@niroai/niro 0.13.0 → 0.15.0

package/CHANGELOG.md

@@ -4,6 +4,115 @@ Notable changes to `@niroai/niro`. Dates are release dates.
 
 ## Unreleased
 
+## 0.15.0 — 2026-09-21
+
+### Twenty more file types are offered for upload
+
+`niro init` and the folder sync decide which files to offer the server from a fixed list of
+extensions (`src/lib/folderSync.js`). That list was a hand-kept copy of the server's own list and
+had fallen behind it in two places:
+
+- the ten C++ extensions the parser routes to its C++ grammar besides `.cpp`, `.h` and `.hpp`:
+  `.cc`, `.cxx`, `.hxx`, `.hh`, `.h++`, `.c++`, `.tcc`, `.ipp`, `.inl`, `.tpp`. A C++ project with
+  `include/widget.hxx` and `detail/vector.tcc` never had those two files in its graph, because the
+  CLI never offered them.
+- ten more the parser has always understood but the CLI never offered: `.kts`, `.csx`, `.rake`,
+  `.gemspec`, `.phtml`, `.php3`, `.php4`, `.php5`, `.pyi`, `.pyw`.
+
+A test now reads the server's Java list and fails if the two drift apart again
+(`test/sourceExtensionDrift.test.js`); the server carries the mirror-image test.
+
+The server's own filter remains the final say, so an older CLI simply offers fewer files and a
+newer CLI against an older server has its extra offers declined. Either order of upgrade is safe;
+the new files reach the graph once both sides are current (ai-orchestrator `cadb5360` or later).
+
+Note: 0.14.0 was cut in this repository but never published to npm, so upgrading from 0.13.0 brings
+the 0.14.0 change below as well.
+
+### A file whose name contains `+` no longer stops a folder syncing
+
+After `niro init`, the server replies with the patterns saying which paths belong to the
+project, and the watch daemon checks every path against them: on each file event, on each
+delta and backstop pass, and once more before it asks the server to delete anything.
+
+For a file at the top level of a repository, the pattern the server sends is the filename
+itself. The daemon turned patterns into regular expressions but escaped only the dot, so a
+name carrying a character that means something in a regular expression was read as an
+instruction rather than as a name. With `main.c++` at a repository root, `main.c++` became
+`/^main\.c++$/`, which is not a valid expression. Every sync pass for that folder then failed.
+The daemon stayed up and printed nothing, so the folder simply went quiet.
+
+The `.c++` and `.h++` file types added in this same release are what would have exposed it. The
+same flaw had a quieter form that needed no C++ at all: a root-level file called `app (copy).js`
+built a valid expression with a capture group, so the file stopped matching its own pattern and
+was never synced again. A directory named `libstdc++` hit the throwing form, because saying yes
+to "New directory detected. Add to sync?" stores the directory's own name as a pattern.
+
+The matcher now escapes every character that has a special meaning, leaving only `*` and `**`
+as wildcards, so a pattern can no longer fail to compile. Behaviour for patterns that already
+worked is unchanged: old and new were compared over 10,701 path-and-pattern pairs taken from
+three real repositories and agreed on every one.
+
+## 0.14.0 — 2026-09-19
+
+### `niro init` on a folder of repos now indexes each repo, not the folder
+
+If you run `niro init` in a folder that is not itself a git repository but contains repositories —
+an `apps/` folder, a `~/projects/github/<org>/` folder, anything that groups checkouts — each
+repository is now onboarded in its own right, with its own git URL and its own branch, into one
+project.
+
+Before this, the folder itself was registered as a single repo. A folder has no git remote, so it
+got a synthetic `local://<folder-name>` URL and no branch at all, and the monorepo splitter then
+tried to recover the structure by reading folder layout. On one customer's tree that produced 92
+internal repos from 14 real ones: 92 of 92 carried `local://apps`, none had a branch, 58 of them
+were vendored copies and reference checkouts of other people's projects, and 45% of the indexing
+spend went on code the customer had never written. Because no repo had a URL of its own, MCP could
+not match a repo from inside its own folder, and kept offering to create a temporary project in
+code that was already indexed.
+
+The repositories underneath were the boundaries the customer had already declared. Reading them is
+better than re-deriving them.
+
+What you will see:
+
+```
+    apps is not a git repository, but contains 14 that are.
+    Niro will index each repo separately, with its own git URL and branch.
+
+        + voibe-backend
+        + voibe_app
+        - legal-docs — not a git repository, NOT indexed
+```
+
+Folders holding code but no repository are reported rather than skipped in silence: from that point
+on, editing a file in one of them does nothing, and you should know which ones they are. Run
+`niro init` inside one to add it.
+
+The scan stops at the first repository it finds down any path, so a repository vendored inside
+another — a submodule, a `third_party/` checkout — is indexed as part of its parent rather than as a
+service of its own.
+
+Unchanged: a folder that IS a git repository still indexes whole, submodules and all. A folder with
+no git anywhere still uploads as one repo, as before.
+
+### A folder whose repositories sit deeper than one level is no longer refused
+
+`niro init` requires a build file at the folder or just below it, which is right for a folder of
+documents and wrong for `~/projects/github/<org>/<repo>`, where the repositories are three levels
+down and every folder above them is empty. That was refused with "No project found" and a pointer to
+`--force`, and `--force` would then upload the entire tree as one repo. A folder holding
+repositories is now exempt from that rule, because it has already declared its projects.
+
+The refusal message for a folder that genuinely holds nothing indexable now says what Niro looks
+for, and suggests running from the folder where the code actually is.
+
+### Fixed
+
+- The background watcher was being installed once per repository when onboarding several at once,
+  asking for your password each time. It is one process; it is now set up once per run.
+
+
 ## 0.13.0 — 2026-09-08
 
