@niroai/niro 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -18,8 +18,52 @@ startup.
 
 Nothing else is required.
 
+### Added
+
+- **You can now see what Niro did, without asking.** At the end of a task you get one line:
+
+  ```
+  [NIRO] Mapped 29 callers across 8 files that a grep would have missed · 3 calls instead of ~14 searches
+  ```
+
+  The call count is measured by the server. The number of searches it stands in for, and the
+  description, are the assistant's own account of its own work, so that number always carries a `~`
+  to mark it as an estimate. We would rather you trusted a smaller number than doubted a bigger one.
+
+  On a turn where Niro found nothing useful, the description is dropped rather than invented, and
+  you see the bare call count.
+
+- **It also tells you when Niro went unused.** On a turn where the assistant searched your code
+  without asking Niro, you get `[NIRO] Not consulted: this turn used grep and file reads instead`.
+  Until now a skipped turn looked exactly like Niro not being installed, which meant every one of
+  our failures was invisible. Nothing is printed after a turn that did no code work.
+
+- **On by default, including on upgrade.** Turn it off with `niro mcp receipt --off` and back on
+  with `--on`; run it with no flags to see the current state. The setting is per machine.
+
+  Works the same in all twelve supported assistants: the line travels back inside the
+  `mark_task_complete` tool result and your assistant prints it, wrapped in backticks so it renders
+  as code rather than as more of its own prose. If the assistant never calls `mark_task_complete`,
+  no line appears.
+
 ### Fixed
 
+- **Codex no longer asks permission for every Niro tool call.** Two causes, both fixed by re-running
+  `niro mcp install`:
+
+  The approval mode was set to `"auto"`, which asks Codex to decide for itself — and it decides to
+  ask. It is now `"writes"`: prompt only for tools that write, and Niro writes nothing. An existing
+  `"auto"` is migrated; a value you chose yourself is left alone.
+
+  Codex also records a per-tool override whenever you answer a prompt with "approve once" rather than
+  "always allow", and a per-tool setting beats the default. Those are now cleared on install.
+
+- **A malformed tool response when a reply contained a backslash, tab or quote.** The
+  `mark_task_complete` response was assembled by a hand-written JSON builder that escaped only the
+  double quote. That was survivable while every value was a fixed keyword, but any free text
+  containing a Windows path or a tab produced JSON the client could not parse, losing the whole
+  response. All control characters are now escaped.
+
 - **The reminder to prefer niro's tools no longer goes quiet mid-session.** Claude Code's
   `Grep|Glob|Read` hook deduplicated to once per session, per repo, per branch — so it fired early
   in a session and then said nothing, which is precisely when an agent drifts back to `grep`. It now

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@niroai/niro",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Niro — one package: the niro CLI plus the Niro MCP server (code intelligence for AI coding assistants).",
   "keywords": [
     "niro",

package/src/commands/mcp.js

@@ -37,4 +37,32 @@ function serve() {
   require("../mcp/server");
 }
 
-module.exports = { install, uninstall, serve };
+/**
+ * `niro mcp receipt` — the per-developer off switch for the end-of-task line.
+ *
+ * The line itself is printed by the model from the tool result; nothing here displays it. This
+ * command only records the preference, which the bridge reads to decide whether to strip the
+ * receipt before the model ever sees it.
+ *
+ * `--pop` and `--hook` are gone. They served the Claude Code Stop hook, which was retired because
+ * Claude Code labels hook output "Stop says: …" — a system-warning framing for what is meant to be
+ * a quiet note from Niro.
+ */
+function receipt(opts = {}) {
+  const store = require("../lib/receiptStore");
+
+  if (opts.off || opts.on) {
+    const changed = store.setDisabled(!!opts.off);
+    const state = opts.off ? "off" : "on";
+    console.log(changed
+      ? `  End-of-task Niro line is now ${state}.`
+      : `  End-of-task Niro line was already ${state}.`);
+    return;
+  }
+
+  console.log(store.isDisabled()
+    ? "  End-of-task Niro line: off  (turn it on with `niro mcp receipt --on`)"
+    : "  End-of-task Niro line: on   (turn it off with `niro mcp receipt --off`)");
+}
+
+module.exports = { install, uninstall, serve, receipt };

