@niroai/niro 0.4.0 → 0.6.0

package/src/mcp/setup.js

@@ -127,6 +127,17 @@ function isNiroPreToolUseHook(h) {
   return cmds.some((c) => c.includes("should_create_temp_project") || c.includes("should_sandbox_repo"));
 }
 
+/**
+ * True if `h` is niro's Stop hook (the end-of-task receipt). Keyed on the exact subcommand it runs,
+ * which no other tool would have a reason to invoke. Shared by installer and uninstaller.
+ */
+function isNiroStopHook(h) {
+  const cmds = [];
+  if (h && Array.isArray(h.hooks)) h.hooks.forEach((i) => i && typeof i.command === "string" && cmds.push(i.command));
+  if (h && typeof h.command === "string") cmds.push(h.command);
+  return cmds.some((c) => c.includes("mcp receipt --hook"));
+}
+
 /**
  * True if `h` is niro's PreToolUse explore-first reminder entry (matcher Grep|Glob|Read). Keyed on the
  * unique `niro-explore-` marker-file prefix so a foreign PreToolUse hook on the same matcher is never
@@ -565,6 +576,7 @@ async function setupClaudeCode(apiKey, mcpServerUrl) {
   addClaudeCodeUserPromptHook();
   addClaudeCodePreToolUseHook();
   addClaudeCodeExploreHook();
+  removeStaleNiroStopHook();
   addClaudeCodeMemory();
   addClaudeCodeSkill();
   addClaudeCodeCliSkill();
@@ -769,6 +781,47 @@ const NIRO_PRETOOL_COMMAND = [
   `printf '%s' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","additionalContext":"Niro temporary project check: you are editing a Niro-indexed repo on its CURRENT branch. The temporary project answer is per branch, so a check you ran on a different branch (e.g. before switching) does NOT count here. Call should_create_temp_project(git_url, branch=current branch, project_id from its .niro-project) for THIS repo now and run niro new-temp-project if it returns needs_temp_project. Shown once per repo per branch per session."}}'`,
 ].join('; ');
 
+/**
+ * Removes a Stop hook left behind by an earlier version of this installer.
+ *
+ * Niro used to print the end-of-task receipt from a Claude Code Stop hook. It worked, but Claude
+ * Code labels anything a Stop hook prints with "Stop says: …", which read as a confusing system
+ * warning rather than a note from Niro. The receipt is now printed by the model itself, wrapped in
+ * backticks, which renders as code in every client rather than just this one.
+ *
+ * Anyone who installed the hook version still has it on disk, and hooks are frozen there until an
+ * install re-runs — so a plain upgrade would leave them seeing "Stop says:" for ever. Hence removing
+ * it here rather than only in uninstall. Other Stop hooks, including the developer's own, are
+ * matched by our exact subcommand and never touched.
+ */
+function removeStaleNiroStopHook() {
+  const settingsPath = path.join(process.env.HOME || "", ".claude", "settings.json");
+  let settings;
+  try {
+    if (!fs.existsSync(settingsPath)) return;
+    settings = JSON.parse(fs.readFileSync(settingsPath, "utf-8"));
+  } catch {
+    return; // unreadable or malformed — leave it alone rather than risk rewriting it
+  }
+  const stop = settings.hooks && settings.hooks.Stop;
+  if (!Array.isArray(stop)) return;
+
+  const kept = stop.filter((h) => !isNiroStopHook(h));
+  if (kept.length === stop.length) return;
+
+  settings.hooks.Stop = kept;
+  if (kept.length === 0) delete settings.hooks.Stop;
+  if (Object.keys(settings.hooks).length === 0) delete settings.hooks;
+
+  try {
+    fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+    console.log("  Removed the old Stop hook — the end-of-task line now comes from Niro directly,");
+    console.log("  without the \"Stop says:\" prefix Claude Code adds to hook output.\n");
+  } catch (err) {
+    console.warn(`  Could not update ~/.claude/settings.json: ${err.message}`);
+  }
+}
+
 /**
  * Adds the PreToolUse (Edit|Write) temporary project-reminder hook to ~/.claude/settings.json. Idempotent:
  * upgrades a stale niro entry in place, never touches a foreign PreToolUse hook (matched by the
@@ -1427,53 +1480,222 @@ async function setupCodex(apiKey, mcpServerUrl) {
 
