@niroai/niro 0.10.1 → 0.12.0

package/src/lib/impactLog.js

@@ -0,0 +1,251 @@
+/**
+ * Record of the impact checks an agent made through the bridge, read by the Edit|Write impact gate.
+ *
+ * Why this exists: CLAUDE.md, the niro skill and the UserPromptSubmit hook all tell the agent to map
+ * who depends on code before changing it (get_blast_radius, get_impact_analysis). Prose decays over a
+ * session: the agent obeys early, then reads a method with sed and edits it. Niraj, 2026-09-04: "I
+ * always felt that before you make any code changes in any method you would want to check what's
+ * the impact of that but you hardly ever care to check." The only thing that survives a long session
+ * is a check at the moment of the edit. The PreToolUse hook in setup.js (NIRO_IMPACT_COMMAND) is that
+ * check, and it needs evidence of what the agent actually called. The bridge sees every tools/call and
+ * every answer, so it keeps that evidence here.
+ *
+ * What is written: one JSON line per answered impact call under ~/.niro/impact/<key>.jsonl, where
+ * <key> is the bridge's working directory, symlinks resolved, with every byte that is not an ASCII
+ * letter or digit replaced by "-". The hook derives the same key from the payload's cwd with
+ * `cd -P` and `tr -c 'A-Za-z0-9' '-'`, so the two sides agree without sharing code (tested in
+ * test/impactGateHook.test.js). A line carries the tool name, the names the agent asked about
+ * (method_fqn, class_fqn and friends) and every source path the answer mentioned. Lines older than
+ * WINDOW_MS are pruned on every write, so the file cannot grow past one hour of checks.
+ *
+ * Liveness: <key>.alive is touched whenever the server answers. The hook denies an unchecked edit only
+ * while that file is fresh; with the bridge gone it can only advise, so Niro being unreachable never
+ * blocks an edit. Fail-open by design.
+ *
+ * Every function here swallows filesystem errors: this sits on the message path between the host and
+ * the server, and a full disk or an unwritable home must cost the gate and nothing else.
+ */
+const fs = require("fs");
+const path = require("path");
+const { niroHome } = require("./receiptStore");
+
+/** The calls that count as "checked who depends on it". Downstream-only walks (get_call_chain) do not. */
+const IMPACT_TOOLS = new Set(["get_blast_radius", "get_impact_analysis", "get_reverse_call_chain"]);
+/** How long a recorded check keeps a file unlocked. */
+const WINDOW_MS = 60 * 60 * 1000;
+const MAX_LINES = 500;
+const MAX_NAMES = 50;
+const MAX_FILES = 200;
+const MAX_IN_FLIGHT = 100;
+/** The alive file is rewritten at most this often; answers arrive far more frequently than that. */
+const ALIVE_TOUCH_MIN_MS = 10 * 1000;
+/** Argument names across the impact tools that carry what the agent asked about. */
+const NAME_ARGS = [
+  "method_fqn", "method_fqns", "class_fqn", "entity_fqn", "entity_fqns", "fqn", "fqns", "targets",
+  "http_path", "event_fqn",
+];
+const SOURCE_EXT = "java|js|mjs|cjs|ts|tsx|jsx|py|go|rb|kt|kts|cs|php|rs|scala|swift|c|cc|cpp|h|hpp";
+/**
+ * A source path inside an answer: optional leading "/", slash-separated segments, a known extension,
+ * bounded by whitespace, quotes, brackets, ":" or ",". The ":" lets `repo::src/a/B.java` yield the
