@niroai/niro 0.3.0

package/src/mcp/server.js

@@ -0,0 +1,764 @@
+#!/usr/bin/env node
+
+/**
+ * Niro MCP Server — stdio-to-SSE bridge.
+ *
+ * Reads MCP JSON-RPC messages from stdin, forwards them to the
+ * Niro ai-assistant SSE transport, and writes responses to stdout.
+ *
+ * Required env vars:
+ *   NIRO_API_KEY     — Your Niro API key (from console.niroai.dev)
+ *
+ * Optional env vars:
+ *   NIRO_MCP_SERVER_URL — ai-assistant base URL the bridge connects to
+ *                         (default: https://aiassistant.niroai.dev). Falls back to
+ *                         the `mcpServerUrl` field in ~/.niro/config.json.
+ *
+ * Project detection (in priority order):
+ *   1. `.niro-project` file — walks up from process.cwd(); first non-comment line = project_id.
+ *   2. `~/.niro/projects.json` — written by the Niro desktop sync agent; path-prefix matched
+ *      against cwd. Contains projectId for synced folders.
+ *   3. Git remote URL — `git remote get-url origin` is passed to the server for remote matching
+ *      against stored project git mappings (RESOLVED / AMBIGUOUS → select_project / NONE).
+ *   If none of the above resolve a project, falls back to multi-project mode.
+ *
+ * Flags:
+ *   --setup          — Interactive setup wizard (configures Claude, Cursor, Windsurf, etc.)
+ */
+
+// Delegate to interactive setup if invoked with --setup
+if (process.argv.includes("--setup")) {
+  require("./setup");
+  // setup.js handles its own exit; prevent server startup below
+  return;
+}
+
+const fs = require("fs");
+const http = require("http");
+const https = require("https");
+const os = require("os");
+const path = require("path");
+const readline = require("readline");
+const { execSync } = require("child_process");
+const niroProjectFile = require("../lib/niroProjectFile");
+const { redactRemoteCreds } = require("../lib/git");
+
+/** Absolute path to ~/.niro/projects.json. Uses os.homedir() so it also resolves on Windows, where HOME is
+ *  normally unset — `process.env.HOME || ""` there produced a relative path that never existed, silently
+ *  no-op'ing local project resolution and the ADR-017 sibling-divergence feature. */
+function niroProjectsFilePath() {
+  const home = process.env.HOME || process.env.USERPROFILE || os.homedir() || "";
+  return path.join(home, ".niro", "projects.json");
+}
+const { createPendingTracker, isTrackableRequest, resolveTimeoutMs } = require("../lib/pendingRequests");
+
+const API_KEY = process.env.NIRO_API_KEY;
+
+/**
+ * Read the durable per-device CLI token from ~/.niro/credentials.json (written by `niro login`).
+ * This is the preferred MCP credential — it is sent as the X-Niro-Cli-Token header (never in the
+ * URL) and the server resolves the account/user from it. Returns the token or null; never logs it.
+ */
+function resolveCliToken() {
+  try {
+    const credsPath = path.join(
+      process.env.HOME || process.env.USERPROFILE || "", ".niro", "credentials.json");
+    if (!fs.existsSync(credsPath)) return null;
+    const creds = JSON.parse(fs.readFileSync(credsPath, "utf8"));
+    const token = creds && creds.cliToken;
+    return token && String(token).trim() ? String(token).trim() : null;
+  } catch (e) {
+    process.stderr.write(
+      `[niro-mcp] WARN: could not read CLI token from ~/.niro/credentials.json: ${e.message}\n`);
+    return null;
+  }
+}
+
+const CLI_TOKEN = resolveCliToken();
+
+/**
+ * Step 1: Walk up from cwd looking for a `.niro-project` file.
+ * Returns { id, source } or null. The parse (first non-comment, non-blank line)
+ * and walk-up live in ../lib/niroProjectFile so the writer and every reader share
+ * one definition — see that module's header for the drift this prevents.
+ */
+function resolveProjectIdFromWorkspace() {
+  return niroProjectFile.read(process.cwd());
+}
+
+/**
+ * Step 2: Check ~/.niro/projects.json for a path-prefix match against cwd.
+ * The file is written by the Niro desktop sync agent; keys are local directory paths.
+ * Returns { id, source } for the longest prefix match, or null.
