@slack/radar-mcp 1.6.0 → 1.8.0

package/README.md

@@ -45,9 +45,10 @@ Opens `http://localhost:8100` automatically. Set `SLACK_RADAR_WEB_PORT` to use a
 * **RTM** — real-time websocket events
 * **Clogs** — analytics events, click one to see its payload
 * **Logs** — device logcat, filtered to the Slack app (switch app or clear the filter)
+* **Database** — read-only browser for the on-device SQLite stores (pick a database, then a table, or run a read-only query). See the data-handling note below.
 * **Custom** — a tab Claude builds on request. Ask a Claude Code session in your terminal for a view the pre-built tabs do not cover (e.g. "graph calls per second and flag the slow ones"); it authors the view via the `open_radar_dashboard` tool and it appears here. Persists until you refresh the page.
 
-Each tab has a counter, rate, sparkline, graph, a filter / sort / pause feed, and a payload inspector. Switching tabs replays what you have already seen this session (the browser caches it, bounded by count and age) so the view does not reset to empty. ADB forwarding and device activation are handled for you; a reconnect control re-arms after a device sleep.
+Each tab has a rate, sparkline, graph, a filter / sort / pause feed, and a payload inspector. Switching tabs replays what you have already seen this session (the browser caches it, bounded by count and age) so the view does not reset to empty. ADB forwarding and device activation are handled for you; a reconnect control re-arms after a device sleep. The dashboard follows your system light/dark setting by default; the theme toggle in the header overrides it and is remembered.
 
 ### Screen overlay
 
@@ -89,7 +90,7 @@ Radar starts **disabled** each session. All tools except `ping` return an error
 | `wait_for_events` | Block until matching events arrive via SSE stream. Idle-timeout based, not polling. |
 | `search` | Full-text search across network, RTM, and clog buffers. |
 | `get_app_state` | Current Activity/Fragment state via `dumpsys`. Shows visible screen, parameters, tab state. |
-| `get_recent_logs` | Logcat entries filtered by tag. For Timber debug logs (`FKDebug`, `SlackRadar`, etc.). |
+| `get_recent_logs` | Recent device logs, optionally filtered by tag (omit `tag` for all lines). Reads the app's own debug log buffer first, falling back to logcat; the result's `source` field (`app_buffer` / `logcat_capture` / `logcat_ring`) names which one served it. For Timber debug logs (`FKDebug`, `SlackRadar`, etc.). |
 | `screenshot` | Capture device screen as PNG. 720px default, `full_res=true` for full resolution. |
 | `record_screen` | Record short screen video (MP4). Default 5s, max 30s. |
 | `clear_buffers` | Clear all captured network calls and RTM events from device and local buffers. |
@@ -146,7 +147,7 @@ This tool captures unredacted network traffic from your debug Slack build, inclu
 * RTM WebSocket payloads (every sent and received message)
 * Analytics (clog) events serialized as JSON
 * Screenshots and short screen recordings on demand
-* Logcat entries filtered by tag
+* Device logs (the app's own debug buffer, with a logcat fallback), optionally filtered by tag
 
 Auth tokens and session cookies will appear in captured data. Captured data flows to your MCP client (Claude Code), which may send relevant portions to the configured AI provider per its own data handling policy.
 

package/dist/mcp/api-paths.d.ts

@@ -0,0 +1 @@
+export declare function buildApiPath(name: string, args: Record<string, unknown>): string | null;