package/src/index.js

@@ -265,6 +265,12 @@ function main() {
     .command("serve")
     .description("Run the Niro MCP server over stdio (used by your editor's MCP config).")
     .action(() => { require("./commands/mcp").serve(); });
+  mcp
+    .command("receipt")
+    .description("Turn the end-of-task Niro line on or off for this machine. No flags shows the current state.")
+    .option("--on", "Turn the end-of-task line back on.")
+    .option("--off", "Stop showing the end-of-task line.")
+    .action((opts) => { require("./commands/mcp").receipt(opts); });
 
   program.parseAsync(process.argv).catch((err) => {
     console.error(err && err.message ? err.message : err);

package/src/lib/receiptStore.js

@@ -0,0 +1,85 @@
+/**
+ * The per-developer off switch for the end-of-task receipt line.
+ *
+ * The line itself is composed by the server and travels back inside the mark_task_complete tool
+ * result, which the model prints wrapped in backticks. Nothing is stored locally to display it.
+ *
+ * This file used to be a letterbox: the bridge wrote each receipt to disk and a Claude Code Stop
+ * hook printed it. That worked, but Claude Code prefixes anything a Stop hook prints with
+ * "Stop says: …", which read as a system warning rather than a note from Niro. Printing from the
+ * model reads better and works in all twelve clients instead of one, so the hook, the letterbox and
+ * the terminal colouring all went with it.
+ *
+ * What remains is the switch. It stays local because it is a personal preference: the server serves
+ * a whole account and cannot know that one developer wants the line quiet. The bridge reads it and
+ * strips the receipt from the tool result, so the model never sees it and cannot print it.
+ */
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+/** ~/.niro, resolved the same way as the rest of the CLI (Windows has no HOME). */
+function niroHome() {
+  const home = process.env.HOME || process.env.USERPROFILE || os.homedir() || "";
+  return path.join(home, ".niro");
+}
+
+/**
+ * Presence of this file switches the line off.
+ *
+ * A file rather than a key inside projects.json so that toggling it can never corrupt, or be
+ * corrupted by, the sync state the watch daemon depends on.
+ */
+function disabledFlagPath() {
+  return path.join(niroHome(), "receipts-off");
+}
+
+function isDisabled() {
+  try {
+    return fs.existsSync(disabledFlagPath());
+  } catch {
+    // Cannot read the home directory: treat as ON. Failing to a silent state would make the
+    // feature look broken with nothing to explain why.
+    return false;
+  }
+}
+
+/** Turn the line on or off. Returns true when the state actually changed. */
+function setDisabled(disabled) {
+  const flag = disabledFlagPath();
+  try {
+    if (disabled) {
+      if (fs.existsSync(flag)) return false;
+      fs.mkdirSync(path.dirname(flag), { recursive: true, mode: 0o700 });
+      fs.writeFileSync(flag, "", { mode: 0o600 });
+      return true;
+    }
+    if (!fs.existsSync(flag)) return false;
+    fs.unlinkSync(flag);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Remove the off switch and any leftovers from the retired letterbox.
+ *
+ * Used by `niro mcp uninstall`, and worth keeping past the letterbox itself: anyone who ran a
+ * version that wrote receipts to disk still has that directory, and an uninstall that leaves files
+ * behind is not an uninstall.
+ */
+function purge() {
+  try {
+    fs.rmSync(path.join(niroHome(), "receipts"), { recursive: true, force: true });
+  } catch {
+    /* best effort */
+  }
+  try {
+    fs.rmSync(disabledFlagPath(), { force: true });
+  } catch {
+    /* best effort */
+  }
+}
+
+module.exports = { disabledFlagPath, isDisabled, setDisabled, purge };

package/src/mcp/server.js

@@ -42,6 +42,7 @@ const readline = require("readline");
 const { execSync } = require("child_process");
 const niroProjectFile = require("../lib/niroProjectFile");
 const { redactRemoteCreds } = require("../lib/git");
+const receiptStore = require("../lib/receiptStore");
 