+ */
+function resolveProjectIdFromNiroProjects() {
+  const projectsFile = niroProjectsFilePath();
+  const cwd = process.cwd();
+  try {
+    if (!fs.existsSync(projectsFile)) return null;
+    const projects = JSON.parse(fs.readFileSync(projectsFile, "utf8"));
+    let bestMatch = null;
+    let bestLen = 0;
+    for (const [dir, info] of Object.entries(projects)) {
+      // Normalise both sides to end with / for reliable prefix detection
+      const normalDir = dir.endsWith("/") ? dir : dir + "/";
+      const normalCwd = cwd.endsWith("/") ? cwd : cwd + "/";
+      if (normalCwd.startsWith(normalDir) && normalDir.length > bestLen && info && info.projectId) {
+        bestMatch = info;
+        bestLen = normalDir.length;
+      }
+    }
+    // ADR-018 (review MAJOR): for a taken-over folder this entry's projectId is the TEMP project —
+    // but the id resolved here travels as _niroPin, which is documented as a SOURCE binding. Sending
+    // the temp id would route verbatim forever (branch switches stop self-correcting). Prefer the
+    // recorded source, exactly like enumerateProjectRepos' sourceOf() does.
+    if (bestMatch) {
+      const id = (bestMatch.takeover && bestMatch.takeover.sourceProjectId) || bestMatch.projectId;
+      return { id, source: projectsFile };
+    }
+  } catch (e) {
+    process.stderr.write(`[niro-mcp] WARN: could not read ${projectsFile}: ${e.message}\n`);
+  }
+  return null;
+}
+
+/**
+ * Step 3: Detect the git remote URL and current branch for server-side project resolution.
+ * Used when no project_id could be resolved locally. The server matches the remote URL
+ * against stored project git mappings.
+ * Returns { remote, branch } or null if not in a git repo or git is unavailable.
+ */
+function detectGitContext(dir) {
+  try {
+    const opts = { encoding: "utf8", timeout: 3000, stdio: ["ignore", "pipe", "ignore"] };
+    if (dir) opts.cwd = dir;
+    const remote = execSync("git remote get-url origin 2>/dev/null", opts).trim();
+    if (!remote) return null;
+    let branch = null;
+    try { branch = execSync("git rev-parse --abbrev-ref HEAD 2>/dev/null", opts).trim(); } catch (_) {}
+    // The freshness/takeover notices compare the local HEAD + dirty state against what Niro indexed, so
+    // the bridge must report them — without git_commit the server-side check no-ops entirely.
+    let commit = null;
+    try { commit = execSync("git rev-parse HEAD 2>/dev/null", opts).trim(); } catch (_) {}
+    let dirty = false;
+    try { dirty = execSync("git status --porcelain 2>/dev/null", opts).trim().length > 0; } catch (_) {}
+    return { remote, branch, commit, dirty };
+  } catch (_) {
+    return null;
+  }
+}
+
+/**
+ * ADR-017 #1 (robust): enumerate the git state of EVERY local repo of this session's project, not just
+ * the folder the bridge started in. The server compares each against the index to detect SIBLING
+ * divergence — so a session in `demo` that also branches `math` gets nudged to sandbox `math` too,
+ * instead of relying on the agent to remember. Siblings are found via ~/.niro/projects.json, related by
+ * shared SOURCE project: a sandboxed folder's `takeover.sourceProjectId`, else its `projectId`. This is
+ * BEST-EFFORT — only ONBOARDED folders are visible (a repo cloned but never `niro init`'d is invisible),
+ * and any failure yields [] so the single-folder `_niroGit` path (below) still fires. Capped to bound
+ * per-call git work.
+ */
+function enumerateProjectRepos() {
+  try {
+    const projectsFile = niroProjectsFilePath();
+    if (!fs.existsSync(projectsFile)) return [];
+    const entries = JSON.parse(fs.readFileSync(projectsFile, "utf8"));
+    const cwd = process.cwd();
+    // The session's own entry = the longest folderPath that is a prefix of cwd.
+    let sessionEntry = null, bestLen = 0;
+    for (const [dir, info] of Object.entries(entries)) {
+      if (!info) continue;
+      const nd = dir.endsWith("/") ? dir : dir + "/";
+      const nc = cwd.endsWith("/") ? cwd : cwd + "/";
+      if (nc.startsWith(nd) && nd.length > bestLen) { sessionEntry = info; bestLen = nd.length; }
+    }
+    const sourceOf = (e) => (e && e.takeover && e.takeover.sourceProjectId) || (e && e.projectId) || null;
+    const sourceProject = sourceOf(sessionEntry) || PROJECT_ID;
+    if (!sourceProject) return [];
+    // Backend scoping: project ids are human-chosen slugs that collide across a developer's backends, so
+    // relating siblings by project id ALONE would enumerate folders tracked only against ANOTHER stack and
+    // send their git state to a server that shouldn't see them. Scope to the session entry's own backend
+    // (its recorded apiUrl); legacy untagged entries (no apiUrl) stay wildcard for backward compatibility.