package/dist/mcp/api-paths.js

@@ -0,0 +1,108 @@
+// Maps an MCP tool name + its args to the device HTTP path the MCP server proxies it to.
+// Extracted from index.ts (where it was nested inside runMcpServer, so unreachable by a unit
+// test) into its own module so the device-route contract for EVERY proxied tool -- network,
+// rtm, clog, trace, search, and the detail-by-id variants -- is pinned by a table test
+// (tests/api-paths.test.mjs). Pure: no I/O, no device, just string building.
+//
+// The arg shapes here are the query-param subset each tool sends; they intentionally duplicate
+// the (wider) handler arg interfaces in index.ts rather than couple this pure module to them.
+// Build the device path for a detail-by-id tool. The MCP SDK casts args without enforcing the
+// JSON Schema (no zod), so `id` can arrive as a string carrying "/" or ".." even though the
+// schema says number. All four detail tools (network/rtm/clog/trace) read the device's OWN
+// forwarded server with no shell/fs, so the blast radius is small, but an un-encoded id is still
+// a path-traversal smell. Accept only a non-negative integer id; anything else returns null
+// (the caller reports "unknown tool"/no path rather than firing a malformed device request).
+function detailPath(resource, id) {
+    let n;
+    if (typeof id === "number") {
+        n = id;
+    }
+    else if (typeof id === "string" && /^\d+$/.test(id.trim())) {
+        // a clean digit string only -- Number("") and Number(" ") are 0 and Number("1/../x") is NaN,
+        // but "1e3"/"0x10"/"  5  " would also coerce; the \d+ test rejects all of those outright.
+        n = Number(id.trim());
+    }
+    else {
+        return null;
+    }
+    if (!Number.isInteger(n) || n < 0)
+        return null;
+    return `/api/${resource}/${n}`;
+}
+export function buildApiPath(name, args) {
+    switch (name) {
+        case "get_recent_network_calls": {
+            const a = args;
+            const params = new URLSearchParams();
+            if (a?.limit)
+                params.set("limit", String(a.limit));
+            if (a?.url_filter)
+                params.set("url_filter", a.url_filter);
+            if (a?.status_code)
+                params.set("status_code", String(a.status_code));
+            const qs = params.toString();
+            return `/api/network${qs ? "?" + qs : ""}`;
+        }
+        case "get_network_call_detail": {
+            const a = args;
+            return detailPath("network", a.id);
+        }
+        case "get_recent_rtm_events": {
+            const a = args;
+            const params = new URLSearchParams();
+            if (a?.limit)
+                params.set("limit", String(a.limit));
+            if (a?.event_type)
+                params.set("event_type", a.event_type);
+            if (a?.direction)
+                params.set("direction", a.direction);
+            if (a?.channel)
+                params.set("channel", a.channel);
+            const qs = params.toString();
+            return `/api/rtm${qs ? "?" + qs : ""}`;
+        }
+        case "get_rtm_event_detail": {
+            const a = args;
+            return detailPath("rtm", a.id);
+        }
+        case "get_recent_clogs": {
+            const a = args;
+            const params = new URLSearchParams();
+            if (a?.limit)
+                params.set("limit", String(a.limit));
+            if (a?.name)
+                params.set("name", a.name);
+            const qs = params.toString();
+            return `/api/clogs${qs ? "?" + qs : ""}`;
+        }
+        case "get_clog_detail": {
+            const a = args;
+            return detailPath("clogs", a.id);
+        }
+        case "get_recent_traces": {
+            const a = args;
+            const params = new URLSearchParams();
+            // Default the limit when absent: traces can be large and an omitted limit would otherwise
+            // rely on an unverified device-side default and stream an unbounded result into the model
+            // context. 50 matches the other recent-* tools' practical page size.
+            params.set("limit", String(a?.limit && a.limit > 0 ? a.limit : 50));
+            if (a?.name)
+                params.set("name", a.name);
+            return `/api/traces?${params.toString()}`;
+        }
+        case "get_trace_detail": {
+            const a = args;
+            return detailPath("traces", a.id);
+        }
+        case "search": {
+            const a = args;
+            const params = new URLSearchParams();
+            params.set("q", a.query);
+            if (a?.limit)
+                params.set("limit", String(a.limit));
+            return `/api/search?${params.toString()}`;
+        }
+        default:
+            return null;
+    }
+}

