@ouro.bot/cli 0.1.0-alpha.43 → 0.1.0-alpha.431

package/dist/heart/daemon/safe-mode.js

@@ -0,0 +1,161 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SAFE_MODE_OVERRIDE_FILENAME = void 0;
+exports.detectSafeMode = detectSafeMode;
+exports.pruneOldCrashes = pruneOldCrashes;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+exports.SAFE_MODE_OVERRIDE_FILENAME = "safe-mode-override.json";
+/** 3+ crashes within this window triggers safe mode */
+const CRASH_WINDOW_MS = 5 * 60 * 1000; // 5 minutes
+const CRASH_THRESHOLD = 3;
+/**
+ * Reads crash history from the tombstone file and determines if safe mode should be active.
+ * Returns active if 3+ crashes occurred within 5 minutes.
+ *
+ * Safe mode is bypassed when:
+ * - devMode is true
+ * - A safe-mode override file exists (written by `ouro up --force`)
+ */
+function detectSafeMode(tombstonePath, options) {
+    const inactive = { active: false, reason: "", enteredAt: "" };
+    // Dev mode: never enter safe mode
+    if (options?.devMode) {
+        return inactive;
+    }
+    // Check for override file (--force)
+    const overridePath = path.join(path.dirname(tombstonePath), exports.SAFE_MODE_OVERRIDE_FILENAME);
+    try {
+        if (fs.existsSync(overridePath)) {
+            return inactive;
+        }
+    }
+    catch {
+        // Best-effort check
+    }
+    // Read tombstone
+    let parsed;
+    try {
+        const raw = fs.readFileSync(tombstonePath, "utf-8");
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return inactive;
+    }
+    // Extract recentCrashes
+    if (!Array.isArray(parsed.recentCrashes)) {
+        return inactive;
+    }
+    const nowMs = options?.now ? options.now() : Date.now();
+    const windowStart = nowMs - CRASH_WINDOW_MS;
+    // Filter to valid string timestamps within the crash window
+    const recentInWindow = parsed.recentCrashes.filter((entry) => {
+        if (typeof entry !== "string")
+            return false;
+        const ts = new Date(entry).getTime();
+        if (isNaN(ts))
+            return false;
+        return ts >= windowStart;
+    });
+    if (recentInWindow.length < CRASH_THRESHOLD) {
+        return inactive;
+    }
+    const result = {
+        active: true,
+        reason: `crash loop detected: ${recentInWindow.length} crashes in last 5 minutes`,
+        enteredAt: new Date(nowMs).toISOString(),
+    };
+    (0, runtime_1.emitNervesEvent)({
+        level: "error",
+        component: "daemon",
+        event: "daemon.safe_mode_entered",
+        message: result.reason,
+        meta: {
+            crashCount: recentInWindow.length,
+            windowMs: CRASH_WINDOW_MS,
+            tombstonePath,
+        },
+    });
+    return result;
+}
+/**
+ * Prunes crash entries older than 5 minutes from the tombstone's recentCrashes.
+ * Also removes the safe-mode override file if present.
+ * Called after successful startup (uptime > stability threshold).
