@niroai/niro 0.8.0 → 0.9.0

package/CHANGELOG.md

@@ -2,6 +2,47 @@
 
 Notable changes to `@niroai/niro`. Dates are release dates.
 
+## 0.9.0 — 2026-08-26
+
+One change to how the client waits, and two fixes for cases where Niro and your machine
+disagreed about what still exists.
+
+### Upgrading
+
+```bash
+npm install -g @niroai/niro@latest
+```
+
+Nothing extra is needed from 0.8.0. Against an older server the waiting change simply does not
+engage, because the client decides from the server's answer rather than from a version.
+
+**Creating a working copy no longer times out.** It takes 44 to 60 seconds, and it used to run
+inside a single request, against a gateway that gives up at 60. Three at once on 26 August all
+came back as gateway error pages, and because such an error says nothing about whether the work
+finished, the real cause underneath went unread for an afternoon. The client now asks the server
+to do it in the background and waits for it to finish, showing progress. A dropped connection
+while waiting is not treated as a failure, because the copy is still being made on the server; an
+expired login is, because waiting cannot fix it.
+
+**Discarding a working copy the server had already deleted.** A working copy can go away
+without your machine being told: someone deletes it in the web UI, or the server reaps it
+after it has sat idle for two weeks. The folder on your machine kept a registration pointing
+at it, and `niro discard-temp-project`, which is what clears that registration, failed before
+it got that far. The registration is also what makes `niro new-temp-project` in a second
+worktree refuse, advising you to run discard in the other folder, so the advice named the one
+command that could not work. Discard now treats a project the server says is missing as
+nothing left to delete: it skips the server call and does the local half, pointing the folder
+back at the original project. A server it could not reach, or one that refuses because the
+copy belongs to another developer, still fails loudly and changes nothing, which matters
+because the server answers both of those with the same status code as a deleted project.
+
+**A detached checkout stopped Niro answering.** During `git bisect`, or after checking out a
+tag, your repo is on no branch. `git rev-parse --abbrev-ref HEAD` does not fail there, it
+prints the word `HEAD`, and Niro passed that on as though it were a branch name. Nothing
+indexes a branch called `HEAD`, so the server treated every such question as coming from a
+diverged branch and declined to answer it, for the whole bisect. Niro now reports no branch,
+which is what the server already had a rule for, and answers from the indexed project.
+
 ## 0.8.0 — 2026-08-26
 
 Needed before a server has the layered store turned on. On an older client the new

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@niroai/niro",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Niro — one package: the niro CLI plus the Niro MCP server (code intelligence for AI coding assistants).",
   "keywords": [
     "niro",

package/src/commands/release.js

@@ -22,6 +22,7 @@ const git = require("../lib/git");
 const niroProjectFile = require("../lib/niroProjectFile");
 const prompt = require("../lib/prompt");
 const watchState = require("../lib/watchState");
+const tempProject = require("../lib/tempProject");
 