 /** Absolute path to ~/.niro/projects.json. Uses os.homedir() so it also resolves on Windows, where HOME is
  *  normally unset — `process.env.HOME || ""` there produced a relative path that never existed, silently
@@ -507,6 +508,7 @@ function connectSse() {
             // Swallow the response to an internally-replayed initialize (sentinel id) so the host
             // never sees a duplicate initialize result after a transparent reconnect.
             let swallowed = false;
+            let rewritten = null;
             try {
               const msg = JSON.parse(data);
               // ADR-018 handshake: only an initialize result carries capabilities. When the server
@@ -528,9 +530,12 @@ function connectSse() {
               } else {
                 // Cancel the client-side deadline when a delivered result matches an in-flight request.
                 pending.onIncoming(msg);
+                rewritten = captureReceipt(msg);
               }
             } catch (_) { /* not correlatable JSON — forward unchanged */ }
-            if (!swallowed) process.stdout.write(data + "\n");
+            // captureReceipt returns a rewritten payload when it stripped the receipt field so the
+            // Stop hook can print it instead; otherwise the original bytes go through untouched.
+            if (!swallowed) process.stdout.write((rewritten || data) + "\n");
           }
         }
       });
@@ -662,6 +667,56 @@ function sendMessage(message) {
   });
 }
 
+/**
+ * Stash the end-of-task receipt line, if this incoming message carries one.
+ *
+ * The server composes the line and returns it inside the mark_task_complete tool result. The model
+ * is asked to print it, but a model can forget an instruction; the Claude Code Stop hook prints it
+ * whether or not the model cooperates, and this is where it gets the text. See
+ * `docs/usecases/task-receipt.md`.
+ *
+ * Deliberately does NOT filter by tool name: the bridge does not track which request id belonged to
+ * which tool, and a `receipt` string in a result is unambiguous enough on its own. Any future tool
+ * that wants to say something at end of task gets this for free.
+ *
+ * Silent on every failure. This sits on the path that hands results back to the developer's
+ * assistant, so a malformed message, an unwritable home directory, or an unexpected shape must cost
+ * the receipt and nothing else.
+ */
+function captureReceipt(msg) {
+  // Nothing to do unless the developer has switched the line off. The receipt is displayed by the
+  // model printing it from the tool result — there is no local copy and no hook any more.
+  if (!receiptStore.isDisabled()) return null;
+  try {
+    const content = msg && msg.result && msg.result.content;
+    if (!Array.isArray(content)) return null;
+    for (const item of content) {
+      if (!item || typeof item.text !== "string") continue;
+      // Cheap reject before parsing: tool results are frequently large, and almost none of them
+      // are the one message per task that carries a receipt.
+      if (!item.text.includes('"receipt"')) continue;
+      let parsed;
+      try {
+        parsed = JSON.parse(item.text);
+      } catch (_) {
+        continue; // not JSON — some other tool's prose that happens to contain the word
+      }
+      if (parsed && typeof parsed.receipt === "string") {
+        // Strip it here rather than asking the server not to send it. The switch is per developer
+        // and lives on this machine; the server serves a whole account and cannot know that one
+        // person wants it quiet.
+        delete parsed.receipt;
+        item.text = JSON.stringify(parsed);
+        return JSON.stringify(msg);
+      }
+    }
+  } catch (_) {
+    /* never let this disturb the message path */
+  }
+  return null;
+}
+
+
 /**
  * Enrich an outgoing tools/call: send the folder's `.niro-project` pin as `_niroPin` (ADR-018 — a
  * SOURCE binding the server's routing ladder consumes, NOT an explicit project choice), and

package/src/mcp/setup.js

@@ -127,6 +127,17 @@ function isNiroPreToolUseHook(h) {
   return cmds.some((c) => c.includes("should_create_temp_project") || c.includes("should_sandbox_repo"));
 }
 