package/dist/mcp/index.js

@@ -12,9 +12,12 @@ import { RADAR_HOST, RADAR_PORT, WEB_PORT_DEFAULT } from "../shared/constants.js
 import { stopCapture } from "../shared/logcat-capture.js";
 import { connectStream, destroyStream, waitForEvents, clearLocalBuffers, isStreamConnected, localNetworkBuffer, localRtmBuffer, setTransport, } from "../shared/stream.js";
 import { buildBufferPath, createSnapshot } from "./snapshot.js";
+import { clampLogLimit, shapeLogsResult } from "./logs-result.js";
 import { handleListDatabases, handleListTables, handleQueryDatabase, } from "./db-tools.js";
 import { cleanupPulledDatabases, initializeDatabasePath, resetDbState, } from "../shared/db.js";
 import { TOOL_DEFINITIONS, SERVER_INSTRUCTIONS, sessionGate } from "./tools.js";
+import { buildApiPath } from "./api-paths.js";
+import { interpretRadarResponse } from "./radar-response.js";
 // --- Subcommand + bin-name dispatch ---
 //
 // One entrypoint, two front doors, chosen so each invocation does the obvious thing:
@@ -198,8 +201,31 @@ async function runMcpServer() {
         process.once(sig, cleanupPulledDatabases);
     }
     let sessionEnabled = false;
+    // --- HTTP requests to the on-device radar server ---
+    // Host-side ceiling on a proxied device response. radarRequest forwards the device body straight
+    // into the model context, so an unbounded response (large trace/clog payloads) could flood it.
+    // When the cap trips we stop reading, tear the socket down, and return a truncation marker
+    // rather than a partial JSON blob the parser would choke on. 1MB is generous for a point query;
+    // bulk exports go through capture_snapshot, not this path.
+    const MAX_RADAR_RESPONSE_BYTES = 1024 * 1024;
     function radarRequest(requestPath) {
         return new Promise((resolve, reject) => {
+            // settled-guard: req.destroy() on the cap path fires "error" (ECONNRESET) AFTER we have
+            // already resolved the truncation, so every settle goes through these wrappers and the
+            // second one is a no-op. Without this the abort would reject an already-resolved promise.
+            let settled = false;
+            const done = (r) => {
+                if (settled)
+                    return;
+                settled = true;
+                resolve(r);
+            };
+            const fail = (e) => {
+                if (settled)
+                    return;
+                settled = true;
+                reject(e);
+            };
             const req = http.get({
                 host: RADAR_HOST,
                 port: RADAR_PORT,
@@ -207,22 +233,31 @@ async function runMcpServer() {
                 timeout: 10000,
             }, (res) => {
                 let data = "";
+                let bytes = 0;
                 res.on("data", (chunk) => {
+                    if (settled)
+                        return;
+                    bytes += chunk.length; // byte length, not String.length (UTF-8 over the wire)
+                    if (bytes > MAX_RADAR_RESPONSE_BYTES) {
+                        // Resolve the truncation NOW (not on "end" — req.destroy() aborts the response so
+                        // "end" never fires; it surfaces as an "error" the settled-guard then swallows).
+                        done({
+                            error: `Device response exceeded the ${Math.round(MAX_RADAR_RESPONSE_BYTES / 1024)}KB response budget and was dropped to protect the model context. Narrow the query (lower limit, add a name/filter), or use capture_snapshot for a bulk export.`,
+                            _truncated: true,
+                        });
+                        req.destroy();
+                        return;
+                    }
                     data += chunk;
                 });
                 res.on("end", () => {
-                    try {
-                        resolve(JSON.parse(data));
-                    }
-                    catch {
-                        resolve({ raw: data });
-                    }
+                    done(interpretRadarResponse(res.statusCode ?? 0, data));
                 });
             });
-            req.on("error", reject);
+            req.on("error", fail);
             req.on("timeout", () => {
                 req.destroy();
-                reject(new Error("Request timed out"));
+                fail(new Error("Request timed out"));
             });
         });
     }
@@ -427,18 +462,14 @@ async function runMcpServer() {
     }
     function handleGetRecentLogs(args) {
         try {
-            const lines = device.getRecentLogs(args.tag, args.limit || 50, args.grep);
-            // Surface the capture file path so the model knows which on-disk file
-            // produced these lines. Helps avoid cross-session staleness (e.g. the
-            // model remembering an earlier profile's logs after a profile switch).
-            const sourceFile = device.getCaptureFilePath?.() ?? null;
-            return textResult({
-                tag: args.tag,
-                lines,
-                count: lines.length,
-                source_file: sourceFile,
-                source: sourceFile ? "capture" : "adb_logcat_d",
-            });
+            const tag = args.tag ?? "";
+            const limit = clampLogLimit(args.limit);
+            const result = device.getRecentLogs(tag, limit, args.grep);
+            // shapeLogsResult preserves the source label (app_buffer / logcat_capture / logcat_ring)
+            // that getRecentLogs returns, so the caller can tell a true-empty result from a silent
+            // fallback to an inferior source (0 lines from app_buffer means the tag is really absent;
+            // 0 from logcat_ring may mean the better source was unreachable).
+            return textResult(shapeLogsResult(tag, result));
         }
         catch (e) {
             return textResult({ error: `Log query failed: ${e.message}`, lines: [] }, true);
@@ -517,70 +548,8 @@ async function runMcpServer() {
             }, true);
         }
     }
-    function buildApiPath(name, args) {
-        switch (name) {
-            case "get_recent_network_calls": {
-                const a = args;
-                const params = new URLSearchParams();
-                if (a?.limit)
-                    params.set("limit", String(a.limit));
-                if (a?.url_filter)
-                    params.set("url_filter", a.url_filter);
-                if (a?.status_code)
-                    params.set("status_code", String(a.status_code));
-                const qs = params.toString();
-                return `/api/network${qs ? "?" + qs : ""}`;
-            }
-            case "get_network_call_detail": {
-                const a = args;
-                return `/api/network/${a.id}`;
-            }
-            case "get_recent_rtm_events": {
-                const a = args;
-                const params = new URLSearchParams();
-                if (a?.limit)
-                    params.set("limit", String(a.limit));
-                if (a?.event_type)
-                    params.set("event_type", a.event_type);
-                if (a?.direction)
-                    params.set("direction", a.direction);
-                if (a?.channel)
-                    params.set("channel", a.channel);
-                const qs = params.toString();
-                return `/api/rtm${qs ? "?" + qs : ""}`;
-            }
-            case "get_rtm_event_detail": {
-                const a = args;
-                return `/api/rtm/${a.id}`;
-            }
-            case "get_recent_clogs": {
-                const a = args;
-                const params = new URLSearchParams();
-                if (a?.limit)
-                    params.set("limit", String(a.limit));
-                if (a?.name)
-                    params.set("name", a.name);
-                const qs = params.toString();
-                return `/api/clogs${qs ? "?" + qs : ""}`;
-            }
-            case "get_clog_detail": {
-                const a = args;
-                return `/api/clogs/${a.id}`;
-            }
-            case "search": {
-                const a = args;
-                const params = new URLSearchParams();
-                params.set("q", a.query);
-                if (a?.limit)
-                    params.set("limit", String(a.limit));
-                return `/api/search?${params.toString()}`;
-            }
-            default:
-                return null;
-        }
-    }
     // --- MCP Server ---
-    const server = new Server({ name: "slack-radar", version: "1.6.0" }, { capabilities: { tools: {} }, instructions: SERVER_INSTRUCTIONS });
+    const server = new Server({ name: "slack-radar", version: "1.8.0" }, { capabilities: { tools: {} }, instructions: SERVER_INSTRUCTIONS });
     server.setRequestHandler(ListToolsRequestSchema, async () => ({
         tools: TOOL_DEFINITIONS,
     }));