 const ok = (s) => color.green(s);
 const warn = (s) => color.yellow(s);
@@ -56,26 +57,80 @@ async function release(pathArg, opts = {}) {
         "`niro discard-temp-project --project <temp-project-id>`. The server refuses to delete anything " +
         "that is not a temporary project, so this is always safe.");
   }
-  const project = await api.get(`/api/projects/${encodeURIComponent(tempProjectId)}`);
-  const cloneOf = project.clone_of_project_id || project.cloneOfProjectId;
-  if (!cloneOf) {
-    throw new Error(`Project ${tempProjectId} is not a temporary project — refusing. ` +
-        "(discard only deletes projects created by `niro new-temp-project`)");
+  // The temporary project may ALREADY be gone from the server, and nothing tells this machine when
+  // that happens: the idle sweeper reaps it after N days, and deleting it in the UI goes down the
+  // ordinary project-delete path. This fetch used to throw on that, BEFORE any local cleanup ran, so
+  // the folder kept a registration pointing at a project that no longer exists — and the only advice
+  // anything offered ("run `niro discard-temp-project` in that folder first") named this very command,
+  // which then failed the same way. A definitive not-found means there is nothing left to delete, so
+  // skip the server half and do the local half, which is the half that was still needed.
+  let project = null;
+  let cloneOf = null;
+  let alreadyGone = false;
+  try {
+    project = await api.get(`/api/projects/${encodeURIComponent(tempProjectId)}`);
+  } catch (err) {
+    // Only a definitive "no such project" counts. A network blip, a 401, a 500 or a genuine
+    // permissions refusal must still fail loudly — rewriting local registrations because the server
+    // could not be reached is exactly the mistake this command exists to undo.
+    if (!tempProject.isProjectNotFound(err)) throw err;
+    alreadyGone = true;
+  }
+  if (alreadyGone && !opts.project && !(entry && entry.takeover)) {
+    // The id did not come from a takeover backup or from the user — it came from a `.niro-project`
+    // pin that happens to name a missing project. Nothing here says this folder was ever taken over,
+    // so there is no warrant to touch its registration.
+    throw new Error(`Project ${tempProjectId} does not exist on this backend, and nothing on this ` +
+        "machine records a temporary project for this folder — refusing to change anything. " +
+        "If you know the temporary project's id, pass it explicitly: " +
+        "`niro discard-temp-project --project <temp-project-id>`.");
+  }
+  if (!alreadyGone) {
+    cloneOf = project.clone_of_project_id || project.cloneOfProjectId;
+    if (!cloneOf) {
+      throw new Error(`Project ${tempProjectId} is not a temporary project — refusing. ` +
+          "(discard only deletes projects created by `niro new-temp-project`)");
+    }
   }
 
   // Every folder registered against this temp project (multi-repo takeover, ADR-016).
   const currentDir = path.resolve(targetDir);
-  const folders = watchState.allLocal(baseUrl).filter((e) => e.projectId === tempProjectId);
+  let folders = watchState.allLocal(baseUrl).filter((e) => e.projectId === tempProjectId);
   if (!folders.some((e) => path.resolve(e.folderPath) === currentDir)) {
     folders.push({ folderPath: targetDir, ...(entry || {}) });
   }
+  if (alreadyGone) {
+    // Two corrections that only matter once the server is no longer there to check the id against.
+    //
+    // Drop any folder not actually registered against THIS project. The line above adds the current
+    // folder unconditionally, which is right when the id came from that folder, and wrong when it came
+    // from `--project`: a mistyped or already-discarded id, run from a folder holding a DIFFERENT live
+    // working copy, would rewrite that copy's registration and report it as cleaned up. On the alive
+    // path the server's own answer bounds the damage; here nothing does.
+    folders = folders.filter((e) => e.projectId === tempProjectId);
+    // Then recover the source project from whichever folder recorded it. Every folder in one working
+    // copy is a clone of the SAME source project (ADR-016 extends a copy with more repos, it never
+    // spans two sources), so any one backup answers for all of them — including a sibling that has no
+    // backup of its own, which would otherwise be left pointing at the deleted project while the alive
+    // path restores it from `clone_of_project_id`.
+    const witness = folders.find((e) => e.takeover && e.takeover.sourceProjectId);
+    if (!witness) {
+      throw new Error(`Project ${tempProjectId} does not exist on this backend, and no folder on this ` +
+          "machine records which project it was a working copy of — refusing to guess. " +
+          "Nothing has been changed.");
+    }
+    cloneOf = witness.takeover.sourceProjectId;
+  }
 
   // ADR-018 discard guard: deleting the temp project kills coverage for EVERY repo in it. Check each
   // folder's CURRENT branch against its recorded source branch; a folder still on a feature branch is
   // in-flight work whose coverage this discard would destroy. Old entries without sourceBranch can't be
   // verified client-side (the server-side nudge guard still covers the agent-driven path).
+  // Skipped when the copy is already gone: this guard exists to warn BEFORE destroying coverage, and
+  // there is no coverage left to destroy. Leaving it on would ask the developer to confirm losing
+  // something they have already lost, and then refuse non-interactively over it.
   const stillDiverged = [];
-  for (const e of folders) {
+  for (const e of alreadyGone ? [] : folders) {
     const sourceBranch = e.takeover && e.takeover.sourceBranch;
     if (!sourceBranch || !fs.existsSync(e.folderPath)) continue;
     try {
@@ -103,7 +158,7 @@ async function release(pathArg, opts = {}) {
         return;
       }
     }
-  } else if (process.stdout.isTTY && !opts.yes) {
+  } else if (!alreadyGone && process.stdout.isTTY && !opts.yes) {
     const sure = await prompt.confirm(
       `Discard temporary project ${color.bold(project.alias || tempProjectId)}?`);
     if (!sure) {
@@ -112,7 +167,9 @@ async function release(pathArg, opts = {}) {
     }
   }
 
