execbro 1.10.24 → 1.11.0

package/build/tools/logTools.js

@@ -1,14 +1,120 @@
 import { z } from "zod";
 import { registerToolWithTelemetry } from "../core/register.js";
-import { getLogs, searchLogs, getLogSummary, getTotalLogCount, getConnectedAppByDevice, getFirstConnectedApp, formatLogsAsTonl, checkAndEnsureConnection, metroMissingHintIfAbsent, logBuffers, verifyLogPipeline, getPassiveConnectionStatus, connectedApps, getRecentGaps, formatDuration, getLogBuffer, } from "../core/index.js";
+import { getLogs, searchLogs, getLogSummary, getTotalLogCount, getConnectedAppByDevice, getFirstConnectedApp, checkAndEnsureConnection, metroMissingHintIfAbsent, logBuffers, verifyLogPipeline, getPassiveConnectionStatus, connectedApps, getRecentGaps, formatDuration, getLogBuffer, } from "../core/index.js";
 import { resolveLogBuffer } from "../core/toolHelpers.js";
+import { diagnoseEmptyLogs } from "../core/logDiagnosis.js";
 import { UserInputError } from "../core/errors.js";
 import { isSDKInstalled, querySDKConsole, clearSDKConsole, getSDKConsoleStats, } from "../core/sdkBridge.js";
+import { findLogEvent, nativeLogBuffers, getNativeLogBuffer } from "../core/logEvents.js";
+import { jsEventsFromEntries } from "../core/jsLogEvents.js";
+import { formatEventList, formatEventDetails } from "../core/logEventFormat.js";
+import { collectNativeEvents, deviceKeyOf } from "../core/nativeLogs.js";
+// Binds the live connection/pipeline probes for `diagnoseEmptyLogs`. Kept here
+// so the diagnosis logic itself stays free of module-level state and testable.
+function logDiagnosisDeps(device) {
+    return {
+        checkConnection: () => checkAndEnsureConnection(device),
+        resolveApp: () => (device ? getConnectedAppByDevice(device) : getFirstConnectedApp()),
+        verifyPipeline: verifyLogPipeline,
+    };
+}
+/**
+ * Parse "5m" / "90s" / an ISO timestamp into an absolute Date.
+ *
+ * Distinguishes "not provided" from "provided but unparseable" — the latter
+ * silently falling back to the default watermark would look, from the
+ * caller's side, like their filter was honored when it was actually ignored.
+ */
+function parseSince(since) {
+    if (!since)
+        return { date: undefined };
+    const rel = since.match(/^(\d+)([smh])$/);
+    if (rel) {
+        const mult = { s: 1000, m: 60_000, h: 3_600_000 }[rel[2]];
+        return { date: new Date(Date.now() - Number(rel[1]) * mult) };
+    }
+    const parsed = new Date(since);
+    if (Number.isNaN(parsed.getTime())) {
+        return {
+            date: undefined,
+            note: `[NOTE] since="${since}" was not recognized (use an ISO timestamp or a duration like "5m"/"90s"/"2h") — showing the default window instead.`,
+        };
+    }
+    return { date: parsed };
+}
+/**
+ * Bound the events shown on the native/merged path to `maxLogs`, applied
+ * AFTER kind-filtering and keeping the newest — when investigating a crash
+ * the latest one is the subject. Never truncates silently: an agent that
+ * cannot see the list was capped will assume it has the full picture and
+ * reason from a partial one. Exported (not a `__`-prefixed test hook) because
+ * it is a genuinely reusable, side-effect-free piece of the response shape.