+/**
+ * True if `h` is niro's Stop hook (the end-of-task receipt). Keyed on the exact subcommand it runs,
+ * which no other tool would have a reason to invoke. Shared by installer and uninstaller.
+ */
+function isNiroStopHook(h) {
+  const cmds = [];
+  if (h && Array.isArray(h.hooks)) h.hooks.forEach((i) => i && typeof i.command === "string" && cmds.push(i.command));
+  if (h && typeof h.command === "string") cmds.push(h.command);
+  return cmds.some((c) => c.includes("mcp receipt --hook"));
+}
+
 /**
  * True if `h` is niro's PreToolUse explore-first reminder entry (matcher Grep|Glob|Read). Keyed on the
  * unique `niro-explore-` marker-file prefix so a foreign PreToolUse hook on the same matcher is never
@@ -565,6 +576,7 @@ async function setupClaudeCode(apiKey, mcpServerUrl) {
   addClaudeCodeUserPromptHook();
   addClaudeCodePreToolUseHook();
   addClaudeCodeExploreHook();
+  removeStaleNiroStopHook();
   addClaudeCodeMemory();
   addClaudeCodeSkill();
   addClaudeCodeCliSkill();
@@ -769,6 +781,47 @@ const NIRO_PRETOOL_COMMAND = [
   `printf '%s' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","additionalContext":"Niro temporary project check: you are editing a Niro-indexed repo on its CURRENT branch. The temporary project answer is per branch, so a check you ran on a different branch (e.g. before switching) does NOT count here. Call should_create_temp_project(git_url, branch=current branch, project_id from its .niro-project) for THIS repo now and run niro new-temp-project if it returns needs_temp_project. Shown once per repo per branch per session."}}'`,
 ].join('; ');
 
+/**
+ * Removes a Stop hook left behind by an earlier version of this installer.
+ *
+ * Niro used to print the end-of-task receipt from a Claude Code Stop hook. It worked, but Claude
+ * Code labels anything a Stop hook prints with "Stop says: …", which read as a confusing system
+ * warning rather than a note from Niro. The receipt is now printed by the model itself, wrapped in
+ * backticks, which renders as code in every client rather than just this one.
+ *
+ * Anyone who installed the hook version still has it on disk, and hooks are frozen there until an
+ * install re-runs — so a plain upgrade would leave them seeing "Stop says:" for ever. Hence removing
+ * it here rather than only in uninstall. Other Stop hooks, including the developer's own, are
+ * matched by our exact subcommand and never touched.
+ */
+function removeStaleNiroStopHook() {
+  const settingsPath = path.join(process.env.HOME || "", ".claude", "settings.json");
+  let settings;
+  try {
+    if (!fs.existsSync(settingsPath)) return;
+    settings = JSON.parse(fs.readFileSync(settingsPath, "utf-8"));
+  } catch {
+    return; // unreadable or malformed — leave it alone rather than risk rewriting it
+  }
+  const stop = settings.hooks && settings.hooks.Stop;
+  if (!Array.isArray(stop)) return;
+
+  const kept = stop.filter((h) => !isNiroStopHook(h));
+  if (kept.length === stop.length) return;
+
+  settings.hooks.Stop = kept;
+  if (kept.length === 0) delete settings.hooks.Stop;
+  if (Object.keys(settings.hooks).length === 0) delete settings.hooks;
+
+  try {
+    fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+    console.log("  Removed the old Stop hook — the end-of-task line now comes from Niro directly,");
+    console.log("  without the \"Stop says:\" prefix Claude Code adds to hook output.\n");
+  } catch (err) {
+    console.warn(`  Could not update ~/.claude/settings.json: ${err.message}`);
+  }
+}
+
 /**
  * Adds the PreToolUse (Edit|Write) temporary project-reminder hook to ~/.claude/settings.json. Idempotent:
  * upgrades a stale niro entry in place, never touches a foreign PreToolUse hook (matched by the
@@ -1427,53 +1480,222 @@ async function setupCodex(apiKey, mcpServerUrl) {
 
