@niroai/niro 0.4.0 → 0.6.0

package/src/commands/watch.js

@@ -19,6 +19,8 @@ const credentials = require("../lib/credentials");
 const prompt = require("../lib/prompt");
 const color = require("../lib/color");
 const folderSync = require("../lib/folderSync");
+const git = require("../lib/git");
+const tempProject = require("../lib/tempProject");
 const {
   SOURCE_EXTENSIONS, STRUCTURAL_EXTENSIONS, STRUCTURAL_FILENAMES,
   IGNORED_DIRS, isConfigName, chunk,
@@ -31,10 +33,52 @@ const DEBOUNCE_MS = 2_000;
 // so a slower run would clobber a faster one's hash updates. A per-folder guard serializes them (a skipped
 // run is safe — the in-progress one re-hashes the whole tree and so already covers the skipped trigger).
 const syncInFlight = new Set();
+// Folders that are NOT the one their temporary project currently reflects. Uploads from these are held
+// back until the slot returns, so two branches cannot blend into one copy. Set by deltaSyncOnResume and
+// honoured by the live file handler, so one check per sync pass covers both paths rather than asking
+// the server on every save.
+const notHolding = new Set();
 // The state file is rewritten several times during a `niro takeover` (per-file hashes), so debounce
 // before reconciling the watch set. Also the interval for the mtime backstop re-scan below.
 const STATE_RELOAD_DEBOUNCE_MS = 1_500;
 const RESCAN_INTERVAL_MS = 60_000;
+/** Ceiling for the backstop's exponential backoff. Long enough to stop hammering a broken server,
+ *  short enough that a recovered one is picked up within half an hour without anyone intervening. */
+const BACKSTOP_BACKOFF_MAX_MS = 30 * 60_000;
+
+/**
+ * Per-folder retry state for the backstop re-scan: { failures, nextAttemptAt }.
+ *
+ * The backstop used to fire every 60s regardless of how many times it had just failed, with no
+ * backoff, no cap and no notion that anything was wrong. When the server broke on 8-9 August it
+ * minted a fresh sync session every single tick — roughly 1,400 failed requests a day, for two days,
+ * per watched folder. The bug was ours, but the client turned it into a flood.
+ */
+const backstopBackoff = new Map();
+
+/** Doubling delay, capped. failures=1 gives 2 minutes; the cap is reached after about six. */
+function nextBackoffMs(failures) {
+  return Math.min(RESCAN_INTERVAL_MS * Math.pow(2, failures), BACKSTOP_BACKOFF_MAX_MS);
+}
+
+/** False while a folder is still serving a backoff from its last failure. */
+function shouldAttemptBackstop(key, now = Date.now()) {
+  const state = backstopBackoff.get(key);
+  return !state || now >= state.nextAttemptAt;
+}
+
+/** @return the delay applied, so the caller can say how long it is waiting. */
+function recordBackstopFailure(key, now = Date.now()) {
+  const failures = (backstopBackoff.get(key)?.failures || 0) + 1;
+  const delay = nextBackoffMs(failures);
+  backstopBackoff.set(key, { failures, nextAttemptAt: now + delay });
+  return delay;
+}
+
+/** @return true if this success ended a run of failures (so recovery is worth announcing). */
+function recordBackstopSuccess(key) {
+  return backstopBackoff.delete(key);
+}
 