 /**
  * After `codex mcp add` writes [mcp_servers.niro], set
- * `default_tools_approval_mode = "auto"` — niro tools are all read-only, so no per-tool
- * approval prompts (codex mcp add has no flag for this; we insert it directly after the
- * table header, which is valid TOML — bare keys precede any sub-table). Idempotent and a
- * safe no-op if the file/table is missing. Also prints the optional `required = true`
- * recommendation (left off by default: it would make niro a hard Codex startup dependency).
+ * `default_tools_approval_mode = "writes"` — prompt only for tools that write, and niro writes
+ * nothing, so nothing prompts.
+ *
+ * It was "auto" until a developer reported being asked to approve every single call. Codex accepts
+ * four values (`auto`, `prompt`, `writes`, `approve` — confirmed from its own validation error on a
+ * bad one), and "auto" means Codex decides for itself. It decides to ask. "writes" states the fact
+ * about niro that makes asking unnecessary, rather than delegating the judgement.
+ *
+ * Inserted directly after the table header, which is valid TOML — bare keys precede any sub-table.
+ * Idempotent and a safe no-op if the file or table is missing. Also prints the optional
+ * `required = true` recommendation (left off by default: it would make niro a hard Codex startup
+ * dependency).
  */
-function hardenCodexServerConfig() {
-  const cfgPath = path.join(process.env.HOME || "", ".codex", "config.toml");
-  const header = "[mcp_servers.niro]";
+/**
+ * Write ~/.codex/config.toml, then prove Codex can still load it — rolling back if it cannot.
+ *
+ * This file holds [mcp_servers.niro] itself, so a malformed edit does not merely fail: it makes
+ * Codex reject the whole file and takes the developer's Niro registration down with it. That is the
+ * failure mode that got a Codex hook built and pulled twice (ae7bdaa, dcc4f7f), and the lesson from
+ * it was that every write here needs a verify-and-rollback rather than care alone.
+ *
+ * Atomic temp-then-rename, with the original file mode preserved. Widening permissions matters:
+ * this file can hold API keys, and an earlier version of the pulled work reset 0600 to 0644 on
+ * rollback.
+ *
+ * Verification runs the real binary. `codex mcp get niro` parses the config and prints the server,
+ * so a non-zero exit means Codex would not load what we just wrote. If the binary is missing we
+ * cannot verify, and the write is skipped entirely — an unverifiable edit to this file is not worth
+ * the risk it carries.
+ */
+function writeCodexConfigVerified(cfgPath, contents) {
+  const { execSync } = require("child_process");
+
+  try {
+    execSync("command -v codex >/dev/null 2>&1", { stdio: "ignore", shell: "/bin/sh" });
+  } catch {
+    throw new Error("codex is not on PATH, so the edit cannot be verified — leaving the file alone");
+  }
+
+  const previous = fs.readFileSync(cfgPath, "utf-8");
+  let mode = 0o600;
+  try {
+    mode = fs.statSync(cfgPath).mode & 0o777;
+  } catch {
+    /* fall back to the conservative default above */
+  }
+
+  const tmp = `${cfgPath}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, contents, { mode });
+  fs.renameSync(tmp, cfgPath);
 
