@slack/radar-mcp 1.6.0 → 1.7.0

package/README.md

@@ -45,9 +45,10 @@ Opens `http://localhost:8100` automatically. Set `SLACK_RADAR_WEB_PORT` to use a
 * **RTM** — real-time websocket events
 * **Clogs** — analytics events, click one to see its payload
 * **Logs** — device logcat, filtered to the Slack app (switch app or clear the filter)
+* **Database** — read-only browser for the on-device SQLite stores (pick a database, then a table, or run a read-only query). See the data-handling note below.
 * **Custom** — a tab Claude builds on request. Ask a Claude Code session in your terminal for a view the pre-built tabs do not cover (e.g. "graph calls per second and flag the slow ones"); it authors the view via the `open_radar_dashboard` tool and it appears here. Persists until you refresh the page.
 
-Each tab has a counter, rate, sparkline, graph, a filter / sort / pause feed, and a payload inspector. Switching tabs replays what you have already seen this session (the browser caches it, bounded by count and age) so the view does not reset to empty. ADB forwarding and device activation are handled for you; a reconnect control re-arms after a device sleep.
+Each tab has a rate, sparkline, graph, a filter / sort / pause feed, and a payload inspector. Switching tabs replays what you have already seen this session (the browser caches it, bounded by count and age) so the view does not reset to empty. ADB forwarding and device activation are handled for you; a reconnect control re-arms after a device sleep. The dashboard follows your system light/dark setting by default; the theme toggle in the header overrides it and is remembered.
 
 ### Screen overlay
 
@@ -89,7 +90,7 @@ Radar starts **disabled** each session. All tools except `ping` return an error
 | `wait_for_events` | Block until matching events arrive via SSE stream. Idle-timeout based, not polling. |
 | `search` | Full-text search across network, RTM, and clog buffers. |
 | `get_app_state` | Current Activity/Fragment state via `dumpsys`. Shows visible screen, parameters, tab state. |
-| `get_recent_logs` | Logcat entries filtered by tag. For Timber debug logs (`FKDebug`, `SlackRadar`, etc.). |
+| `get_recent_logs` | Recent device logs, optionally filtered by tag (omit `tag` for all lines). Reads the app's own debug log buffer first, falling back to logcat; the result's `source` field (`app_buffer` / `logcat_capture` / `logcat_ring`) names which one served it. For Timber debug logs (`FKDebug`, `SlackRadar`, etc.). |
 | `screenshot` | Capture device screen as PNG. 720px default, `full_res=true` for full resolution. |
 | `record_screen` | Record short screen video (MP4). Default 5s, max 30s. |
 | `clear_buffers` | Clear all captured network calls and RTM events from device and local buffers. |
@@ -146,7 +147,7 @@ This tool captures unredacted network traffic from your debug Slack build, inclu
 * RTM WebSocket payloads (every sent and received message)
 * Analytics (clog) events serialized as JSON
 * Screenshots and short screen recordings on demand
-* Logcat entries filtered by tag
+* Device logs (the app's own debug buffer, with a logcat fallback), optionally filtered by tag
 
 Auth tokens and session cookies will appear in captured data. Captured data flows to your MCP client (Claude Code), which may send relevant portions to the configured AI provider per its own data handling policy.
 

package/dist/mcp/api-paths.d.ts

@@ -0,0 +1 @@
+export declare function buildApiPath(name: string, args: Record<string, unknown>): string | null;

