pendingyou 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,63 @@
 # Changelog
 
+## 0.11.0
+
+- One step for the coding agents on a computer (Darin, 2026-10-04): `npx -y pendingyou@latest init` finds Claude Code
+  and Codex (`--app claude-code,codex` names some), says what it found and which it can't set up (an agent too old for
+  it is named, with the version it needs), and sets each up with one approval. Then: restart the agent, and its first
+  session finishes setting up by itself (whoami, report_setup, a test card). Asked for by name and not installed, or
+  nothing found at all: it says so and stops before anyone signs in.
+- One sign-in everywhere: each agent's MCP server signs in through this computer's own connection ("Claude Code on
+  Ann-MBP", "Codex on Ann-MBP"), through the headers helper, on every computer but Windows; 0.10.0 did that only over
+  SSH. The hooks use the same connection, so there's nothing to Authenticate and no second sign-in. Each agent gets a
+  sign-in and a client of its own (`credentials.json`: Claude Code's under the address as before, another agent's under
+  `<address>#<app>`, so a 0.10.0 process still running keeps it; a `.gitignore` of `*` in the folder).
+- Several agents, one approval: a device sign-in each, started together and shown as one link,
+  `/device?code=A&code=B`, which Pending You turns into one consent card naming each agent and the computer, with one
+  Allow (needs Pending You's Worker from this release). On a computer with a browser, the browser opens on it ("Your
+  browser is open on Pending You: press Allow once for Claude Code and Codex (codes …)"); over SSH, the link, a QR code
+  and each code. `--device` shows the codes anywhere, `--browser` opens the browser anyway, `--no-browser` only prints
+  the address. Cancel stops `init` before it changes anything. `login --app <app>` signs one agent in again, with its
+  own client, so it keeps its connection; `login --browser` no longer refuses a connection.
+- Codex CLI (0.152 or later, whose `http_headers_helper` can give Authorization): its `[mcp_servers.pendingyou]` table
+  in `~/.codex/config.toml`, edited in place with every other line as it was, signed in through the helper
+  (`--app codex`) with `default_tools_approval_mode = "approve"`; a stored OAuth sign-in, which would win over the
+  helper, is logged out first. Its skill in `~/.agents/skills/pendingyou/SKILL.md`, and four hooks in
+  `~/.codex/hooks.json`, added after the person's own: a session start (startup, resume, clear), each message, Pending
+  You's card tools, and the Stop check (pattern matching on Codex's final message, once a turn at most). Codex runs a
+  hook only once the person trusts it: `init` says to choose “Trust all and continue”, `status` says which are trusted
+  (from Codex's own hash of each), and `uninstall` keeps the trust of the person's own hooks that move up when ours go.
+  When a card a Codex thread posted is answered, a listener the hooks start for that thread runs `codex queue` in the
+  wake mod's words (never with the answer itself, which other programs could read in its arguments) (Codex 0.157 or later starts a turn on an idle thread; `init` says so on an older
+  one). A server and hooks Codex's `/import` copied from Claude Code are replaced. Not on Windows yet.
+- What happens to a `pendingyou` server that's there is decided before anyone signs in. At this Pending You, signing
+  in by itself (the agent's own OAuth, or the Pending You plugin with no server added by hand): moved to this
+  computer's sign-in without a word where there's no browser, on Yes (the default) at a terminal after saying what
+  that means, or with `--yes`; with nobody to ask, kept, with the command that switches it. Kept, the agent's hooks get
+  a sign-in that only hears, and a kept plugin carries the skill, so none is saved. At another Pending You: replaced
+  once the person says so (or `--yes`); kept, that agent is left as it is.
+- `--oauth`: every agent signs in to its MCP server by itself, as before 0.11.0 (Claude Code's `claude mcp add`; Codex's
+  table without the helper, then `codex mcp login pendingyou`).
+- Finishing setup by itself: a session start (new, resumed or cleared, never a compaction) adds one line while Pending
+  You says the agent's setup isn't finished (hear_answers' `for.setup`, on the request the hook makes anyway): what to
+  call, or that the test card's answer is waiting to be picked up; at most 3 times per `init`, none after 7 days, never
+  once it's verified. `init`'s copy of the wake mod starts that turn itself in Claude Code 2.1.287 or later. `init`
+  ends with the sentence to say when it doesn't, on its own line: “Finish setting up Pending You: it’s connected here
+  already.” (`FINISH_SAY`, the same as Pending You's pages).
+- The hooks run a script with a path that never changes, `~/.config/pendingyou/bin/pendingyou-hook <command> --app
+  <app>`, which runs this version's private copy: upgrading rewrites the script, never the hook lines. Every request a
+  hook or the listener makes names its app (`source`).
+- Node, without the shell's PATH (a Claude Code started from its desktop app or an IDE, Codex's stripped environment):
+  `init` records the Node it ran with by its stable path (`/opt/homebrew/bin/node`, not the Cellar folder an upgrade
+  removes), and the helper and the hooks' script also look in `/opt/homebrew/bin`, `/usr/local/bin` and `~/.volta/bin`.
+  A Mac is named by its own name (`scutil --get ComputerName`) unless `--name` says otherwise.
+- `status` has a section for each agent `init` set up, a `Setup:` line (finished, waiting for the first session with
+  the sentence to say, the test card waiting on you, or answered and being picked up) that never changes Ready, and
+  "no browser here" in its header only when that's true. `uninstall` covers each agent, takes out the shared parts once
+  none is left, says which connections stay on your Assistants page, and ends with how to connect again.
+- `pendingyou mcp --app <app>` is reserved for a stdio MCP server for an agent that can't run a headers helper; it says
+  it isn't ready yet.
+
 ## 0.10.0
 