+    const sessionBackend = sessionEntry && sessionEntry.apiUrl;
+    const seen = new Set();
+    const repos = [];
+    for (const [dir, info] of Object.entries(entries)) {
+      if (!info || sourceOf(info) !== sourceProject) continue;
+      if (sessionBackend && info.apiUrl && info.apiUrl !== sessionBackend) continue; // different stack — skip
+      const folder = info.folderPath || dir;
+      if (seen.has(folder) || !fs.existsSync(folder)) continue;
+      seen.add(folder);
+      const git = detectGitContext(folder);
+      if (git && git.commit) {
+        // Redact any embedded credential before sending a sibling remote to the server — same as the
+        // single-repo _niroGit path (GIT_REMOTE above). Without this a token in a sibling remote leaks.
+        repos.push({ remote: redactRemoteCreds(git.remote), branch: git.branch || null, commit: git.commit, dirty: !!git.dirty });
+      }
+      if (repos.length >= 10) break; // safety cap on per-call git work
+    }
+    return repos;
+  } catch (_) {
+    return [];
+  }
+}
+
+// Short-TTL cache over the per-call git enumeration. Every MCP tools/call runs detectGitContext (4 git
+// spawns) + enumerateProjectRepos (up to ~40 more) — bursts of calls would run ~44 synchronous execSync
+// each, blocking the bridge event loop and threatening the ≤2s MCP budget. A 2.5s TTL keyed by cwd collapses
+// a burst to one enumeration while still catching a mid-session branch switch within the window.
+const GIT_ENUM_TTL_MS = 2500;
+let _gitCacheKey = null, _gitCacheAt = 0, _gitCacheVal;
+let _reposCacheKey = null, _reposCacheAt = 0, _reposCacheVal;
+function detectGitContextCached() {
+  const key = process.cwd();
+  const now = Date.now();
+  if (_gitCacheKey === key && now - _gitCacheAt < GIT_ENUM_TTL_MS) return _gitCacheVal;
+  _gitCacheVal = detectGitContext();
+  _gitCacheKey = key; _gitCacheAt = now;
+  return _gitCacheVal;
+}
+function enumerateProjectReposCached() {
+  const key = process.cwd();
+  const now = Date.now();
+  if (_reposCacheKey === key && now - _reposCacheAt < GIT_ENUM_TTL_MS) return _reposCacheVal;
+  _reposCacheVal = enumerateProjectRepos();
+  _reposCacheKey = key; _reposCacheAt = now;
+  return _reposCacheVal;
+}
+
+// --- Project detection chain ---
+let PROJECT_ID = null;
+let PROJECT_ID_SOURCE = null;
+let GIT_REMOTE = null;
+let GIT_BRANCH = null;
+let GIT_COMMIT = null;
+let GIT_DIRTY = false;
+
+// ADR-018: set when the server's initialize result advertises capabilities.experimental
+// .niroTempProjectRouting — only then does the bridge send the pin as _niroPin (routing ladder)
+// instead of injecting it as project_id (pin-wins legacy behaviour). Reset on reconnect? No —
+// the same backend answers the reconnected session, and initialize is replayed anyway (the
+// re-advertised capability just re-sets it to true).
+let routingCapable = false;
+// Env escape hatch: NIRO_DISABLE_ROUTING=1 forces legacy pin-as-project_id even against a new
+// server (operational rollback without downgrading the bridge).
+function serverSupportsRouting() {
+  return routingCapable && process.env.NIRO_DISABLE_ROUTING !== "1";
+}
+
+const foundInFile = resolveProjectIdFromWorkspace();
+if (foundInFile) {
+  PROJECT_ID = foundInFile.id;
+  PROJECT_ID_SOURCE = foundInFile.source;
+}
+
+if (!PROJECT_ID) {
+  const foundInNiroProjects = resolveProjectIdFromNiroProjects();
+  if (foundInNiroProjects) {
+    PROJECT_ID = foundInNiroProjects.id;
+    PROJECT_ID_SOURCE = foundInNiroProjects.source;
+  }
+}
+
+// Always detect the local git state — the freshness/takeover/release notices need branch + HEAD + dirty
+// even when the project is ALREADY pinned (they compare the local checkout against what Niro indexed).