+ * repo-relative path, which is what the hook compares against the edited file's path.
+ */
+const PATH_RE = new RegExp(
+  "(?:^|[\\s\"'(:,])(/?(?:[A-Za-z0-9_.\\-]+/)*[A-Za-z0-9_.\\-]+\\.(?:" + SOURCE_EXT + "))(?=$|[\\s\"'),:])",
+  "g",
+);
+
+function impactDir() {
+  return path.join(niroHome(), "impact");
+}
+
+/** Presence of this file switches the gate off for every session on this machine. */
+function offSwitchPath() {
+  return path.join(niroHome(), "impact-gate-off");
+}
+
+/**
+ * The per-folder key, byte for byte what `printf '%s' "$(cd -P dir && pwd -P)" | tr -c 'A-Za-z0-9' '-'`
+ * produces. Byte-based on purpose: tr works on bytes, so a non-ASCII character becomes several dashes
+ * there and must here too, or the hook looks for a file the bridge never wrote.
+ */
+function keyForCwd(cwd) {
+  let real = String(cwd || "");
+  try {
+    real = fs.realpathSync(real);
+  } catch (_) {
+    /* a folder that does not exist keeps its lexical path, as the hook's `cd -P || printf` fallback does */
+  }
+  let out = "";
+  for (const b of Buffer.from(real, "utf8")) {
+    const alnum = (b >= 48 && b <= 57) || (b >= 65 && b <= 90) || (b >= 97 && b <= 122);
+    out += alnum ? String.fromCharCode(b) : "-";
+  }
+  return out;
+}
+
+function logPathFor(cwd) {
+  return path.join(impactDir(), keyForCwd(cwd) + ".jsonl");
+}
+
+function alivePathFor(cwd) {
+  return path.join(impactDir(), keyForCwd(cwd) + ".alive");
+}
+
+function toolNameOf(message) {
+  if (!message || message.method !== "tools/call" || !message.params) return null;
+  return typeof message.params.name === "string" ? message.params.name : null;
+}
+
+function isImpactCall(message) {
+  const name = toolNameOf(message);
+  return !!name && IMPACT_TOOLS.has(name);
+}
+
+/** The strings the agent asked about, deduplicated and bounded; routing extras like _niroPin are ignored. */
+function namesFromArgs(args) {
+  const out = [];
+  const push = (v) => {
+    if (typeof v !== "string") return;
+    const s = v.trim().slice(0, 300);
+    if (s && !out.includes(s)) out.push(s);
+  };
+  if (args && typeof args === "object") {
+    for (const key of NAME_ARGS) {
+      const v = args[key];
+      if (Array.isArray(v)) v.forEach(push);
+      else push(v);
+    }
+  }
+  return out.slice(0, MAX_NAMES);
+}
+
+/** All text parts of a tool result, joined; "" for anything that is not a text result. */
+function resultText(msg) {
+  const content = msg && msg.result && msg.result.content;
+  if (!Array.isArray(content)) return "";
+  return content.map((c) => (c && typeof c.text === "string" ? c.text : "")).join("\n");
+}
+
+/** Every distinct source path an answer mentions, in order of appearance, bounded. */
+function filesFromResultText(text) {
+  const out = [];
+  if (typeof text !== "string" || !text) return out;
+  PATH_RE.lastIndex = 0;
+  let m;
+  while ((m = PATH_RE.exec(text)) && out.length < MAX_FILES) {
+    if (!out.includes(m[1])) out.push(m[1]);
+  }
+  return out;
+}
+
+/** Drop lines older than the window, then cap the count; the newest lines win. */
+function pruneLines(lines, now) {
+  const cutoff = now - WINDOW_MS;
+  const kept = lines.filter((line) => {
+    const m = /"ts":(\d+)/.exec(line);