 - The wake mod: Claude Code 2.1.287 or later is woken when you answer, with nothing waiting in the background. A

package/README.md

@@ -1,51 +1,101 @@
 # pendingyou
 
-Pending You for Claude Code. Your assistants ask you in [Pending You](https://www.pendingyou.com) when you're away;
-this command lets Claude Code hear your answer the moment it's ready, even while it sits idle at the prompt.
+Pending You for your coding agents. Your agents ask you in [Pending You](https://www.pendingyou.com) when you're away;
+this command sets Claude Code and Codex up to ask there and to hear your answer the moment it's ready, even while they
+sit idle at the prompt.
 
 ```sh
-npx pendingyou init
+npx -y pendingyou@latest init
 ```
 
-Run it once on each computer. It:
-
-- adds the Pending You MCP server to Claude Code for every project (unless it's already there),
-- saves the Pending You skill to `~/.claude/skills/pendingyou/SKILL.md`,
-- signs this computer in (your browser opens once; press Allow; over SSH, a code on your phone instead, as
-  [below](#a-computer-with-no-browser)),
-- adds three hooks to `~/.claude/settings.json`: a new session picks up answers that arrived while nothing was
-  running, your next message brings a waiting answer with it, and a check when Claude Code finishes a turn (below),
-- lets Claude Code start `npx pendingyou hold` and use Pending You's tools without a permission prompt, so a question
-  it asks while you're away doesn't wait on one,
-- keeps a copy of this version for the hooks in `~/.config/pendingyou/cli/<version>/`, so they start in a few
-  hundredths of a second instead of waiting on npx (about half a second each),
-- on Claude Code 2.1.287 or later, adds the wake mod in that copy to `CLAUDE_CODE_PLUGIN_DIRS` (`env` in
-  `~/.claude/settings.json`), so every session is woken when you answer (below). Other folders already there are kept;
-  an older version's copy is replaced.
-
-Your other settings are kept as they are. `npx pendingyou uninstall` removes exactly what `init` added.
-
-Adding the MCP server can take Claude Code a minute or more (it checks its servers); `init` says when it's waiting on
-that. If Claude Code already has a `pendingyou` server pointing somewhere else (staging, say), `init` names both and
-asks before replacing it; `--yes` replaces it without asking, and with nobody to ask it prints the two commands to
-run. Afterwards restart Claude Code, run `/mcp`, choose pendingyou and Authenticate (on a computer with no browser
-there's nothing to authenticate: [below](#a-computer-with-no-browser)).
+Run it once on each computer, in a terminal. It finds the agents on the computer (Claude Code, Codex; `--app` names
+some), says what it found, and for each one:
+
+- connects it to Pending You through **this computer's own sign-in**: its own connection ("Claude Code on Ann-MBP",
+  "Codex on Ann-MBP" on your Assistants page), which its MCP server and its hooks share, so there's nothing to
+  Authenticate in the agent and no second sign-in,
+- signs them all in with **one approval**: your browser opens on Pending You with one card naming each agent and this
+  computer, and you press Allow once (over SSH: a code and a QR code for your phone, [below](#a-computer-with-no-browser)),
+- adds the Pending You MCP server for every project, signed in through a small helper script, and lets the agent use
+  Pending You's tools without asking each time,
+- saves the Pending You skill (Claude Code: `~/.claude/skills/pendingyou/SKILL.md`; Codex:
+  `~/.agents/skills/pendingyou/SKILL.md`),
+- adds the hooks that hand it your answers: a new session picks up answers that arrived while nothing was running,
+  your next message brings a waiting answer with it, and a check when it finishes a turn catches what it left you only
+  in chat ([below](#nothing-left-only-in-chat)),
+- and wakes it when you answer: Claude Code 2.1.287 or later through the wake mod, Codex through `codex queue`.
+
+Then it says what to do next, and the one sentence to say if it's needed:
 