package/dist/mcp/api-paths.js

@@ -0,0 +1,108 @@
+// Maps an MCP tool name + its args to the device HTTP path the MCP server proxies it to.
+// Extracted from index.ts (where it was nested inside runMcpServer, so unreachable by a unit
+// test) into its own module so the device-route contract for EVERY proxied tool -- network,
+// rtm, clog, trace, search, and the detail-by-id variants -- is pinned by a table test
+// (tests/api-paths.test.mjs). Pure: no I/O, no device, just string building.
+//
+// The arg shapes here are the query-param subset each tool sends; they intentionally duplicate
+// the (wider) handler arg interfaces in index.ts rather than couple this pure module to them.
+// Build the device path for a detail-by-id tool. The MCP SDK casts args without enforcing the
+// JSON Schema (no zod), so `id` can arrive as a string carrying "/" or ".." even though the
+// schema says number. All four detail tools (network/rtm/clog/trace) read the device's OWN
+// forwarded server with no shell/fs, so the blast radius is small, but an un-encoded id is still
+// a path-traversal smell. Accept only a non-negative integer id; anything else returns null
+// (the caller reports "unknown tool"/no path rather than firing a malformed device request).
+function detailPath(resource, id) {
+    let n;
+    if (typeof id === "number") {
+        n = id;
+    }
+    else if (typeof id === "string" && /^\d+$/.test(id.trim())) {
+        // a clean digit string only -- Number("") and Number(" ") are 0 and Number("1/../x") is NaN,
+        // but "1e3"/"0x10"/"  5  " would also coerce; the \d+ test rejects all of those outright.
+        n = Number(id.trim());
+    }
+    else {
+        return null;
+    }
+    if (!Number.isInteger(n) || n < 0)
+        return null;
+    return `/api/${resource}/${n}`;
+}
+export function buildApiPath(name, args) {
+    switch (name) {
+        case "get_recent_network_calls": {
+            const a = args;
+            const params = new URLSearchParams();
+            if (a?.limit)
+                params.set("limit", String(a.limit));
+            if (a?.url_filter)
+                params.set("url_filter", a.url_filter);
+            if (a?.status_code)
+                params.set("status_code", String(a.status_code));
+            const qs = params.toString();
+            return `/api/network${qs ? "?" + qs : ""}`;
+        }
+        case "get_network_call_detail": {
+            const a = args;
+            return detailPath("network", a.id);
+        }
+        case "get_recent_rtm_events": {
+            const a = args;
+            const params = new URLSearchParams();
+            if (a?.limit)
+                params.set("limit", String(a.limit));
+            if (a?.event_type)
+                params.set("event_type", a.event_type);
+            if (a?.direction)
+                params.set("direction", a.direction);
+            if (a?.channel)
+                params.set("channel", a.channel);
+            const qs = params.toString();
+            return `/api/rtm${qs ? "?" + qs : ""}`;
+        }
+        case "get_rtm_event_detail": {
+            const a = args;
+            return detailPath("rtm", a.id);
+        }
+        case "get_recent_clogs": {
+            const a = args;
+            const params = new URLSearchParams();
+            if (a?.limit)
+                params.set("limit", String(a.limit));
+            if (a?.name)
+                params.set("name", a.name);
+            const qs = params.toString();
+            return `/api/clogs${qs ? "?" + qs : ""}`;
+        }
+        case "get_clog_detail": {
+            const a = args;
+            return detailPath("clogs", a.id);
+        }
+        case "get_recent_traces": {
+            const a = args;
+            const params = new URLSearchParams();
+            // Default the limit when absent: traces can be large and an omitted limit would otherwise
+            // rely on an unverified device-side default and stream an unbounded result into the model
+            // context. 50 matches the other recent-* tools' practical page size.
+            params.set("limit", String(a?.limit && a.limit > 0 ? a.limit : 50));
+            if (a?.name)
+                params.set("name", a.name);
+            return `/api/traces?${params.toString()}`;
+        }
+        case "get_trace_detail": {
+            const a = args;
+            return detailPath("traces", a.id);
+        }
+        case "search": {
+            const a = args;
+            const params = new URLSearchParams();
+            params.set("q", a.query);
+            if (a?.limit)
+                params.set("limit", String(a.limit));
+            return `/api/search?${params.toString()}`;
+        }
+        default:
+            return null;
+    }
+}

