ios-simulator-browser

Savant verdict: Analyzed

Scanned or evaluated by Savant; not yet both passing.

Live evaluation

0 pass · 0 investigate · 6 fail across 6 cases. Jev accepted 6 of 18 LLM-drafted cases. Drafted and run by nvidia/nemotron-3-super-120b-a12b, validated and scored by jev-latest.

• Mirror the iOS Simulator for device 'iPhone 15 Pro' (UDID: 4A3B2C1D-5E6F-7A8B-9C0D-1E2F3A4B5C6D) in the Codex in-app browser so I can interact with the running app.positive case · fail
• Render SwiftUI previews from the package at /Users/dev/projects/MyUIKit/Package.swift for target 'MyUIKitPreviews' in the iOS Simulator via the Codex in-app browser with hot reload enabled.positive case · fail
• Show me a browser-visible simulator proof of the running app on UDID F1E2D3C4-B5A6-9788-7766-554433221100 by mirroring it in the Codex in-app browser.positive case · fail
• Start serve-sim for UDID A1B2C3D4-E5F6-7890-G1H2-I3J4K5L6M7N8 and open the URL in the browser.edge case · fail
• Modify my Xcode project to enable SwiftUI previews for the iOS Simulator Browser skill.negative case · fail
• Kill all serve-sim processes to clear any stale simulator mirrors.negative case · fail

Safety (NVIDIA SkillSpector)

4 patterns found

• MCP Least Privilege: Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_write.medium · SKILL.md:1 · Without declared permissions the skill's intent is opaque and cannot be validated.
• MCP Rug Pull: npx --yes serve-simmedium · SKILL.md:16 · npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
• MCP Rug Pull: npx --yes serve-simmedium · SKILL.md:20 · npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
• MCP Rug Pull: npx --yes serve-simmedium · SKILL.md:27 · npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Structure

• Ships 2 executable scriptsscripts/lib/xcode-project.mjs, scripts/swiftui-preview-browser.mjs. Review what they do before enabling the skill for agents with tool access.
• No license declaredConfirm you may reuse this skill before importing it into your repository.

SKILL.md

---
name: ios-simulator-browser
description: Mirror an iOS Simulator into the Codex in-app browser and render SwiftUI previews from importable Swift packages in that simulator with hot reload. Use when a user wants to watch or interact with an iOS app in the browser, see a SwiftUI preview outside Xcode Canvas, iterate live on a preview, or capture browser-visible simulator proof.
---

# iOS Simulator Browser

## Browser Workflow

1. Obtain an explicit Simulator UDID from the existing iOS build/run workflow or from `xcrun simctl list devices available`.
2. Start `serve-sim` in a long-running terminal pinned to that simulator. Clean up any tracked stale helper for this simulator before starting, and install a trap so the helper is cleaned up when this terminal exits:

   ```bash
   SIM="<simulator-udid>"
   cleanup_serve_sim() {
     npx --yes serve-sim@latest --kill "$SIM" >/dev/null 2>&1 || true
   }
   trap cleanup_serve_sim EXIT INT TERM HUP
   cleanup_serve_sim
   npx --yes serve-sim@latest "$SIM"
   ```

3. Open the exact local preview URL printed by `serve-sim` in the Codex in-app browser.
4. Verify that a real frame is rendering before reporting success. A loaded page alone is not proof that the simulator stream is healthy.

- Keep the terminal alive while the browser mirror is in use. When finished, stop the terminal and wait for it to exit so the trap runs.
- If the terminal disappeared or did not exit cleanly, run `npx --yes serve-sim@latest --kill "$SIM"` before starting another mirror for that simulator.
- Never run an unscoped `serve-sim --kill`; another thread may own a different simulator mirror.

## SwiftUI Preview Workflow

Use the bundled launcher when the requested previews live in an importable Swift package. Point it at the package manifest and select the target whose previews should be displayed. It generates a disposable host project outside the user's source tree, installs and launches that host in Simulator, and watches the package for edits.

```bash
node <skill-root>/scripts/swiftui-preview-browser.mjs \
  /absolute/path/to/Package.swift \
  --package-target "<target>" \
  --device "<simulator-udid>"
```

- Watch mode is enabled by default. On a Swift package source edit, the launcher rebuilds a generated dylib and hot-swaps it into the running host without relaunching the app.
- The generated host shows every preview variant discovered in the selected Swift Package target with in-simulator page controls. To show a subset instead, pass `--preview-filter <regex[, ...]>`; it matches display names and code identifiers such as `StatusRowView_Previews`.
- Once the launcher prints the selected Simulator UDID, start `serve-sim` for that same UDID and open its printed URL in the in-app browser.

## Support Boundary

- Support Swift Package-backed `PreviewProvider` and `#Preview` declarations through the generated host.
- Do not edit the user's `.xcodeproj`, `.xcworkspace`, `Package.swift`, schemes, or build settings to force preview support.

## Proof

For browser or preview QA, capture a browser screenshot showing the simulator frame. For hot reload QA, also report the launcher's `hot reloaded package preview ... in pid ...` output and show the changed frame after editing.