fix(cli): let an explicit pid drop a configured bundleId (#551)

[vsolano9]

Fixes #551.

Cause

On the CLI path, register-tool-commands.ts merges the configured session defaults into the explicit arguments (mergeCliSessionDefaults) before it calls the tool handler. That merge drops a defaulted key when the user passes the other key of an exclusive pair, but the CLI's own pair list only had projectPath/workspacePath and simulatorId/simulatorName. debug_attach_sim declares ['bundleId', 'pid'] as exclusive, so with sessionDefaults.bundleId set, debugging attach --pid <pid> reached the handler with both keys as explicit arguments and failed the mutual-exclusion check. Over MCP the handler's own merge already drops the default, which is why only the CLI was affected.

Change

• Add ['bundleId', 'pid'] to CLI_SESSION_DEFAULT_EXCLUSIVE_PAIRS, so an explicit pid drops the configured bundleId (and an explicit bundleId would drop a defaulted pid). The list is typed as ExclusiveParameterGroup[] because pid is not a session-default key.
• Two regression tests in src/cli/__tests__/session-defaults.test.ts: --pid with a configured bundleId, and --json '{"pid":…,"bundleId":null}'. Both fail on main and pass with the change.
• CHANGELOG entry under [Unreleased].

debug_attach_sim is the only tool that declares pid, and passing bundleId and pid together explicitly is still rejected by the handler.

Testing

On macOS 26 (arm64), Node 26.11:

• npm run build, npm run typecheck, npm run lint, npm run format:check: all pass.
• npm test: 243 files, 2593 tests passed. The pre-commit hook passed on the commit.
• Real CLI against a booted simulator, with .mobilebuildmcp/config.yaml setting sessionDefaults.bundleId and simulatorId, then node build/cli.js debugging attach --simulator-id <udid> --pid <pid> --continue-on-attach true --output json:
  • main: Parameter validation failed: Invalid parameters: Mutually exclusive parameters provided: bundleId, pid. (MUTUALLY_EXCLUSIVE_PARAMETERS)
  • this branch: validation passes and the attach targets the given processId. In my run, lldb then declined because the session was non-interactive over ssh (cannot get permission to debug processes), which is a local debugger-permission limit, not part of this change.

I also went through the mobilebuildmcp-runtime-boundary-review guardrails by hand (shared handlers and routing.stateful daemon routing are unchanged; the daemon receives the already-merged args). The warden CLI was not available here, so that review was not run through Warden.

This change was prepared with AI assistance (Claude Code); the checks above were run as described.

🤖 Generated with Claude Code