@ouro.bot/cli 0.1.0-alpha.45 → 0.1.0-alpha.451

package/dist/heart/daemon/safe-mode.js

@@ -0,0 +1,161 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SAFE_MODE_OVERRIDE_FILENAME = void 0;
+exports.detectSafeMode = detectSafeMode;
+exports.pruneOldCrashes = pruneOldCrashes;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+exports.SAFE_MODE_OVERRIDE_FILENAME = "safe-mode-override.json";
+/** 3+ crashes within this window triggers safe mode */
+const CRASH_WINDOW_MS = 5 * 60 * 1000; // 5 minutes
+const CRASH_THRESHOLD = 3;
+/**
+ * Reads crash history from the tombstone file and determines if safe mode should be active.
+ * Returns active if 3+ crashes occurred within 5 minutes.
+ *
+ * Safe mode is bypassed when:
+ * - devMode is true
+ * - A safe-mode override file exists (written by `ouro up --force`)
+ */
+function detectSafeMode(tombstonePath, options) {
+    const inactive = { active: false, reason: "", enteredAt: "" };
+    // Dev mode: never enter safe mode
+    if (options?.devMode) {
+        return inactive;
+    }
+    // Check for override file (--force)
+    const overridePath = path.join(path.dirname(tombstonePath), exports.SAFE_MODE_OVERRIDE_FILENAME);
+    try {
+        if (fs.existsSync(overridePath)) {
+            return inactive;
+        }
+    }
+    catch {
+        // Best-effort check
+    }
+    // Read tombstone
+    let parsed;
+    try {
+        const raw = fs.readFileSync(tombstonePath, "utf-8");
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return inactive;
+    }
+    // Extract recentCrashes
+    if (!Array.isArray(parsed.recentCrashes)) {
+        return inactive;
+    }
+    const nowMs = options?.now ? options.now() : Date.now();
+    const windowStart = nowMs - CRASH_WINDOW_MS;
+    // Filter to valid string timestamps within the crash window
+    const recentInWindow = parsed.recentCrashes.filter((entry) => {
+        if (typeof entry !== "string")
+            return false;
+        const ts = new Date(entry).getTime();
+        if (isNaN(ts))
+            return false;
+        return ts >= windowStart;
+    });
+    if (recentInWindow.length < CRASH_THRESHOLD) {
+        return inactive;
+    }
+    const result = {
+        active: true,
+        reason: `crash loop detected: ${recentInWindow.length} crashes in last 5 minutes`,
+        enteredAt: new Date(nowMs).toISOString(),
+    };
+    (0, runtime_1.emitNervesEvent)({
+        level: "error",
+        component: "daemon",
+        event: "daemon.safe_mode_entered",
+        message: result.reason,
+        meta: {
+            crashCount: recentInWindow.length,
+            windowMs: CRASH_WINDOW_MS,
+            tombstonePath,
+        },
+    });
+    return result;
+}
+/**
+ * Prunes crash entries older than 5 minutes from the tombstone's recentCrashes.
+ * Also removes the safe-mode override file if present.
+ * Called after successful startup (uptime > stability threshold).