 async function watch(pathArg, opts = {}) {
   const creds = credentials.requireCreds();
@@ -192,8 +236,42 @@ async function startWatch(targetDir, opts = {}) {
   const rescanTimer = setInterval(() => {
     const fresh = watchState.get(targetDir, api.currentBaseUrl());
     if (!fresh || !fresh.gitId) return; // folder released — nothing to sync
-    deltaSyncOnResume(fresh.gitId, targetDir, fresh, { quiet: true }).catch(err =>
-      console.error(color.red(`  Backstop re-scan failed for ${targetDir}: ${err.message}`)));
+    // Back off after failures instead of retrying every 60s forever. Retrying at full rate against a
+    // server that is failing does not fix anything and buries the real error in its own noise.
+    const backoffKey = path.resolve(targetDir);
+    if (!shouldAttemptBackstop(backoffKey)) return;
+    deltaSyncOnResume(fresh.gitId, targetDir, fresh, { quiet: true })
+      .then(result => {
+        // A run that never reached the server proves nothing about the server. The in-flight guard
+        // returns at once when another sync for this folder is already going, and during an outage a
+        // large delta holds that flag for minutes — so a skipped tick was clearing the failure count
+        // and printing a green "Sync recovered" in the middle of the incident, while the real run was
+        // still heading for its own failure. The count then never grew past one, so the backoff never
+        // climbed towards its ceiling and kept hammering every two minutes: both things this backoff
+        // was added to stop.
+        // Only a pass that actually reached the server and had nothing fail counts as a recovery.
+        // A skipped run (another sync in flight) and a no-change run both contact nothing, and a pass
+        // whose per-file deletes were all refused resolves cleanly — so all three used to clear the
+        // failure count and print a green "Sync recovered" during an outage, which is how the retry rate
+        // never decayed and the real error stayed buried.
+        if (!result || result.skipped || result.noContact || result.notHolder) return;
+        if (result.failures > 0) {
+          const delayMs = recordBackstopFailure(backoffKey, Date.now());
+          console.error(color.red(
+            `  ${result.failures} file operation(s) failed for ${targetDir} — retrying in ` +
+            `${Math.round(delayMs / 60_000)} min.`));
+          return;
+        }
+        if (recordBackstopSuccess(backoffKey)) {
+          console.log(color.green(`  Sync recovered for ${targetDir}.`));
+        }
+      })
+      .catch(err => {
+        const delayMs = recordBackstopFailure(backoffKey, Date.now());
+        console.error(color.red(
+          `  Backstop re-scan failed for ${targetDir}: ${err.message} — retrying in ` +
+          `${Math.round(delayMs / 60_000)} min.`));
+      });
   }, RESCAN_INTERVAL_MS);
 
   // Start file watcher
@@ -244,11 +322,51 @@ async function deltaSyncOnResume(gitId, targetDir, state, opts = {}) {
   if (syncInFlight.has(inFlightKey)) {
     // A sync (startup, live event, or backstop) is already running for this folder — skip to avoid the
     // whole-map fileHashes clobber race; the in-progress run re-hashes the whole tree and covers this trigger.
-    return;
+    // Reported so the caller can tell "nothing to do" from "the server answered": this run never
+    // contacted it, so it is not evidence that anything is working.
+    return { skipped: true };
   }
   syncInFlight.add(inFlightKey);
   try {
   const quiet = opts.quiet === true; // periodic backstop re-scan runs silently unless it actually syncs
+
+  // Am I still the folder this temporary project reflects? Every folder taken over for one project
+  // shares the SAME repo id, so the server cannot tell us apart. If I keep uploading after the slot has
+  // moved, my branch blends into the copy that is reflecting someone else, and every answer drawn from
+  // it is a mixture — with nothing on screen to say so. Verified live with two worktrees.
+  //
+  // Nothing is changed or discarded here. The local record is left exactly as it is, so running
+  // `niro new-temp-project` here picks straight back up. This only declines to WRITE.
+  if (state.takeover && state.takeover.sourceProjectId) {
+    const heldBranch = await tempProject.currentBranch(state.projectId, gitId);
+    const myBranch = ((git.inspect(targetDir) || {}).branch) || state.branch;
+    // A null heldBranch means the server could not be asked. That must NEVER be read as "you lost the
+    // slot", or one network hiccup would stop a perfectly healthy folder syncing.
+    if (heldBranch && myBranch && heldBranch !== myBranch) {
+      if (!notHolding.has(inFlightKey)) {
+        notHolding.add(inFlightKey);
+        // TWO very different causes, and they need different advice. Another folder bound to the same
+        // copy is the stealing case. NO other folder means you simply switched branch in place, and
+        // saying "another folder holds it" there sends you hunting for a folder that does not exist —
+        // which is exactly what it did on a real repo the first time this ran.
+        const otherFolder = watchState.allLocal(api.currentBaseUrl()).find((e) =>
+          e.projectId === state.projectId && path.resolve(e.folderPath) !== inFlightKey);
+        console.warn(color.yellow(otherFolder
+          ? `  ${targetDir} is on \`${myBranch}\`, but this project's temporary project is on ` +
+            `\`${heldBranch}\`, held by ${otherFolder.folderPath}. Pausing uploads from here so the ` +
+            `two branches do not mix. Run \`niro new-temp-project\` here to move it, or ` +
+            `\`niro discard-temp-project\` in that folder.`
+          : `  ${targetDir} is on \`${myBranch}\`, but its temporary project is still on ` +
+            `\`${heldBranch}\` — you switched branch in this folder. Pausing uploads so the two ` +
+            `branches do not mix. Run \`niro new-temp-project\` here to move the temporary project ` +
+            `onto \`${myBranch}\`.`));
+      }
+      return { notHolder: true };
+    }
+    if (notHolding.delete(inFlightKey)) {
+      console.log(color.green(`  ${targetDir} holds the temporary project again — resuming uploads.`));
+    }
+  }
   const storedHashes = state.fileHashes || {};
   const currentHashes = {};
   const changed = [];
@@ -257,27 +375,50 @@ async function deltaSyncOnResume(gitId, targetDir, state, opts = {}) {
   // Walk all currently included files
   const manifest = buildMinimalManifest(targetDir, state.includePatterns, state.excludePatterns);
 