+    return !!m && Number(m[1]) >= cutoff;
+  });
+  return kept.length > MAX_LINES ? kept.slice(kept.length - MAX_LINES) : kept;
+}
+
+/** Append one record, pruning first. Returns false, never throws, when the file cannot be written. */
+function appendRecord(file, record, now) {
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    let lines = [];
+    try {
+      lines = fs.readFileSync(file, "utf8").split("\n").filter(Boolean);
+    } catch (_) {
+      /* first record for this folder */
+    }
+    lines = pruneLines(lines, now);
+    lines.push(JSON.stringify(record));
+    fs.writeFileSync(file, lines.join("\n") + "\n", { mode: 0o600 });
+    return true;
+  } catch (_) {
+    return false;
+  }
+}
+
+/**
+ * One recorder per bridge process. `noteRequest` on every outgoing message, `noteResult` and
+ * `touchAlive` on every incoming one; each returns true only when it wrote something, which the
+ * tests use and the bridge ignores.
+ */
+function createImpactRecorder({ cwd = process.cwd(), now = Date.now } = {}) {
+  const inFlight = new Map();
+  let lastAlive = 0;
+  return {
+    noteRequest(message) {
+      if (!isImpactCall(message) || message.id === undefined || message.id === null) return false;
+      const args = message.params.arguments || {};
+      inFlight.set(message.id, { tool: message.params.name, names: namesFromArgs(args), ts: now() });
+      if (inFlight.size > MAX_IN_FLIGHT) inFlight.delete(inFlight.keys().next().value);
+      return true;
+    },
+    noteResult(msg) {
+      if (!msg || msg.id === undefined || msg.id === null) return false;
+      const meta = inFlight.get(msg.id);
+      if (!meta) return false;
+      inFlight.delete(msg.id);
+      // An error answer is still recorded: the agent asked, which is the behaviour the gate exists to
+      // produce, and a name the server could not resolve must not leave the file locked.
+      const files = filesFromResultText(resultText(msg));
+      return appendRecord(logPathFor(cwd), { ts: meta.ts, tool: meta.tool, names: meta.names, files }, now());
+    },
+    clearAlive() {
+      try {
+        fs.rmSync(alivePathFor(cwd), { force: true });
+        return true;
+      } catch (_) {
+        return false;
+      }
+    },
+    touchAlive() {
+      const t = now();
+      if (t - lastAlive < ALIVE_TOUCH_MIN_MS) return false;
+      lastAlive = t;
+      try {
+        fs.mkdirSync(impactDir(), { recursive: true, mode: 0o700 });
+        fs.writeFileSync(alivePathFor(cwd), String(t), { mode: 0o600 });
+        return true;
+      } catch (_) {
+        return false;
+      }
+    },
+  };
+}
+
+/** Remove the evidence files and the off switch. Used by `niro mcp uninstall`. Best effort. */
+function purge() {
+  try {
+    fs.rmSync(impactDir(), { recursive: true, force: true });
+  } catch (_) {
+    /* best effort */
+  }
+  try {
+    fs.rmSync(offSwitchPath(), { force: true });
+  } catch (_) {
+    /* best effort */
+  }
+}
+
+module.exports = {
+  purge,
+  IMPACT_TOOLS,
+  WINDOW_MS,
+  MAX_LINES,
+  keyForCwd,
+  impactDir,
+  offSwitchPath,
+  logPathFor,
+  alivePathFor,
+  isImpactCall,
+  namesFromArgs,
+  resultText,
+  filesFromResultText,
+  pruneLines,
+  appendRecord,
+  createImpactRecorder,
+};