 ### Upgrading

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@niroai/niro",
-  "version": "0.13.0",
-  "description": "Niro — one package: the niro CLI plus the Niro MCP server (code intelligence for AI coding assistants).",
+  "version": "0.15.0",
+  "description": "Niro \u2014 one package: the niro CLI plus the Niro MCP server (code intelligence for AI coding assistants).",
   "keywords": [
     "niro",
     "mcp",

package/src/commands/init.js

@@ -41,7 +41,7 @@ const color = require("../lib/color");
 const watchDaemon = require("../lib/watchDaemon");
 const { login } = require("./login");
 const { watchStatus } = require("./build");
-const { currentIndent } = require("../lib/nestedOutput");
+const { currentIndent, withIndent } = require("../lib/nestedOutput");
 
 /** Depth as spaces, for the \r-written lines that bypass withIndent's console wrappers. */
 function nestPad() {
@@ -99,9 +99,24 @@ async function init(pathArg, opts = {}) {
   // repo for must not start failing its re-run just because it has no build file.
   // See src/lib/onboardTarget.js.
   const knownEntry = watchState.get(targetDir, apiUrlBeforeLogin);
+  // A FOLDER THAT HOLDS GIT REPOS ALREADY DECLARES ITS PROJECTS, just not with a build file.
+  //
+  // The descriptor rule looks for package.json / pom.xml / go.mod in this folder or just below it,
+  // and refuses when it finds none. That is right for a folder of holiday photos. It is wrong for
+  // ~/projects/github/<org>/<repo>, where the repos are three levels down and the folders above them
+  // hold nothing at all: the scan found no descriptor, the user was told "No project found" and
+  // pointed at --force, and --force would then upload the whole tree as ONE repo — the exact outcome
+  // this release exists to prevent. The comment on CHILD_SCAN_MAX_DEPTH calls that layout the
+  // commonest one on disk. Reproduced on a demo tree on 2026-09-19 before this line existed.
+  //
+  // Cheap because it stops at the first repo it sees, and only runs when the descriptor scan already
+  // came back empty. Every other refusal in ensureOnboardable (home directory, filesystem root) still
+  // applies: this exempts the descriptor rule alone.
+  const holdsGitRepos = () => collectNestedGitRepos(targetDir).repos.length > 0;
   if (!onboardTarget.ensureOnboardable(targetDir, {
     ...opts,
     alreadyRegistered: !!(knownEntry && knownEntry.gitId),
+    hasGitReposBeneath: holdsGitRepos,
   })) {
     process.exitCode = 1;
     return;
@@ -244,6 +259,25 @@ async function init(pathArg, opts = {}) {
   // onboarded, so resolve each immediate git-repo child against the server too — this
   // catches children indexed via the web UI / as separate repos.
   const childScan = await scanIndexedChildren(targetDir, opts);
+
+  // THE FOLDER IS NOT A REPO BUT CONTAINS SOME: onboard each of them, not the folder.
+  //
+  // `git.inspect` walks UPWARDS, so repoRoot can be an ANCESTOR of targetDir. "This folder is a
+  // repo" therefore has to compare paths, not just test for a truthy repoRoot.
+  //
+  // Why this exists. Onboarding the parent registers ONE repo, and a folder with no git remote gets
+  // the synthetic `local://<name>` URL from step 4. Measured on a customer's tree on 2026-09-18:
+  // `niro init` in an `apps/` folder holding 14 real repos produced 92 internal repos, every one of
+  // them carrying `local://apps` and a null branch — so no repo had its own identity, none could be
+  // matched by MCP from its own folder (it kept offering to create a temp project inside indexed
+  // code), and nothing could track a per-repo branch. The repos beneath were the customer's own
+  // declared boundaries; the split was re-deriving them, badly, from folder structure.
+  const targetIsRepoRoot = !!gitInfo.repoRoot
+    && path.resolve(gitInfo.repoRoot) === path.resolve(targetDir);
+  if (!targetIsRepoRoot && childScan.all.length) {
+    return onboardDiscoveredRepos({ targetDir, defaultName, childScan, opts });
+  }
+
   if (childScan.indexed.length) {
     console.error(fail(`\n    This folder contains ${childScan.indexed.length} repo(s) already indexed in Niro:`));
     for (const c of childScan.indexed) {
@@ -642,7 +676,14 @@ async function init(pathArg, opts = {}) {
   }
 