+ */
+function pruneOldCrashes(tombstonePath, options) {
+    // Remove override file
+    const overridePath = path.join(path.dirname(tombstonePath), exports.SAFE_MODE_OVERRIDE_FILENAME);
+    try {
+        if (fs.existsSync(overridePath)) {
+            fs.unlinkSync(overridePath);
+        }
+    }
+    catch {
+        // Best-effort
+    }
+    // Read existing tombstone
+    let parsed;
+    try {
+        const raw = fs.readFileSync(tombstonePath, "utf-8");
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return;
+    }
+    if (!Array.isArray(parsed.recentCrashes)) {
+        return;
+    }
+    const nowMs = options?.now ? options.now() : Date.now();
+    const windowStart = nowMs - CRASH_WINDOW_MS;
+    // Keep only entries within the window
+    const pruned = parsed.recentCrashes.filter((entry) => {
+        if (typeof entry !== "string")
+            return false;
+        const ts = new Date(entry).getTime();
+        if (isNaN(ts))
+            return false;
+        return ts >= windowStart;
+    });
+    parsed.recentCrashes = pruned;
+    try {
+        fs.writeFileSync(tombstonePath, JSON.stringify(parsed, null, 2) + "\n", "utf-8");
+    }
+    catch {
+        // Best-effort
+    }
+}

package/dist/heart/daemon/sense-manager.js

@@ -38,18 +38,21 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const runtime_1 = require("../../nerves/runtime");
-const bluebubbles_runtime_state_1 = require("../../senses/bluebubbles-runtime-state");
 const identity_1 = require("../identity");
+const runtime_credentials_1 = require("../runtime-credentials");
 const sense_truth_1 = require("../sense-truth");
+const machine_identity_1 = require("../machine-identity");
 const process_manager_1 = require("./process-manager");
 const DEFAULT_TEAMS_PORT = 3978;
 const DEFAULT_BLUEBUBBLES_PORT = 18790;
 const DEFAULT_BLUEBUBBLES_WEBHOOK_PATH = "/bluebubbles-webhook";
+const BLUEBUBBLES_RUNTIME_FRESHNESS_WINDOW_MS = 90_000;
 function defaultSenses() {
     return {
         cli: { ...identity_1.DEFAULT_AGENT_SENSES.cli },
         teams: { ...identity_1.DEFAULT_AGENT_SENSES.teams },
         bluebubbles: { ...identity_1.DEFAULT_AGENT_SENSES.bluebubbles },
+        mail: { ...identity_1.DEFAULT_AGENT_SENSES.mail },
     };
 }
 function readAgentSenses(agentJsonPath) {
@@ -75,7 +78,7 @@ function readAgentSenses(agentJsonPath) {
     if (!rawSenses || typeof rawSenses !== "object" || Array.isArray(rawSenses)) {
         return defaults;
     }
-    for (const sense of ["cli", "teams", "bluebubbles"]) {
+    for (const sense of ["cli", "teams", "bluebubbles", "mail"]) {
         const rawSense = rawSenses[sense];
         if (!rawSense || typeof rawSense !== "object" || Array.isArray(rawSense)) {
             continue;
@@ -87,22 +90,6 @@ function readAgentSenses(agentJsonPath) {
     }
     return defaults;
 }
-function readSecretsPayload(secretsPath) {
-    try {
-        const raw = fs.readFileSync(secretsPath, "utf-8");
-        const parsed = JSON.parse(raw);
-        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-            return { payload: {}, error: "invalid secrets.json object" };
-        }
-        return { payload: parsed, error: null };
-    }
-    catch (error) {
-        return {
-            payload: {},
-            error: error instanceof Error ? error.message : String(error),
-        };
-    }
-}
 function textField(record, key) {
     const value = record?.[key];
     return typeof value === "string" ? value.trim() : "";
@@ -111,17 +98,36 @@ function numberField(record, key, fallback) {
     const value = record?.[key];
     return typeof value === "number" && Number.isFinite(value) ? value : fallback;
 }
-function senseFactsFromSecrets(agent, senses, secretsPath) {
+function compactRuntimeConfigError(agent, error) {
+    const compact = error.replace(/\s+/g, " ").trim();
+    if (/credential vault is locked|vault locked|vault is locked/i.test(compact)) {
+        return `vault locked; run 'ouro vault unlock --agent ${agent}' if you have the saved secret, or 'ouro vault replace --agent ${agent}' if none was saved`;
+    }
+    return compact || "unavailable";
+}
+function runtimeConfigUnavailableDetail(agent, runtimeConfig) {