 /**
  * After `codex mcp add` writes [mcp_servers.niro], set
- * `default_tools_approval_mode = "auto"` — niro tools are all read-only, so no per-tool
- * approval prompts (codex mcp add has no flag for this; we insert it directly after the
- * table header, which is valid TOML — bare keys precede any sub-table). Idempotent and a
- * safe no-op if the file/table is missing. Also prints the optional `required = true`
- * recommendation (left off by default: it would make niro a hard Codex startup dependency).
+ * `default_tools_approval_mode = "writes"` — prompt only for tools that write, and niro writes
+ * nothing, so nothing prompts.
+ *
+ * It was "auto" until a developer reported being asked to approve every single call. Codex accepts
+ * four values (`auto`, `prompt`, `writes`, `approve` — confirmed from its own validation error on a
+ * bad one), and "auto" means Codex decides for itself. It decides to ask. "writes" states the fact
+ * about niro that makes asking unnecessary, rather than delegating the judgement.
+ *
+ * Inserted directly after the table header, which is valid TOML — bare keys precede any sub-table.
+ * Idempotent and a safe no-op if the file or table is missing. Also prints the optional
+ * `required = true` recommendation (left off by default: it would make niro a hard Codex startup
+ * dependency).
  */
-function hardenCodexServerConfig() {
-  const cfgPath = path.join(process.env.HOME || "", ".codex", "config.toml");
-  const header = "[mcp_servers.niro]";
+/**
+ * Write ~/.codex/config.toml, then prove Codex can still load it — rolling back if it cannot.
+ *
+ * This file holds [mcp_servers.niro] itself, so a malformed edit does not merely fail: it makes
+ * Codex reject the whole file and takes the developer's Niro registration down with it. That is the
+ * failure mode that got a Codex hook built and pulled twice (ae7bdaa, dcc4f7f), and the lesson from
+ * it was that every write here needs a verify-and-rollback rather than care alone.
+ *
+ * Atomic temp-then-rename, with the original file mode preserved. Widening permissions matters:
+ * this file can hold API keys, and an earlier version of the pulled work reset 0600 to 0644 on
+ * rollback.
+ *
+ * Verification runs the real binary. `codex mcp get niro` parses the config and prints the server,
+ * so a non-zero exit means Codex would not load what we just wrote. If the binary is missing we
+ * cannot verify, and the write is skipped entirely — an unverifiable edit to this file is not worth
+ * the risk it carries.
+ */
+function writeCodexConfigVerified(cfgPath, contents) {
+  const { execSync } = require("child_process");
+
+  try {
+    execSync("command -v codex >/dev/null 2>&1", { stdio: "ignore", shell: "/bin/sh" });
+  } catch {
+    throw new Error("codex is not on PATH, so the edit cannot be verified — leaving the file alone");
+  }
+
+  const previous = fs.readFileSync(cfgPath, "utf-8");
+  let mode = 0o600;
+  try {
+    mode = fs.statSync(cfgPath).mode & 0o777;
+  } catch {
+    /* fall back to the conservative default above */
+  }
+
+  const tmp = `${cfgPath}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, contents, { mode });
+  fs.renameSync(tmp, cfgPath);
 