-If the `pendingyou` MCP server Claude Code uses in a session's folder is another Pending You than the hooks' (staging
-and production, say), both hooks add one line telling Claude Code so, and to ask you which one you use: its cards
-would otherwise go where you don't look. `npx pendingyou status` flags it too. Fix it with `npx pendingyou init
---origin <the one you use>`, then restart the session.
+```
+Next: restart Claude Code here (/exit, then claude --continue), or start it in the folder you work in.
+It finishes setting up by itself and sends you a test card. If it doesn't, say this to it:
+
+Finish setting up Pending You: it’s connected here already.
+```
+
+The first session finishes setting up on its own: it checks in with Pending You, reports what's set up and sends you a
+test card. Claude Code 2.1.287 or later starts that turn by itself; otherwise (and in Codex, after you choose “Trust all
+and continue” for its hooks) the session start adds one line saying what's left, and you say the sentence.
+`npx pendingyou status` says what's set up for each agent, what's missing with the command that fixes it, and how setup
+stands. `npx pendingyou uninstall` removes exactly what `init` added.
+
+Your other settings are kept as they are: `init` merges into Claude Code's `~/.claude/settings.json`, Codex's
+`~/.codex/config.toml` (its `[mcp_servers.pendingyou]` table and nothing else, every other line as it was) and
+`~/.codex/hooks.json`, and running it again changes nothing it doesn't need to.
+
+**A pendingyou server that's there already** is decided on before anyone signs in. One at another Pending You
+(staging, say) is named and replaced only once you say so (`--yes` replaces it without asking); keep it and that agent
+is left as it is. One at this Pending You that signs in by itself (Claude Code's `/mcp` → Authenticate, Codex's
+`codex mcp login`, or the Pending You plugin for Claude) is moved to this computer's sign-in: without asking where
+there's no browser (it can't finish there anyway), on Yes (the default) at a terminal, or with `--yes`; with nobody to
+ask it's kept, and `init` prints the command that switches it. The connection it had stays on your Assistants page for
+you to remove, and answers to the cards it asked through that one won't reach the agent by themselves. A kept plugin
+carries the skill, so none is saved. `--oauth` keeps every agent signing in by itself, as before 0.11.0.
+
+The hooks run a copy of this version kept in `~/.config/pendingyou/cli/<version>/`, through a small script with a path
+that never changes, `~/.config/pendingyou/bin/pendingyou-hook`:
+
+```
+"~/.config/pendingyou/bin/pendingyou-hook" pickup --app claude-code || true
+```
+
+(the path in full). Upgrading rewrites that script, never the hook lines, so Codex, which runs a hook only while you
+trust its exact definition, doesn't ask again. The script runs the copy with the Node `init` ran with, by its stable
+path (Homebrew's `/opt/homebrew/bin/node`, which outlives an upgrade), or the first Node it finds. If the copy can't be
+made (no npm, no network), the hooks run through `npx -y --prefer-offline pendingyou@<version>` instead.
 