+ */
+function pruneOldCrashes(tombstonePath, options) {
+    // Remove override file
+    const overridePath = path.join(path.dirname(tombstonePath), exports.SAFE_MODE_OVERRIDE_FILENAME);
+    try {
+        if (fs.existsSync(overridePath)) {
+            fs.unlinkSync(overridePath);
+        }
+    }
+    catch {
+        // Best-effort
+    }
+    // Read existing tombstone
+    let parsed;
+    try {
+        const raw = fs.readFileSync(tombstonePath, "utf-8");
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return;
+    }
+    if (!Array.isArray(parsed.recentCrashes)) {
+        return;
+    }
+    const nowMs = options?.now ? options.now() : Date.now();
+    const windowStart = nowMs - CRASH_WINDOW_MS;
+    // Keep only entries within the window
+    const pruned = parsed.recentCrashes.filter((entry) => {
+        if (typeof entry !== "string")
+            return false;
+        const ts = new Date(entry).getTime();
+        if (isNaN(ts))
+            return false;
+        return ts >= windowStart;
+    });
+    parsed.recentCrashes = pruned;
+    try {
+        fs.writeFileSync(tombstonePath, JSON.stringify(parsed, null, 2) + "\n", "utf-8");
+    }
+    catch {
+        // Best-effort
+    }
+}

package/dist/heart/daemon/sense-manager.js

@@ -39,11 +39,14 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const runtime_1 = require("../../nerves/runtime");
 const identity_1 = require("../identity");
+const runtime_credentials_1 = require("../runtime-credentials");
 const sense_truth_1 = require("../sense-truth");
+const machine_identity_1 = require("../machine-identity");
 const process_manager_1 = require("./process-manager");
 const DEFAULT_TEAMS_PORT = 3978;
 const DEFAULT_BLUEBUBBLES_PORT = 18790;
 const DEFAULT_BLUEBUBBLES_WEBHOOK_PATH = "/bluebubbles-webhook";
+const BLUEBUBBLES_RUNTIME_FRESHNESS_WINDOW_MS = 90_000;
 function defaultSenses() {
     return {
         cli: { ...identity_1.DEFAULT_AGENT_SENSES.cli },
@@ -86,22 +89,6 @@ function readAgentSenses(agentJsonPath) {
     }
     return defaults;
 }
-function readSecretsPayload(secretsPath) {
-    try {
-        const raw = fs.readFileSync(secretsPath, "utf-8");
-        const parsed = JSON.parse(raw);
-        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-            return { payload: {}, error: "invalid secrets.json object" };
-        }
-        return { payload: parsed, error: null };
-    }
-    catch (error) {
-        return {
-            payload: {},
-            error: error instanceof Error ? error.message : String(error),
-        };
-    }
-}
 function textField(record, key) {
     const value = record?.[key];
     return typeof value === "string" ? value.trim() : "";
@@ -110,17 +97,34 @@ function numberField(record, key, fallback) {
     const value = record?.[key];
     return typeof value === "number" && Number.isFinite(value) ? value : fallback;
 }
-function senseFactsFromSecrets(agent, senses, secretsPath) {
+function compactRuntimeConfigError(agent, error) {
+    const compact = error.replace(/\s+/g, " ").trim();
+    if (/credential vault is locked|vault locked|vault is locked/i.test(compact)) {
+        return `vault locked; run 'ouro vault unlock --agent ${agent}' if you have the saved secret, or 'ouro vault replace --agent ${agent}' if none was saved`;
+    }
+    return compact || "unavailable";
+}
+function runtimeConfigUnavailableDetail(agent, runtimeConfig) {
+    if (runtimeConfig.ok)
+        return "";
+    const itemName = /^vault:[^:]+:(.+)$/.exec(runtimeConfig.itemPath)?.[1] ?? "runtime/config";
+    if (runtimeConfig.reason === "missing")
+        return `missing vault ${itemName} (${agent})`;
+    return `vault ${itemName} unavailable (${compactRuntimeConfigError(agent, runtimeConfig.error)})`;
+}
+function senseFactsFromRuntimeConfig(agent, senses, runtimeConfig, machineRuntimeConfig = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent)) {
     const base = {
         cli: { configured: true, detail: "local interactive terminal" },
         teams: { configured: false, detail: "not enabled in agent.json" },
         bluebubbles: { configured: false, detail: "not enabled in agent.json" },
     };
-    const { payload, error } = readSecretsPayload(secretsPath);
+    const payload = runtimeConfig.ok ? runtimeConfig.config : {};