+    if (runtimeConfig.ok)
+        return "";
+    const itemName = /^vault:[^:]+:(.+)$/.exec(runtimeConfig.itemPath)?.[1] ?? "runtime/config";
+    if (runtimeConfig.reason === "missing")
+        return `missing vault ${itemName} (${agent})`;
+    return `vault ${itemName} unavailable (${compactRuntimeConfigError(agent, runtimeConfig.error)})`;
+}
+function senseFactsFromRuntimeConfig(agent, senses, runtimeConfig, machineRuntimeConfig = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent)) {
     const base = {
         cli: { configured: true, detail: "local interactive terminal" },
         teams: { configured: false, detail: "not enabled in agent.json" },
         bluebubbles: { configured: false, detail: "not enabled in agent.json" },
+        mail: { configured: false, detail: "not enabled in agent.json" },
     };
-    const { payload, error } = readSecretsPayload(secretsPath);
+    const payload = runtimeConfig.ok ? runtimeConfig.config : {};
+    const unavailableDetail = runtimeConfigUnavailableDetail(agent, runtimeConfig);
     const teams = payload.teams;
     const teamsChannel = payload.teamsChannel;
-    const bluebubbles = payload.bluebubbles;
-    const bluebubblesChannel = payload.bluebubblesChannel;
+    const machinePayload = machineRuntimeConfig.ok ? machineRuntimeConfig.config : {};
+    const bluebubbles = machinePayload.bluebubbles;
+    const bluebubblesChannel = machinePayload.bluebubblesChannel;
+    const mailroom = payload.mailroom;
     if (senses.teams.enabled) {
         const missing = [];
         if (!textField(teams, "clientId"))
@@ -137,9 +143,9 @@ function senseFactsFromSecrets(agent, senses, secretsPath) {
             }
             : {
                 configured: false,
-                detail: error && !fs.existsSync(secretsPath)
-                    ? `missing secrets.json (${agent})`
-                    : `missing ${missing.join("/")}`,
+                detail: runtimeConfig.ok
+                    ? `missing ${missing.join("/")}`
+                    : unavailableDetail,
             };
     }
     if (senses.bluebubbles.enabled) {
@@ -155,19 +161,52 @@ function senseFactsFromSecrets(agent, senses, secretsPath) {
             }
             : {
                 configured: false,
-                detail: error && !fs.existsSync(secretsPath)
-                    ? `missing secrets.json (${agent})`
-                    : `missing ${missing.join("/")}`,
+                optional: !machineRuntimeConfig.ok && machineRuntimeConfig.reason === "missing",
+                detail: !machineRuntimeConfig.ok && machineRuntimeConfig.reason === "missing"
+                    ? "not attached on this machine"
+                    : machineRuntimeConfig.ok
+                        ? `missing ${missing.join("/")}`
+                        : runtimeConfigUnavailableDetail(agent, machineRuntimeConfig),
+            };
+    }
+    if (senses.mail.enabled) {
+        const privateKeys = mailroom?.privateKeys;
+        const hasPrivateKeys = !!privateKeys && typeof privateKeys === "object" && !Array.isArray(privateKeys) && Object.values(privateKeys).some((value) => typeof value === "string" && value.trim().length > 0);
+        const mailboxAddress = textField(mailroom, "mailboxAddress");
+        const missing = [];
+        if (!mailboxAddress)
+            missing.push("mailroom.mailboxAddress");
+        if (!hasPrivateKeys)
+            missing.push("mailroom.privateKeys");
+        base.mail = missing.length === 0
+            ? { configured: true, detail: mailboxAddress }
+            : {
+                configured: false,
+                detail: runtimeConfig.ok
+                    ? `missing ${missing.join("/")}`
+                    : unavailableDetail,
             };
     }
     return base;
 }
+function senseRepairHint(agent, sense) {
+    if (sense === "teams") {
+        return `Run 'ouro vault config set --agent ${agent} --key teams.clientId', teams.clientSecret, and teams.tenantId; then run 'ouro up' again.`;
+    }
+    if (sense === "mail") {
+        return `Run 'ouro connect mail --agent ${agent}' to provision Mailroom access; then run 'ouro up' again.`;
+    }