-  await api.post(`/api/projects/${encodeURIComponent(tempProjectId)}/clone/release`, {});
+  if (!alreadyGone) {
+    await api.post(`/api/projects/${encodeURIComponent(tempProjectId)}/clone/release`, {});
+  }
 
   // Restore each folder's local registration. ADR-018: the .niro-project file is left ALONE unless it
   // still carries the OLD-STYLE swapped pin (pre-ADR-018 takeover) — then it points at a now-deleted
@@ -175,7 +232,16 @@ async function release(pathArg, opts = {}) {
     }
   }
 
-  console.log(`\n  ${ok("✓")} Temporary project discarded. Niro routes back to the original project automatically.`);
+  if (alreadyGone) {
+    console.log(`\n  ${ok("✓")} Temporary project ${color.bold(tempProjectId)} was already gone from the server` +
+        color.dim(" (deleted from the UI, or reaped after sitting idle)."));
+    console.log(repinned.length
+      ? `  ${ok("✓")} Cleaned up ${repinned.length} local registration(s) that still pointed at it. ` +
+        "Niro routes back to the original project automatically."
+      : `  ${ok("✓")} Nothing left to clean up locally.`);
+  } else {
+    console.log(`\n  ${ok("✓")} Temporary project discarded. Niro routes back to the original project automatically.`);
+  }
   if (healed.length) {
     console.log(color.dim("  Healed old-style pins:"));
     for (const h of healed) console.log(color.dim(`    ${h.folder} → ${h.to}`));

package/src/commands/takeover.js

@@ -22,6 +22,7 @@ const git = require("../lib/git");
 const prompt = require("../lib/prompt");
 const watchState = require("../lib/watchState");
 const resolveCtxLib = require("../lib/resolveContext");
+const spinner = require("../lib/spinner");
 
 const ok = (s) => color.green(s);
 const warn = (s) => color.yellow(s);
@@ -146,9 +147,7 @@ async function takeover(pathArg, opts = {}) {
   // 2. Create-or-extend server-side (ADR-016). If you already have a temporary project of this project,
   // the backend EXTENDS it — adds this repo to the same copy — instead of minting a second one, so
   // cross-repo answers stay coherent. Either way this folder's repo becomes AGENT_UPLOAD.
-  const outcome = await api.post(
-    `/api/projects/${encodeURIComponent(source.project_id)}/clone`,
-    { local_git_ids: [source.git_id], branch });
+  const outcome = await requestClone(source.project_id, source.git_id, branch);
   const newProjectId = outcome.new_project_id || outcome.newProjectId;
   const gitIdMap = outcome.git_id_map || outcome.gitIdMap || {};
   const newGitId = gitIdMap[source.git_id];
@@ -273,4 +272,87 @@ async function takeover(pathArg, opts = {}) {
   console.log(color.dim("  routing falls back to the original project by itself."));
 }
 