package/src/lib/periodicClaim.js

@@ -0,0 +1,100 @@
+/**
+ * "Has this periodic job already run recently, and may I be the one to run it now?"
+ *
+ * Two problems, one answer.
+ *
+ * PM2 restarts the watch daemon on a crash, on a reboot, and on `niro service restart`. A job wired to
+ * a plain setInterval that also runs at startup therefore runs on every restart, and a crash loop turns
+ * a daily job into a hot loop. So the last run time has to OUTLIVE the process, which means a file.
+ *
+ * And two daemons can be up at once — the PM2 one plus a `niro watch` somebody left running in a
+ * terminal. Both would fire the same job at the same moment. For a job that only reads that is waste;
+ * for one that deletes on the server it is two processes racing over the same decision.
+ *
+ * A timestamp file answers both: whoever writes it first owns the interval, and everybody else sees a
+ * recent stamp and stands down. The write is atomic (tmp + rename, the same technique watchState uses)
+ * so a reader never sees a half-written file.
+ *
+ * NOT a mutex. Two processes calling claim() in the same millisecond can both win: each reads the old
+ * stamp before either writes. Closing that needs an O_EXCL lock file plus stale-lock recovery, which
+ * costs more than it saves here — the jobs this guards are idempotent (a second sweep finds the work
+ * already done) and the interval is hours, so the collision window is milliseconds wide once a day.
+ * The comment is here so nobody later mistakes this for a lock and puts something non-idempotent
+ * behind it.
+ */
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const DIR = path.join(os.homedir(), ".niro");
+const FILE = path.join(DIR, "periodic.json");
+
+function load() {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(FILE, "utf8"));
+    // An ARRAY passes `typeof === "object"`, and JSON.stringify then drops the named property we set on
+    // it — so the stamp never persisted and the job claimed on EVERY tick, which is precisely the crash
+    // loop this module exists to prevent. Anything that is not a plain object starts again from empty.
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+    return parsed;
+  } catch {
+    return {};
+  }
+}
+
+function save(state) {
+  fs.mkdirSync(DIR, { recursive: true, mode: 0o700 });
+  const tmp = `${FILE}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n", { mode: 0o600 });
+  fs.renameSync(tmp, FILE);
+}
+
+/** When `name` last ran, in epoch millis, or null if it never has (or the stamp is unreadable). */
+/** Said once per process, not once per tick — a six-hourly job would otherwise fill the log. */
+let warnedAboutWrite = false;
+
+function lastRun(name) {
+  const at = load()[name];
+  const n = Number(at);
+  return Number.isFinite(n) && n > 0 ? n : null;
+}
+
+/**
+ * Try to claim the current interval for `name`.
+ *
+ * Returns true and stamps the file when `intervalMs` has passed since the last run (or it has never
+ * run). Returns false and writes nothing otherwise.
+ *
+ * The stamp is written BEFORE the job runs, not after. A job that dies half way through must not be
+ * retried immediately on the next tick — that is the crash loop this exists to prevent — and these
+ * jobs are safe to skip for one interval. The cost of the choice is that a run interrupted at 1% waits
+ * a full interval to try again, which is the right trade for something that runs every few hours.
+ *
+ * A stamp in the FUTURE (a clock that jumped back, or a file copied between machines) would otherwise
+ * block the job until real time caught up, potentially for years. Treated as "never ran" instead.
+ */
+function claim(name, intervalMs, now = Date.now()) {
+  const last = lastRun(name);
+  if (last !== null && last <= now && now - last < intervalMs) return false;
+  const state = load();
+  state[name] = now;
+  try {
+    save(state);
+  } catch (err) {
+    // Cannot persist the stamp (read-only home, a file left by a `sudo` run, a full disk). Refuse the
+    // claim rather than run: an unstampable job would run on EVERY tick, which is worse than not
+    // running at all.
+    //
+    // But SAY SO, once. Returning a quiet false disables the job for good, and the developer has no
+    // way to know: their folders simply stop being tidied and nothing ever mentions it.
+    if (!warnedAboutWrite) {
+      warnedAboutWrite = true;
+      console.warn(`    Could not write ${FILE} (${err.message}). Periodic housekeeping is paused; ` +
+          "fix the permissions on ~/.niro to re-enable it.");
+    }
+    return false;
+  }
+  return true;
+}
+
+module.exports = { claim, lastRun, FILE };