+// The remote is additionally used for server-side project resolution when no project_id was found locally.
+{
+  const gitCtx = detectGitContext();
+  if (gitCtx) {
+    GIT_REMOTE = redactRemoteCreds(gitCtx.remote); // never send/log an embedded token
+    GIT_BRANCH = gitCtx.branch;
+    GIT_COMMIT = gitCtx.commit;
+    GIT_DIRTY = gitCtx.dirty;
+  }
+}
+
+// The MCP bridge connects to ai-assistant. Resolution: env var, then
+// ~/.niro/config.json (mcpServerUrl, written by the setup wizard), then prod default.
+// Relative require from src/mcp/ resolves regardless of cwd.
+function resolveMcpServerUrl() {
+  if (process.env.NIRO_MCP_SERVER_URL) return process.env.NIRO_MCP_SERVER_URL;
+  try {
+    const fromConfig = require("../lib/config").load().mcpServerUrl;
+    if (fromConfig) return fromConfig;
+  } catch (_) {
+    // No config / unreadable — fall through to default.
+  }
+  return "https://aiassistant.niroai.dev";
+}
+
+const API_URL = resolveMcpServerUrl();
+
+function fatal(message) {
+  const error = {
+    jsonrpc: "2.0",
+    id: null,
+    error: { code: -32603, message },
+  };
+  process.stdout.write(JSON.stringify(error) + "\n");
+  process.stderr.write(`[niro-mcp] ERROR: ${message}\n`);
+  process.exit(1);
+}
+
+if (!API_KEY && !CLI_TOKEN) {
+  fatal("No Niro credential found. Run `niro login` to authenticate (preferred), or set NIRO_API_KEY.");
+}
+process.stderr.write(
+  `[niro-mcp] Auth: ${CLI_TOKEN ? "CLI token (~/.niro/credentials.json)" : "NIRO_API_KEY"}\n`);
+if (PROJECT_ID) {
+  process.stderr.write(`[niro-mcp] Project: ${PROJECT_ID} (from ${PROJECT_ID_SOURCE})\n`);
+} else if (GIT_REMOTE) {
+  process.stderr.write(`[niro-mcp] Git remote detected: ${GIT_REMOTE} — server will auto-resolve project.\n`);
+} else {
+  process.stderr.write(
+    "[niro-mcp] No project detected — multi-project mode. Add a .niro-project file at the repo root (single line with project_id) or the Niro desktop agent will populate ~/.niro/projects.json.\n"
+  );
+}
+
+const parsedUrl = new URL(API_URL);
+const httpModule = parsedUrl.protocol === "https:" ? https : http;
+
+let sessionId = null;
+
+// --- SSE auto-reconnect + liveness ----------------------------------------------------
+// niro is wired into MCP hosts as a STDIO server (via `niro mcp install` → `niro mcp serve`),
+// and hosts (e.g. Claude Code) do NOT auto-reconnect stdio servers — they only reconnect native
+// HTTP/SSE ones. So the bridge must heal its own upstream SSE stream: on a drop (or a silently
+// half-open connection), re-establish the stream and replay `initialize` to re-authenticate the
+// fresh server session, instead of exiting and forcing the user to manually reconnect the MCP.
+// (Kept in lockstep with the standalone @niroai/mcp-server bridge — niro-mcp-server-npm/index.js.)
+let generation = 0;
+let reconnecting = false;
+let currentReq = null;
+let initializeRaw = null;
+let reinitCounter = 0;
+const SWALLOW = new Set();
+let lastActivity = Date.now();
+
+const RECONNECT_INITIAL_BACKOFF_MS = 1000;
+const RECONNECT_MAX_BACKOFF_MS = 30000;
+let reconnectBackoffMs = RECONNECT_INITIAL_BACKOFF_MS;
+
+// A dead-but-open TCP stream looks alive until we try to use it. The server pings every ~15s,
+// so a gap several times that long means the stream is gone. Default 45s; override with env.
+const SSE_LIVENESS_MS = (() => {
+  const raw = parseInt(process.env.NIRO_SSE_LIVENESS_MS, 10);
+  return Number.isFinite(raw) && raw > 0 ? raw : 45000;
+})();
+
+function sleep(ms) {
+  return new Promise((r) => {
+    const t = setTimeout(r, ms);
+    if (typeof t.unref === "function") t.unref();
+  });
+}
+
+// Client-side per-request deadline: turns a never-answered request into a clean JSON-RPC
+// error instead of an indefinite hang. See src/lib/pendingRequests.js.