+  const unreadable = [];
   for (const relativePath of manifest) {
     const absPath = path.join(targetDir, relativePath);
     const hash = watchState.hashFile(absPath);
-    if (!hash) continue;
+    if (!hash) {
+      // The walk that produced this manifest JUST FOUND this file, so it exists. Failing to READ it
+      // is not evidence that it was deleted — it is a permission error, a transient lock, a file being
+      // rewritten, or simply too many open files. hashFile returns null for every one of those.
+      //
+      // Skipping the file here used to leave it out of currentHashes, and the loop below reads
+      // "absent from currentHashes" as "deleted", so an unreadable file became a delete instruction to
+      // the server. Carrying the stored hash forward keeps it in the baseline and out of `deleted`.
+      unreadable.push(relativePath);
+      if (Object.prototype.hasOwnProperty.call(storedHashes, relativePath)) {
+        currentHashes[relativePath] = storedHashes[relativePath];
+      }
+      continue;
+    }
     currentHashes[relativePath] = hash;
     if (storedHashes[relativePath] !== hash) {
       changed.push(relativePath);
     }
   }
 
-  // Files that were in stored hashes but no longer exist
+  if (unreadable.length > 0) {
+    console.warn(color.yellow(
+      `  ${unreadable.length} file(s) could not be read this pass — keeping them as-is rather than ` +
+      `reporting them deleted. Sample: ${unreadable.slice(0, 5).join(", ")}`));
+  }
+
+  // Files that were in stored hashes but are no longer present in the walk at all.
   for (const rp of Object.keys(storedHashes)) {
-    if (!currentHashes[rp]) {
+    if (!Object.prototype.hasOwnProperty.call(currentHashes, rp)) {
       deleted.push(rp);
     }
   }
 
   if (changed.length === 0 && deleted.length === 0) {
     if (!quiet) console.log(`  No changes since last sync.`);
-    watchState.update(targetDir, { fileHashes: currentHashes });
-    return;
+    watchState.mergeFileHashes(targetDir, { set: currentHashes });
+    // Nothing to send, so the server was never contacted and this pass is not evidence it is healthy.
+    // This is the MAJORITY of backstop ticks: treated as a success it cleared the failure count on the
+    // very next tick after one, so the backoff could never grow past its first step.
+    return { noContact: true };
   }
 