package/src/lib/printError.js

@@ -0,0 +1,46 @@
+/**
+ * How a failed command is written to the terminal.
+ *
+ * Extracted from index.js's `run` for one reason: it was dropping text the user needed, and there was
+ * no way to test that. index.js calls main() at load, so nothing could require it.
+ *
+ * The bug it exists to stop: the printer took `err.stack.split("\n")[0]`, which is the error's class
+ * name plus the FIRST LINE of its message. Any message built over several lines therefore printed its
+ * opening line and silently swallowed the rest. Two real cases, both of which end in the user staring
+ * at a sentence that promises a list and then shows nothing:
+ *
+ *   "Multiple projects match this repo — pass --project:"   ...and then no projects.
+ *   "You already have 5 working copies..."                  ...and then no folders to go and look in.
+ *
+ * Nothing was broken in either feature. The text existed, was correct, and never reached the screen.
+ */
+
+/**
+ * Print `err` the way the CLI always has, plus the lines that were being lost.
+ *
+ * The first line still comes from the stack, so an error's real class name survives (a TypeError says
+ * TypeError, not Error). Subsequent lines come from the MESSAGE, never the stack, because a stack trace
+ * is noise to somebody running a CLI and this repo deliberately does not print them.
+ *
+ * A single-line message prints exactly as it did before, byte for byte.
+ *
+ * @param {*} err the thrown value; need not be an Error
+ * @param {(...args: any[]) => void} write where to send each line (console.error by default)
+ */
+function printError(err, write = console.error) {
+  // With a stack, its first line already carries the class name and the message's first line, so only
+  // the REMAINING message lines are added. Without one — anything thrown that is not an Error — there
+  // is no such line, so the whole message is printed rather than silently starting at line two.
+  const hasStack = Boolean(err && err.stack);
+  const first = hasStack ? String(err.stack).split("\n")[0] : String(err);
+  write(first);
+  // Only lines the FIRST line did not already carry. With a stack that is everything after line one.
+  // Without one, String(err) may already be the whole message (an Error whose stack was stripped
+  // stringifies to "Error: <the lot>"), so printing from line one again said it all twice.
+  const messageLines = err && typeof err.message === "string" ? err.message.split("\n") : [];
+  const rest = hasStack ? messageLines.slice(1) : messageLines.filter((l) => !first.includes(l));
+  for (const line of rest) write(line);
+  if (err && err.status) write(`    (HTTP ${err.status})`);
+}
+
+module.exports = { printError };

package/src/lib/receiptStore.js

@@ -82,4 +82,4 @@ function purge() {
   }
 }
 
-module.exports = { disabledFlagPath, isDisabled, setDisabled, purge };
+module.exports = { niroHome, disabledFlagPath, isDisabled, setDisabled, purge };