package/dist/mcp/logs-result.d.ts

@@ -0,0 +1,9 @@
+import type { LogResult } from "../shared/transport.js";
+export interface LogsToolResult {
+    tag: string;
+    lines: string[];
+    count: number;
+    source?: string;
+}
+export declare function clampLogLimit(limit: number | undefined): number;
+export declare function shapeLogsResult(tag: string, result: LogResult): LogsToolResult;

package/dist/mcp/logs-result.js

@@ -0,0 +1,15 @@
+// Clamp the requested line count. With tag optional, a no-tag call returns the whole buffer
+// (thousands of lines, ~1.5MB), so an unbounded limit would flood the model context with
+// potentially PII-bearing log lines. 1000 is a generous ceiling for a debug read; default 50.
+export function clampLogLimit(limit) {
+    return Math.min(Math.max(limit || 50, 1), 1000);
+}
+// Shape the device result into the tool payload, preserving the source label verbatim.
+export function shapeLogsResult(tag, result) {
+    return {
+        tag,
+        lines: result.lines,
+        count: result.lines.length,
+        source: result.source,
+    };
+}

package/dist/mcp/radar-response.d.ts

@@ -0,0 +1,21 @@
+export interface RadarResponse {
+    error?: string;
+    status?: number;
+    stream_connected?: boolean;
+    local_network_buffer?: number;
+    local_rtm_buffer?: number;
+    timeout_minutes?: number;
+    raw?: string;
+    [key: string]: unknown;
+}
+/**
+ * Turn a device HTTP (status, body) into the RadarResponse the tool layer returns. Parse JSON
+ * when the body is JSON: this preserves the device's own error bodies (e.g. an in-app 404 sends
+ * {"error":"Not Found"}) and every happy-path payload unchanged. The added guard is for a 4xx/5xx
+ * whose body is NOT JSON (empty, HTML, a bare string): a build that predates a tool's route, or
+ * an upstream proxy error, would otherwise surface as a confusing {raw:""} the caller cannot read.
+ * In that case synthesize a clear error naming the status so the model reports something useful
+ * (an older debug build can predate a newer tool) instead of an empty blob. A 2xx with a non-JSON
+ * body keeps the existing {raw} behavior, a real if unusual success payload.
+ */
+export declare function interpretRadarResponse(status: number, body: string): RadarResponse;