+ */
+export function capEventsForDisplay(events, maxLogs) {
+    const capped = maxLogs > 0 && events.length > maxLogs ? events.slice(-maxLogs) : events;
+    const omitted = events.length - capped.length;
+    const note = omitted > 0
+        ? `\n\n[${omitted} older event${omitted === 1 ? "" : "s"} not shown — raise maxLogs or narrow with kind/minLevel/since]`
+        : "";
+    return { capped, note };
+}
+/**
+ * Native acquisition costs a ~1-1.5s subprocess per device, so it must never
+ * run on the hot path. It earns its cost in exactly one situation: the JS
+ * buffer is empty AND the app is not connected — which is what a native crash
+ * looks like from here. Mirrors get_bundle_errors' screenshot fallback, which
+ * likewise fires only when the cheap path has demonstrably failed.
+ */
+function shouldEscalateToNative(bufferEmpty, connected) {
+    return bufferEmpty && !connected;
+}
+const ESCALATION_COOLDOWN_MS = 30_000;
+/**
+ * Negative-result cooldown for the empty-and-disconnected escalation, keyed by
+ * the `device` argument that produced the miss.
+ *
+ * A miss (buffer empty, disconnected, no crash found) still costs a
+ * subprocess per device. Without a cooldown, every get_logs call made while
+ * the app stays crashed-and-disconnected would re-pay that cost forever. 30s
+ * is short enough that a real crash occurring during the cooldown is still
+ * caught by the very next get_logs call once it expires, and long enough to
+ * stop a tight investigation loop from thrashing the device.
+ *
+ * Keying matters: a miss for device="A" says nothing about device B, and a
+ * process-wide latch would let one device's quiet period suppress another
+ * device's real crash. An undefined device queries every device at once, so
+ * caching that miss under a single key is correct.
+ *
+ * Cleared for a key whenever its escalation DOES find crashes, so a genuine
+ * crash is never suppressed by a stale miss.
+ */
+const lastEmptyEscalationAt = new Map();
+function escalationKey(device) {
+    return device ?? "*";
+}
+function isEscalationCoolingDown(device) {
+    const at = lastEmptyEscalationAt.get(escalationKey(device));
+    return at !== undefined && Date.now() - at < ESCALATION_COOLDOWN_MS;
+}
+/**
+ * Test-only. Exercises the per-device cooldown map directly, so the
+ * per-device keying can be pinned without standing up a full get_logs
+ * invocation (device connection, CDP session, etc).
+ */
+export const __escalationCooldownTestHooks = {
+    isEscalationCoolingDown,
+    recordMiss: (device) => {
+        lastEmptyEscalationAt.set(escalationKey(device), Date.now());
+    },
+    reset: () => {
+        lastEmptyEscalationAt.clear();
+    },
+};
 export function registerLogTools(server) {
     // Tool: Get console logs
     registerToolWithTelemetry(server, "get_logs", {
         description: "Retrieve console logs from connected React Native app. Tip: Use summary=true first for a quick overview (counts by level + last 5 messages), then fetch specific logs as needed.\n" +
-            "PURPOSE: Pull captured console output (log/warn/error/info/debug) from the in-memory buffer for the connected app.\n" +
+            "PURPOSE: Pull captured console output (log/warn/error/info/debug) from the in-memory buffer, and optionally native device logs (crashes, ANRs) via source=\"native\".\n" +
             "WHEN TO USE: Start of any log-driven investigation, verifying a code change picked up via Fast Refresh, or confirming a reported error actually fires.\n" +
             "WORKFLOW: scan_metro -> get_logs(summary=true) -> narrow with search_logs(text=\"...\") or get_logs(level=\"error\") -> clear_logs between reproductions.\n" +
             "LIMITATIONS: Circular buffer (~500 entries). Only captures logs emitted after the app connected; pre-connect logs are lost.\n" +
@@ -37,24 +143,79 @@ export function registerLogTools(server) {
                 .optional()
                 .default(false)
                 .describe("Disable all truncation and return full messages. Tip: Use with lower maxLogs (e.g., 10) to avoid token overload when inspecting large objects."),
-            format: z
-                .enum(["text", "tonl"])
-                .optional()
-                .default("tonl")
-                .describe("Output format: 'text' or 'tonl' (default, compact token-optimized format, ~30-50% smaller)"),
             summary: z
                 .boolean()
                 .optional()
                 .default(false)
                 .describe("Return summary statistics instead of full logs (count by level + last 5 messages). Use for quick overview."),
-            device: z.string().optional().describe("Target device name (substring match). Omit for all devices. Run get_apps to see connected devices.")