-module.exports = { takeover };
+
+/**
+ * Ask the server for a working copy, and wait for it without holding the request open.
+ *
+ * WHY. The copy takes 44 to 60 seconds. It used to run inside the POST, and the gateway in front of
+ * the server gives up at 60, so three requests at once on 2026-08-26 all came back as HTML 504 pages.
+ * A 504 also says nothing about whether the work finished: the real error underneath, a duplicate key
+ * from a migration that had not been run, went unread for an afternoon because of it.
+ *
+ * WORKS AGAINST BOTH SERVERS, and that is why it branches on the RESPONSE rather than on a version.
+ * A server that understands `async` returns 202 and a job id to poll. An older one ignores the unknown
+ * field and returns the outcome inline exactly as before, which is the shape this already handled. So
+ * there is no capability check to keep in step, and no flag day.
+ */
+async function requestClone(projectId, gitId, branch, opts = {}) {
+  const started = await api.post(
+    `/api/projects/${encodeURIComponent(projectId)}/clone`,
+    { local_git_ids: [gitId], branch, async: true });
+
+  const jobId = started && (started.job_id || started.jobId);
+  if (!jobId) {
+    return started; // older server: it did the work inline and this IS the outcome
+  }
+
+  // Poll until it finishes. The interval is deliberately not tight: nothing is waiting on the answer
+  // faster than a person reads, and a shorter one only adds load to the server doing the copy.
+  // A seam, not a knob: tests pass a small value so they do not sit through real polls.
+  const POLL_MS = opts.pollMs || 2000;
+  const GIVE_UP_MS = opts.giveUpMs || 15 * 60 * 1000;
+  const startedAt = Date.now();
+  const deadline = startedAt + GIVE_UP_MS;
+  const sp = spinner.start("Building your temporary project...");
+  try {
+    for (;;) {
+      await sleep(POLL_MS);
+      let job;
+      try {
+        job = await api.get(`/api/projects/clone/job/${encodeURIComponent(jobId)}`);
+      } catch (e) {
+        // A blip while polling is not a failed clone. The copy is running on the server regardless of
+        // whether this one request reached it, so keep waiting rather than reporting a failure that
+        // has not happened. A 404 is different: the job is gone, and waiting cannot bring it back.
+        // Waiting cannot fix an expired token or a revoked account, and 15 minutes of silent retrying
+        // before finally reporting it is worse than saying so at once.
+        if (e && (e.status === 401 || e.status === 403)) {
+          throw e;
+        }
+        if (e && e.status === 404) {
+          throw new Error(
+            `The server has no record of clone job ${jobId}. It may have expired, or the server was `
+            + "restarted mid-copy. Run `niro new-temp-project` again.");
+        }
+        if (Date.now() > deadline) throw e;
+        continue;
+      }
+      const state = job && job.state;
+      if (state === "SUCCEEDED") {
+        sp.stop();
+        return job.outcome;
+      }
+      if (state === "FAILED") {
+        sp.stop();
+        throw new Error(job.error || "The server could not create the temporary project.");
+      }
+      if (Date.now() > deadline) {
+        sp.stop();
+        throw new Error(
+          `Still building after ${Math.round(GIVE_UP_MS / 60000)} minutes. The server may still finish; `
+          + `check with \`niro status\` before running this again.`);
+      }
+      // Deliberately NOT re-labelled with the elapsed time. Without a TTY the spinner prints a fresh
+      // line every time the label CHANGES, so putting the seconds in it produced one line per poll:
+      // measured at 10 lines in 11 seconds. The spinner already shows elapsed time where it can.
+    }
+  } finally {
+    sp.stop();
+  }
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+module.exports = { takeover, requestClone};

package/src/lib/git.js

@@ -7,6 +7,25 @@ const fs = require("fs");
 const path = require("path");
 const { execSync } = require("child_process");
 
+/**
+ * The branch name from `git rev-parse --abbrev-ref HEAD`, or null when there is no branch.
+ *
+ * On a detached HEAD (a bisect, a tag checkout, a plain commit checkout) that command does not
+ * fail — it prints the literal string "HEAD". A caller that trusts it verbatim therefore reports a
+ * branch named "HEAD", which no repository has, and everything downstream reads the checkout as
+ * being on an unknown branch rather than on no branch at all.
+ *
+ * `inspect` below has always collapsed that to null, matching what the `.git/HEAD` file read
+ * returns. This is that one rule, shared, so a second caller cannot drift from it. One already had:
+ * the MCP bridge sent "HEAD" straight through, so the server's routing ladder took every detached
+ * checkout for a diverged branch and refused to answer it, even though the ladder has an explicit
+ * guard meant to route exactly that case to the indexed project.
+ */
+function normalizeBranch(raw) {
+  const b = typeof raw === "string" ? raw.trim() : "";
+  return b && b !== "HEAD" ? b : null;
+}
+
 function findGitDir(startDir) {
   let dir = path.resolve(startDir);
   const root = path.parse(dir).root;
@@ -93,8 +112,7 @@ function inspect(startDir) {
   // unavailable the calls return null and behaviour is identical to before.
   if (originUrl === null) originUrl = redactRemoteCreds(gitOut("git remote get-url origin", found.repoRoot));
   if (branch === null) {
-    const b = gitOut("git rev-parse --abbrev-ref HEAD", found.repoRoot);
-    branch = b && b !== "HEAD" ? b : null; // "HEAD" = detached; keep null like the file read
+    branch = normalizeBranch(gitOut("git rev-parse --abbrev-ref HEAD", found.repoRoot));
   }
   return { repoRoot: found.repoRoot, originUrl, branch };
 }
@@ -210,4 +228,4 @@ function isTracked(repoRoot, relativePath) {
 }
 