 The hooks never get in your way: if anything goes wrong (no network, not signed in, a bad option), they print nothing
 and let your message through. Each one stops within 3 seconds whatever happens, with at most its one-line reminder, and
 never refreshes the sign-in itself: when that's due, it starts the refresh in the background, which finishes on its
-own. Running `init` again updates them in place, and adds any a newer version brings.
+own. Each hands an agent only its own app's cards from its folder, never one another agent posted there.
+
+If the `pendingyou` MCP server Claude Code uses in a session's folder is another Pending You than the hooks' (staging
+and production, say), both hooks add one line telling Claude Code so, and to ask you which one you use: its cards
+would otherwise go where you don't look. `npx pendingyou status` flags it too. Fix it with `npx pendingyou init
+--origin <the one you use>`, then restart the session. Codex's hooks do the same for Codex's server.
+
+## Codex
 
-The hooks run that copy with Node directly, like
-`"/opt/homebrew/bin/node" "~/.config/pendingyou/cli/0.10.0/node_modules/pendingyou/dist/cli.js" handoff || true` (the
-paths in full). If the copy can't be made (no npm, no network), they run through `npx -y --prefer-offline
-pendingyou@<version>` instead. `npx pendingyou status` says which. If you remove the Node they run with, run `init`
-again.
+Codex CLI 0.152 or later (its `http_headers_helper` gives the sign-in; 0.157 or later wakes an idle thread by itself).
+`init` writes, in `~/.codex/config.toml`:
+
+```toml
+[mcp_servers.pendingyou]
+url = "https://www.pendingyou.com/mcp"
+http_headers_helper = "/Users/ann/.config/pendingyou/bin/pendingyou-mcp-headers --app codex"
+default_tools_approval_mode = "approve"
+```
+
+and four hooks in `~/.codex/hooks.json`: a session start, each message, Pending You's card tools (so the Stop check
+knows a turn posted, and so the thread is woken), and the Stop check. **Codex runs a hook only once you trust it**: start
+`codex` and choose “Trust all and continue” (or trust them in `/hooks`). `status` says which are trusted. A
+`pendingyou` server or hooks Codex's `/import` copied from Claude Code (without its sign-in) are replaced.
+
+When you answer a card a Codex thread posted, a small listener `init`'s hooks start for that thread puts a message into
+it with `codex queue`: “Pending You: your person answered “…” (req_…). Call get_request …”, which reads your answer (the
+answer itself never goes in a command's arguments, where other programs could see it). Codex starts a turn at
+once when the thread is open and idle, after the current one when it's working, or when you next open it.
 
 ## Nothing left only in chat
 
@@ -78,6 +128,10 @@ card titled “Confirm in Claude Code on <computer>: <step>”, with the exact w
 session's link when Remote Control or Claude Code on the web gives one) and what it'll do then. Only such a message
 costs a request: this folder's open cards, given up after 1.5 seconds.
 
+Codex gets the same two (0.11.0). Its Stop check reads Codex's final message, and whether the turn posted, updated or
+replied on a card comes from Codex's own hook for Pending You's tools in that turn; it asks once a turn at most, for an
+action card titled “Confirm in Codex on <computer>: <step>” when it asked you to type something there.
+
 **On 0.2.0 with another origin?** Its hooks blocked every message (`There's no "--origin" command`). Run
 `npx pendingyou@latest init --origin <url>` again to repair them; see [CHANGELOG.md](CHANGELOG.md).
 
@@ -111,41 +165,37 @@ next message brings any answer with it too.
 When you're at the terminal, Claude Code asks you there and puts the same question in Pending You at once; the
 first answer wins. If you answer in the terminal, it withdraws the card and the hold ends by itself.
 
+**Finishing setup by itself (0.11.0).** In `init`'s copy of the mod, a few seconds after a session you're at opens
+(never `claude -p`), it asks Pending You whether Claude Code is set up here (`whoami`, once Pending You's tools are
+allowed and the server has connected). When it isn't, it starts one turn once the session is idle: “Finish setting up
+Pending You: it’s connected here already.” and exactly what to do. Once per session, in at most three sessions, never
+two within ten minutes, and never again once Pending You says it's set up.
+
 ## A computer with no browser
 