+  try {
+    execSync("codex mcp get niro", { stdio: "ignore", timeout: 15000 });
+  } catch (err) {
+    // Put it back exactly as it was, mode included, then report.
+    const rollback = `${cfgPath}.${process.pid}.rollback`;
+    fs.writeFileSync(rollback, previous, { mode });
+    fs.renameSync(rollback, cfgPath);
+    throw new Error("Codex could not load the edited config — rolled back, nothing changed");
+  }
+}
+
+/**
+ * Remove [mcp_servers.niro.tools.*] approval overrides from ~/.codex/config.toml.
+ *
+ * Codex writes one of these each time a developer answers a tool prompt with "approve once", and a
+ * per-tool setting overrides default_tools_approval_mode. The result is a config that looks correctly
+ * configured and prompts on every single call.
+ *
+ * Only niro's own sub-tables are touched, matched by their full prefix. This is the file that holds
+ * [mcp_servers.niro] itself, so a careless edit costs the developer their whole Niro registration —
+ * the reason a Codex hook was built and pulled twice (ae7bdaa, dcc4f7f). Hence: read, rewrite in
+ * memory, and only write when the result still parses as something Codex will load.
+ *
+ * Returns how many tables were removed; 0 on any failure, having changed nothing.
+ */
+function clearCodexPerToolApprovals(cfgPath) {
   let toml;
   try {
     toml = fs.readFileSync(cfgPath, "utf-8");
   } catch {
-    console.warn("  Could not read ~/.codex/config.toml to set the approval mode — skipping.\n");
-    return;
+    return 0;
   }
 
-  const idx = toml.indexOf(header);
-  if (idx === -1) {
-    console.warn("  [mcp_servers.niro] not found in config.toml — skipping approval-mode hardening.\n");
-    return;
+  // A table runs from its header to the next header at any level, or end of file.
+  const pattern = /\n\[mcp_servers\.niro\.tools\.[^\]]+\]\n(?:(?!\n?\[)[^\n]*\n)*/g;
+  const matches = toml.match(pattern);
+  if (!matches || matches.length === 0) return 0;
+
+  const rewritten = toml.replace(pattern, "\n").replace(/\n{3,}/g, "\n\n");
+
+  // Refuse to write anything that lost the niro server itself. Cheap, and the failure it guards
+  // against is the one that matters.
+  if (!rewritten.includes("[mcp_servers.niro]")) {
+    console.warn("  Skipped clearing Codex tool approvals — the edit would have dropped [mcp_servers.niro].\n");
+    return 0;
+  }
+
+  try {
+    writeCodexConfigVerified(cfgPath, rewritten);
+  } catch (err) {
+    console.warn(`  Could not clear Codex per-tool approvals: ${err.message}\n`);
+    return 0;
   }
 
-  // Limit the "already set?" check to the niro table body (up to the next table header).
-  const after = toml.slice(idx + header.length);
-  const nextTableRel = after.search(/\n\s*\[/);
-  const tableBody = nextTableRel === -1 ? after : after.slice(0, nextTableRel);
+  console.log(`  Cleared ${matches.length} per-tool approval override${matches.length === 1 ? "" : "s"} for niro.`);
+  console.log("  → those beat default_tools_approval_mode and made every call prompt.\n");
+  return matches.length;
+}
+
+/**
+ * Absolute path to Codex's config.toml, honouring CODEX_HOME.
+ *
+ * `codex mcp add` writes wherever CODEX_HOME points, so reading from a hard-coded ~/.codex would
+ * edit a file Codex never loads while reporting success — the server registered in one place and the
+ * approval mode set in another.
+ *
+ * Returns null rather than a relative path when no home resolves. userHome() can be "", and
+ * path.join("", ".codex", "config.toml") yields ".codex/config.toml" relative to the current working
+ * directory, which on some machines is a git-tracked project folder.
+ */
+function codexConfigPath() {
+  const codexHome = process.env.CODEX_HOME && process.env.CODEX_HOME.trim();
+  if (codexHome) return path.join(codexHome, "config.toml");
+  const home = userHome();
+  if (!home) return null;
+  return path.join(home, ".codex", "config.toml");
+}
+
+function hardenCodexServerConfig() {
+  const cfgPath = codexConfigPath();
+  if (!cfgPath) {
+    console.warn("  Could not resolve ~/.codex/config.toml — skipping approval-mode hardening.\n");
+    return;
+  }
 
   console.log("  Tip: for a hard dependency, add `required = true` under [mcp_servers.niro]");
   console.log("       (Codex then fails startup if niro is unreachable — off by default).\n");
 