   // --defaults promised "no prompts": never surface the PM2 install offer there.
-  const daemon = await watchDaemon.ensureWatchDaemon({ skipPrompts: !!opts.defaults });
+  // INSTALLED ONCE PER RUN, not once per repo. The daemon is a single global PM2 process that reads
+  // ~/.niro/projects.json, so a second install is a no-op that still shells out to `pm2 startup`,
+  // which asks for sudo. Onboarding a folder of 6 repos asked six times and printed six identical
+  // sudo failures (seen on the demo tree, 2026-09-18); the caller that onboards several repos
+  // installs it itself, after the last one.
+  const daemon = opts.skipDaemonSetup
+    ? { ok: true }
+    : await watchDaemon.ensureWatchDaemon({ skipPrompts: !!opts.defaults });
 
   // The closing banner must not read as an all-clear when auto-sync is dead —
   // customers were only discovering the missing daemon after a reboot.
@@ -694,6 +735,135 @@ const CHILD_SCAN_MAX = 60;       // bound the number of nested repos we resolve
 // single repo and 50 for this monorepo, versus 5 and 13 at depth 2.
 const CHILD_SCAN_MAX_DEPTH = 4;
 
+/**
+ * Onboard every git repo found beneath a folder that is not itself a repo, into ONE project.
+ *
+ * <b>Why one project and not one per repo.</b> Cross-service answers — who calls this endpoint, what
+ * breaks if I change this, trace this request across services — resolve by unioning the repos of a
+ * PROJECT. Fourteen projects would give fourteen islands and lose the thing the customer is paying
+ * for. So: one project, N repos, each carrying its own origin URL and its own HEAD branch.
+ *
+ * <b>Why each repo goes through init() again rather than a bespoke path.</b> Registering a repo is
+ * not one call: it dedupes against the same repo in this and other projects, reuses a gitId rather
+ * than re-uploading, filters the manifest, pushes include/exclude patterns, scans env vars and writes
+ * the per-folder watch entry. `start.js` already re-enters init this way with `nested: true`. A second
+ * implementation of that would drift from this one within a release.
+ *
+ * Folders holding code but no repo are REPORTED, never silently skipped: from this point on, editing
+ * a file in one of them does nothing at all, and the user has to have been told once. Silently
+ * dropping code is the failure ADR-023 was written against.
+ */
+async function onboardDiscoveredRepos({ targetDir, defaultName, childScan, opts },
+    runInit = init, readEntry = watchState.peek) {
+  const already = childScan.indexed;
+  const fresh = childScan.all.filter(
+    (r) => !already.some((c) => path.resolve(c.path) === path.resolve(r))
+  );
+  const codeFoldersWithoutRepo = nonRepoCodeFolders(targetDir, childScan.all);
+
+  console.log(`\n    ${ok(`${path.basename(targetDir)} is not a git repository, but contains ${childScan.all.length} that are.`)}`);
+  console.log(`    Niro will index each repo separately, with its own git URL and branch.\n`);
+  for (const r of fresh) console.log(`        ${ok("+")} ${path.relative(targetDir, r) || path.basename(r)}`);
+
+  // Already indexed elsewhere: SKIPPED, not a reason to refuse the rest.
+  //
+  // The whole-run refusal further down exists because onboarding the PARENT would upload that child's
+  // content a second time. Here the parent is never uploaded, so that reasoning does not apply, and
+  // refusing thirteen new repos because the fourteenth is known would be the wrong answer.
+  for (const c of already) {
+    const where = c.projects.map((x) => `"${x.alias || x.project_id}"`).join(", ");
+    console.log(`        ${warn("-")} ${path.relative(targetDir, c.path)} — already indexed in ${where}, skipping`);
+  }
+  for (const f of codeFoldersWithoutRepo) {
+    console.log(`        ${warn("-")} ${path.relative(targetDir, f)} — not a git repository, NOT indexed`);
+  }
+  if (childScan.unverified.length) {
+    console.log(`        ${warn("?")} ${childScan.unverified.length} repo(s) could not be checked against the server; they will be onboarded.`);
+  }
+  if (childScan.truncated) {
+    console.log(color.dim(`        (Stopped after the first ${CHILD_SCAN_MAX} repos; deeper ones were not scanned.)`));