+            device: z.string().optional().describe("Target device name (substring match). Omit for all devices. Run get_apps to see connected devices."),
+            source: z
+                .enum(["js", "native", "all"])
+                .optional()
+                .default("js")
+                .describe("Which log stream to read. 'js' (default) = console output over CDP, instant. " +
+                "'native' = device logs (Android logcat / iOS os_log) filtered to this app — surfaces crashes, ANRs and OOM kills that never reach JS; costs ~1-1.5s per device. " +
+                "'all' = both, merged. When the JS buffer is empty and the app is disconnected, native crash events are consulted automatically."),
+            kind: z
+                .enum(["crash", "anr", "exception", "lifecycle", "message"])
+                .optional()
+                .describe("Filter native/merged events by kind. Omit for all kinds."),
+            minLevel: z
+                .enum(["debug", "info", "warn", "error", "fatal"])
+                .optional()
+                .default("warn")
+                .describe("Relevance floor for native events (default: warn). Crashes and ANRs are always returned regardless. Lower to 'debug' to see native library loading."),
+            since: z
+                .string()
+                .optional()
+                .describe("Native acquisition window — ISO timestamp or a duration like \"5m\". Widens the device query; already-seen events are still deduped.")
         }
-    }, async ({ maxLogs, level, startFromText, maxMessageLength, verbose, format, summary, device }) => {
+    }, async ({ maxLogs, level, startFromText, maxMessageLength, verbose, summary, device, source, kind, minLevel, since }) => {
         // Check if SDK is installed — prefer SDK data for richer logs.
         // `device` must be threaded through: without it the SDK bridge reads
         // whichever app happens to be first, so a multi-device session
         // silently answers with the wrong device's buffer.
         const sdkAvailable = await isSDKInstalled(device);
+        // Prepended to every return's text below when source==="all".
+        let nativePrefix = "";
+        // Set when source==="native"/"all" already paid for a native fetch
+        // this call, so the empty+disconnected escalation below can reuse
+        // it instead of paying twice.
+        let nativeEventsForEscalation;
+        // Explicit native / merged read — the caller asked for the cost.
+        if (source === "native" || source === "all") {
+            const sinceParsed = parseSince(since);
+            const nativeOpts = { device, minLevel, since: sinceParsed.date };
+            const { events, notes } = await collectNativeEvents(nativeOpts);
+            nativeEventsForEscalation = events;
+            const filtered = kind ? events.filter((e) => e.kind === kind) : events;
+            const { capped, note: cappedNote } = capEventsForDisplay(filtered, maxLogs);
+            const showDevice = nativeLogBuffers.size > 1;
+            const noteText = notes.length > 0 ? `\n\n${notes.join("\n")}` : "";
+            const sinceNote = sinceParsed.note ? `\n\n${sinceParsed.note}` : "";
+            const rendered = formatEventList(capped, { showDevice, maxLength: maxMessageLength, verbose });
+            if (source === "native") {
+                // Emptiness is judged on the UNFILTERED events: a `kind`
+                // filter matching nothing is a filter outcome, not a
+                // capture failure — mirrors the js-buffer `filtered_out`
+                // handling below. Capping is a display bound, not a
+                // capture/filter outcome, so it plays no part in either
+                // signal.