-  if (/^\s*default_tools_approval_mode\s*=/m.test(tableBody)) {
-    console.log("  Codex approval mode already set — skipping.\n");
+  // Clear per-tool overrides FIRST. Codex writes a [mcp_servers.niro.tools.<name>] table with
+  // approval_mode = "approve" whenever the developer answers a prompt with "approve once" rather
+  // than "always allow", and a per-tool setting BEATS default_tools_approval_mode. So the default
+  // below can be correct while every call still prompts — exactly what a developer reported.
+  //
+  // This rewrites the file, so everything after it must work from freshly read contents. An earlier
+  // version computed byte offsets BEFORE this call and spliced with them afterwards, which inserted
+  // text into the middle of an unrelated line whenever the rewrite shortened anything above the niro
+  // header. That produced invalid TOML, and Codex refuses to load a config it cannot parse — taking
+  // [mcp_servers.niro] and every other server's credentials down with it.
+  clearCodexPerToolApprovals(cfgPath);
+
+  const located = locateCodexNiroTable(cfgPath);
+  if (!located) {
+    console.warn("  [mcp_servers.niro] not found in config.toml — skipping approval-mode hardening.\n");
+    return;
+  }
+  const { toml, bodyStart, bodyEnd, body } = located;
+
+  const existing = body.match(/^[ \t]*default_tools_approval_mode[ \t]*=[ \t]*"([^"]*)"/m);
+
+  if (existing && existing[1] !== "auto") {
+    console.log(`  Codex approval mode already set to "${existing[1]}" — leaving your choice alone.\n`);
     return;
   }
 
-  const insertAt = idx + header.length;
-  const newToml = toml.slice(0, insertAt) + '\ndefault_tools_approval_mode = "auto"' + toml.slice(insertAt);
+  // Every edit below is confined to niro's own table slice. Replacing across the whole file with a
+  // single /m regex rewrote the FIRST matching line anywhere in it — which, since `codex mcp add`
+  // appends niro last, was reliably ANOTHER server's line. That silently relaxed a third party's
+  // approval settings and left niro's untouched, while printing that it had succeeded.
+  let newBody;
+  let message;
+  if (existing) {
+    newBody = body.replace(/^([ \t]*default_tools_approval_mode[ \t]*=[ \t]*)"auto"/m, '$1"writes"');
+    message = ['  Changed Codex approval mode from "auto" to "writes".',
+               '  -> "auto" let Codex decide, and it decided to ask on every call.'];
+  } else {
+    // A bare key must precede any sub-table, so it goes at the very top of the body.
+    newBody = '\ndefault_tools_approval_mode = "writes"' + body;
+    message = ['  Set default_tools_approval_mode = "writes" in ~/.codex/config.toml',
+               "  -> niro is read-only, so its tools run without per-call approval prompts."];
+  }
+
+  if (newBody === body) return; // nothing to do
 
   try {
-    fs.writeFileSync(cfgPath, newToml);
-    console.log('  Set default_tools_approval_mode = "auto" in ~/.codex/config.toml');
-    console.log("  → niro is read-only, so its tools run without per-call approval prompts.\n");
+    writeCodexConfigVerified(cfgPath, toml.slice(0, bodyStart) + newBody + toml.slice(bodyEnd));
+    message.forEach((line) => console.log(line));
+    console.log("");
   } catch (err) {
-    console.warn(`  Could not update ~/.codex/config.toml: ${err.message}\n`);
+    console.warn(`  Could not update the Codex approval mode: ${err.message}\n`);
+  }
+}
+
+/**
+ * Locate [mcp_servers.niro]'s body in the CURRENT contents of config.toml.
+ *
+ * Returns the whole file plus the byte range of the table body (everything after the header, up to
+ * the next table header at any level). Read fresh on every call: any offset computed before another
+ * function rewrote the file is a splice into the wrong place waiting to happen.
+ */
+function locateCodexNiroTable(cfgPath) {
+  const header = "[mcp_servers.niro]";
+  let toml;
+  try {
+    toml = fs.readFileSync(cfgPath, "utf-8");
+  } catch {
+    return null;
   }
+  const idx = toml.indexOf(header);
+  if (idx === -1) return null;
+
+  const bodyStart = idx + header.length;
+  const after = toml.slice(bodyStart);
+  const nextTableRel = after.search(/\n[ \t]*\[/);
+  const bodyEnd = nextTableRel === -1 ? toml.length : bodyStart + nextTableRel;
+  return { toml, bodyStart, bodyEnd, body: toml.slice(bodyStart, bodyEnd) };
 }
 