package/dist/mcp/radar-response.js

@@ -0,0 +1,38 @@
+// The shape a proxied device call resolves to, and how a raw (status, body) becomes one. Split
+// out of index.ts so it is unit-testable: index.ts connects stdio at module load, so importing it
+// from a test would hang.
+/**
+ * Turn a device HTTP (status, body) into the RadarResponse the tool layer returns. Parse JSON
+ * when the body is JSON: this preserves the device's own error bodies (e.g. an in-app 404 sends
+ * {"error":"Not Found"}) and every happy-path payload unchanged. The added guard is for a 4xx/5xx
+ * whose body is NOT JSON (empty, HTML, a bare string): a build that predates a tool's route, or
+ * an upstream proxy error, would otherwise surface as a confusing {raw:""} the caller cannot read.
+ * In that case synthesize a clear error naming the status so the model reports something useful
+ * (an older debug build can predate a newer tool) instead of an empty blob. A 2xx with a non-JSON
+ * body keeps the existing {raw} behavior, a real if unusual success payload.
+ */
+export function interpretRadarResponse(status, body) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        if (status >= 400) {
+            const bodyPrefix = body.substring(0, 200).trim();
+            const bodyDetail = bodyPrefix ? ` Body: ${bodyPrefix}` : "";
+            return {
+                error: `Device returned HTTP ${status} with a non-JSON body. The route may not exist on this build (an older debug build can predate a newer tool), or an upstream error occurred.${bodyDetail}`,
+                status,
+            };
+        }
+        return { raw: body };
+    }
+    // Device routes return JSON OBJECTS. A bare null/number/array/string is valid JSON but not a
+    // RadarResponse, and a downstream `result.error` read on a non-object (esp. null) would throw.
+    // Keep it as a raw payload instead of casting a lie. (The old code cast straight to
+    // RadarResponse and carried this hole; guarding here closes it.)
+    if (typeof parsed !== "object" || parsed === null) {
+        return { raw: body };
+    }
+    return parsed;
+}

package/dist/mcp/snapshot.d.ts

@@ -13,6 +13,7 @@ export interface SnapshotResult {
         network: number;
         rtm: number;
         clogs: number;
+        traces: number;
         log_lines: number;
         log_lines_truncated: boolean;
         screenshot: boolean;
@@ -21,6 +22,7 @@ export interface SnapshotResult {
         network: boolean;
         rtm: boolean;
         clogs: boolean;
+        traces: boolean;
     };
     errors: string[];
     privacy_notice: string;
@@ -35,7 +37,7 @@ export declare function buildSnapshotDir(now?: number, root?: string): string;
  * intentionally larger than point-query defaults — snapshots are bulk
  * exports and the device-side ring buffers cap their own responses.
  */
-export declare function buildBufferPath(kind: "network" | "rtm" | "clogs"): string;
+export declare function buildBufferPath(kind: "network" | "rtm" | "clogs" | "traces"): string;
 export interface LogTailResult {
     text: string;
     truncated: boolean;
@@ -60,4 +62,4 @@ export declare function readRecentLogTail(requestedLimit?: number): LogTailResul
  * snapshot still lands on disk with whatever succeeded; failures are
  * collected in `result.errors` so the model can tell the user.
  */
-export declare function createSnapshot(device: DeviceTransport, fetchBuffer: (kind: "network" | "rtm" | "clogs") => Promise<unknown>, opts?: SnapshotOptions, now?: number, snapshotRoot?: string): Promise<SnapshotResult>;
+export declare function createSnapshot(device: DeviceTransport, fetchBuffer: (kind: "network" | "rtm" | "clogs" | "traces") => Promise<unknown>, opts?: SnapshotOptions, now?: number, snapshotRoot?: string): Promise<SnapshotResult>;

package/dist/mcp/snapshot.js

@@ -10,7 +10,7 @@ import { getCaptureFilePath, readTailBytes } from "../shared/logcat-capture.js";
  * tool outputs.
  *
  * Snapshot contents:
- *   - `bundle.json` — device-side buffers (net + RTM + clogs) plus metadata
+ *   - `bundle.json` — device-side buffers (net + RTM + clogs + traces) plus metadata
  *   - `screenshot.png` — current screen (optional)
  *   - `logcat.tail.log` — last N lines of the active capture file (optional)
  *
@@ -33,19 +33,19 @@ const BUNDLE_README = `Slack Radar snapshot
 This directory is a point-in-time bundle of Radar state.
 