package/dist/mcp/index.js

@@ -12,9 +12,11 @@ import { RADAR_HOST, RADAR_PORT, WEB_PORT_DEFAULT } from "../shared/constants.js
 import { stopCapture } from "../shared/logcat-capture.js";
 import { connectStream, destroyStream, waitForEvents, clearLocalBuffers, isStreamConnected, localNetworkBuffer, localRtmBuffer, setTransport, } from "../shared/stream.js";
 import { buildBufferPath, createSnapshot } from "./snapshot.js";
+import { clampLogLimit, shapeLogsResult } from "./logs-result.js";
 import { handleListDatabases, handleListTables, handleQueryDatabase, } from "./db-tools.js";
 import { cleanupPulledDatabases, initializeDatabasePath, resetDbState, } from "../shared/db.js";
 import { TOOL_DEFINITIONS, SERVER_INSTRUCTIONS, sessionGate } from "./tools.js";
+import { buildApiPath } from "./api-paths.js";
 // --- Subcommand + bin-name dispatch ---
 //
 // One entrypoint, two front doors, chosen so each invocation does the obvious thing:
@@ -198,8 +200,30 @@ async function runMcpServer() {
         process.once(sig, cleanupPulledDatabases);
     }
     let sessionEnabled = false;
+    // Host-side ceiling on a proxied device response. radarRequest forwards the device body straight
+    // into the model context, so an unbounded response (large trace/clog payloads) could flood it.
+    // When the cap trips we stop reading, tear the socket down, and return a truncation marker
+    // rather than a partial JSON blob the parser would choke on. 1MB is generous for a point query;
+    // bulk exports go through capture_snapshot, not this path.
+    const MAX_RADAR_RESPONSE_BYTES = 1024 * 1024;
     function radarRequest(requestPath) {
         return new Promise((resolve, reject) => {
+            // settled-guard: req.destroy() on the cap path fires "error" (ECONNRESET) AFTER we have
+            // already resolved the truncation, so every settle goes through these wrappers and the
+            // second one is a no-op. Without this the abort would reject an already-resolved promise.
+            let settled = false;
+            const done = (r) => {
+                if (settled)
+                    return;
+                settled = true;
+                resolve(r);
+            };
+            const fail = (e) => {
+                if (settled)
+                    return;
+                settled = true;
+                reject(e);
+            };
             const req = http.get({
                 host: RADAR_HOST,
                 port: RADAR_PORT,
@@ -207,22 +231,36 @@ async function runMcpServer() {
                 timeout: 10000,
             }, (res) => {
                 let data = "";
+                let bytes = 0;
                 res.on("data", (chunk) => {
+                    if (settled)
+                        return;
+                    bytes += chunk.length; // byte length, not String.length (UTF-8 over the wire)
+                    if (bytes > MAX_RADAR_RESPONSE_BYTES) {
+                        // Resolve the truncation NOW (not on "end" — req.destroy() aborts the response so
+                        // "end" never fires; it surfaces as an "error" the settled-guard then swallows).
+                        done({
+                            error: `Device response exceeded the ${Math.round(MAX_RADAR_RESPONSE_BYTES / 1024)}KB response budget and was dropped to protect the model context. Narrow the query (lower limit, add a name/filter), or use capture_snapshot for a bulk export.`,
+                            _truncated: true,
+                        });
+                        req.destroy();
+                        return;
+                    }
                     data += chunk;
                 });
                 res.on("end", () => {
                     try {
-                        resolve(JSON.parse(data));
+                        done(JSON.parse(data));
                     }
                     catch {
-                        resolve({ raw: data });
+                        done({ raw: data });
                     }
                 });
             });
-            req.on("error", reject);
+            req.on("error", fail);
             req.on("timeout", () => {
                 req.destroy();
-                reject(new Error("Request timed out"));
+                fail(new Error("Request timed out"));
             });
         });
     }
@@ -427,18 +465,14 @@ async function runMcpServer() {
     }