-On a devbox or server you reach over SSH, `/mcp`'s Authenticate opens a browser on that machine, which you can't
-reach. So SSH in, and at the prompt there run:
+On a devbox or server you reach over SSH, an agent's own sign-in opens a browser on that machine, which you can't
+reach. `init` signs in with a code there instead: SSH in, and at the prompt there run
 
 ```sh
-npx pendingyou init
+npx -y pendingyou@latest init
 ```
 
-`init` sees it's an SSH session (or Linux with no display) and signs the machine in with a code instead: it shows the
-code, `pendingyou.com/device` and a QR code of the link with the code in it. Open it on your phone, sign in, check the
-code matches and press Allow. Only allow a code your own computer is showing you. That one approval makes the machine
-a Claude Code connection of its own ("Claude Code on devbox" on your Assistants page), and `init` sets up the rest:
-
-- adds the `pendingyou` MCP server for every project with a `headersHelper` instead of OAuth
-  (`claude mcp add-json --scope user pendingyou '{"type":"http","url":"…/mcp","headersHelper":"…"}'`), so Claude Code
-  signs in through this machine's sign-in and there's nothing to Authenticate,
-- writes that helper, `~/.config/pendingyou/bin/pendingyou-mcp-headers`, a small sh script Claude Code runs each time
-  it connects. It finds Node on PATH, else nvm's default (`$NVM_DIR` or `~/.nvm`), else the Node `init` ran with,
-  runs this version's own copy (never npx), and prints only `{"Authorization":"Bearer …"}`, refreshing the sign-in
-  when it's due,
-- adds the wake mod, the hooks and Pending You's tools to `~/.claude/settings.json` as above, so Remote Control,
-  terminal multiplexers and plain SSH sessions all get them, whatever shell profile they read.
+It sees it's an SSH session (or Linux with no display) and shows a link for your phone, a QR code of it, and each code,
+for every agent it found. Open it on your phone, sign in, check the codes match and press Allow once. Only allow codes
+your own computer is showing you. `--device` shows codes like this anywhere; `--browser` opens the browser anyway;
+`--no-browser` only prints the address.
 
 Run it at an interactive prompt after you SSH in, not as `ssh host npx pendingyou init`: on stock Ubuntu that one-line
-form doesn't read your shell's setup, so nvm's Node and `claude` may not be on PATH. `--device` sets a computer up this
-way wherever it is, and `--browser` uses the browser instead. Then start Claude Code there and ask it to finish
-setting up Pending You. `npx pendingyou status` says what's set up and what's missing, with the command that fixes it.
-If the sign-in ends (30 days, or you remove the machine on your Assistants page), `npx pendingyou login` approves a
-new code and keeps the same connection.
+form doesn't read your shell's setup, so nvm's Node, `claude` and `codex` may not be on PATH. The helper script and the
+hooks find Node anyway when the agents run without your shell's PATH (a systemd service, a terminal multiplexer,
+Remote Control): on PATH, nvm's default, the one `init` ran with, or where Node usually is.
 
 The machine is called by its Tailscale name when Tailscale is installed and running (as `tailscale status` shows it),
-else by its hostname, or by `--name devbox` on `init` or `login`. A cloud's own hostname (AWS's `ip-10-42-1-252`) is
-kept when there's nothing better, and `login` says how to change it: `npx pendingyou login --name <name>` asks for one
-more approval on your phone and renames the connection, which stays the same one.
+else by its hostname, or by `--name devbox` on `init` or `login`; a Mac by its own name (Sharing in System Settings). A
+cloud's own hostname (AWS's `ip-10-42-1-252`) is kept when there's nothing better, and `login` says how to change it:
+`npx pendingyou login --name <name>` asks for one more approval and renames the connection, which stays the same one.
+If an agent's sign-in ends (30 days, or you remove it on your Assistants page), `npx pendingyou login` (`--app codex`
+for Codex's) approves a new code and keeps the same connection.
 