 module.exports = { inspect, mainWorktreeRoot, deriveRepoName, checkIgnored, checkIgnoredPaths,
-  redactRemoteCreds, isTracked };
+  redactRemoteCreds, isTracked, normalizeBranch };

package/src/lib/tempProject.js

@@ -34,4 +34,28 @@ async function currentBranch(tempProjectId, gitId, opts = {}) {
   return match && match.branch ? match.branch : null;
 }
 
-module.exports = { currentBranch };
+/**
+ * True when an error from a project read means "this project does not exist on this backend".
+ *
+ * Status alone cannot answer it. A deleted project fails its access check before anything looks for
+ * the row, and that check raises AccessDeniedException, which the backend maps to 403 — the SAME
+ * status it returns when the project is alive but belongs to someone else
+ * (AccessControlService.validateProjectAccess, GlobalExceptionHandler). Treating every 403 as "gone"
+ * would let a permissions problem wipe a healthy local registration, and treating none of them as
+ * gone is what left dead registrations behind in the first place. So the message decides: only a
+ * missing row produces "Project not found", while the other two say "User does not have access to
+ * project" and "User not found".
+ *
+ * A bare status is deliberately NOT enough, not even a 404. This route does not produce one today,
+ * so a 404 here means something other than the API answered: a proxy, or an HTML error page. Its
+ * sibling agentApi.isRepoNotFound does accept a bare 404, and can afford to — being wrong there
+ * costs a re-registration. Being wrong here destroys the record of how to undo a takeover, so this
+ * one fails toward keeping it: an unrecognised failure throws and changes nothing.
+ */
+function isProjectNotFound(err) {
+  if (!err) return false;
+  const text = `${err.message || ""} ${typeof err.body === "string" ? err.body : ""}`;
+  return /project not found/i.test(text);
+}
+
+module.exports = { currentBranch, isProjectNotFound };

package/src/mcp/server.js

@@ -41,7 +41,7 @@ const path = require("path");
 const readline = require("readline");
 const { execSync } = require("child_process");
 const niroProjectFile = require("../lib/niroProjectFile");
-const { redactRemoteCreds } = require("../lib/git");
+const { redactRemoteCreds, normalizeBranch } = require("../lib/git");
 const receiptStore = require("../lib/receiptStore");
 
 /** Absolute path to ~/.niro/projects.json. Uses os.homedir() so it also resolves on Windows, where HOME is
@@ -161,8 +161,13 @@ function detectGitContext(dir) {
     if (dir) opts.cwd = dir;
     const remote = execSync("git remote get-url origin 2>/dev/null", opts).trim();
     if (!remote) return null;
+    // normalizeBranch, not a bare trim: on a detached HEAD this command PRINTS "HEAD" instead of
+    // failing, and sending that verbatim told the server the checkout was on a branch called "HEAD".
+    // Nothing indexes such a branch, so the routing ladder read every bisect / tag checkout as
+    // diverged and refused to answer it — past its own guard for detached HEAD, which only fires on
+    // a null branch. `git.inspect` has always collapsed "HEAD" to null; this shares that one rule.
     let branch = null;
-    try { branch = execSync("git rev-parse --abbrev-ref HEAD 2>/dev/null", opts).trim(); } catch (_) {}
+    try { branch = normalizeBranch(execSync("git rev-parse --abbrev-ref HEAD 2>/dev/null", opts)); } catch (_) {}
     // The freshness/takeover notices compare the local HEAD + dirty state against what Niro indexed, so
     // the bridge must report them — without git_commit the server-side check no-ops entirely.
     let commit = null;