     function handleGetRecentLogs(args) {
         try {
-            const lines = device.getRecentLogs(args.tag, args.limit || 50, args.grep);
-            // Surface the capture file path so the model knows which on-disk file
-            // produced these lines. Helps avoid cross-session staleness (e.g. the
-            // model remembering an earlier profile's logs after a profile switch).
-            const sourceFile = device.getCaptureFilePath?.() ?? null;
-            return textResult({
-                tag: args.tag,
-                lines,
-                count: lines.length,
-                source_file: sourceFile,
-                source: sourceFile ? "capture" : "adb_logcat_d",
-            });
+            const tag = args.tag ?? "";
+            const limit = clampLogLimit(args.limit);
+            const result = device.getRecentLogs(tag, limit, args.grep);
+            // shapeLogsResult preserves the source label (app_buffer / logcat_capture / logcat_ring)
+            // that getRecentLogs returns, so the caller can tell a true-empty result from a silent
+            // fallback to an inferior source (0 lines from app_buffer means the tag is really absent;
+            // 0 from logcat_ring may mean the better source was unreachable).
+            return textResult(shapeLogsResult(tag, result));
         }
         catch (e) {
             return textResult({ error: `Log query failed: ${e.message}`, lines: [] }, true);
@@ -517,70 +551,8 @@ async function runMcpServer() {
             }, true);
         }
     }
-    function buildApiPath(name, args) {
-        switch (name) {
-            case "get_recent_network_calls": {
-                const a = args;
-                const params = new URLSearchParams();
-                if (a?.limit)
-                    params.set("limit", String(a.limit));
-                if (a?.url_filter)
-                    params.set("url_filter", a.url_filter);
-                if (a?.status_code)
-                    params.set("status_code", String(a.status_code));
-                const qs = params.toString();
-                return `/api/network${qs ? "?" + qs : ""}`;
-            }
-            case "get_network_call_detail": {
-                const a = args;
-                return `/api/network/${a.id}`;
-            }
-            case "get_recent_rtm_events": {
-                const a = args;
-                const params = new URLSearchParams();
-                if (a?.limit)
-                    params.set("limit", String(a.limit));
-                if (a?.event_type)
-                    params.set("event_type", a.event_type);
-                if (a?.direction)
-                    params.set("direction", a.direction);
-                if (a?.channel)
-                    params.set("channel", a.channel);
-                const qs = params.toString();
-                return `/api/rtm${qs ? "?" + qs : ""}`;
-            }
-            case "get_rtm_event_detail": {
-                const a = args;
-                return `/api/rtm/${a.id}`;
-            }
-            case "get_recent_clogs": {
-                const a = args;
-                const params = new URLSearchParams();
-                if (a?.limit)
-                    params.set("limit", String(a.limit));
-                if (a?.name)
-                    params.set("name", a.name);
-                const qs = params.toString();
-                return `/api/clogs${qs ? "?" + qs : ""}`;
-            }
-            case "get_clog_detail": {
-                const a = args;
-                return `/api/clogs/${a.id}`;
-            }
-            case "search": {
-                const a = args;
-                const params = new URLSearchParams();
-                params.set("q", a.query);
-                if (a?.limit)
-                    params.set("limit", String(a.limit));
-                return `/api/search?${params.toString()}`;
-            }
-            default:
-                return null;
-        }
-    }
     // --- MCP Server ---
-    const server = new Server({ name: "slack-radar", version: "1.6.0" }, { capabilities: { tools: {} }, instructions: SERVER_INSTRUCTIONS });
+    const server = new Server({ name: "slack-radar", version: "1.7.0" }, { capabilities: { tools: {} }, instructions: SERVER_INSTRUCTIONS });
     server.setRequestHandler(ListToolsRequestSchema, async () => ({
         tools: TOOL_DEFINITIONS,
     }));