+    const unavailableDetail = runtimeConfigUnavailableDetail(agent, runtimeConfig);
     const teams = payload.teams;
     const teamsChannel = payload.teamsChannel;
-    const bluebubbles = payload.bluebubbles;
-    const bluebubblesChannel = payload.bluebubblesChannel;
+    const machinePayload = machineRuntimeConfig.ok ? machineRuntimeConfig.config : {};
+    const bluebubbles = machinePayload.bluebubbles;
+    const bluebubblesChannel = machinePayload.bluebubblesChannel;
     if (senses.teams.enabled) {
         const missing = [];
         if (!textField(teams, "clientId"))
@@ -136,9 +140,9 @@ function senseFactsFromSecrets(agent, senses, secretsPath) {
             }
             : {
                 configured: false,
-                detail: error && !fs.existsSync(secretsPath)
-                    ? `missing secrets.json (${agent})`
-                    : `missing ${missing.join("/")}`,
+                detail: runtimeConfig.ok
+                    ? `missing ${missing.join("/")}`
+                    : unavailableDetail,
             };
     }
     if (senses.bluebubbles.enabled) {
@@ -154,13 +158,25 @@ function senseFactsFromSecrets(agent, senses, secretsPath) {
             }
             : {
                 configured: false,
-                detail: error && !fs.existsSync(secretsPath)
-                    ? `missing secrets.json (${agent})`
-                    : `missing ${missing.join("/")}`,
+                optional: !machineRuntimeConfig.ok && machineRuntimeConfig.reason === "missing",
+                detail: !machineRuntimeConfig.ok && machineRuntimeConfig.reason === "missing"
+                    ? "not attached on this machine"
+                    : machineRuntimeConfig.ok
+                        ? `missing ${missing.join("/")}`
+                        : runtimeConfigUnavailableDetail(agent, machineRuntimeConfig),
             };
     }
     return base;
 }
+function senseRepairHint(agent, sense) {
+    if (sense === "teams") {
+        return `Run 'ouro vault config set --agent ${agent} --key teams.clientId', teams.clientSecret, and teams.tenantId; then run 'ouro up' again.`;
+    }
+    return `Run 'ouro connect bluebubbles --agent ${agent}' to attach BlueBubbles on this machine; then run 'ouro up' again.`;
+}
+function currentMachineId() {
+    return (0, machine_identity_1.loadOrCreateMachineIdentity)({ homeDir: os.homedir() }).machineId;
+}
 function parseSenseSnapshotName(name) {
     const parts = name.split(":");
     if (parts.length !== 2)
@@ -175,30 +191,112 @@ function runtimeInfoFor(status) {
         return { runtime: "running" };
     return { runtime: "error" };
 }
+function blueBubblesRuntimeStateIsFresh(lastCheckedAt, now = Date.now()) {
+    if (!lastCheckedAt) {
+        return false;
+    }
+    const checkedAt = Date.parse(lastCheckedAt);
+    if (!Number.isFinite(checkedAt)) {
+        return false;
+    }
+    return checkedAt >= now - BLUEBUBBLES_RUNTIME_FRESHNESS_WINDOW_MS;
+}
+function readBlueBubblesRuntimeJson(runtimePath) {
+    try {
+        const raw = fs.readFileSync(runtimePath, "utf-8");
+        const parsed = JSON.parse(raw);
+        /* v8 ignore start -- branches: ternary fallbacks for missing/malformed BB runtime fields @preserve */
+        return {
+            upstreamStatus: parsed.upstreamStatus === "ok" || parsed.upstreamStatus === "error"
+                ? parsed.upstreamStatus
+                : "unknown",
+            detail: typeof parsed.detail === "string" && parsed.detail.trim()
+                ? parsed.detail
+                : "startup health probe pending",
+            lastCheckedAt: typeof parsed.lastCheckedAt === "string" ? parsed.lastCheckedAt : undefined,
+        };
+        /* v8 ignore stop */
+        /* v8 ignore start -- defensive: catch for missing/corrupt BB runtime state file @preserve */
+    }
+    catch {
+        return { upstreamStatus: "unknown", detail: "startup health probe pending" };
+    }
+    /* v8 ignore stop */
+}
+function readBlueBubblesRuntimeFacts(agent, bundlesRoot, snapshot) {
+    const agentRoot = path.join(bundlesRoot, `${agent}.ouro`);
+    const runtimePath = path.join(agentRoot, "state", "senses", "bluebubbles", "runtime.json");
+    if (!fs.existsSync(runtimePath)) {