+                const nativeEmpty = events.length === 0;
+                const nativeEmptyReason = !nativeEmpty && filtered.length === 0 ? "filtered_out" : undefined;
+                return {
+                    _emptyResult: nativeEmpty,
+                    ...(nativeEmptyReason && { _emptyReason: nativeEmptyReason }),
+                    content: [{
+                            type: "text",
+                            text: `Native Log Events (${capped.length}):\n\n${rendered}${cappedNote}${noteText}${sinceNote}\n\nUse get_log_details("<id>") for a full backtrace.`
+                        }]
+                };
+            }
+            // source === "all": fall through so JS output is appended below,
+            // carrying the native block with it.
+            nativePrefix = `Native Log Events (${capped.length}):\n\n${rendered}${cappedNote}${noteText}${sinceNote}\n\n`;
+        }
         if (sdkAvailable) {
             if (summary) {
                 const sdkStats = await getSDKConsoleStats(device);
@@ -69,23 +230,14 @@ export function registerLogTools(server) {
                         for (const [lvl, cnt] of Object.entries(s.byLevel))
                             lines.push(`  ${lvl}: ${cnt}`);
                     }
-                    return { content: [{ type: "text", text: `Log Summary (SDK):\n\n${lines.join("\n")}` }] };
+                    // Served real SDK data — not empty, regardless of what the
+                    // (separate) CDP buffer happens to hold.
+                    return { _emptyResult: false, content: [{ type: "text", text: `${nativePrefix}Log Summary (SDK):\n\n${lines.join("\n")}` }] };
                 }
             }
             const sdkResult = await querySDKConsole({ count: maxLogs, level, text: startFromText }, device);
             if (sdkResult.success && sdkResult.data.length > 0) {
                 const entries = sdkResult.data;
-                if (format === "tonl") {
-                    const tonlLines = entries.map((e) => {
-                        const time = new Date(e.timestamp).toLocaleTimeString();
-                        let msg = e.message;
-                        if (!verbose && maxMessageLength > 0 && msg.length > maxMessageLength) {
-                            msg = msg.slice(0, maxMessageLength) + "...";
-                        }
-                        return `${time} [${e.level}] ${msg}`;
-                    });
-                    return { content: [{ type: "text", text: `Console Logs (${entries.length} entries, SDK):\n\n${tonlLines.join("\n")}` }] };
-                }
                 const lines = entries.map((e) => {
                     const time = new Date(e.timestamp).toLocaleTimeString();
                     let msg = e.message;
@@ -94,99 +246,122 @@ export function registerLogTools(server) {
                     }
                     return `[${time}] [${e.level.toUpperCase()}] ${msg}`;
                 });
-                return { content: [{ type: "text", text: `Console Logs (${entries.length} entries, SDK):\n\n${lines.join("\n")}` }] };
+                return { _emptyResult: false, content: [{ type: "text", text: `${nativePrefix}Console Logs (${entries.length} entries, SDK):\n\n${lines.join("\n")}` }] };
             }
         }
         // Return summary if requested
         if (summary) {
-            const summaryText = getLogSummary(resolveLogBuffer(device), { lastN: 5, maxMessageLength: 100 });
+            const buffer = resolveLogBuffer(device);
+            const summaryText = getLogSummary(buffer, { lastN: 5, maxMessageLength: 100 });
+            // Judge emptiness by the buffer this summary was actually built
+            // from, not the global count across every device.
+            const summaryEmpty = buffer.size === 0;
             let connectionWarning = "";
-            if (getTotalLogCount() === 0) {
-                const status = await checkAndEnsureConnection(device);
-                connectionWarning = status.message ? `\n\n${status.message}` : "";
-                if (status.connected) {
-                    const targetApp = device ? getConnectedAppByDevice(device) : getFirstConnectedApp();
-                    if (targetApp) {
-                        const pipeline = await verifyLogPipeline(targetApp);
-                        if (pipeline.message) {
-                            connectionWarning += `\n\n${pipeline.message}`;
-                        }
-                    }
-                }
+            let emptyReason;
+            if (summaryEmpty) {
+                const diagnosis = await diagnoseEmptyLogs(logDiagnosisDeps(device));
+                connectionWarning = diagnosis.warning;
+                emptyReason = diagnosis.reason;
                 connectionWarning += await metroMissingHintIfAbsent("get_logs");
             }
             return {
+                _emptyResult: summaryEmpty,
+                ...(emptyReason && { _emptyReason: emptyReason }),
                 content: [
                     {
                         type: "text",
-                        text: `Log Summary:\n\n${summaryText}${connectionWarning}`
+                        text: `${nativePrefix}Log Summary:\n\n${summaryText}${connectionWarning}`
                     }
                 ]
             };
         }
-        const { logs, count, formatted } = getLogs(resolveLogBuffer(device), {
+        // Resolved once: for the all-devices case this copies every buffered
+        // entry into a merged buffer, so it is not free to call repeatedly.