+  try {
+    execSync("codex mcp get niro", { stdio: "ignore", timeout: 15000 });
+  } catch (err) {
+    // Put it back exactly as it was, mode included, then report.
+    const rollback = `${cfgPath}.${process.pid}.rollback`;
+    fs.writeFileSync(rollback, previous, { mode });
+    fs.renameSync(rollback, cfgPath);
+    throw new Error("Codex could not load the edited config — rolled back, nothing changed");
+  }
+}
+
+/**
+ * Remove [mcp_servers.niro.tools.*] approval overrides from ~/.codex/config.toml.
+ *
+ * Codex writes one of these each time a developer answers a tool prompt with "approve once", and a
+ * per-tool setting overrides default_tools_approval_mode. The result is a config that looks correctly
+ * configured and prompts on every single call.
+ *
+ * Only niro's own sub-tables are touched, matched by their full prefix. This is the file that holds
+ * [mcp_servers.niro] itself, so a careless edit costs the developer their whole Niro registration —
+ * the reason a Codex hook was built and pulled twice (ae7bdaa, dcc4f7f). Hence: read, rewrite in
+ * memory, and only write when the result still parses as something Codex will load.
+ *
+ * Returns how many tables were removed; 0 on any failure, having changed nothing.
+ */
+function clearCodexPerToolApprovals(cfgPath) {
   let toml;
   try {
     toml = fs.readFileSync(cfgPath, "utf-8");
   } catch {
-    console.warn("  Could not read ~/.codex/config.toml to set the approval mode — skipping.\n");
-    return;
+    return 0;
   }
 
-  const idx = toml.indexOf(header);
-  if (idx === -1) {
-    console.warn("  [mcp_servers.niro] not found in config.toml — skipping approval-mode hardening.\n");
-    return;
+  // A table runs from its header to the next header at any level, or end of file.
+  const pattern = /\n\[mcp_servers\.niro\.tools\.[^\]]+\]\n(?:(?!\n?\[)[^\n]*\n)*/g;
+  const matches = toml.match(pattern);
+  if (!matches || matches.length === 0) return 0;
+
+  const rewritten = toml.replace(pattern, "\n").replace(/\n{3,}/g, "\n\n");
+
+  // Refuse to write anything that lost the niro server itself. Cheap, and the failure it guards
+  // against is the one that matters.
+  if (!rewritten.includes("[mcp_servers.niro]")) {
+    console.warn("  Skipped clearing Codex tool approvals — the edit would have dropped [mcp_servers.niro].\n");
+    return 0;
+  }
+
+  try {
+    writeCodexConfigVerified(cfgPath, rewritten);
+  } catch (err) {
+    console.warn(`  Could not clear Codex per-tool approvals: ${err.message}\n`);
+    return 0;
   }
 
-  // Limit the "already set?" check to the niro table body (up to the next table header).
-  const after = toml.slice(idx + header.length);
-  const nextTableRel = after.search(/\n\s*\[/);
-  const tableBody = nextTableRel === -1 ? after : after.slice(0, nextTableRel);
+  console.log(`  Cleared ${matches.length} per-tool approval override${matches.length === 1 ? "" : "s"} for niro.`);
+  console.log("  → those beat default_tools_approval_mode and made every call prompt.\n");
+  return matches.length;
+}
+
+/**
+ * Absolute path to Codex's config.toml, honouring CODEX_HOME.
+ *
+ * `codex mcp add` writes wherever CODEX_HOME points, so reading from a hard-coded ~/.codex would
+ * edit a file Codex never loads while reporting success — the server registered in one place and the
+ * approval mode set in another.
+ *
+ * Returns null rather than a relative path when no home resolves. userHome() can be "", and
+ * path.join("", ".codex", "config.toml") yields ".codex/config.toml" relative to the current working
+ * directory, which on some machines is a git-tracked project folder.
+ */
+function codexConfigPath() {
+  const codexHome = process.env.CODEX_HOME && process.env.CODEX_HOME.trim();
+  if (codexHome) return path.join(codexHome, "config.toml");
+  const home = userHome();
+  if (!home) return null;
+  return path.join(home, ".codex", "config.toml");
+}
+
+function hardenCodexServerConfig() {
+  const cfgPath = codexConfigPath();
+  if (!cfgPath) {
+    console.warn("  Could not resolve ~/.codex/config.toml — skipping approval-mode hardening.\n");
+    return;
+  }
 
   console.log("  Tip: for a hard dependency, add `required = true` under [mcp_servers.niro]");
   console.log("       (Codex then fails startup if niro is unreachable — off by default).\n");
 