+  }
+
+  if (!fresh.length) {
+    console.log(`\n    ${warn("Nothing new to index.")} Every repo here is already in Niro.`);
+    return;
+  }
+  if (codeFoldersWithoutRepo.length) {
+    console.log(color.dim(`\n    Folders marked NOT indexed will not sync. Run \`niro init\` inside one to add it.`));
+  }
+
+  if (!opts.defaults && !opts.force && !prompt.isNonInteractive()) {
+    if (!(await prompt.confirm(`\n    Index these ${fresh.length} repo(s)?`, true))) return;
+  }
+
+  // The FIRST repo creates the project; the rest attach to whatever it created. Hoisting project
+  // creation out of init() instead would mean duplicating the new-vs-existing resolution, the name
+  // availability check and the alias-to-project_id reassignment that init already does.
+  let projectRef = opts.addTo || null;
+  let onboarded = 0;
+  for (const repoPath of fresh) {
+    const name = path.relative(targetDir, repoPath) || path.basename(repoPath);
+    console.log(`\n    ${ok("▸")} ${name}`);
+    const childOpts = {
+      ...opts,
+      nested: true,
+      // One build for the project at the end, not one per repo.
+      confirmBuild: "no",
+      // ...and one watch-daemon install for the run, done below once every repo is in.
+      skipDaemonSetup: true,
+      // The project name is the FOLDER's, not the first repo's — `apps` reads better than whichever
+      // repo happened to sort first.
+      projectName: projectRef ? undefined : (opts.projectName || defaultName),
+      addTo: projectRef || undefined,
+    };
+    try {
+      await withIndent(4, () => runInit(repoPath, childOpts));
+    } catch (err) {
+      console.error(fail(`        Could not onboard ${name}: ${err.message}`));
+      continue;
+    }
+    const entry = readEntry(repoPath);
+    if (entry && entry.projectId) {
+      onboarded += 1;
+      if (!projectRef) projectRef = entry.projectId;
+    }
+  }
+
+  if (!projectRef || !onboarded) {
+    console.error(fail(`\n    No repo could be onboarded; nothing was created.`));
+    process.exitCode = 1;
+    return;
+  }
+  const daemon = await watchDaemon.ensureWatchDaemon({ skipPrompts: !!opts.defaults });
+  if (!daemon.ok) {
+    console.log(`\n    ${warn("auto-sync is OFF")} — these folders will not stay in sync (see above).`);
+  }
+  console.log(`\n    ${ok(`${onboarded} repo(s) indexed into project "${projectRef}".`)}`);
+  console.log(`    ${color.cyan(`niro build`)} to index them, or ${color.cyan("niro status")} to review first.`);
+}
+
+/**
+ * Immediate subfolders that hold files but are neither a git repo nor on the way to one.
+ *
+ * A grouping folder like `services/` that CONTAINS repos is not "skipped code" — its repos are being
+ * onboarded. Only a folder with no repo anywhere beneath it is genuinely being left out.
+ */
+function nonRepoCodeFolders(targetDir, discoveredRepos) {
+  const out = [];
+  let entries;
+  try { entries = fs.readdirSync(targetDir, { withFileTypes: true }); } catch { return out; }
+  for (const e of entries) {
+    if (!e.isDirectory() || e.name.startsWith(".") || CHILD_SCAN_SKIP.has(e.name)) continue;
+    const dir = path.join(targetDir, e.name);
+    const leadsToARepo = discoveredRepos.some((r) => {
+      const rel = path.relative(dir, r);
+      return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+    });
+    if (!leadsToARepo) out.push(dir);
+  }
+  return out;
+}
+
 /**
  * Collect directories under `root` that are their OWN git repo (have a `.git` entry),
  * scanning immediate children AND one level of NON-git grouping dirs (so `services/foo`,
@@ -741,7 +911,9 @@ function collectNestedGitRepos(root) {
  */
 async function scanIndexedChildren(targetDir, opts, resolve = resolveContext) {
   const { repos: gitChildren, truncated } = collectNestedGitRepos(targetDir);
-  if (!gitChildren.length) return { indexed: [], unverified: [], truncated };
+  // `all` is every git repo found beneath targetDir, indexed or not. The refusal below only ever
+  // needed the indexed ones; onboarding them (onboardDiscoveredRepos) needs the whole list.
+  if (!gitChildren.length) return { indexed: [], unverified: [], truncated, all: [] };
 