+        const logBuffer = resolveLogBuffer(device);
+        const { logs, count } = getLogs(logBuffer, {
             maxLogs,
             level,
             startFromText,
             maxMessageLength,
             verbose
         });
+        // `_emptyResult` measures CAPTURE reliability, not whether this
+        // particular call returned rows — see the 2026-03-19 empty-result
+        // spec. A filter that matches nothing is a natural outcome, so it is
+        // reported via `_emptyReason` (`filtered_out`) without setting the
+        // empty flag. Keeps the empty rate comparable across time.
+        const bufferEmpty = logBuffer.size === 0;
         // Check connection health
         let connectionWarning = "";
         let emptyReason;
-        if (count === 0) {
-            const status = await checkAndEnsureConnection(device);
-            connectionWarning = status.message ? `\n\n${status.message}` : "";
-            // Track empty reason for telemetry
-            emptyReason = "no_logs";
-            if (!status.connected) {
-                emptyReason = "disconnected";
-            }
-            else if (status.wasReconnected) {
-                emptyReason = "post_reconnect";
-            }
-            // End-to-end log pipeline verification (with automatic recovery)
-            if (status.connected) {
-                const targetApp = device ? getConnectedAppByDevice(device) : getFirstConnectedApp();
-                if (targetApp) {
-                    const pipeline = await verifyLogPipeline(targetApp);
-                    if (pipeline.message) {
-                        connectionWarning += `\n\n${pipeline.message}`;
-                    }
-                    if (!pipeline.ok) {
-                        emptyReason = "pipeline_failed";
-                    }
-                    else if (pipeline.recovered) {
-                        emptyReason = "pipeline_recovered";
-                    }
-                    // If pipeline recovered, re-read the buffer — new logs may have arrived
-                    if (pipeline.recovered && pipeline.ok) {
-                        const retryResult = getLogs(resolveLogBuffer(device), {
-                            maxLogs, level, startFromText, maxMessageLength, verbose
-                        });
-                        if (retryResult.count > 0) {
-                            // Return the recovered logs instead of empty
-                            return {
-                                _emptyReason: "pipeline_recovered",
-                                content: [{
-                                        type: "text",
-                                        text: `React Native Console Logs (${retryResult.count} entries):\n\n${retryResult.formatted}${connectionWarning}`
-                                    }]
-                            };
-                        }
-                    }
+        if (count === 0 && !bufferEmpty) {
+            // Capture is demonstrably working — the level/startFromText filter
+            // simply matched nothing. Report that instead of probing the
+            // connection and blaming it for a filter miss.
+            emptyReason = "filtered_out";
+            connectionWarning = "";
+        }
+        else if (bufferEmpty) {
+            const diagnosis = await diagnoseEmptyLogs(logDiagnosisDeps(device));
+            connectionWarning = diagnosis.warning;
+            emptyReason = diagnosis.reason;
+            // If the pipeline recovered, re-read the buffer — new logs may have arrived
+            if (diagnosis.recovered) {
+                const retryResult = getLogs(resolveLogBuffer(device), {
+                    maxLogs, level, startFromText, maxMessageLength, verbose
+                });
+                if (retryResult.count > 0) {
+                    // Route through the same event pipeline as the final JS
+                    // return below — retryResult.formatted is legacy text with
+                    // no [jN] ids, which would leave get_log_details unusable
+                    // for whatever this call surfaces.