-  if (/^\s*default_tools_approval_mode\s*=/m.test(tableBody)) {
-    console.log("  Codex approval mode already set — skipping.\n");
+  // Clear per-tool overrides FIRST. Codex writes a [mcp_servers.niro.tools.<name>] table with
+  // approval_mode = "approve" whenever the developer answers a prompt with "approve once" rather
+  // than "always allow", and a per-tool setting BEATS default_tools_approval_mode. So the default
+  // below can be correct while every call still prompts — exactly what a developer reported.
+  //
+  // This rewrites the file, so everything after it must work from freshly read contents. An earlier
+  // version computed byte offsets BEFORE this call and spliced with them afterwards, which inserted
+  // text into the middle of an unrelated line whenever the rewrite shortened anything above the niro
+  // header. That produced invalid TOML, and Codex refuses to load a config it cannot parse — taking
+  // [mcp_servers.niro] and every other server's credentials down with it.
+  clearCodexPerToolApprovals(cfgPath);
+
+  const located = locateCodexNiroTable(cfgPath);
+  if (!located) {
+    console.warn("  [mcp_servers.niro] not found in config.toml — skipping approval-mode hardening.\n");
+    return;
+  }
+  const { toml, bodyStart, bodyEnd, body } = located;
+
+  const existing = body.match(/^[ \t]*default_tools_approval_mode[ \t]*=[ \t]*"([^"]*)"/m);
+
+  if (existing && existing[1] !== "auto") {
+    console.log(`  Codex approval mode already set to "${existing[1]}" — leaving your choice alone.\n`);
     return;
   }
 
-  const insertAt = idx + header.length;
-  const newToml = toml.slice(0, insertAt) + '\ndefault_tools_approval_mode = "auto"' + toml.slice(insertAt);
+  // Every edit below is confined to niro's own table slice. Replacing across the whole file with a
+  // single /m regex rewrote the FIRST matching line anywhere in it — which, since `codex mcp add`
+  // appends niro last, was reliably ANOTHER server's line. That silently relaxed a third party's
+  // approval settings and left niro's untouched, while printing that it had succeeded.
+  let newBody;
+  let message;
+  if (existing) {
+    newBody = body.replace(/^([ \t]*default_tools_approval_mode[ \t]*=[ \t]*)"auto"/m, '$1"writes"');
+    message = ['  Changed Codex approval mode from "auto" to "writes".',
+               '  -> "auto" let Codex decide, and it decided to ask on every call.'];
+  } else {
+    // A bare key must precede any sub-table, so it goes at the very top of the body.
+    newBody = '\ndefault_tools_approval_mode = "writes"' + body;
+    message = ['  Set default_tools_approval_mode = "writes" in ~/.codex/config.toml',
+               "  -> niro is read-only, so its tools run without per-call approval prompts."];
+  }
+
+  if (newBody === body) return; // nothing to do
 
   try {
-    fs.writeFileSync(cfgPath, newToml);
-    console.log('  Set default_tools_approval_mode = "auto" in ~/.codex/config.toml');
-    console.log("  → niro is read-only, so its tools run without per-call approval prompts.\n");
+    writeCodexConfigVerified(cfgPath, toml.slice(0, bodyStart) + newBody + toml.slice(bodyEnd));
+    message.forEach((line) => console.log(line));
+    console.log("");
   } catch (err) {
-    console.warn(`  Could not update ~/.codex/config.toml: ${err.message}\n`);
+    console.warn(`  Could not update the Codex approval mode: ${err.message}\n`);
+  }
+}
+
+/**
+ * Locate [mcp_servers.niro]'s body in the CURRENT contents of config.toml.
+ *
+ * Returns the whole file plus the byte range of the table body (everything after the header, up to
+ * the next table header at any level). Read fresh on every call: any offset computed before another
+ * function rewrote the file is a splice into the wrong place waiting to happen.
+ */
+function locateCodexNiroTable(cfgPath) {
+  const header = "[mcp_servers.niro]";
+  let toml;
+  try {
+    toml = fs.readFileSync(cfgPath, "utf-8");
+  } catch {
+    return null;
   }
+  const idx = toml.indexOf(header);
+  if (idx === -1) return null;
+
+  const bodyStart = idx + header.length;
+  const after = toml.slice(bodyStart);
+  const nextTableRel = after.search(/\n[ \t]*\[/);
+  const bodyEnd = nextTableRel === -1 ? toml.length : bodyStart + nextTableRel;
+  return { toml, bodyStart, bodyEnd, body: toml.slice(bodyStart, bodyEnd) };
 }
 