   // A quiet backstop run only speaks up when it actually found something fs.watch missed.
@@ -287,6 +428,7 @@ async function deltaSyncOnResume(gitId, targetDir, state, opts = {}) {
   // using the same helper as init/add-repo. A gitignored secret edited after
   // onboarding (e.g. a raw .env) must never be re-uploaded here.
   let changedToUpload = changed;
+  const gitignoreDropped = [];
   if (changed.length > 0) {
     const drops = folderSync.gitignoreDrops(targetDir, changed);
     if (drops.size > 0) {
@@ -294,7 +436,7 @@ async function deltaSyncOnResume(gitId, targetDir, state, opts = {}) {
       // Don't persist hashes for dropped (gitignored / unverifiable) files — they
       // were never uploaded, so leave them out of state so they're re-evaluated
       // rather than recorded as synced.
-      for (const rp of drops) delete currentHashes[rp];
+      for (const rp of drops) { delete currentHashes[rp]; gitignoreDropped.push(rp); }
     }
   }
 
@@ -313,16 +455,61 @@ async function deltaSyncOnResume(gitId, targetDir, state, opts = {}) {
     await agentApi.completeSync(gitId, sessionId);
   }
 
+  // Re-check each file immediately before telling the server to remove it. The walk that built this
+  // list ran BEFORE the uploads above, which on a large delta take minutes, so by now a file may exist
+  // again — or may never have been gone, having merely been unreadable at the wrong moment. The live
+  // per-file path already stats before deleting; this one fired blind.
+  // Per-file failures are swallowed below so one bad path cannot abort the pass. They still have to be
+  // REPORTED, or a pass in which everything failed is indistinguishable from one in which all was well.
+  let failures = 0;
+  const reappeared = [];
+  // Only paths the server actually accepted. Marking a FAILED delete as done drops it from the
+  // baseline, and once dropped it can never re-enter `deleted` — so the file stays on the server, stays
+  // indexed, and nothing retries it. With the burst guard that is systematic: delete 500 files, the
+  // first 100 land, the rest are refused, and all 500 were being forgotten.
+  const deletedOk = [];
   for (const rp of deleted) {
+    // Existing on disk is NOT on its own a reason to keep it. A file leaves the manifest for two
+    // different reasons: it was removed from disk, or it stopped matching the include/exclude
+    // patterns. Only the first can "come back". Rescuing on existence alone meant adding an exclude
+    // pattern no longer removed the file from Niro — so a path excluded BECAUSE it holds secrets
+    // would have gone on being indexed for ever.
+    if (fs.existsSync(path.join(targetDir, rp)) && inManifestScope(rp, state)) {
+      reappeared.push(rp);
+      continue;
+    }
     try {
       await agentApi.deleteFile(gitId, rp);
+      deletedOk.push(rp);
     } catch (err) {
+      // Swallowed so one bad path cannot abort the pass, but COUNTED: a pass whose deltas are deletes
+      // only never throws, so without this the caller saw a clean resolve while every single delete was
+      // being refused, cleared the backoff, and retried the whole set 60 seconds later. Forever.
+      failures++;
       console.warn(color.yellow(`  Warning: failed to delete ${rp}: ${err.message}`));
     }
   }
-
-  watchState.update(targetDir, { fileHashes: currentHashes, lastSyncedAt: new Date().toISOString() });
+  if (reappeared.length > 0) {
+    console.warn(color.yellow(
+      `  ${reappeared.length} file(s) were back on disk by the time the delete ran — not deleted. ` +
+      `Sample: ${reappeared.slice(0, 5).join(", ")}`));
+    // Deliberately NOT re-hashed into the baseline. The file may have come back with DIFFERENT bytes
+    // (a branch switch or stash pop mid-upload), and it was in `deleted` rather than `changed`, so it
+    // was never uploaded — recording the new hash would claim the server holds content it never
+    // received. Leaving its OLD entry untouched is what makes the next pass see a hash mismatch and
+    // upload it. It is in scope and on disk, so that pass finds it in the manifest.
+  }
+  const actuallyDeleted = deletedOk;
+
+  // Merge rather than replace. Removals are explicit: the files we actually deleted, plus any the
+  // gitignore policy dropped (those were never uploaded, so they must not stay recorded as synced).
+  watchState.mergeFileHashes(targetDir, {
+    set: currentHashes,
+    remove: [...actuallyDeleted, ...gitignoreDropped],
+    patch: { lastSyncedAt: new Date().toISOString() },
+  });
   console.log(`  ${color.green("✓")} Delta sync complete.`);
+  return { failures };
   } finally {
     syncInFlight.delete(inFlightKey);
   }
@@ -335,6 +522,10 @@ async function handleFileEvent(gitId, targetDir, relativePath, state) {
   // daemon kept uploading to the OLD gitId — every edit failed with "Repository not found"
   // until the daemon was manually restarted. Reading fresh also picks up include/exclude
   // pattern changes from `niro edit`.
+  //
+  // Held back by the last sync pass: this folder is not the one its temporary project reflects, so
+  // uploading would mix two branches into one copy. Re-checked every pass, so it clears by itself.
+  if (notHolding.has(path.resolve(targetDir))) return;
   const fresh = watchState.get(targetDir, api.currentBaseUrl());
   if (!fresh || !fresh.gitId) {
     // Folder was released / is no longer tracked for this backend — stop syncing it.
@@ -390,9 +581,10 @@ async function handleFileEvent(gitId, targetDir, relativePath, state) {
     // File deleted
     try {
       await agentApi.deleteFile(gitId, relativePath);
-      const hashes = { ...(watchState.get(targetDir) || {}).fileHashes };
-      delete hashes[relativePath];
-      watchState.update(targetDir, { fileHashes: hashes, lastSyncedAt: new Date().toISOString() });
+      watchState.mergeFileHashes(targetDir, {
+        remove: [relativePath],
+        patch: { lastSyncedAt: new Date().toISOString() },
+      });
       console.log(`  ${color.yellow("−")} ${relativePath}`);
     } catch (err) {
       console.error(color.red(`  Failed to delete ${relativePath}: ${err.message}`));
@@ -422,8 +614,10 @@ async function handleFileEvent(gitId, targetDir, relativePath, state) {
 