+                    const retryEvents = jsEventsFromEntries(retryResult.logs, device ?? "all devices");
+                    const retryFiltered = kind ? retryEvents.filter((e) => e.kind === kind) : retryEvents;
+                    const retryRendered = formatEventList(retryFiltered, { showDevice: logBuffers.size > 1, maxLength: maxMessageLength, verbose });
+                    // Return the recovered logs instead of empty
+                    return {
+                        _emptyResult: false,
+                        _emptyReason: "pipeline_recovered",
+                        content: [{
+                                type: "text",
+                                text: `${nativePrefix}React Native Console Logs (${retryFiltered.length} entries):\n\n${retryRendered}${connectionWarning}`
+                            }]
+                    };
                 }
             }
-            // Add diagnostic metadata for empty results (captured by telemetry via responsePreview)
-            if (count === 0) {
-                const diagParts = [
-                    `empty_reason=${status?.wasReconnected ? "post_reconnect" : "no_logs"}`,
-                    `connection=${getPassiveConnectionStatus().reason}`,
-                    `device_count=${connectedApps.size}`,
-                    `buffer_sizes=${JSON.stringify(Object.fromEntries([...logBuffers.entries()].map(([k, v]) => [k, v.size])))}`,
-                ];
-                connectionWarning += `\n\n[DIAG] ${diagParts.join(", ")}`;
+            if (shouldEscalateToNative(bufferEmpty, getPassiveConnectionStatus().connected) && !isEscalationCoolingDown(device)) {
+                // Safe to reuse a fetch taken at a higher minLevel: isRelevant
+                // exempts crash/anr from the floor entirely, so they are present
+                // regardless of what the caller asked for.
+                // Reuse the native fetch already paid for by source==="all"
+                // instead of running the subprocess a second time.
+                const events = nativeEventsForEscalation
+                    ?? (await collectNativeEvents({ device, minLevel: "warn" })).events;
+                const crashes = events.filter((e) => e.kind === "crash" || e.kind === "anr");
+                if (crashes.length > 0) {
+                    lastEmptyEscalationAt.delete(escalationKey(device));
+                    return {
+                        _emptyResult: false,
+                        _emptyReason: "native_crash_found",
+                        content: [{
+                                type: "text",
+                                text: `${nativePrefix}React Native Console Logs (0 entries) — app is not connected.\n\n` +
+                                    `Native crash found:\n${formatEventList(crashes, { showDevice: nativeLogBuffers.size > 1, maxLength: maxMessageLength, verbose })}\n\n` +
+                                    `Use get_log_details("${crashes[0].id}") for the full backtrace.`
+                            }]
+                    };
+                }
+                lastEmptyEscalationAt.set(escalationKey(device), Date.now());
             }
+            // Diagnostic metadata for empty results (local dev dashboard only —
+            // responsePreview is never sent to the remote telemetry backend).
