read-only SQL gate. Throws on anything that is not a single read-only statement.
+ *
+ * Exported so a caller (the MCP query handler) can reject a bad query BEFORE pulling a
+ * multi-MB DB copy off the device. queryDatabase calls it too, so the boundary holds even
+ * if a caller forgets the pre-check.
  *
- * Read-only is NOT just about blocking writes. `sqlite3 -readonly` forbids writes to the
- * opened DB, but a single SELECT can still READ any host file the process can open, via
- * `ATTACH '/path' AS x; SELECT * FROM x.t` or `SELECT readfile('/path')` — a confidentiality
- * bypass (the other plaintext Slack DBs, any file on disk), reachable through the query box
- * or a pushed db-spec's `sql`. Three layers close this:
- *   1. `sqlite3 -safe` — engine-level: forbids ATTACH, readfile/writefile/edit, and
- *      load_extension while still allowing ordinary SELECT/PRAGMA. This is the load-bearing
+ * What actually keeps this safe (the boundary does NOT rest on this gate alone):
+ *   1. copy-based design — we only ever READ the device file (`exec-out cat`) and query a
+ *      throwaway local copy; nothing is ever written back, so no query can mutate device
+ *      state no matter what it does to the copy.
+ *   2. `sqlite3 -safe` — engine-level: forbids ATTACH, readfile/writefile/edit, and
+ *      load_extension while still allowing ordinary SELECT/PRAGMA. The load-bearing exfil
  *      control; a keyword denylist alone is whack-a-mole.
- *   2. the guard below: only a SINGLE SELECT/PRAGMA statement (no `;`-chaining), and an
- *      explicit reject of attach/readfile/writefile names as defense in depth.
- *   3. `-readonly` still blocks writes to the opened DB.
- * Surfaces sqlite's own error message on failure.
+ *   3. this gate — a single SELECT/PRAGMA/WITH/EXPLAIN/VALUES statement (no `;`-chaining),
+ *      a write-PRAGMA reject, and an explicit reject of file-access primitive names as
+ *      defense in depth.
+ * NOTE: the copy is opened NORMALLY (not `-readonly`, not `immutable`) on purpose, so SQLite
+ * replays the `-wal` sidecar and recently-committed rows stay visible. `-readonly`/immutable
+ * would read the main file alone and silently drop them; writes to the throwaway copy are
+ * harmless. So `-readonly` is intentionally NOT passed — the read-only guarantee comes from
+ * (1) and (2), not from the open mode.
+ */
+export declare function assertReadOnlyQuery(sql: string): void;
+/**
+ * Run a read-only query against a (lazily pulled) local copy. The query is gated by
+ * assertReadOnlyQuery (see there for the full read-only/exfil rationale). Surfaces sqlite's
+ * own error message on failure.
  */
 export declare function queryDatabase(name: string, sql: string, user?: string | null): Promise<unknown[]>;
 /** Size in bytes of a pulled local copy for the given user, or 0 if not pulled. */

package/dist/shared/db.js

@@ -19,13 +19,18 @@ import fs from "fs";
 import os from "os";
 import path from "path";
 import { resolveAdbPath } from "./android.js";
+import { SLACK_DEBUG_PKG } from "./constants.js";
 /** The debug build whose sandbox we can `run-as` into. */
-const DB_PKG = "com.Slack.internal.debug";
-/** Dedicated tmp dir for pulled DB copies. Cleaned on start/stop; files written 0600. Port-scoped so concurrent dashboards do not collide. */
+const DB_PKG = SLACK_DEBUG_PKG;
+/** Dedicated tmp dir for pulled DB copies. Cleaned on start/stop; files written 0600. Scoped by a per-process key so concurrent readers do not collide. */
 let DB_TMP = path.join(os.tmpdir(), "slack-radar-db");
-/** Initialize DB_TMP with a port-scoped path. Call from the web server on startup. */
-export function initializeDatabasePath(port) {
-    DB_TMP = path.join(os.tmpdir(), `slack-radar-db-${port}`);
+/**
+ * Initialize DB_TMP with a per-process-unique path. Call on startup. The web server scopes
+ * by its port; the MCP server scopes by process.pid (every MCP shares one fixed port, so a
+ * port key would collide between two concurrent MCP servers).
+ */
+export function initializeDatabasePath(scopeKey) {
+    DB_TMP = path.join(os.tmpdir(), `slack-radar-db-${scopeKey}`);
 }
 /** Every valid SQLite file begins with these 16 bytes. */
 const SQLITE_MAGIC = Buffer.from("SQLite format 3\0", "binary");
@@ -302,31 +307,32 @@ export async function pullDatabase(name, user, force = false) {
     return local;
 }
 /**
- * Run a read-only query against a (lazily pulled) local copy.
+ * Read-only SQL gate. Throws on anything that is not a single read-only statement.
+ *
+ * Exported so a caller (the MCP query handler) can reject a bad query BEFORE pulling a
+ * multi-MB DB copy off the device. queryDatabase calls it too, so the boundary holds even
+ * if a caller forgets the pre-check.