+const pending = createPendingTracker({
+  timeoutMs: resolveTimeoutMs(process.env),
+  onExpire: (err) => process.stdout.write(JSON.stringify(err) + "\n"),
+  onLog: (m) => process.stderr.write(`[niro-mcp] WARN: ${m}\n`),
+});
+
+/**
+ * Connect to the SSE endpoint and listen for responses.
+ *
+ * Resolves once the `endpoint` event arrives (sessionId set). After it resolves, a dropped or
+ * half-open stream routes to onConnectionLost() → reconnect, rather than exiting the process.
+ * Late callbacks from a superseded socket are ignored via the generation guard.
+ */
+function connectSse() {
+  return new Promise((resolve, reject) => {
+    const myGen = ++generation;
+    let settled = false;
+    // ADR-018: re-detect routing support per connection. A backend ROLLBACK mid-session (new→old)
+    // must drop the bridge back to legacy pin-as-project_id; the replayed initialize re-advertises
+    // the capability on a new backend (detection runs before the swallow), so upgrade re-detects too.
+    routingCapable = false;
+
+    // Abort any prior stream up front; its late 'end'/'error' now belong to an older generation
+    // and are ignored below, so they cannot trigger a second reconnect.
+    if (currentReq) {
+      try { currentReq.destroy(); } catch (_) {}
+      currentReq = null;
+    }
+
+    // The CLI token is sent ONLY as a header (never in the URL/query, which gets logged by proxies).
+    // The legacy api_key is still passed for back-compat; the server prefers the CLI token.
+    const params = [];
+    if (API_KEY) params.push(`api_key=${encodeURIComponent(API_KEY)}`);
+    if (PROJECT_ID) {
+      params.push(`project_id=${encodeURIComponent(PROJECT_ID)}`);
+    } else {
+      params.push(`cwd=${encodeURIComponent(process.cwd())}`);
+    }
+    // Git context is sent regardless of how the project resolved — the freshness/takeover/release notices
+    // compare the local checkout (branch + HEAD + dirty) against the indexed graph even for a pinned project.
+    if (GIT_REMOTE) params.push(`git_remote=${encodeURIComponent(GIT_REMOTE)}`);
+    if (GIT_BRANCH) params.push(`git_branch=${encodeURIComponent(GIT_BRANCH)}`);
+    if (GIT_COMMIT) {
+      params.push(`git_commit=${encodeURIComponent(GIT_COMMIT)}`);
+      params.push(`git_dirty=${GIT_DIRTY ? "true" : "false"}`);
+    }
+    const sseUrl = `${API_URL}/mcp/sse${params.length ? "?" + params.join("&") : ""}`;
+    process.stderr.write(`[niro-mcp] Connecting to ${API_URL}/mcp/sse\n`);
+    process.stderr.write(`[niro-mcp] Session params: ${sseUrl.replace(/api_key=[^&]+/, "api_key=***")}\n`);
+
+    const sseHeaders = {
+      "Accept": "text/event-stream",
+    };
+    if (CLI_TOKEN) sseHeaders["X-Niro-Cli-Token"] = CLI_TOKEN;
+    if (API_KEY) sseHeaders["X-Niro-Api-Key"] = API_KEY;
+    if (PROJECT_ID) {
+      sseHeaders["X-Niro-Project-Id"] = PROJECT_ID;
+    } else {
+      sseHeaders["X-Niro-Cwd"] = process.cwd();
+    }
+    // Git context on every session (see params above) so the freshness notice works for pinned projects too.