   const indexed = [];
   const unverified = [];
@@ -767,7 +939,7 @@ async function scanIndexedChildren(targetDir, opts, resolve = resolveContext) {
       else unverified.push(r);
     }
   }
-  return { indexed, unverified, truncated };
+  return { indexed, unverified, truncated, all: gitChildren };
 }
 
 /**
@@ -1226,4 +1398,6 @@ function logicalCwd() {
   return process.cwd();
 }
 
-module.exports = { init, parseOnOff, parseYesNo, parseQuietPeriod, promptEnvVars, promptActivePropertyFiles, scanIndexedChildren };
+module.exports = {
+  onboardDiscoveredRepos,
+  nonRepoCodeFolders, init, parseOnOff, parseYesNo, parseQuietPeriod, promptEnvVars, promptActivePropertyFiles, scanIndexedChildren };

package/src/commands/watch.js

@@ -878,13 +878,42 @@ function matchesPatterns(relativePath, includePatterns, excludePatterns) {
   return !excludePatterns.some(p => minimatch(relativePath, p));
 }
 
-/** Simple glob matching without a dependency: handles ** and * patterns. */
+// Every character that is special inside a regular expression EXCEPT `*`, which is the
+// only wildcard this glob syntax has. Escaping `.` alone was the defect, because a pattern
+// is not ours to choose: the server names a ROOT-LEVEL file by its own filename
+// (ai-orchestrator SourceFileFilterService.derivePatterns, the `else` branch) and the new
+// directory prompt above names a directory by its own path, so a real name reaches this
+// function verbatim. `main.c++` at a repo root became /^main\.c++$/, "Nothing to repeat",
+// and that throw killed EVERY sync pass for the folder: the file event gate, the delta and
+// backstop walk, and the rescue check that runs before a delete. The quieter half of the
+// same defect never threw at all: `app (copy).js` built a valid regex with a capture group,
+// so the file silently stopped matching its own pattern and was never synced again.
+// No /g flag: `test` on a global regex advances lastIndex between calls.
+const REGEX_SPECIAL_CHARS = /[.+?^${}()|[\]\\]/;
+
+/**
+ * Simple glob matching without a dependency: handles ** and * patterns.
+ *
+ * One pass over the pattern, so every character that is not a wildcard is escaped as a
+ * literal and the result is always a valid regular expression. The previous version
+ * escaped `.` and then routed `**` through a `§§` placeholder, which also corrupted any
+ * pattern that genuinely contained `§§`.
+ */
 function minimatch(filePath, pattern) {
-  const regexStr = pattern
-    .replace(/\./g, "\\.")
-    .replace(/\*\*/g, "§§")    // temp placeholder
-    .replace(/\*/g, "[^/]*")
-    .replace(/§§/g, ".*");
+  let regexStr = "";
+  for (let i = 0; i < pattern.length; i++) {
+    const ch = pattern[i];
+    if (ch === "*") {
+      if (pattern[i + 1] === "*") {
+        regexStr += ".*"; // ** crosses directory separators
+        i++;
+      } else {
+        regexStr += "[^/]*"; // * stays inside one path segment
+      }
+      continue;
+    }
+    regexStr += REGEX_SPECIAL_CHARS.test(ch) ? "\\" + ch : ch;
+  }
   return new RegExp("^" + regexStr + "$").test(filePath);
 }
 