+    return `Run 'ouro connect bluebubbles --agent ${agent}' to attach BlueBubbles on this machine; then run 'ouro up' again.`;
+}
+function currentMachineId() {
+    return (0, machine_identity_1.loadOrCreateMachineIdentity)({ homeDir: os.homedir() }).machineId;
+}
 function parseSenseSnapshotName(name) {
     const parts = name.split(":");
     if (parts.length !== 2)
         return null;
     const [agent, sense] = parts;
-    if (sense !== "teams" && sense !== "bluebubbles")
+    if (sense !== "teams" && sense !== "bluebubbles" && sense !== "mail")
         return null;
     return { agent, sense };
 }
@@ -176,20 +215,58 @@ function runtimeInfoFor(status) {
         return { runtime: "running" };
     return { runtime: "error" };
 }
+function blueBubblesRuntimeStateIsFresh(lastCheckedAt, now = Date.now()) {
+    if (!lastCheckedAt) {
+        return false;
+    }
+    const checkedAt = Date.parse(lastCheckedAt);
+    if (!Number.isFinite(checkedAt)) {
+        return false;
+    }
+    return checkedAt >= now - BLUEBUBBLES_RUNTIME_FRESHNESS_WINDOW_MS;
+}
+function readBlueBubblesRuntimeJson(runtimePath) {
+    try {
+        const raw = fs.readFileSync(runtimePath, "utf-8");
+        const parsed = JSON.parse(raw);
+        /* v8 ignore start -- branches: ternary fallbacks for missing/malformed BB runtime fields @preserve */
+        return {
+            upstreamStatus: parsed.upstreamStatus === "ok" || parsed.upstreamStatus === "error"
+                ? parsed.upstreamStatus
+                : "unknown",
+            detail: typeof parsed.detail === "string" && parsed.detail.trim()
+                ? parsed.detail
+                : "startup health probe pending",
+            lastCheckedAt: typeof parsed.lastCheckedAt === "string" ? parsed.lastCheckedAt : undefined,
+        };
+        /* v8 ignore stop */
+        /* v8 ignore start -- defensive: catch for missing/corrupt BB runtime state file @preserve */
+    }
+    catch {
+        return { upstreamStatus: "unknown", detail: "startup health probe pending" };
+    }
+    /* v8 ignore stop */
+}
 function readBlueBubblesRuntimeFacts(agent, bundlesRoot, snapshot) {
     const agentRoot = path.join(bundlesRoot, `${agent}.ouro`);
     const runtimePath = path.join(agentRoot, "state", "senses", "bluebubbles", "runtime.json");
-    if (snapshot?.runtime !== "running" || !fs.existsSync(runtimePath)) {
+    if (!fs.existsSync(runtimePath)) {
+        return { runtime: snapshot?.runtime };
+    }
+    const state = readBlueBubblesRuntimeJson(runtimePath);
+    if (!blueBubblesRuntimeStateIsFresh(state.lastCheckedAt)) {
         return { runtime: snapshot?.runtime };
     }
-    const state = (0, bluebubbles_runtime_state_1.readBlueBubblesRuntimeState)(agent, agentRoot);
     if (state.upstreamStatus === "error") {
         return {
             runtime: "error",
             detail: state.detail,
         };
     }
-    return { runtime: snapshot.runtime };
+    if (state.upstreamStatus === "ok") {
+        return { runtime: "running" };
+    }
+    return { runtime: snapshot?.runtime };
 }
 class DaemonSenseManager {
     processManager;
@@ -197,26 +274,53 @@ class DaemonSenseManager {
     bundlesRoot;
     constructor(options) {
         const bundlesRoot = options.bundlesRoot ?? path.join(os.homedir(), "AgentBundles");
-        const secretsRoot = options.secretsRoot ?? path.join(os.homedir(), ".agentsecrets");
         this.bundlesRoot = bundlesRoot;
         this.contexts = new Map(options.agents.map((agent) => {
             const senses = readAgentSenses(path.join(bundlesRoot, `${agent}.ouro`, "agent.json"));
-            const facts = senseFactsFromSecrets(agent, senses, path.join(secretsRoot, agent, "secrets.json"));
+            const facts = senseFactsFromRuntimeConfig(agent, senses, (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent), (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent));
             return [agent, { senses, facts }];
         }));
         const managedSenseAgents = [...this.contexts.entries()].flatMap(([agent, context]) => {
             return ["teams", "bluebubbles"]
-                .filter((sense) => context.senses[sense].enabled && context.facts[sense].configured)