package/dist/mcp/logs-result.d.ts

@@ -0,0 +1,9 @@
+import type { LogResult } from "../shared/transport.js";
+export interface LogsToolResult {
+    tag: string;
+    lines: string[];
+    count: number;
+    source?: string;
+}
+export declare function clampLogLimit(limit: number | undefined): number;
+export declare function shapeLogsResult(tag: string, result: LogResult): LogsToolResult;

package/dist/mcp/logs-result.js

@@ -0,0 +1,15 @@
+// Clamp the requested line count. With tag optional, a no-tag call returns the whole buffer
+// (thousands of lines, ~1.5MB), so an unbounded limit would flood the model context with
+// potentially PII-bearing log lines. 1000 is a generous ceiling for a debug read; default 50.
+export function clampLogLimit(limit) {
+    return Math.min(Math.max(limit || 50, 1), 1000);
+}
+// Shape the device result into the tool payload, preserving the source label verbatim.
+export function shapeLogsResult(tag, result) {
+    return {
+        tag,
+        lines: result.lines,
+        count: result.lines.length,
+        source: result.source,
+    };
+}

package/dist/mcp/tools.js

@@ -20,9 +20,10 @@ export const SERVER_INSTRUCTIONS = [
     '- "why isn\'t this loading" / "this is broken" -> screenshot + get_recent_network_calls(status_code=400 or 500)',
     '- "watch what happens when I..." -> clear_buffers then wait_for_events (DO NOT filter unless the user specifies a type)',
     '- "did that clog fire" / "check analytics" -> get_recent_clogs(name="...")',
+    '- "why is this slow" / "how long did X take" / "show me the traces" / "check performance" -> get_recent_traces(name="...") then get_trace_detail',
     '- "what API call was that" -> get_recent_network_calls then get_network_call_detail',
     '- "did I get X" / "did X happen" -> search(query="X") across ALL buffers, not just one',
-    '- "check the debug logs" -> get_recent_logs(tag="...")',
+    '- "check the debug logs" -> get_recent_logs (tag is OPTIONAL: pass tag="FKDebug" to filter, or omit it for all recent lines)',
     '- "save this" / "file this as a bug" / "share this" / "bundle this" / "attach to ticket" / "give me a repro" / "snapshot this" / "preserve this" / "hold this state" / "save what you just saw" -> capture_snapshot',
     "",
     "Key behaviors:",
@@ -203,6 +204,30 @@ export const TOOL_DEFINITIONS = [
         },
         annotations: { readOnlyHint: true },
     },
+    {
+        name: "get_recent_traces",
+        description: "Get recent performance trace summaries (one row per completed span from the app's telemetry pipeline). Returns trace name, span name, and duration. Use get_trace_detail for the full span, including its tags and the parent/trace ids.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                limit: { type: "number", description: "Max number of traces to return (default: 50)" },
+                name: { type: "string", description: "Filter by trace name or span name substring" },
+            },
+        },
+        annotations: { readOnlyHint: true },
+    },
+    {
+        name: "get_trace_detail",
+        description: "Get full details of a specific performance trace by ID: trace and span names, the trace and parent ids, start/end/duration, and the span tags.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                id: { type: "number", description: "The trace ID from get_recent_traces" },
+            },
+            required: ["id"],
+        },
+        annotations: { readOnlyHint: true },
+    },
     {
         name: "wait_for_events",
         description: "Wait for matching events to arrive in real-time via the SSE stream.",
@@ -211,7 +236,7 @@ export const TOOL_DEFINITIONS = [
             properties: {
                 event_type: { type: "string", description: "RTM event type to wait for" },
                 channel: { type: "string", description: "Filter by channel ID" },
-                source: { type: "string", description: "Wait for network calls or RTM events (default: both)" },
+                source: { type: "string", description: "Limit to one stream: network, rtm, clog, log, or trace (default: all)" },
                 timeout_ms: { type: "number", description: "Max time to wait in ms (default: 30000)" },
                 idle_timeout_ms: { type: "number", description: "Resolve after this many ms of silence (default: 3000)" },
             },
@@ -220,7 +245,7 @@ export const TOOL_DEFINITIONS = [
     },
     {
         name: "search",
-        description: "Search across all captured network calls and RTM events.",
+        description: "Search across all captured network calls, RTM events, clogs, and performance traces.",
         inputSchema: {
             type: "object",
             properties: {
@@ -239,15 +264,14 @@ export const TOOL_DEFINITIONS = [
     },
     {
         name: "get_recent_logs",
-        description: "Get recent device logs for the Slack debug build, filtered by tag. Reads the app's own log buffer first (the DEBUG-and-above Timber lines the in-app Log Viewer shows, this app only), and falls back to an adb logcat snapshot when that buffer cannot be read. For native crashes, VERBOSE lines, or non-Slack processes, use adb logcat directly.",
+        description: "Get recent device logs for the Slack debug build. Reads the app's own log buffer first (the DEBUG-and-above Timber lines the in-app Log Viewer shows, this app only), and falls back to an adb logcat snapshot when that buffer cannot be read. The result includes a `source` field (app_buffer / logcat_capture / logcat_ring) so you can tell a real empty result from a fallback. Leave `tag` out to get all recent lines. For native crashes, VERBOSE lines, or non-Slack processes, use adb logcat directly.",
         inputSchema: {
             type: "object",
             properties: {
-                tag: { type: "string", description: "Substring to filter log lines by (matched anywhere in the line, not an exact tag-column match)" },
-                limit: { type: "number", description: "Max number of lines to return (default: 50)" },
+                tag: { type: "string", description: "Optional substring to filter log lines by (matched anywhere in the line, not an exact tag-column match). Omit to return all recent lines." },
+                limit: { type: "number", description: "Max number of lines to return (default: 50, capped at 1000)" },
                 grep: { type: "string", description: "Optional text to grep within the filtered output" },
             },
-            required: ["tag"],
         },
         annotations: { readOnlyHint: true },
     },