+            const diagParts = [
+                `empty_reason=${emptyReason}`,
+                `connection=${getPassiveConnectionStatus().reason}`,
+                `device_count=${connectedApps.size}`,
+                `buffer_sizes=${JSON.stringify(Object.fromEntries([...logBuffers.entries()].map(([k, v]) => [k, v.size])))}`,
+            ];
+            connectionWarning += `\n\n[DIAG] ${diagParts.join(", ")}`;
             connectionWarning += await metroMissingHintIfAbsent("get_logs");
         }
         else {
@@ -211,30 +386,23 @@ export function registerLogTools(server) {
             }
         }
         const startNote = startFromText ? ` (starting from "${startFromText}")` : "";
-        // Use TONL format if requested
-        if (format === "tonl") {
-            const tonlOutput = formatLogsAsTonl(logs, { maxMessageLength: verbose ? 0 : maxMessageLength });
-            return {
-                ...(emptyReason && { _emptyReason: emptyReason }),
-                content: [
-                    {
-                        type: "text",
-                        text: `React Native Console Logs (${count} entries)${startNote}:\n\n${tonlOutput}${gapWarning}${connectionWarning}`
-                    }
-                ]
-            };
-        }
+        const jsEvents = jsEventsFromEntries(logs, device ?? "all devices");
+        const jsFiltered = kind ? jsEvents.filter((e) => e.kind === kind) : jsEvents;
+        const jsRendered = formatEventList(jsFiltered, { showDevice: logBuffers.size > 1, maxLength: maxMessageLength, verbose });
         return {
+            _emptyResult: bufferEmpty,
             ...(emptyReason && { _emptyReason: emptyReason }),
             content: [
                 {
                     type: "text",
-                    text: `React Native Console Logs (${count} entries)${startNote}:\n\n${formatted}${gapWarning}${connectionWarning}`
+                    text: `${nativePrefix}React Native Console Logs (${jsFiltered.length} entries)${startNote}:\n\n${jsRendered}${gapWarning}${connectionWarning}`
                 }
             ]
         };
     }, 
-    // Empty result detector: buffer has no entries at all
+    // Fallback only — every return path above sets `_emptyResult` explicitly,
+    // which takes precedence. Retained so a future path that forgets to set it
+    // still reports something rather than nothing.
     () => getTotalLogCount() === 0);
     // Tool: Search logs
     registerToolWithTelemetry(server, "search_logs", {
@@ -259,14 +427,9 @@ export function registerLogTools(server) {
                 .default(500)
                 .describe("Max characters per message (default: 500, set to 0 for unlimited)"),
             verbose: z.boolean().optional().default(false).describe("Disable all truncation and return full messages"),
-            format: z
-                .enum(["text", "tonl"])
-                .optional()
-                .default("tonl")
-                .describe("Output format: 'text' or 'tonl' (default, compact token-optimized format)"),
             device: z.string().optional().describe("Target device name (substring match). Omit for all devices. Run get_apps to see connected devices.")
         }
-    }, async ({ text, maxResults, maxMessageLength, verbose, format, device }) => {
+    }, async ({ text, maxResults, maxMessageLength, verbose, device }) => {
         // Check if SDK is installed — prefer SDK data. See get_logs: the
         // device must be threaded through, and an empty SDK result falls
         // through to the CDP buffer instead of short-circuiting.
@@ -275,17 +438,6 @@ export function registerLogTools(server) {
             const sdkResult = await querySDKConsole({ count: maxResults, text }, device);
             if (sdkResult.success && sdkResult.data.length > 0) {
                 const entries = sdkResult.data;
-                if (format === "tonl") {
-                    const tonlLines = entries.map((e) => {
-                        const time = new Date(e.timestamp).toLocaleTimeString();
-                        let msg = e.message;
-                        if (!verbose && maxMessageLength > 0 && msg.length > maxMessageLength) {
-                            msg = msg.slice(0, maxMessageLength) + "...";
-                        }
-                        return `${time} [${e.level}] ${msg}`;
-                    });
-                    return { content: [{ type: "text", text: `Search results for "${text}" (${entries.length} matches, SDK):\n\n${tonlLines.join("\n")}` }] };
-                }
                 const lines = entries.map((e) => {
                     const time = new Date(e.timestamp).toLocaleTimeString();
                     let msg = e.message;
@@ -297,7 +449,7 @@ export function registerLogTools(server) {
                 return { content: [{ type: "text", text: `Search results for "${text}" (${entries.length} matches, SDK):\n\n${lines.join("\n")}` }] };
             }
         }
-        const { logs, count, formatted } = searchLogs(resolveLogBuffer(device), text, { maxResults, maxMessageLength, verbose });
+        const { count, formatted } = searchLogs(resolveLogBuffer(device), text, { maxResults, maxMessageLength, verbose });
         // Check connection health
         let connectionWarning = "";
         if (count === 0) {
@@ -311,18 +463,6 @@ export function registerLogTools(server) {
                 ? "\n\n[CONNECTION] Disconnected. Showing cached data. New data is not being captured."