   try {
     await agentApi.upsertFile(gitId, relativePath, absPath);
-    const hashes = { ...storedHashes, [relativePath]: newHash };
-    watchState.update(targetDir, { fileHashes: hashes, lastSyncedAt: new Date().toISOString() });
+    watchState.mergeFileHashes(targetDir, {
+      set: { [relativePath]: newHash },
+      patch: { lastSyncedAt: new Date().toISOString() },
+    });
     console.log(`  ${color.green("+")} ${relativePath}`);
   } catch (err) {
     console.error(color.red(`  Failed to sync ${relativePath}: ${err.message}`));
@@ -435,6 +629,13 @@ function shouldIgnore(relativePath) {
   return parts.some(p => IGNORED_DIRS.has(p) || p.startsWith("."));
 }
 
+/** Mirrors buildMinimalManifest's membership rule: empty includePatterns means everything is in. */
+function inManifestScope(relativePath, state) {
+  const include = state.includePatterns;
+  if (!include || include.length === 0) return true;
+  return matchesPatterns(relativePath, include, state.excludePatterns);
+}
+
 function matchesPatterns(relativePath, includePatterns, excludePatterns) {
   if (!includePatterns || includePatterns.length === 0) return true;
   const matched = includePatterns.some(p => minimatch(relativePath, p));
@@ -495,4 +696,5 @@ function buildMinimalManifest(rootDir, includePatterns, excludePatterns) {
 
 // handleFileEvent + deltaSyncOnResume are exported for unit testing the
 // gitignore/fail-closed guards without a live server or fs.watch loop.
-module.exports = { watch, startWatch, handleFileEvent, deltaSyncOnResume, handleEntryFailure };
+module.exports = { watch, startWatch, handleFileEvent, deltaSyncOnResume, handleEntryFailure,
+  nextBackoffMs, shouldAttemptBackstop, recordBackstopFailure, recordBackstopSuccess };