package/dist/shared/android.d.ts

@@ -1,4 +1,4 @@
-import type { DeviceTransport } from "./transport.js";
+import type { DeviceTransport, LogResult } from "./transport.js";
 /**
  * Resolve the adb binary. MCP servers spawned from GUI launchers (Spotlight,
  * Raycast, Dock) do not inherit the user's shell PATH, so a bare `adb` call
@@ -44,7 +44,7 @@ export declare class AndroidTransport implements DeviceTransport {
     screenshot(fullRes: boolean): string;
     recordScreen(durationS: number): string;
     getAppState(): string;
-    getRecentLogs(tag: string, limit: number, grep?: string): string[];
+    getRecentLogs(tag: string, limit: number, grep?: string): LogResult;
     listProfiles(): {
         userId: string;
         label: string;

package/dist/shared/android.js

@@ -1,4 +1,4 @@
-import { execSync } from "child_process";
+import { execSync, execFileSync } from "child_process";
 import fs from "fs";
 import os from "os";
 import path from "path";
@@ -209,7 +209,7 @@ export class AndroidTransport {
         // sandbox -- matching how the DB browser threads its user.
         const appLog = readDebugLogBuffer(ADB, this.resolveActiveUser());
         if (appLog !== null) {
-            return filterLogLines(appLog, tag, limit, grep);
+            return { lines: filterLogLines(appLog, tag, limit, grep), source: "app_buffer" };
         }
         // Fallback: read from the session capture file so lines cannot have been
         // evicted from the device ring buffer between enable and now.
@@ -220,20 +220,25 @@ export class AndroidTransport {
             rotateCaptureIfNeeded(ADB);
             const lines = readRecentLogs(tag, limit, grep);
             if (lines !== null)
-                return lines;
+                return { lines, source: "logcat_capture" };
         }
         // Fallback: device ring buffer snapshot. Used when capture is not running
-        // (activate() was skipped, child died, or the file was deleted).
-        let cmd = `${ADB} logcat -d | grep -F "${tag}" | tail -${limit}`;
-        if (grep) {
-            cmd = `${ADB} logcat -d | grep -F "${tag}" | grep -i "${grep.replace(/"/g, '\\"')}" | tail -${limit}`;
-        }
-        const output = execSync(cmd, {
+        // (activate() was skipped, child died, or the file was deleted). No shell:
+        // dump the ring with execFileSync (argv, so a tag/grep with a backtick,
+        // $(...), or trailing backslash cannot break out of a command string) and do
+        // the tag/grep/limit filtering in pure JS via the same filterLogLines the
+        // other two sources use. An empty tag means "no filter" (includes("") is
+        // true), so the whole tail is returned.
+        const output = execFileSync(ADB, ["logcat", "-d"], {
             timeout: 10000,
-            shell: "/bin/zsh",
             encoding: "utf-8",
+            maxBuffer: 64 * 1024 * 1024,
         });
-        return output.trim().split("\n").filter(Boolean);
+        const lines = output.split("\n").filter(Boolean);
+        return {
+            lines: filterLogLines(lines, tag, limit, grep),
+            source: "logcat_ring",
+        };
     }
     listProfiles() {
         if (!ADB)