 Only want this command's own sign-in (for `watch`, below)? `npx pendingyou login --device` signs it in with a code,
 hearing answers only, and adds no connection. Your phone asks "Let devbox hear your answers for the assistants running
@@ -170,35 +220,44 @@ more, then skipped. `--once` stops after the first.
 
 | Command | What it does |
 | --- | --- |
-| `init` | Set up Claude Code on this computer (`--no-login`, `--no-browser`, `--device`, `--browser`, `--yes`) |
+| `init` | Set up every agent on this computer (`--app`, `--oauth`, `--no-login`, `--no-browser`, `--device`, `--browser`, `--yes`, `--name`) |
 | `hold <requestId>` | Wait for the answer, print it, exit (`--timeout 4h`); the wake mod answers it itself |
-| `status` | What's set up; exits 0 when Claude Code hears answers right away |
-| `login` / `logout` | Sign this computer in or out (`--device`, `--browser`, `--force`, `--all`) |
+| `status` | What's set up for each agent; exits 0 when each hears answers right away (`--app`) |
+| `login` / `logout` | Sign an agent in again, or out (`--app`, `--device`, `--browser`, `--force`, `--name`, `--all`) |
 | `watch -- <command>` | Run a command each time an answer is ready (`--once`) |
-| `pickup` / `handoff` | The session-start and next-message hooks |
-| `stopcheck` | The Stop hook: items for you left only in chat |
-| `uninstall` | Remove what `init` added, and sign out |
+| `pickup` / `handoff` | The session-start and next-message hooks (`--app`) |
+| `stopcheck` | The Stop hook: items for you left only in chat (`--app`) |
+| `uninstall` | Remove what `init` added, and sign out (`--app`) |
+| `mcp --app <app>` | Not yet: a stdio MCP server for an agent that can't run a headers helper |
 
-Every command takes `--origin` (default `https://www.pendingyou.com`, or `$PENDINGYOU_ORIGIN`). Options can come
-before or after the command.
+Every command takes `--origin` (default `https://www.pendingyou.com`, or `$PENDINGYOU_ORIGIN`). `--app` takes
+`claude-code` or `codex` (several with commas where a command sets up or reports several); with none, a command that
+acts for one agent acts for Claude Code. Options can come before or after the command.
 
 ## What it can see, and where it keeps things
 
-The sign-in only hears answers to your own Claude Code assistants' questions (or, for one made before 2026-10-04, to the one assistant you picked). It isn't an assistant: it can't ask,
-answer or change anything, and it doesn't show up as one. The hooks and `hold` hand a session only the cards its own
-app (Claude Code) posted from its folder, never one Codex or another app posted there. On a computer with no browser it's that computer's Claude
-Code connection instead, which Claude Code asks through, and the hooks hear its answers only. It's stored in
-`~/.config/pendingyou/credentials.json` (readable only by you), refreshes itself, and ends after 30 days or on
-`logout`; `clients.json` remembers which sign-in a computer's connection used, so signing in again keeps it. `state.json` beside it remembers
-which answers were already handed over (ids only), `claude-code.json` what `init` added, and `cli/` the hooks' copy
-of the command line. `init`, `status` and the hooks read `~/.claude.json` (and a folder's `.mcp.json`, and
-`~/.claude/settings.json`'s enabled plugins) only to see whether Claude Code has a `pendingyou` MCP server and where
-it points. Nothing is sent anywhere but Pending You.
+Each agent's sign-in is that agent's own connection on Pending You, signed in from this computer: it can post cards,
+change or cancel its own, read the answers to them and reply in their threads, and it can't answer anything for you.
+The hooks use the same sign-in, and hand a session only the cards its own app posted from its folder. An agent that
+signs in by itself (`--oauth`, or one you kept) gets a sign-in that only hears its answers instead: it can't ask,
+answer or change anything, and doesn't show up as an assistant. They're stored in `~/.config/pendingyou/credentials.json`
+(readable only by you, in a folder with a `.gitignore` of `*` so a dotfiles repository never takes it), refresh
+themselves, and end after 30 days or on `logout`. The headers helper hands an agent's token only to that agent's
+Pending You (Claude Code says which server it's for; Codex's is the one `init` wrote). `clients.json` remembers which
+sign-in each agent's connection used, so signing in again keeps it.
+
+`state.json` beside them remembers which answers were already handed over (ids only) and how many session starts
+reminded an unfinished setup; `claude-code.json` and `codex.json` what `init` added; `codex-threads.json` which cards
+each Codex thread waits on (ids, names and titles: never an answer); and `cli/` the hooks' copy of the command line.
+`init`, `status` and the hooks read `~/.claude.json` (and a folder's `.mcp.json`, and `~/.claude/settings.json`'s
+enabled plugins) and `~/.codex/config.toml` only to see whether the agent has a `pendingyou` MCP server and where it
+points. Nothing is sent anywhere but Pending You.
 