+    if (GIT_REMOTE) sseHeaders["X-Niro-Git-Remote"] = GIT_REMOTE;
+    if (GIT_BRANCH) sseHeaders["X-Niro-Git-Branch"] = GIT_BRANCH;
+    if (GIT_COMMIT) {
+      sseHeaders["X-Niro-Git-Commit"] = GIT_COMMIT;
+      sseHeaders["X-Niro-Git-Dirty"] = GIT_DIRTY ? "true" : "false";
+    }
+
+    const req = httpModule.get(sseUrl, {
+      headers: sseHeaders,
+    }, (res) => {
+      if (res.statusCode !== 200) {
+        settled = true;
+        try { req.destroy(); } catch (_) {}
+        reject(new Error(`SSE connection failed: HTTP ${res.statusCode}`));
+        return;
+      }
+
+      currentReq = req;
+      lastActivity = Date.now();
+      let buffer = "";
+
+      res.on("data", (chunk) => {
+        if (myGen !== generation) return; // superseded socket
+        lastActivity = Date.now();        // ANY byte proves liveness — including the server ':hb' heartbeat comment
+        buffer += chunk.toString();
+
+        // SSE events are delimited by double newline
+        let doubleNewline;
+        while ((doubleNewline = buffer.indexOf("\n\n")) !== -1) {
+          const block = buffer.slice(0, doubleNewline);
+          buffer = buffer.slice(doubleNewline + 2);
+
+          // Parse the SSE block
+          let eventName = null;
+          let dataLines = [];
+          for (const line of block.split("\n")) {
+            if (line.startsWith("event:")) {
+              eventName = line.slice(6).trim();
+            } else if (line.startsWith("data:")) {
+              dataLines.push(line.slice(5));
+            }
+          }
+
+          const data = dataLines.join("\n").trim();
+          if (!eventName || !data) continue; // comment/heartbeat blocks (no event:) — liveness already refreshed above
+
+          if (eventName === "endpoint") {
+            const match = data.match(/sessionId=([a-f0-9-]+)/);
+            if (match) {
+              sessionId = match[1];
+              settled = true;
+              process.stderr.write(`[niro-mcp] Session established: ${sessionId}\n`);
+              resolve();
+            }
+          } else if (eventName === "message") {
+            // Swallow the response to an internally-replayed initialize (sentinel id) so the host
+            // never sees a duplicate initialize result after a transparent reconnect.
+            let swallowed = false;
+            try {
+              const msg = JSON.parse(data);
+              // ADR-018 handshake: only an initialize result carries capabilities. When the server
+              // advertises niroTempProjectRouting, the bridge sends the folder pin as _niroPin (the
+              // server's routing ladder decides which project answers); otherwise it keeps injecting
+              // the pin as project_id — byte-identical pre-ADR-018 behaviour against old servers.
+              const exp = msg && msg.result && msg.result.capabilities
+                  && msg.result.capabilities.experimental;
+              // Presence check (truthy), not === true: the MCP spec requires experimental capability
+              // VALUES to be objects (a boolean fails the host's schema validation and kills the whole
+              // connection — found live), so the server sends {} and this must accept it.
+              if (exp && exp.niroTempProjectRouting && !routingCapable) {
+                routingCapable = true;
+                process.stderr.write("[niro-mcp] Server supports temp-project routing (_niroPin).\n");
+              }
+              if (msg && SWALLOW.has(msg.id)) {
+                SWALLOW.delete(msg.id);
+                swallowed = true;
+              } else {
+                // Cancel the client-side deadline when a delivered result matches an in-flight request.
+                pending.onIncoming(msg);
+              }
+            } catch (_) { /* not correlatable JSON — forward unchanged */ }
+            if (!swallowed) process.stdout.write(data + "\n");
+          }
+        }
+      });
+
+      res.on("error", (err) => {
+        if (myGen !== generation) return;
+        process.stderr.write(`[niro-mcp] SSE error: ${err.message}\n`);
+        onConnectionLost(myGen, err.message);
+      });
+
+      res.on("end", () => {
+        if (myGen !== generation) return;
+        process.stderr.write("[niro-mcp] SSE connection closed\n");
+        onConnectionLost(myGen, "stream ended");
+      });
+    });
+
+    req.on("error", (err) => {
+      if (myGen !== generation) return;
+      // Redact api_key before it can reach an error string that fatal() writes to stdout/stderr.
+      const safeUrl = sseUrl.replace(/api_key=[^&]+/, "api_key=***");
+      if (!settled) {
+        settled = true;
+        reject(new Error(`Failed to connect to ${safeUrl}: ${err.message}`));
+      } else {
+        // Established stream failed later — reconnect rather than die.
+        process.stderr.write(`[niro-mcp] SSE request error: ${err.message}\n`);
+        onConnectionLost(myGen, err.message);
+      }
+    });
+  });
+}
+
+/**
+ * Handle a lost SSE stream: mark reconnecting, drop the stale session (so POSTs during the gap
+ * fail fast rather than hang), and start the reconnect loop. Guarded so overlapping 'end'/'error'
+ * callbacks and the watchdog cannot start multiple loops.
+ */
+function onConnectionLost(gen, reason) {
+  if (gen !== generation) return; // stale socket
+  if (reconnecting) return;       // already handling
+  reconnecting = true;
+  sessionId = null;
+  process.stderr.write(`[niro-mcp] SSE connection lost (${reason}); reconnecting...\n`);
+  reconnectLoop();
+}
+
+/**
+ * Re-establish the SSE stream with capped exponential backoff, retrying indefinitely (a stdio
+ * bridge that gives up would force a manual host reconnect — the very thing we are removing).