package/src/lib/takeoverRestore.js

@@ -0,0 +1,156 @@
+/**
+ * Undoing a takeover locally: point a folder's registration back at the source project.
+ *
+ * This is the LOCAL half of discarding a temporary project. The server half (deleting the copy) is
+ * `niro discard-temp-project`; the sweep that finds copies already gone from the server is
+ * `niro cleanup-temp-projects`. Both end in exactly this loop, so it lives here rather than in
+ * either command. Copying it would be the worst option available: the two comments below record
+ * incidents that cost silent data loss, and a second copy is a second place for that reasoning to
+ * rot out of step with the first.
+ *
+ * It never contacts the server and it never deletes a registration. A folder whose temporary project
+ * is gone still needs to be synced to SOMETHING, so it is moved back to the source project rather
+ * than unregistered.
+ */
+const fs = require("fs");
+const path = require("path");
+
+const niroProjectFile = require("./niroProjectFile");
+const watchState = require("./watchState");
+
+/**
+ * Order a group so that folders carrying a takeover backup are written LAST.
+ *
+ * The backup is the only thing on this machine that says "this project id is a temporary project".
+ * Restoring a folder spends its backup, so if the one folder holding the group's backup is written
+ * first and the run then stops (Ctrl-C, a closed lid, a full disk), the rest of the group becomes
+ * invisible: `niro cleanup-temp-projects` no longer recognises the id as a temporary project and
+ * reports "nothing to clean up", while `niro discard-temp-project` refuses because no folder records
+ * what the copy was made from. The only repair left is editing the JSON by hand.
+ *
+ * Writing the witnesses last means an interrupted run always leaves at least one behind, so the next
+ * run finds the group and finishes the job. Order within each half is untouched.
+ */
+function witnessesLast(folders) {
+  const withoutBackup = folders.filter((e) => !(e.takeover && e.takeover.sourceProjectId));
+  const withBackup = folders.filter((e) => e.takeover && e.takeover.sourceProjectId);
+  return [...withoutBackup, ...withBackup];
+}
+
+/**
+ * Move every folder in `folders` off `tempProjectId` and back onto its source project.
+ *
+ * @param {Array<object>} folders  watchState entries (each with `folderPath`), all registered
+ *                                 against the same temporary project.
+ * @param {object}  opts
+ * @param {string}  opts.tempProjectId  the temporary project being undone.
+ * @param {string}  opts.cloneOf        the source project id, used for any folder whose own
+ *                                      takeover backup does not name one.
+ * @param {string}  opts.baseUrl        backend to tag an entry with when it carries no apiUrl.
+ * @param {boolean} opts.healPins       write/delete an old-style swapped `.niro-project`. TRUE for
+ *                                      an interactive discard, FALSE for the unattended sweep — it
+ *                                      touches a git-tracked file in the developer's repo.
+ * @returns {{ repinned: string[], healed: Array<{folder: string, to: string}>,
+ *             failed: Array<{folder: string, error: string}>,
+ *             skipped: Array<{folder: string, nowGitId: string|null}>,
+ *             untracked: string[] }}
+ */
+function restoreFolders(folders, { tempProjectId, cloneOf, baseUrl, healPins = true } = {}) {
+  // ADR-018: the .niro-project file is left ALONE unless it still carries the OLD-STYLE swapped pin
+  // (pre-ADR-018 takeover) — then it points at a now-deleted project and must be healed: previousPin
+  // verbatim when recorded; explicit "no pin existed" → delete the file; otherwise the source project
+  // id. New-style folders (pin untouched) skip all of this.
+  const repinned = [];
+  const healed = [];
+  const failed = [];
+  const skipped = [];
+  const untracked = [];
+  for (const e of witnessesLast(folders)) {
+    try {
+      const backup = e.takeover || {};
+      const sourceProjectId = backup.sourceProjectId || cloneOf;
+      const entryDir = path.resolve(e.folderPath);
+
+      // Compare-and-write, exactly as watchState.remove does its compare-and-delete, and for the
+      // reason its own comment gives: a folder can be re-pointed by ANOTHER PROCESS between the read
+      // that produced `e` and this write. The sweep makes that window wide, because it reads the whole
+      // registry once and then does a server round-trip per temporary project before writing anything.
+      //
+      // What it costs to get wrong is not a stale row. A `niro new-temp-project` landing mid-sweep