 The wake mod runs inside Claude Code and reaches Pending You only through the session's own connection, with
-`get_request` on the session's own cards. It keeps each session's cards (id, title, the agent's name, where each
-stands) in Claude Code's store for mods, `~/.claude/plugins/store/`, and forgets them once they close or after 7 days.
-It marks the copy acting for a session in that session's environment (`PENDINGYOU_WAKE_OWNER`).
+`get_request` on the session's own cards (and, in `init`'s copy, `whoami` to see whether setup is finished). It keeps
+each session's cards (id, title, the agent's name, where each stands) in Claude Code's store for mods,
+`~/.claude/plugins/store/`, and forgets them once they close or after 7 days. It marks the copy acting for a session in
+that session's environment (`PENDINGYOU_WAKE_OWNER`).
 
 ## Development
 

package/dist/api.js

@@ -9,15 +9,15 @@
 // a hook that needs a new token starts `pendingyou refresh` detached (background), which runs to the end under the
 // lock whatever happens to the hook, and waits for it only briefly; until it lands the hook uses the token it has, or
 // gives up and prints its plain fallback.
+//
+// Since 0.11.0 each app has its own sign-in (credentials.ts), and every call names the app it's for: its sign-in is
+// the one used, and a session's request names it as `source` (routing by sender, 2026-10-04), so Pending You returns
+// only that app's cards, never one Codex posted from the same folder to a Claude Code session there. `watch` names no
+// app: it hands answers to a script, not a session, with Claude Code's sign-in as before.
+import { DEFAULT_APP } from "./apps/ids.js";
 import { credentialsPath, readCredential, updateCredential, } from "./credentials.js";
 import { isLocked } from "./files.js";
 import { OAuthError, refresh } from "./oauth.js";
-/**
- * The app whose sessions the command line hands answers to: its hooks and holds run in Claude Code. Routing by sender
- * (2026-10-04): every request for a session names it, so Pending You returns only Claude Code's cards, never one Codex
- * or another app posted from the same folder. `watch` names none: it hands answers to a script, not a session.
- */
-export const SESSION_APP = 'claude-code';
 /** Refresh this long before the access token runs out. */
 const EARLY_MS = 60_000;
 /** A hook starts a background refresh this long before the access token runs out, and goes on with the old one. */
@@ -49,7 +49,7 @@ export class Unavailable extends Error {
  * Refreshes the sign-in under the lock unless it no longer needs it: a token with more than `earlyMs` left (or, when
  * `force`d after a 401, a refresh token another process already replaced) is used as it is.
  */
-async function refreshStored(io, origin, stored, options) {
+async function refreshStored(io, origin, stored, options, app) {
     let ended = false;
     const updated = await updateCredential(io, origin, async (current) => {
         if (!current)
@@ -71,35 +71,43 @@ async function refreshStored(io, origin, stored, options) {
             }
             throw error;
         }
-    });
+    }, app);
     if (!updated)
         throw new SignInNeeded(ended);
     return updated;
 }
-async function freshToken(io, origin, force) {
-    const stored = await readCredential(io, origin);
+async function freshToken(io, origin, force, app) {
+    const stored = await readCredential(io, origin, app);
     if (!stored)
         throw new SignInNeeded(false);
     if (!force && stored.expiresAt - EARLY_MS > io.now())
         return stored.accessToken;
-    return (await refreshStored(io, origin, stored, { force, earlyMs: EARLY_MS })).accessToken;
+    return (await refreshStored(io, origin, stored, { force, earlyMs: EARLY_MS }, app)).accessToken;
 }
+/** What a process starts to refresh an app's sign-in in the background: `--app` only for an app but Claude Code. */
+export const refreshArgs = (origin, app, force = false) => [
+    'refresh',
+    '--origin',
+    origin,
+    ...(app === DEFAULT_APP ? [] : ['--app', app]),
+    ...(force ? ['--force'] : []),
+];
 /**
  * `pendingyou refresh`, what a hook starts in the background: refreshes the sign-in when it runs out within SOON_MS
  * (or `force`, after a 401), under the lock, to the end. Quiet; true when there's a sign-in afterwards.
  */