 /**
@@ -2125,6 +2347,9 @@ module.exports = {
   isNiroUserPromptHook,
   isNiroPreToolUseHook,
   isNiroExploreHook,
+  isNiroStopHook,
+  clearCodexPerToolApprovals,
+  hardenCodexServerConfig,
   userHome,
   // Exposed for tests: the hook bodies are shell, so the only way to prove they still fire (and still
   // carry their identity token) is to execute the real string.

package/src/mcp/teardown.js

@@ -6,7 +6,8 @@
  * `niro mcp uninstall` removes everything `niro mcp install` wrote, per editor:
  *   - the MCP server registration (claude/codex CLI, or the editor's JSON config)
  *   - the niro hooks in ~/.claude/settings.json (PostCompact + UserPromptSubmit + PreToolUse: both the
- *     Edit|Write temp-project reminder and the Grep|Glob|Read explore-first reminder)
+ *     Edit|Write temp-project reminder and the Grep|Glob|Read explore-first reminder + Stop: the
+ *     end-of-task receipt line), and any receipts still pending on disk
  *   - the niro section in markdown config (CLAUDE.md / AGENTS.md / Windsurf rules)
  *   - the generated skills (~/.claude/skills, the shared ~/.agents/skills)
  *   - Cursor's "niro:*" allowlist entry and project rule
@@ -36,6 +37,7 @@ const {
   CLIENTS,
   NIRO_MD_MARKER,
   NIRO_MD_SECTIONS,
+  isNiroStopHook,
   isNiroPostCompactHook,
   isNiroUserPromptHook,
   isNiroPreToolUseHook,
@@ -154,6 +156,12 @@ function filterNiroHooks(settings) {
     removed += before - hooks.PreToolUse.length;
     if (hooks.PreToolUse.length === 0) delete hooks.PreToolUse;
   }
+  if (Array.isArray(hooks.Stop)) {
+    const before = hooks.Stop.length;
+    hooks.Stop = hooks.Stop.filter((h) => !isNiroStopHook(h));
+    removed += before - hooks.Stop.length;
+    if (hooks.Stop.length === 0) delete hooks.Stop;
+  }
   if (Object.keys(hooks).length === 0) delete settings.hooks;
 
   return { settings, removed };
@@ -375,6 +383,14 @@ function uninstallClaudeCode() {
   const home = userHome();
   runMcpRemove("claude", ["mcp", "remove", "niro", "--scope", "user"]);
   stripNiroHooksFromSettings(path.join(home, ".claude", "settings.json"));
+  // Claude Code is the only client with the Stop hook, so its pending receipts have nothing left to
+  // read them. Leaving them behind would mean a reinstall months later opens with a line describing
+  // a task the developer has long forgotten.
+  try {
+    require("../lib/receiptStore").purge();
+  } catch {
+    /* best effort — never block an uninstall on cleaning up a cache */
+  }
   stripMarkerFromFile(path.join(home, ".claude", "CLAUDE.md"), "Claude Code memory");
   deleteFileIfPresent(path.join(home, ".claude", "skills", "niro-skill", "SKILL.md"), "niro skill");
   deleteFileIfPresent(path.join(home, ".claude", "skills", "niro-cli", "SKILL.md"), "niro-cli skill");