package/dist/shared/screen.d.ts

@@ -130,6 +130,16 @@ export declare function startLive(fps: number): LiveCast | null;
 /** Attach an HTTP response as a viewer of the live cast (after the multipart headers are written). */
 export declare function addViewer(L: LiveCast, res: NodeJS.WritableStream): void;
 export declare function removeViewer(res: NodeJS.WritableStream): void;
+/**
+ * Tear down the live cast when nothing is keeping it alive: no viewers AND no active
+ * recording. Either a viewer leaving or a recording stopping can be the last thing
+ * holding the cast, so both paths call this. The close-while-recording case needs it:
+ * the browser aborts the <img> (dropping the last viewer) BEFORE its record/stop POST
+ * resolves, so the viewer-leave finds recording still set and cannot reap; the cast
+ * would then run forever (screenrecord + ffmpeg) once the recording ends. Reaping again
+ * after stopRecording closes that gap.
+ */
+export declare function reapLiveIfIdle(): void;
 export declare function getLive(): LiveCast | null;
 export declare function lastFrame(): Buffer | null;
 export declare function primeIfNeeded(): Promise<void>;

package/dist/shared/screen.js

@@ -461,7 +461,19 @@ export function removeViewer(res) {
     if (!scLive)
         return;
     scLive.viewers.delete(res);
-    if (!scLive.viewers.size && !scLive.recording) {
+    reapLiveIfIdle();
+}
+/**
+ * Tear down the live cast when nothing is keeping it alive: no viewers AND no active
+ * recording. Either a viewer leaving or a recording stopping can be the last thing
+ * holding the cast, so both paths call this. The close-while-recording case needs it:
+ * the browser aborts the <img> (dropping the last viewer) BEFORE its record/stop POST
+ * resolves, so the viewer-leave finds recording still set and cannot reap; the cast
+ * would then run forever (screenrecord + ffmpeg) once the recording ends. Reaping again
+ * after stopRecording closes that gap.
+ */
+export function reapLiveIfIdle() {
+    if (scLive && !scLive.viewers.size && !scLive.recording) {
         cleanupLive(scLive);
         scLive = null;
     }

package/dist/shared/stream.d.ts

@@ -6,7 +6,7 @@ export interface RadarEvent {
     [key: string]: unknown;
 }
 export interface ParsedSSE {
-    type: "network" | "rtm";
+    type: "network" | "rtm" | "clog" | "log" | "trace";
     event: RadarEvent;
 }
 export declare const localNetworkBuffer: RadarEvent[];

package/dist/shared/transport.d.ts

@@ -6,6 +6,13 @@
  * device-specific operations. The MCP server and tool handlers
  * interact only through this interface.
  */
+/** Which underlying source served a getRecentLogs result. */
+export type LogSource = "app_buffer" | "logcat_capture" | "logcat_ring";
+/** Lines plus the source that produced them. */
+export interface LogResult {
+    lines: string[];
+    source: LogSource;
+}
 export interface DeviceTransport {
     /** Human-readable platform name (e.g. "android", "ios"). */
     readonly platform: string;
@@ -47,14 +54,15 @@ export interface DeviceTransport {
      */
     getAppState(): string;
     /**
-     * Get recent log entries filtered by tag.
+     * Get recent log entries, optionally filtered by tag.
      *
-     * @param tag Log tag to filter by
+     * @param tag Log tag to filter by. Empty string returns every line (no tag filter).
      * @param limit Max number of lines
      * @param grep Optional text to further filter
-     * @returns Array of matching log lines
+     * @returns The matching lines plus which source served them, so the caller can tell a
+     *   true-empty result from a silent fallback to an inferior source.
      */
-    getRecentLogs(tag: string, limit: number, grep?: string): string[];
+    getRecentLogs(tag: string, limit: number, grep?: string): LogResult;
     /**
      * Returns the currently active user ID, or null if none is set. On Android
      * this is the profile (e.g. "0" for personal, "10" for work); on iOS it