                 : "";
         }
-        // Use TONL format if requested
-        if (format === "tonl") {
-            const tonlOutput = formatLogsAsTonl(logs, { maxMessageLength: verbose ? 0 : maxMessageLength });
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `Search results for "${text}" (${count} matches):\n\n${tonlOutput}${connectionWarning}`
-                    }
-                ]
-            };
-        }
         return {
             content: [
                 {
@@ -359,6 +499,16 @@ export function registerLogTools(server) {
                 if (sdkResult.success && sdkResult.count)
                     count += sdkResult.count;
             }
+            // Clear that device's native buffer too, otherwise a targeted
+            // clear leaves native (logcat/os_log) events behind and
+            // get_logs(source="native") still shows pre-repro entries. The
+            // native buffer deliberately keeps its watermark on clear (see
+            // the all-devices branch below) so cleared events are not
+            // re-ingested on the next fetch.
+            const deviceKey = deviceKeyOf(app);
+            if (deviceKey) {
+                count += getNativeLogBuffer(deviceKey).clear();
+            }
             return { content: [{ type: "text", text: `Cleared ${count} log entries from ${deviceName}.` }] };
         }
         // Clear all
@@ -374,7 +524,41 @@ export function registerLogTools(server) {
                 total += sdkResult.count;
             }
         }
+        // Native buffers keep their watermark so cleared events are not
+        // re-ingested on the next fetch.
+        for (const buffer of nativeLogBuffers.values()) {
+            total += buffer.clear();
+        }
         return { content: [{ type: "text", text: `Cleared ${total} log entries from all devices.` }] };
     });
+    // Tool: Get full payload for one log event
+    registerToolWithTelemetry(server, "get_log_details", {
+        description: "Get the full payload of a single log event — complete stack trace, backtrace, or oversized message.\n" +
+            "PURPOSE: Expand one row from get_logs into its full text. A crash row collapses a 60-line backtrace; this returns all of it.\n" +
+            "WHEN TO USE: After get_logs shows an event you need to read in full (a crash, an exception, a large payload).\n" +
+            "WORKFLOW: get_logs -> copy the id (e.g. \"n7\") -> get_log_details(id=\"n7\").\n" +
+            "LIMITATIONS: Ids are valid until that device's buffer rolls over or clear_logs runs, not for the whole server session — call get_logs again to get fresh ones. Reads the buffer — it does not re-query the device.\n" +
+            "GOOD: get_log_details({ id: \"n7\" })\n" +
+            "BAD: Guessing ids — always take them from get_logs.\n" +
+            "SEE ALSO: call get_usage_guide(topic=\"logs\") for the full console-debugging playbook.",
+        inputSchema: {
+            id: z.string().describe("Event id from get_logs (e.g. \"n7\")"),
+            maxLength: z.coerce
+                .number()
+                .optional()
+                .default(4000)
+                .describe("Max characters of payload (default: 4000, 0 for unlimited)"),
+            verbose: z.boolean().optional().default(false).describe("Disable truncation entirely")
+        }
+    }, async ({ id, maxLength, verbose }) => {
+        const event = findLogEvent(id);
+        if (!event) {
+            throw new UserInputError(`No log event with id "${id}". Ids come from get_logs — "n7" for native events, "j12" for console entries — ` +
+                `and are valid until that device's buffer rolls over or clear_logs runs. Call get_logs again to refresh them.`);
+        }
+        return {
+            content: [{ type: "text", text: formatEventDetails(event, { maxLength, verbose }) }]
+        };
+    });
 }
 //# sourceMappingURL=logTools.js.map