+ * On success, replay initialize to re-authenticate the fresh server session.
+ */
+async function reconnectLoop() {
+  while (true) {
+    try {
+      await connectSse();
+      reconnectBackoffMs = RECONNECT_INITIAL_BACKOFF_MS;
+      await replayInitialize();
+      reconnecting = false;
+      process.stderr.write("[niro-mcp] Reconnected.\n");
+      return;
+    } catch (err) {
+      process.stderr.write(
+        `[niro-mcp] Reconnect attempt failed: ${err.message}; retrying in ${reconnectBackoffMs}ms\n`);
+      await sleep(reconnectBackoffMs);
+      reconnectBackoffMs = Math.min(reconnectBackoffMs * 2, RECONNECT_MAX_BACKOFF_MS);
+    }
+  }
+}
+
+/**
+ * Replay the host's initialize on the freshly reconnected session so tools/call re-authenticate
+ * (the server authenticates the session during initialize, not at SSE connect). The replay uses a
+ * sentinel id whose response is swallowed (see SWALLOW) so the host never sees a second init
+ * result. A no-op if the host has not initialized yet.
+ */
+async function replayInitialize() {
+  if (!initializeRaw) return;
+  const reinit = JSON.parse(initializeRaw);
+  // Negative sentinel id: JSON-RPC ids may be numbers, and host ids are small non-negative
+  // integers, so this cannot collide with a real in-flight request id.
+  const sentinelId = -(900000000 + (++reinitCounter));
+  reinit.id = sentinelId;
+  SWALLOW.add(sentinelId);
+  await sendMessage(reinit);
+  // The initialized notification has no id/response; safe to (re)send after every init.
+  await sendMessage({ jsonrpc: "2.0", method: "notifications/initialized" });
+  process.stderr.write("[niro-mcp] Re-sent initialize on the new session.\n");
+}
+
+/**
+ * Send a JSON-RPC message to the server via HTTP POST.
+ */
+function sendMessage(message) {
+  return new Promise((resolve, reject) => {
+    // No live session (mid-reconnect): fail fast so the caller returns a clean transport error
+    // to the host instead of POSTing to sessionId=null and waiting out the deadline.
+    if (!sessionId) {
+      reject(new Error("no active Niro session (reconnecting)"));
+      return;
+    }
+    const url = `${API_URL}/mcp/messages?sessionId=${sessionId}`;
+    const postData = JSON.stringify(injectProjectId(message));
+    const parsed = new URL(url);
+
+    const options = {
+      hostname: parsed.hostname,
+      port: parsed.port,
+      path: parsed.pathname + parsed.search,
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(postData),
+      },
+    };
+
+    const req = (parsed.protocol === "https:" ? https : http).request(options, (res) => {
+      res.resume(); // Drain response
+      resolve();
+    });
+
+    req.on("error", (err) => {
+      process.stderr.write(`[niro-mcp] POST error: ${err.message}\n`);
+      reject(err);
+    });
+
+    req.write(postData);
+    req.end();
+  });
+}
+
+/**
+ * Enrich an outgoing tools/call: send the folder's `.niro-project` pin as `_niroPin` (ADR-018 — a
+ * SOURCE binding the server's routing ladder consumes, NOT an explicit project choice), and
+ * re-detect the LIVE git state so routing + the freshness/takeover/release notices reflect a
+ * mid-session branch switch / new commit / edit. The git snapshot taken at SSE connect goes stale the
+ * moment the user changes branch, so it must be refreshed per call (cheap: rev-parse + status, a few ms).
+ * The server strips `_niroPin`/`_niroGit`/`_niroGitRepos` before the tool runs.
+ *
+ * ADR-018 contract: the pin must NOT travel as `project_id` — on the wire that field means "the
+ * agent deliberately chose this project" (step 0, never second-guessed). Sending the pin there
+ * would make every pinned call look explicit and the server's routing ladder would never run.
+ * An OLD server (pre-ADR-018) simply ignores unknown `_niroPin`+`_niroGit` extras… except it would
+ * then have NO project id at all — so for compatibility we still inject `project_id` when the
+ * server hasn't advertised routing support; see `serverSupportsRouting` below.