 /**
@@ -2125,6 +2347,9 @@ module.exports = {
   isNiroUserPromptHook,
   isNiroPreToolUseHook,
   isNiroExploreHook,
+  isNiroStopHook,
+  clearCodexPerToolApprovals,
+  hardenCodexServerConfig,
   userHome,
   // Exposed for tests: the hook bodies are shell, so the only way to prove they still fire (and still
   // carry their identity token) is to execute the real string.

package/src/mcp/teardown.js

@@ -6,7 +6,8 @@
  * `niro mcp uninstall` removes everything `niro mcp install` wrote, per editor:
  *   - the MCP server registration (claude/codex CLI, or the editor's JSON config)
  *   - the niro hooks in ~/.claude/settings.json (PostCompact + UserPromptSubmit + PreToolUse: both the
- *     Edit|Write temp-project reminder and the Grep|Glob|Read explore-first reminder)
+ *     Edit|Write temp-project reminder and the Grep|Glob|Read explore-first reminder + Stop: the
+ *     end-of-task receipt line), and any receipts still pending on disk
  *   - the niro section in markdown config (CLAUDE.md / AGENTS.md / Windsurf rules)
  *   - the generated skills (~/.claude/skills, the shared ~/.agents/skills)
  *   - Cursor's "niro:*" allowlist entry and project rule
@@ -36,6 +37,7 @@ const {
   CLIENTS,
   NIRO_MD_MARKER,
   NIRO_MD_SECTIONS,
+  isNiroStopHook,
   isNiroPostCompactHook,
   isNiroUserPromptHook,
   isNiroPreToolUseHook,
@@ -154,6 +156,12 @@ function filterNiroHooks(settings) {
     removed += before - hooks.PreToolUse.length;
     if (hooks.PreToolUse.length === 0) delete hooks.PreToolUse;
   }
+  if (Array.isArray(hooks.Stop)) {
+    const before = hooks.Stop.length;
+    hooks.Stop = hooks.Stop.filter((h) => !isNiroStopHook(h));
+    removed += before - hooks.Stop.length;
+    if (hooks.Stop.length === 0) delete hooks.Stop;
+  }
   if (Object.keys(hooks).length === 0) delete settings.hooks;
 
   return { settings, removed };
@@ -375,6 +383,14 @@ function uninstallClaudeCode() {
   const home = userHome();
   runMcpRemove("claude", ["mcp", "remove", "niro", "--scope", "user"]);
   stripNiroHooksFromSettings(path.join(home, ".claude", "settings.json"));
+  // Claude Code is the only client with the Stop hook, so its pending receipts have nothing left to
+  // read them. Leaving them behind would mean a reinstall months later opens with a line describing
+  // a task the developer has long forgotten.
+  try {
+    require("../lib/receiptStore").purge();
+  } catch {
+    /* best effort — never block an uninstall on cleaning up a cache */
+  }
   stripMarkerFromFile(path.join(home, ".claude", "CLAUDE.md"), "Claude Code memory");
   deleteFileIfPresent(path.join(home, ".claude", "skills", "niro-skill", "SKILL.md"), "niro skill");
   deleteFileIfPresent(path.join(home, ".claude", "skills", "niro-cli", "SKILL.md"), "niro-cli skill");