 Files:
-- bundle.json: device-side network/RTM/clog buffers, counts, and metadata.
+- bundle.json: device-side network/RTM/clog/trace buffers, counts, and metadata.
 - logcat.tail.log (optional): last N lines of the on-device logcat capture.
 - screenshot.png (optional): current screen.
 
 Privacy: bundle.json contains raw API request/response bodies (auth headers,
-tokens), RTM message content, user IDs, channel IDs, and clog payloads.
-Review before sharing externally. This bundle lives on your local disk only;
-nothing is uploaded anywhere by Radar.
+tokens), RTM message content, user IDs, channel IDs, clog payloads, and
+performance trace spans. Review before sharing externally. This bundle lives
+on your local disk only; nothing is uploaded anywhere by Radar.
 
 To inspect: cat bundle.json | jq .
 To share: zip -r snapshot.zip . then attach the zip.
 `;
-const PRIVACY_NOTICE = "bundle.json contains raw API request/response bodies (including auth headers), RTM message content, user IDs, and clog payloads. Review before sharing externally.";
+const PRIVACY_NOTICE = "bundle.json contains raw API request/response bodies (including auth headers), RTM message content, user IDs, clog payloads, and performance trace spans. Review before sharing externally.";
 /**
  * Resolve the output directory for a snapshot. Exported for tests.
  */
@@ -137,7 +137,8 @@ export async function createSnapshot(device, fetchBuffer, opts = {}, now = Date.
     let network = null;
     let rtm = null;
     let clogs = null;
-    const fetched = { network: false, rtm: false, clogs: false };
+    let traces = null;
+    const fetched = { network: false, rtm: false, clogs: false, traces: false };
     // Device-side buffers. Failures are individually caught so one failing
     // buffer does not nuke the whole snapshot. `fetched` distinguishes
     // "empty because the buffer was empty" from "null because the fetch
@@ -163,6 +164,17 @@ export async function createSnapshot(device, fetchBuffer, opts = {}, now = Date.
     catch (e) {
         errors.push(`clog buffer: ${e.message}`);
     }
+    // Traces capture from app start (like clogs), so they are worth
+    // bundling. An older debug build without the /api/traces route fails
+    // this one fetch and it is recorded in errors[] like any other buffer;
+    // the rest of the snapshot still lands.
+    try {
+        traces = await fetchBuffer("traces");
+        fetched.traces = true;
+    }
+    catch (e) {
+        errors.push(`trace buffer: ${e.message}`);
+    }
     // Logcat tail.
     let logTail = { text: "", truncated: false };
     if (includeLogs) {
@@ -221,6 +233,7 @@ export async function createSnapshot(device, fetchBuffer, opts = {}, now = Date.
         network: countItems(network),
         rtm: countItems(rtm),
         clogs: countItems(clogs),
+        traces: countItems(traces),
         log_lines: logTail.text
             ? logTail.text.split("\n").filter(Boolean).length
             : 0,
@@ -228,12 +241,12 @@ export async function createSnapshot(device, fetchBuffer, opts = {}, now = Date.
         screenshot: screenshotCaptured,
     };
     const bundle = {
-        version: 1,
+        version: 2,
         timestamp: now,
         platform: device.platform,
         active_user_id: device.getActiveUserId(),
         capture_file: getCaptureFilePath(),
-        buffers: { network, rtm, clogs },
+        buffers: { network, rtm, clogs, traces },
         counts,
         fetched,
         errors,
@@ -285,14 +298,14 @@ export async function createSnapshot(device, fetchBuffer, opts = {}, now = Date.
 }
 /**
  * Count items inside a buffer response. Handles the `{ calls: [...] }`,
- * `{ events: [...] }`, `{ clogs: [...] }` shapes the radar HTTP server
- * uses. Falls back to 0 on malformed responses.
+ * `{ events: [...] }`, `{ clogs: [...] }`, `{ traces: [...] }` shapes the
+ * radar HTTP server uses. Falls back to 0 on malformed responses.
  */
 function countItems(body) {
     if (!body || typeof body !== "object")
         return 0;
     const b = body;
-    for (const key of ["calls", "events", "clogs", "items"]) {
+    for (const key of ["calls", "events", "clogs", "traces", "items"]) {
         const v = b[key];
         if (Array.isArray(v))
             return v.length;