+        return { runtime: snapshot?.runtime };
+    }
+    const state = readBlueBubblesRuntimeJson(runtimePath);
+    if (!blueBubblesRuntimeStateIsFresh(state.lastCheckedAt)) {
+        return { runtime: snapshot?.runtime };
+    }
+    if (state.upstreamStatus === "error") {
+        return {
+            runtime: "error",
+            detail: state.detail,
+        };
+    }
+    if (state.upstreamStatus === "ok") {
+        return { runtime: "running" };
+    }
+    return { runtime: snapshot?.runtime };
+}
 class DaemonSenseManager {
     processManager;
     contexts;
+    bundlesRoot;
     constructor(options) {
         const bundlesRoot = options.bundlesRoot ?? path.join(os.homedir(), "AgentBundles");
-        const secretsRoot = options.secretsRoot ?? path.join(os.homedir(), ".agentsecrets");
+        this.bundlesRoot = bundlesRoot;
         this.contexts = new Map(options.agents.map((agent) => {
             const senses = readAgentSenses(path.join(bundlesRoot, `${agent}.ouro`, "agent.json"));
-            const facts = senseFactsFromSecrets(agent, senses, path.join(secretsRoot, agent, "secrets.json"));
+            const facts = senseFactsFromRuntimeConfig(agent, senses, (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent), (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent));
             return [agent, { senses, facts }];
         }));
         const managedSenseAgents = [...this.contexts.entries()].flatMap(([agent, context]) => {
             return ["teams", "bluebubbles"]
-                .filter((sense) => context.senses[sense].enabled && context.facts[sense].configured)
+                .filter((sense) => context.senses[sense].enabled)
                 .map((sense) => ({
                 name: `${agent}:${sense}`,
                 agentArg: agent,
-                entry: sense === "teams" ? "senses/teams-entry.js" : "senses/bluebubbles-entry.js",
+                entry: sense === "teams" ? "senses/teams-entry.js" : "senses/bluebubbles/entry.js",
                 channel: sense,
                 autoStart: true,
             }));
         });
         this.processManager = options.processManager ?? new process_manager_1.DaemonProcessManager({
             agents: managedSenseAgents,
+            configCheck: async (name) => {
+                const parsed = parseSenseSnapshotName(name);
+                if (!parsed)
+                    return { ok: true };
+                const context = this.contexts.get(parsed.agent);
+                if (!context)
+                    return { ok: true };
+                const refreshed = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(parsed.agent, { preserveCachedOnFailure: true });
+                const machineRefreshed = parsed.sense === "bluebubbles"
+                    ? await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(parsed.agent, currentMachineId(), { preserveCachedOnFailure: true })
+                    : (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(parsed.agent);
+                context.facts = senseFactsFromRuntimeConfig(parsed.agent, context.senses, refreshed, machineRefreshed);
+                const fact = context.facts[parsed.sense];
+                if (fact.configured)
+                    return { ok: true };
+                if (fact.optional) {
+                    return {
+                        ok: false,
+                        skip: true,
+                        error: `${parsed.sense} is enabled for ${parsed.agent} but not attached on this machine`,
+                    };
+                }
+                return {
+                    ok: false,
+                    error: `${parsed.sense} is enabled for ${parsed.agent} but runtime credentials are not ready: ${fact.detail}`,
+                    fix: senseRepairHint(parsed.agent, parsed.sense),
+                };
+            },
         });
         (0, runtime_1.emitNervesEvent)({
             component: "channels",
@@ -216,6 +314,13 @@ class DaemonSenseManager {
     async stopAll() {
         await this.processManager.stopAll();
     }
+    /* v8 ignore start -- pid collection for orphan cleanup pidfile @preserve */
+    listManagedPids() {
+        return this.processManager.listAgentSnapshots()
+            .map((s) => s.pid)