+      // would be overwritten: its brand new copy is then named by no entry at all, so discard cannot
+      // find it and a later sweep cannot see it, AND the folder is left pointing at the SHARED source
+      // project's repo with an empty baseline — so the next daemon pass uploads the private
+      // feature-branch tree into the project the whole team reads.
+      //
+      // A missing entry is deliberately NOT a mismatch. `niro discard-temp-project --project <id>` can
+      // be run in a folder that has no registration yet, and creating one there is existing, intended
+      // behaviour. Only a DIFFERENT gitId means somebody re-pointed this folder under us.
+      const current = watchState.peek(e.folderPath);
+      if (current && current.gitId !== e.gitId) {
+        skipped.push({ folder: e.folderPath, nowGitId: current.gitId || null });
+        continue;
+      }
+
+      // healPins is FALSE for the unattended sweep, and that is the whole point of the option. This
+      // block writes and DELETES `.niro-project`, a file tracked in the developer's git repository. It
+      // is right for `niro discard-temp-project`, which a person just ran in that folder; it is not
+      // something a six-hourly background job should do. A fourth review found the sweep reaching it —
+      // through this module — while a test and four documents claimed pins were never touched.
+      if (healPins && fs.existsSync(entryDir)) {
+        const pin = niroProjectFile.read(entryDir);
+        const pinIsSwapped = pin && pin.id === tempProjectId
+            && path.dirname(pin.source) === entryDir; // only heal THIS folder's own pin, never a parent's
+        if (pinIsSwapped) {
+          const recordedNoPin = ("previousPin" in backup) && backup.previousPin === null;
+          if (backup.previousPin) {
+            niroProjectFile.write(entryDir, backup.previousPin, { overwrite: true });
+            healed.push({ folder: e.folderPath, to: backup.previousPin });
+          } else if (recordedNoPin) {
+            niroProjectFile.remove(entryDir);
+            healed.push({ folder: e.folderPath, to: "(no pin — removed)" });
+          } else {
+            niroProjectFile.write(entryDir, sourceProjectId, { overwrite: true });
+            healed.push({ folder: e.folderPath, to: sourceProjectId });
+          }
+        }
+      }
+
+      // Watch/daemon registration goes back to the source project regardless of pin style.
+      watchState.set(e.folderPath, {
+        ...e,
+        gitId: backup.previousGitId || null,
+        projectId: sourceProjectId,
+        // The baseline describes what the TEMPORARY project holds, so it MUST NOT survive the move
+        // back to the source repo. Carrying it across told the daemon the source already had every
+        // file at its sandbox-era fingerprint — which it did not, because those edits only ever went
+        // to the temporary copy. The next pass then compared disk against that baseline, found no
+        // difference, and uploaded nothing. Every edit made during the temporary project was silently
+        // lost to the source project, with no error and nothing to prompt a re-sync.
+        //
+        // Clearing it makes the next pass treat every file as new and upload it. That is a full
+        // re-upload once, which is the cost of being sure: the client cannot know which files the
+        // source repo is missing, so the only safe assumption is all of them.
+        //
+        // The opposite direction already gets this right — takeover.js seeds fileHashes with what it
+        // actually uploaded to the new gitId. A baseline belongs to ONE gitId; when that changes, so
+        // must it.
+        fileHashes: {},
+        lastSyncedAt: null,
+        takeover: undefined,
+      }, e.apiUrl || baseUrl);
+      repinned.push(e.folderPath);
+      // No repo id to go back to means this folder had no local registration BEFORE it was taken over
+      // (takeover.js records `previousGitId: existing ? existing.gitId : null`). Restoring null is
+      // therefore correct — it is the state the folder was in before — but the entry is now inert:
+      // watchState.allLocal filters on gitId, so the daemon stops listing it. Callers report these
+      // separately rather than counting them as "repaired and syncing", because the honest sentence is
+      // "back where it was, and not locally tracked", not "fixed".
+      if (!backup.previousGitId) untracked.push(e.folderPath);
+    } catch (err) {
+      failed.push({ folder: e.folderPath, error: err.message });
+    }
+  }
+  return { repinned, healed, failed, skipped, untracked };
+}
+
+module.exports = { restoreFolders, witnessesLast };