  *
- * Read-only is NOT just about blocking writes. `sqlite3 -readonly` forbids writes to the
- * opened DB, but a single SELECT can still READ any host file the process can open, via
- * `ATTACH '/path' AS x; SELECT * FROM x.t` or `SELECT readfile('/path')` — a confidentiality
- * bypass (the other plaintext Slack DBs, any file on disk), reachable through the query box
- * or a pushed db-spec's `sql`. Three layers close this:
- *   1. `sqlite3 -safe` — engine-level: forbids ATTACH, readfile/writefile/edit, and
- *      load_extension while still allowing ordinary SELECT/PRAGMA. This is the load-bearing
+ * What actually keeps this safe (the boundary does NOT rest on this gate alone):
+ *   1. copy-based design — we only ever READ the device file (`exec-out cat`) and query a
+ *      throwaway local copy; nothing is ever written back, so no query can mutate device
+ *      state no matter what it does to the copy.
+ *   2. `sqlite3 -safe` — engine-level: forbids ATTACH, readfile/writefile/edit, and
+ *      load_extension while still allowing ordinary SELECT/PRAGMA. The load-bearing exfil
  *      control; a keyword denylist alone is whack-a-mole.
- *   2. the guard below: only a SINGLE SELECT/PRAGMA statement (no `;`-chaining), and an
- *      explicit reject of attach/readfile/writefile names as defense in depth.
- *   3. `-readonly` still blocks writes to the opened DB.
- * Surfaces sqlite's own error message on failure.
+ *   3. this gate — a single SELECT/PRAGMA/WITH/EXPLAIN/VALUES statement (no `;`-chaining),
+ *      a write-PRAGMA reject, and an explicit reject of file-access primitive names as
+ *      defense in depth.
+ * NOTE: the copy is opened NORMALLY (not `-readonly`, not `immutable`) on purpose, so SQLite
+ * replays the `-wal` sidecar and recently-committed rows stay visible. `-readonly`/immutable
+ * would read the main file alone and silently drop them; writes to the throwaway copy are
+ * harmless. So `-readonly` is intentionally NOT passed — the read-only guarantee comes from
+ * (1) and (2), not from the open mode.
  */
-export async function queryDatabase(name, sql, user) {
-    assertSafeName(name);
-    // Leading-keyword gate over the common read-query entry forms: SELECT, WITH
-    // (CTEs, common against the message store), EXPLAIN, VALUES, PRAGMA. This shapes
-    // UX; it is NOT the security boundary. A `WITH ... DELETE` would slip the gate,
-    // but the device-safety property does not rest here — it rests on the copy-based
-    // design (the device file is `cat`'d to a throwaway and never written back), plus
-    // `-safe` (blocks file access), the single-statement gate, the write-PRAGMA
-    // reject, and the file-primitive denylist below. Worst case a smuggled write
-    // mutates the disposable copy; the device store is untouched.
+export function assertReadOnlyQuery(sql) {
+    // Leading-keyword gate over the common read-query entry forms. This shapes UX; it is NOT
+    // the security boundary (a `WITH ... DELETE` would slip it, but that can only touch the
+    // throwaway copy). The boundary is the copy-based design + `-safe` above.
     if (!/^\s*(select|pragma|with|explain|values)\b/i.test(sql)) {
         throw new Error("only read-only statements are allowed (SELECT, WITH, EXPLAIN, VALUES, PRAGMA)");
     }
@@ -337,11 +343,8 @@ export async function queryDatabase(name, sql, user) {
     }
     // Reject the common write PRAGMAs: an assigning form (`PRAGMA user_version=5`,
     // `PRAGMA journal_mode=DELETE`) or a checkpoint (`PRAGMA wal_checkpoint(...)`).
-    // This is not exhaustive — a few argless mutating PRAGMAs (`incremental_vacuum`,
-    // `optimize`, `shrink_memory`) still pass. That is acceptable: the device-safety
-    // guarantee comes from the copy-based design (we only ever read the device file
-    // and write a throwaway local copy), not from this gate. Worst case such a PRAGMA
-    // mutates the disposable copy; the device store is never written back.
+    // Not exhaustive — a few argless mutating PRAGMAs (`incremental_vacuum`, `optimize`,
+    // `shrink_memory`) still pass. Acceptable: worst case they mutate the disposable copy.
     if (/^\s*pragma\b/i.test(sql) && (/=/.test(sql) || /\bwal_checkpoint\b/i.test(sql))) {
         throw new Error("that PRAGMA writes; only read-only PRAGMAs are allowed");
     }
@@ -349,6 +352,15 @@ export async function queryDatabase(name, sql, user) {
     if (/\b(attach|readfile|writefile|edit|load_extension|fts3_tokenizer)\b/i.test(sql)) {
         throw new Error("that function/statement is not allowed (read-only, no file access)");
     }
+}
+/**
+ * Run a read-only query against a (lazily pulled) local copy. The query is gated by
+ * assertReadOnlyQuery (see there for the full read-only/exfil rationale). Surfaces sqlite's
+ * own error message on failure.
+ */
+export async function queryDatabase(name, sql, user) {
+    assertSafeName(name);
+    assertReadOnlyQuery(sql);
     const u = resolveUser(user);
     const local = localPath(name, u);
     if (!fs.existsSync(local))