+                .filter((sense) => context.senses[sense].enabled)
                 .map((sense) => ({
                 name: `${agent}:${sense}`,
                 agentArg: agent,
-                entry: sense === "teams" ? "senses/teams-entry.js" : "senses/bluebubbles-entry.js",
+                entry: sense === "teams" ? "senses/teams-entry.js" : "senses/bluebubbles/entry.js",
                 channel: sense,
                 autoStart: true,
             }));
         });
         this.processManager = options.processManager ?? new process_manager_1.DaemonProcessManager({
             agents: managedSenseAgents,
+            configCheck: async (name) => {
+                const parsed = parseSenseSnapshotName(name);
+                if (!parsed)
+                    return { ok: true };
+                const context = this.contexts.get(parsed.agent);
+                if (!context)
+                    return { ok: true };
+                const refreshed = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(parsed.agent, { preserveCachedOnFailure: true });
+                const machineRefreshed = parsed.sense === "bluebubbles"
+                    ? await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(parsed.agent, currentMachineId(), { preserveCachedOnFailure: true })
+                    : (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(parsed.agent);
+                context.facts = senseFactsFromRuntimeConfig(parsed.agent, context.senses, refreshed, machineRefreshed);
+                const fact = context.facts[parsed.sense];
+                if (fact.configured)
+                    return { ok: true };
+                if (fact.optional) {
+                    return {
+                        ok: false,
+                        skip: true,
+                        error: `${parsed.sense} is enabled for ${parsed.agent} but not attached on this machine`,
+                    };
+                }
+                return {
+                    ok: false,
+                    error: `${parsed.sense} is enabled for ${parsed.agent} but runtime credentials are not ready: ${fact.detail}`,
+                    fix: senseRepairHint(parsed.agent, parsed.sense),
+                };
+            },
         });
         (0, runtime_1.emitNervesEvent)({
             component: "channels",
@@ -234,6 +338,13 @@ class DaemonSenseManager {
     async stopAll() {
         await this.processManager.stopAll();
     }
+    /* v8 ignore start -- pid collection for orphan cleanup pidfile @preserve */
+    listManagedPids() {
+        return this.processManager.listAgentSnapshots()
+            .map((s) => s.pid)
+            .filter((pid) => pid !== null && pid !== undefined);
+    }
+    /* v8 ignore stop */
     listSenseRows() {
         const runtime = new Map();
         for (const snapshot of this.processManager.listAgentSnapshots()) {
@@ -245,6 +356,7 @@ class DaemonSenseManager {
             runtime.set(parsed.agent, current);
         }
         const rows = [...this.contexts.entries()].flatMap(([agent, context]) => {
+            context.facts = senseFactsFromRuntimeConfig(agent, context.senses, (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent), (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent));
             const blueBubblesRuntimeFacts = readBlueBubblesRuntimeFacts(agent, this.bundlesRoot, runtime.get(agent)?.bluebubbles);
             const runtimeInfo = {
                 cli: { configured: true },
@@ -254,8 +366,12 @@ class DaemonSenseManager {
                 },
                 bluebubbles: {
                     configured: context.facts.bluebubbles.configured,
+                    optional: context.facts.bluebubbles.optional,
                     ...blueBubblesRuntimeFacts,
                 },
+                mail: {
+                    configured: context.facts.mail.configured,
+                },
             };
             const inventory = (0, sense_truth_1.getSenseInventory)({ senses: context.senses }, runtimeInfo);
             return inventory.map((entry) => ({

package/dist/heart/daemon/session-id-resolver.js

@@ -0,0 +1,131 @@
+"use strict";
+// Pluggable session ID resolver for MCP conversations.