+            .filter((pid) => pid !== null && pid !== undefined);
+    }
+    /* v8 ignore stop */
     listSenseRows() {
         const runtime = new Map();
         for (const snapshot of this.processManager.listAgentSnapshots()) {
@@ -227,6 +332,8 @@ class DaemonSenseManager {
             runtime.set(parsed.agent, current);
         }
         const rows = [...this.contexts.entries()].flatMap(([agent, context]) => {
+            context.facts = senseFactsFromRuntimeConfig(agent, context.senses, (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent), (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent));
+            const blueBubblesRuntimeFacts = readBlueBubblesRuntimeFacts(agent, this.bundlesRoot, runtime.get(agent)?.bluebubbles);
             const runtimeInfo = {
                 cli: { configured: true },
                 teams: {
@@ -235,7 +342,8 @@ class DaemonSenseManager {
                 },
                 bluebubbles: {
                     configured: context.facts.bluebubbles.configured,
-                    ...(runtime.get(agent)?.bluebubbles ?? {}),
+                    optional: context.facts.bluebubbles.optional,
+                    ...blueBubblesRuntimeFacts,
                 },
             };
             const inventory = (0, sense_truth_1.getSenseInventory)({ senses: context.senses }, runtimeInfo);
@@ -245,7 +353,12 @@ class DaemonSenseManager {
                 label: entry.label,
                 enabled: entry.enabled,
                 status: entry.status,
-                detail: entry.enabled ? context.facts[entry.sense].detail : "not enabled in agent.json",
+                detail: entry.enabled
+                    ? entry.sense === "bluebubbles"
+                        ? blueBubblesRuntimeFacts.detail
+                            ?? context.facts[entry.sense].detail
+                        : context.facts[entry.sense].detail
+                    : "not enabled in agent.json",
             }));
         });
         (0, runtime_1.emitNervesEvent)({

package/dist/heart/daemon/session-id-resolver.js

@@ -0,0 +1,131 @@
+"use strict";
+// Pluggable session ID resolver for MCP conversations.
+// Tries tool-specific methods first, falls back to UUID.
+//
+// Claude Code: walks parent PID chain -> reads ~/.claude/sessions/{pid}.json
+// Codex: reads thread_id from env (future)
+// Fallback: generates UUID
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSessionId = resolveSessionId;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const crypto_1 = require("crypto");
+const runtime_1 = require("../../nerves/runtime");
+const DEFAULT_CLAUDE_SESSIONS_DIR = path.join(os.homedir(), ".claude", "sessions");
+const MAX_PID_WALK_DEPTH = 10;
+/**
+ * Try to read a Claude Code session ID from a PID-keyed session file.
+ * Returns the sessionId if found, null otherwise.
+ */
+function tryReadClaudeSession(sessionsDir, pid) {
+    const sessionFile = path.join(sessionsDir, `${pid}.json`);
+    if (!fs.existsSync(sessionFile))
+        return null;
+    try {
+        const raw = fs.readFileSync(sessionFile, "utf-8");
+        const data = JSON.parse(raw);
+        if (typeof data.sessionId === "string" && data.sessionId.length > 0) {
+            return data.sessionId;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Walk the parent PID chain looking for a Claude Code session file.
+ * Starts at the current process PID, walks up to parent, grandparent, etc.
+ * Returns the session ID from the first matching file, or null.
+ */
+function walkPidChain(sessionsDir) {
+    let currentPid = process.pid;
+    for (let depth = 0; depth < MAX_PID_WALK_DEPTH; depth++) {
+        const sessionId = tryReadClaudeSession(sessionsDir, currentPid);
+        if (sessionId) {
+            (0, runtime_1.emitNervesEvent)({
+                component: "daemon",
+                event: "daemon.session_id_pid_walk_hit",
+                message: "found Claude session via PID walk",
+                meta: { pid: currentPid, depth, sessionId },
+            });
+            return sessionId;
+        }
+        // Walk to parent PID
+        // On macOS/Linux, process.ppid gives the parent. For deeper ancestry,
+        // we'd need /proc/{pid}/stat or ps -o ppid=. For now, we check current + parent.