package/src/mcp/server.js

@@ -52,6 +52,12 @@ function niroProjectsFilePath() {
   return path.join(home, ".niro", "projects.json");
 }
 const { createPendingTracker, isTrackableRequest, resolveTimeoutMs } = require("../lib/pendingRequests");
+const { createImpactRecorder } = require("../lib/impactLog");
+
+// Evidence for the Edit|Write impact gate (docs/usecases/impact-gate.md): which impact tools this
+// session called, and that the server is answering. Keyed by this process's working directory, which
+// is the session folder the hook sees as `cwd` (checked on 8 live bridges, 2026-09-04).
+const impact = createImpactRecorder({ cwd: process.cwd() });
 
 /**
  * This package's version, sent as X-Niro-Cli-Version so the server can tell an out-of-date install to
@@ -150,17 +156,26 @@ function resolveProjectIdFromNiroProjects() {
 }
 
 /**
- * Step 3: Detect the git remote URL and current branch for server-side project resolution.
- * Used when no project_id could be resolved locally. The server matches the remote URL
- * against stored project git mappings.
- * Returns { remote, branch } or null if not in a git repo or git is unavailable.
+ * Step 3: Detect the current git branch, HEAD and dirty state — plus the origin remote when there is
+ * one — for the freshness/takeover notices, server-side project resolution, and per-branch temp routing.
+ * The gate is HEAD (is this a git repo with a commit?), NOT origin: a local repo with commits but no
+ * origin remote (a `local://` niro project, or a repo not yet pushed) still has a branch that drives
+ * routing, so its git state must be reported with a null remote rather than dropped entirely.
+ * Returns { remote (nullable), branch, commit, dirty } or null if not a git repo / no commit / git unavailable.
  */
 function detectGitContext(dir) {
   try {
     const opts = { encoding: "utf8", timeout: 3000, stdio: ["ignore", "pipe", "ignore"] };
     if (dir) opts.cwd = dir;
-    const remote = execSync("git remote get-url origin 2>/dev/null", opts).trim();
-    if (!remote) return null;
+    // HEAD first: this is the "real git repo with a commit?" test. The old `if (!remote) return null`
+    // bailed on a MISSING ORIGIN and so discarded the branch + commit of every no-origin repo — those
+    // repos then sent no _niroGit and never routed to their temp project. The owned-temp match needs
+    // only the branch, not the remote, so keep going and let the remote be null.
+    let commit = null;
+    try { commit = execSync("git rev-parse HEAD 2>/dev/null", opts).trim(); } catch (_) {}
+    if (!commit) return null; // not a git repo, or a repo with no commit yet — nothing to report
+    let remote = null;
+    try { remote = execSync("git remote get-url origin 2>/dev/null", opts).trim() || null; } catch (_) {}
     // normalizeBranch, not a bare trim: on a detached HEAD this command PRINTS "HEAD" instead of
     // failing, and sending that verbatim told the server the checkout was on a branch called "HEAD".
     // Nothing indexes such a branch, so the routing ladder read every bisect / tag checkout as
@@ -168,10 +183,6 @@ function detectGitContext(dir) {
     // a null branch. `git.inspect` has always collapsed "HEAD" to null; this shares that one rule.
     let branch = null;
     try { branch = normalizeBranch(execSync("git rev-parse --abbrev-ref HEAD 2>/dev/null", opts)); } catch (_) {}
-    // The freshness/takeover notices compare the local HEAD + dirty state against what Niro indexed, so
-    // the bridge must report them — without git_commit the server-side check no-ops entirely.
-    let commit = null;
-    try { commit = execSync("git rev-parse HEAD 2>/dev/null", opts).trim(); } catch (_) {}
     let dirty = false;
     try { dirty = execSync("git status --porcelain 2>/dev/null", opts).trim().length > 0; } catch (_) {}
     return { remote, branch, commit, dirty };
@@ -535,6 +546,8 @@ function connectSse() {
               } else {
                 // Cancel the client-side deadline when a delivered result matches an in-flight request.
                 pending.onIncoming(msg);
+                impact.noteResult(msg);
+                impact.touchAlive();
                 rewritten = captureReceipt(msg);
               }
             } catch (_) { /* not correlatable JSON — forward unchanged */ }
@@ -827,6 +840,7 @@ async function main() {
     // Remember the host's initialize so we can replay it verbatim to re-authenticate a fresh
     // session after a transparent reconnect.
     if (message.method === "initialize") initializeRaw = line;
+    impact.noteRequest(message);
 
     // Arm the deadline for a real request before sending; a delivered result (or the
     // send-failure path below) cancels it.
@@ -836,6 +850,9 @@ async function main() {
       await sendMessage(message);
     } catch (err) {
       process.stderr.write(`[niro-mcp] Failed to send message: ${err.message}\n`);
+      // The attempt still counts for the impact gate: a server that cannot be reached must not leave
+      // the file locked until the alive marker ages out (review finding, 2026-09-05).
+      impact.noteResult({ jsonrpc: "2.0", id: message.id, error: { code: -32001, message: err.message } });
       // The POST never reached the server, so no result will arrive: fail this request fast
       // instead of waiting out the deadline.
       if (trackable) {
@@ -852,6 +869,9 @@ async function main() {
   rl.on("close", () => {
     process.exit(0);
   });
+  // A bridge that is gone must not keep the impact gate denying edits for up to 30 minutes on the
+  // strength of a stale alive marker. A hard kill still leaves it; the hook ages it out.
+  process.on("exit", () => impact.clearAlive());
 }
 
 main();