+ */
+function injectProjectId(message) {
+  if (message.method === "tools/call" && message.params) {
+    const args = message.params.arguments || {};
+    // Re-read `.niro-project` per call (cheap file walk, same per-call-refresh pattern used below for
+    // git state) so a MID-SESSION pin change — `niro init`, a hand edit, or an OLD CLI's pin swap —
+    // takes effect immediately instead of freezing at the startup value. (ADR-018 takeover no longer
+    // swaps the pin; server-side routing is what reflects a mid-session new-temp-project.)
+    let currentPin = null;
+    try {
+      const fromFile = resolveProjectIdFromWorkspace();
+      if (fromFile && fromFile.id) currentPin = fromFile.id;
+    } catch (_) { /* fall back to the startup value */ }
+    const effectiveProjectId = currentPin || PROJECT_ID;
+    if (!args.project_id && effectiveProjectId) {
+      if (serverSupportsRouting()) {
+        // New server: the pin rides in its own field; the routing ladder decides which project answers.
+        message.params.arguments = { ...args, _niroPin: effectiveProjectId };
+      } else {
+        // Old server: inject as project_id exactly as before (pin-wins behaviour, no routing).
+        message.params.arguments = { ...args, project_id: effectiveProjectId };
+      }
+    }
+    try {
+      const git = detectGitContextCached();
+      if (git && git.commit) {
+        message.params.arguments = {
+          ...(message.params.arguments || {}),
+          _niroGit: { branch: git.branch || null, commit: git.commit, dirty: !!git.dirty },
+        };
+      }
+      // ADR-017 #1 (robust): also report every local repo of this project so the server can detect
+      // sibling divergence. Only attach when it found more than the session repo — keeps single-repo
+      // sessions byte-identical to before.
+      const repos = enumerateProjectReposCached();
+      if (repos.length > 1) {
+        message.params.arguments = {
+          ...(message.params.arguments || {}),
+          _niroGitRepos: repos,
+        };
+      }
+    } catch (_) { /* git unavailable — notices simply won't fire, never break the tool call */ }
+  }
+  return message;
+}
+
+/**
+ * Main: connect SSE, then read stdin line by line and forward to server.
+ */
+async function main() {
+  try {
+    await connectSse();
+  } catch (err) {
+    fatal(`Connection failed: ${err.message}`);
+  }
+
+  // Liveness watchdog: a half-open TCP stream looks alive until we write to it, and its 'end'/
+  // 'error' may never fire. The server pings every ~15s, so a silence far longer than that means
+  // the stream is dead — force-drop it (its 'error' routes to onConnectionLost → reconnect).
+  const watchdog = setInterval(() => {
+    if (reconnecting || !sessionId) return;
+    if (Date.now() - lastActivity > SSE_LIVENESS_MS) {
+      process.stderr.write(
+        `[niro-mcp] No SSE activity for >${SSE_LIVENESS_MS}ms; forcing reconnect\n`);
+      if (currentReq) {
+        try { currentReq.destroy(new Error("liveness timeout")); } catch (_) {}
+      }
+    }
+  }, Math.max(5000, Math.floor(SSE_LIVENESS_MS / 3)));
+  if (typeof watchdog.unref === "function") watchdog.unref();
+
+  const rl = readline.createInterface({
+    input: process.stdin,
+    terminal: false,
+  });
+
+  rl.on("line", async (line) => {
+    line = line.trim();
+    if (!line) return;
+
+    let message;
+    try {
+      message = JSON.parse(line);
+    } catch (err) {
+      process.stderr.write(`[niro-mcp] Failed to parse message: ${err.message}\n`);
+      return;
+    }
+
+    // Remember the host's initialize so we can replay it verbatim to re-authenticate a fresh
+    // session after a transparent reconnect.
+    if (message.method === "initialize") initializeRaw = line;
+
+    // Arm the deadline for a real request before sending; a delivered result (or the
+    // send-failure path below) cancels it.
+    const trackable = isTrackableRequest(message);
+    if (trackable) pending.arm(message.id);
+    try {
+      await sendMessage(message);
+    } catch (err) {
+      process.stderr.write(`[niro-mcp] Failed to send message: ${err.message}\n`);
+      // The POST never reached the server, so no result will arrive: fail this request fast
+      // instead of waiting out the deadline.
+      if (trackable) {
+        pending.clear(message.id);
+        process.stdout.write(JSON.stringify({
+          jsonrpc: "2.0",
+          id: message.id,
+          error: { code: -32001, message: `Niro MCP transport error: ${err.message}` },
+        }) + "\n");
+      }
+    }
+  });
+
+  rl.on("close", () => {
+    process.exit(0);
+  });
+}
+
+main();