+        if (depth === 0) {
+            currentPid = process.ppid;
+        }
+        else {
+            // Cannot walk further without OS-specific process tree APIs
+            break;
+        }
+    }
+    return null;
+}
+/**
+ * Resolve a session ID for the current MCP connection.
+ * Returns a stable identifier that ties MCP tool calls to a conversation session.
+ *
+ * Resolution order:
+ * 1. Claude Code PID walk: check ~/.claude/sessions/{pid}.json for current + parent PID
+ * 2. UUID fallback: generate a random UUID
+ */
+function resolveSessionId(options) {
+    const sessionsDir = options?.claudeSessionsDir ?? DEFAULT_CLAUDE_SESSIONS_DIR;
+    // Try Claude Code PID walk
+    const claudeSessionId = walkPidChain(sessionsDir);
+    if (claudeSessionId) {
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.session_id_resolved",
+            message: "session ID resolved via Claude Code PID walk",
+            meta: { sessionId: claudeSessionId, method: "claude-pid-walk" },
+        });
+        return claudeSessionId;
+    }
+    // Fallback: UUID
+    const sessionId = (0, crypto_1.randomUUID)();
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.session_id_resolved",
+        message: "session ID resolved via UUID fallback",
+        meta: { sessionId, method: "uuid-fallback" },
+    });
+    return sessionId;
+}

package/dist/heart/daemon/skill-management-installer.js

@@ -0,0 +1,94 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureSkillManagement = ensureSkillManagement;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+const identity_1 = require("../identity");
+const SKILL_MANAGEMENT_URL = "https://raw.githubusercontent.com/ouroborosbot/ouroboros-skills/main/skills/skill-management/SKILL.md";
+async function ensureSkillManagement() {
+    const bundlesRoot = (0, identity_1.getAgentBundlesRoot)();
+    if (!fs.existsSync(bundlesRoot))
+        return;
+    // Find all agent bundles
+    const entries = fs.readdirSync(bundlesRoot).filter(e => e.endsWith(".ouro"));
+    if (entries.length === 0)
+        return;
+    // Check if ANY bundle is missing the skill
+    const missing = entries.filter(e => {
+        const targetPath = path.join(bundlesRoot, e, "skills", "skill-management.md");
+        return !fs.existsSync(targetPath);
+    });
+    if (missing.length === 0)
+        return;
+    // eslint-disable-next-line no-console -- terminal UX: visible install status
+    console.log("installing skill-management from ouroboros-skills...");
+    try {
+        const response = await fetch(SKILL_MANAGEMENT_URL);
+        if (!response.ok) {
+            // eslint-disable-next-line no-console -- terminal UX: visible install status
+            console.error(`✗ failed to fetch skill-management (HTTP ${response.status})`);
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "daemon",
+                event: "daemon.skill_management_install_error",
+                message: "failed to fetch skill-management from GitHub",
+                meta: { status: response.status, url: SKILL_MANAGEMENT_URL },
+            });
+            return;
+        }
+        const content = await response.text();
+        for (const bundle of missing) {
+            const skillsDir = path.join(bundlesRoot, bundle, "skills");
+            const targetPath = path.join(skillsDir, "skill-management.md");
+            fs.mkdirSync(skillsDir, { recursive: true });
+            fs.writeFileSync(targetPath, content, "utf-8");
+        }
+        // eslint-disable-next-line no-console -- terminal UX: visible install status
+        console.log(`✓ installed skill-management (${missing.length} agent${missing.length > 1 ? "s" : ""})`);
+    }
+    catch (error) {
+        // eslint-disable-next-line no-console -- terminal UX: visible install status
+        console.error(`✗ failed to install skill-management: ${error instanceof Error ? error.message : String(error)}`);
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "daemon",
+            event: "daemon.skill_management_install_error",
+            message: "failed to install skill-management skill",
+            meta: { error: error instanceof Error ? error.message : String(error) },
+        });
+    }
+}