package/src/index.js

@@ -9,7 +9,34 @@ function main() {
     .name("niro")
     .description("Niro CLI — onboard repos, build indexes, manage projects from the terminal.")
     .version(pkg.version)
-    .option("--api-url <url>", "override API base URL (default: $NIRO_API_URL or https://aiorchestrator.niroai.dev)");
+    .option("--api-url <url>", "backend to log in to — `niro login` only (default: $NIRO_API_URL or https://aiorchestrator.niroai.dev)");
+
+  // --api-url is accepted by `niro login` and REFUSED everywhere else.
+  //
+  // It used to be a global override, but it was only half honoured. api.request takes it
+  // (api.js: `const base = apiUrl || baseUrl(creds)`), while the upload chain builds its own
+  // URL from the stored credentials and never sees it (agentApi.js:113 and :175). So
+  // `niro init --api-url <local>` while logged in elsewhere listed projects from one backend
+  // and uploaded the folder's source to the other — one command, two servers, no warning.
+  //
+  // Threading it through every path is the other possible fix, but the backend is a property
+  // of a SESSION, not of a single command: credentials, tokens, gitIds and watchState tags are
+  // all scoped to one backend, so a per-command override can only ever be a way to mix them.
+  // Choosing it once, at login, is the honest contract. NIRO_API_URL and the config file still
+  // work for every command, because both feed the same resolution chain the uploader uses.
+  //
+  // `niro new-temp-project` already refused this flag for exactly this reason; that local
+  // check is now redundant and has been removed in favour of this one.
+  program.hook("preAction", (_thisCommand, actionCommand) => {
+    if (!program.opts().apiUrl) return;
+    if (actionCommand.name() === "login") return;
+    console.error("`--api-url` only applies to `niro login`.");
+    console.error("  It was ignored by the upload path, so using it here would read from one");
+    console.error("  backend and write to another. Pick the backend once instead:");
+    console.error("    niro login --api-url <url>        log in to that backend");
+    console.error("    NIRO_API_URL=<url> niro <cmd>     or set it for every command");
+    process.exit(1);
+  });
 
   program
     .command("login")
@@ -19,7 +46,7 @@ function main() {
     .option("--email <email>", "email address (password flow only)")
     .action((opts) => run(async () => {
       const loginCmd = require("./commands/login");
-      await loginCmd.login({ ...opts, apiUrl: program.opts().apiUrl });
+      await loginCmd.login({ ...opts, apiUrl: program.opts().apiUrl }); // login: the one command that may set it
     }));
 
   program
@@ -48,7 +75,7 @@ function main() {
     .option("--quiet-period <seconds>", "debounce seconds before an auto-build (used with --auto-build on)")
     .option("--confirm-build <yes|no>", "whether to trigger the initial index build now without prompting")
     .option("--defaults", "accept default values for all env vars without prompting")
-    .option("--force", "proceed past cross-project/overlap warnings without confirming")
+    .option("--force", "onboard a folder with no build file, and proceed past cross-project/overlap warnings without confirming (never bypasses the home/root refusal)")
     .option("--no-watch", "return immediately after triggering the build instead of watching")
     .option(
       "-X, --module-exclude <pattern>",
@@ -64,7 +91,7 @@ function main() {
     )
     .action((pathArg, opts) => run(async () => {
       const initCmd = require("./commands/init");
-      await initCmd.init(pathArg, { ...opts, apiUrl: program.opts().apiUrl });
+      await initCmd.init(pathArg, { ...opts });
     }));
 
   // `niro add` subcommand group
@@ -79,6 +106,7 @@ function main() {
     .option("--name <name>", "display name for this repo")
     .option("--sync-mode <local|remote>", "sync on local file changes or remote commits (skips the interactive choice)")
     .option("--no-confirm", "skip confirmation prompts (non-interactive)")
+    .option("--force", "onboard a folder with no build file in it (never bypasses the home/root refusal)")
     .option("--token-id <id>", "git token ID for private repos")
     .option(
       "-X, --module-exclude <pattern>",
@@ -94,7 +122,7 @@ function main() {
     )
     .action((pathArg, opts) => run(async () => {
       const cmd = require("./commands/add-repo");
-      await cmd.addRepo(pathArg, { ...opts, apiUrl: program.opts().apiUrl });
+      await cmd.addRepo(pathArg, { ...opts });
     }));
 
   add
@@ -103,7 +131,7 @@ function main() {
     .option("--no-watch", "return immediately after triggering the build")
     .action((opts) => run(async () => {
       const cmd = require("./commands/add-project");
-      await cmd.addProject({ ...opts, apiUrl: program.opts().apiUrl });
+      await cmd.addProject({ ...opts });
     }));
 