@@ -944,8 +973,11 @@ function buildMinimalManifest(rootDir, includePatterns, excludePatterns) {
 }
 
 // handleFileEvent + deltaSyncOnResume are exported for unit testing the
-// gitignore/fail-closed guards without a live server or fs.watch loop.
+// gitignore/fail-closed guards without a live server or fs.watch loop. matchesPatterns is
+// exported for the same reason: it is the gate all three sync paths share, and a pattern that
+// cannot be compiled stops every one of them, so it is worth testing on its own.
 module.exports = { watch, startWatch, startPeriodicSweep, handleFileEvent, deltaSyncOnResume, handleEntryFailure,
+  matchesPatterns,
   queueDelete, flushPendingDeletes, pendingDeletes, DELETE_SETTLE_MS, backstopTick, notHolding,
   unreadableRoots,
   nextBackoffMs, shouldAttemptBackstop, recordBackstopFailure, recordBackstopSuccess };

package/src/lib/folderSync.js

@@ -34,11 +34,25 @@ const prompt = require("./prompt");
 const color = require("./color");
 
 const BATCH_SIZE = 50;
+// MUST stay identical to ai-orchestrator SourceFileFilterService.SOURCE_EXTENSIONS.
+// Both are hand-maintained and nothing enforced that until test/sourceExtensionDrift.test.js
+// here, which reads the Java file, and ai-orchestrator SourceExtensionDriftTest, which reads
+// THIS file. The two repositories build separately, so the guard is on both sides. The
+// server's /filter is the authoritative gate, so an extension missing here is never
+// offered and never uploaded, whatever the server would have accepted.
 const SOURCE_EXTENSIONS = new Set([
   ".java", ".py", ".go", ".js", ".ts", ".tsx", ".jsx",
   ".cjs", ".mjs", ".cts", ".mts",
   ".kt", ".scala", ".rs", ".rb", ".php", ".cs", ".swift",
   ".c", ".cpp", ".h", ".hpp", ".dart",
+  // The remaining C++ extensions ast-parser routes to its C++ grammar and CppMapper.
+  ".cc", ".cxx", ".hxx", ".hh", ".h++", ".c++", ".tcc", ".ipp", ".inl", ".tpp",
+  // Ten more the parser routes to a real mapper and that this list did not offer, so the
+  // user's Kotlin build scripts, C# scripts, Rakefiles, gemspecs, legacy PHP files and
+  // Python stubs were never uploaded. Added 2026-09-14 alongside .jsx.
+  ".kts", ".csx", ".rake", ".gemspec",
+  ".phtml", ".php3", ".php4", ".php5",
+  ".pyi", ".pyw",
 ]);
 
 // Build/config files the server's project-structure resolver needs to detect

package/src/lib/onboardTarget.js

@@ -227,16 +227,25 @@ function ensureOnboardable(targetDir, opts = {}) {
       ));
       return true;
     }
+    // A folder holding git repos declares its projects with .git rather than with a build file.
+    // Onboarding handles that case by indexing each repo separately, so refusing here would send the
+    // user to --force, which uploads the whole tree as one repo instead.
+    if (typeof opts.hasGitReposBeneath === "function" && opts.hasGitReposBeneath()) {
+      return true;
+    }
     if (opts.force) {
       console.log(color.yellow(
         `\n    ⚠ No project found in ${resolved}, but --force was passed. Onboarding it anyway.`
       ));
       return true;
     }
-    console.error(color.red(`\n    ✗ No project found in ${resolved}.`));
-    console.error("    Niro looks for a build file (package.json, pom.xml, go.mod, ...) in this");
-    console.error(`    folder or just below it${truncated ? " (the scan stopped early — the tree is very large)" : ""}. None found.`);
-    console.error("    Pass --force if you really mean to upload this folder.");
+    console.error(color.red(`\n    ✗ Nothing to index in ${resolved}.`));
+    console.error("    Niro indexes either a git repository, or a folder holding a build file");
+    console.error(`    (package.json, pom.xml, go.mod, ...) at it or just below it${truncated ? ", though the scan stopped early because the tree is very large" : ""}.`);
+    console.error("    This folder has neither, so there is nothing to build a graph from.");
+    console.error("");
+    console.error("    If the code you meant is deeper down, run niro init from that folder.");
+    console.error("    Pass --force to upload this folder anyway.");
     return false;
   }