+// Tries tool-specific methods first, falls back to UUID.
+//
+// Claude Code: walks parent PID chain -> reads ~/.claude/sessions/{pid}.json
+// Codex: reads thread_id from env (future)
+// Fallback: generates UUID
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSessionId = resolveSessionId;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const crypto_1 = require("crypto");
+const runtime_1 = require("../../nerves/runtime");
+const DEFAULT_CLAUDE_SESSIONS_DIR = path.join(os.homedir(), ".claude", "sessions");
+const MAX_PID_WALK_DEPTH = 10;
+/**
+ * Try to read a Claude Code session ID from a PID-keyed session file.
+ * Returns the sessionId if found, null otherwise.
+ */
+function tryReadClaudeSession(sessionsDir, pid) {
+    const sessionFile = path.join(sessionsDir, `${pid}.json`);
+    if (!fs.existsSync(sessionFile))
+        return null;
+    try {
+        const raw = fs.readFileSync(sessionFile, "utf-8");
+        const data = JSON.parse(raw);
+        if (typeof data.sessionId === "string" && data.sessionId.length > 0) {
+            return data.sessionId;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Walk the parent PID chain looking for a Claude Code session file.
+ * Starts at the current process PID, walks up to parent, grandparent, etc.
+ * Returns the session ID from the first matching file, or null.
+ */
+function walkPidChain(sessionsDir) {
+    let currentPid = process.pid;
+    for (let depth = 0; depth < MAX_PID_WALK_DEPTH; depth++) {
+        const sessionId = tryReadClaudeSession(sessionsDir, currentPid);
+        if (sessionId) {
+            (0, runtime_1.emitNervesEvent)({
+                component: "daemon",
+                event: "daemon.session_id_pid_walk_hit",
+                message: "found Claude session via PID walk",
+                meta: { pid: currentPid, depth, sessionId },
+            });
+            return sessionId;
+        }
+        // Walk to parent PID
+        // On macOS/Linux, process.ppid gives the parent. For deeper ancestry,
+        // we'd need /proc/{pid}/stat or ps -o ppid=. For now, we check current + parent.
+        if (depth === 0) {
+            currentPid = process.ppid;
+        }
+        else {
+            // Cannot walk further without OS-specific process tree APIs
+            break;
+        }
+    }
+    return null;
+}
+/**
+ * Resolve a session ID for the current MCP connection.
+ * Returns a stable identifier that ties MCP tool calls to a conversation session.
+ *
+ * Resolution order:
+ * 1. Claude Code PID walk: check ~/.claude/sessions/{pid}.json for current + parent PID
+ * 2. UUID fallback: generate a random UUID
+ */
+function resolveSessionId(options) {
+    const sessionsDir = options?.claudeSessionsDir ?? DEFAULT_CLAUDE_SESSIONS_DIR;
+    // Try Claude Code PID walk
+    const claudeSessionId = walkPidChain(sessionsDir);
+    if (claudeSessionId) {
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.session_id_resolved",
+            message: "session ID resolved via Claude Code PID walk",
+            meta: { sessionId: claudeSessionId, method: "claude-pid-walk" },
+        });
+        return claudeSessionId;
+    }
+    // Fallback: UUID
+    const sessionId = (0, crypto_1.randomUUID)();
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.session_id_resolved",
+        message: "session ID resolved via UUID fallback",
+        meta: { sessionId, method: "uuid-fallback" },
+    });
+    return sessionId;
+}