   program
@@ -112,7 +140,7 @@ function main() {
     .option("--json", "emit machine-readable JSON")
     .action((pathArg, opts) => run(async () => {
       const infoCmd = require("./commands/info");
-      await infoCmd.info(pathArg, { ...opts, apiUrl: program.opts().apiUrl });
+      await infoCmd.info(pathArg, { ...opts });
     }));
 
   program
@@ -131,7 +159,7 @@ function main() {
     .option("--json", "emit machine-readable JSON where supported (set-env, list-env)")
     .action((opts) => run(async () => {
       const editCmd = require("./commands/edit");
-      await editCmd.edit({ ...opts, apiUrl: program.opts().apiUrl });
+      await editCmd.edit({ ...opts });
     }));
 
   program
@@ -143,7 +171,7 @@ function main() {
     .option("--confirm-name <value>", "required for --project: must equal the project's alias or id")
     .action((opts) => run(async () => {
       const removeCmd = require("./commands/remove");
-      await removeCmd.remove({ ...opts, apiUrl: program.opts().apiUrl });
+      await removeCmd.remove({ ...opts });
     }));
 
   program
@@ -161,7 +189,7 @@ function main() {
     .option("--project <id_or_alias>", "which project to base the temporary project on when the repo maps to several")
     .action((pathArg, opts) => run(async () => {
       const cmd = require("./commands/takeover");
-      await cmd.takeover(pathArg, { ...opts, apiUrl: program.opts().apiUrl });
+      await cmd.takeover(pathArg, { ...opts });
     }));
 
   program
@@ -172,7 +200,7 @@ function main() {
     .option("--project <temp_project_id>", "the temporary project to discard, when this machine has no local record of it (e.g. created elsewhere)")
     .action((pathArg, opts) => run(async () => {
       const cmd = require("./commands/release");
-      await cmd.release(pathArg, { ...opts, apiUrl: program.opts().apiUrl });
+      await cmd.release(pathArg, { ...opts });
     }));
 
   program
@@ -181,7 +209,7 @@ function main() {
     .option("--json", "emit machine-readable JSON")
     .action((projectId, opts) => run(async () => {
       const statusCmd = require("./commands/status");
-      await statusCmd.status(projectId, { ...opts, apiUrl: program.opts().apiUrl });
+      await statusCmd.status(projectId, { ...opts });
     }));
 
   program
@@ -191,7 +219,7 @@ function main() {
     .option("--json", "emit machine-readable JSON")
     .action((opts) => run(async () => {
       const projectsCmd = require("./commands/projects");
-      await projectsCmd.projects({ ...opts, apiUrl: program.opts().apiUrl });
+      await projectsCmd.projects({ ...opts });
     }));
 
   program
@@ -202,7 +230,7 @@ function main() {
     .option("--json", "emit machine-readable JSON status (NDJSON: one object per status change + a final summary)")
     .action((projectId, opts) => run(async () => {
       const buildCmd = require("./commands/build");
-      await buildCmd.build(projectId, { ...opts, apiUrl: program.opts().apiUrl });
+      await buildCmd.build(projectId, { ...opts });
     }));
 
   program
@@ -211,7 +239,7 @@ function main() {
     .option("-y, --yes", "skip the confirmation prompt")
     .action((projectId, opts) => run(async () => {
       const deleteCmd = require("./commands/delete");
-      await deleteCmd.deleteProject(projectId, { ...opts, apiUrl: program.opts().apiUrl });
+      await deleteCmd.deleteProject(projectId, { ...opts });
     }));
 
   const svc = program
@@ -265,6 +293,12 @@ function main() {
     .command("serve")
     .description("Run the Niro MCP server over stdio (used by your editor's MCP config).")
     .action(() => { require("./commands/mcp").serve(); });
+  mcp
+    .command("receipt")
+    .description("Turn the end-of-task Niro line on or off for this machine. No flags shows the current state.")
+    .option("--on", "Turn the end-of-task line back on.")
+    .option("--off", "Stop showing the end-of-task line.")
+    .action((opts) => { require("./commands/mcp").receipt(opts); });
 
   program.parseAsync(process.argv).catch((err) => {
     console.error(err && err.message ? err.message : err);