-export async function refreshInBackground(io, origin, force) {
-    const stored = await readCredential(io, origin);
+export async function refreshInBackground(io, origin, force, app = DEFAULT_APP) {
+    const stored = await readCredential(io, origin, app);
     if (!stored)
         return false;
     if (!force && stored.expiresAt - SOON_MS > io.now())
         return true;
-    await refreshStored(io, origin, stored, { force, earlyMs: SOON_MS });
+    await refreshStored(io, origin, stored, { force, earlyMs: SOON_MS }, app);
     return true;
 }
 /** A hook's token: never refreshed here (see the top of this file). */
-async function hookToken(io, origin, force, signal) {
-    const stored = await readCredential(io, origin);
+async function hookToken(io, origin, force, signal, app) {
+    const stored = await readCredential(io, origin, app);
     if (!stored)
         throw new SignInNeeded(false);
     const left = stored.expiresAt - io.now();
@@ -107,14 +115,14 @@ async function hookToken(io, origin, force, signal) {
         return stored.accessToken;
     // One refresher at a time: a lock held now is a refresh (or a write) already under way.
     if (!(await isLocked(credentialsPath(io))))
-        io.background(['refresh', '--origin', origin, ...(force ? ['--force'] : [])]);
+        io.background(refreshArgs(origin, app, force));
     // Still good for a few seconds: this request goes with it, the next one with the new token.
     if (!force && left > USABLE_MS)
         return stored.accessToken;
     const until = io.now() + REFRESH_WAIT_MS;
     while (io.now() < until && !signal?.aborted) {
         await io.sleep(50, signal);
-        const current = await readCredential(io, origin);
+        const current = await readCredential(io, origin, app);
         if (!current)
             throw new SignInNeeded(true);
         if (current.refreshToken !== stored.refreshToken)
@@ -123,23 +131,23 @@ async function hookToken(io, origin, force, signal) {
     throw new Unavailable('The sign-in is being refreshed in the background.');
 }
 /**
- * The token `pendingyou mcp-headers` hands Claude Code (remote.ts). Claude Code runs the helper each time it connects
- * and gives it 10 seconds, so, as for a hook, a refresh is never made in this process: within 5 minutes of expiry it
- * starts `pendingyou refresh` detached and waits for its token, up to `waitMs`, then uses the old one while it still
- * works. A token handed over has at least 10 seconds left; Claude Code runs the helper again on a 401.
+ * The token `pendingyou mcp-headers` hands an app's MCP server (remote.ts). The app runs the helper each time it
+ * connects and gives it 10 seconds, so, as for a hook, a refresh is never made in this process: within 5 minutes of
+ * expiry it starts `pendingyou refresh` detached and waits for its token, up to `waitMs`, then uses the old one while it
+ * still works. A token handed over has at least 10 seconds left; the app runs the helper again on a 401.
  */
-export async function helperToken(io, origin, waitMs) {
-    const stored = await readCredential(io, origin);
+export async function helperToken(io, origin, waitMs, app = DEFAULT_APP) {
+    const stored = await readCredential(io, origin, app);
     if (!stored)
         throw new SignInNeeded(false);
     if (stored.expiresAt - io.now() > SOON_MS)
         return stored.accessToken;
     if (!(await isLocked(credentialsPath(io))))
-        io.background(['refresh', '--origin', origin]);
+        io.background(refreshArgs(origin, app));
     const until = io.now() + waitMs;
     while (io.now() < until) {
         await io.sleep(100);
-        const current = await readCredential(io, origin);
+        const current = await readCredential(io, origin, app);
         if (!current)
             throw new SignInNeeded(true);
         if (current.refreshToken !== stored.refreshToken)
@@ -163,17 +171,19 @@ function either(signal, ms) {
     return controller.signal;
 }
 /**
- * GETs `path` on `origin` as the command line, and returns the JSON body with its status. 401 after a refresh means
- * the sign-in is over (revoked, or 30 days passed). Network failures and 5xx are `Unavailable`.
+ * GETs `path` on `origin` as the command line, with an app's sign-in (Claude Code's unless `app` says), and returns the
+ * JSON body with its status. 401 after a refresh means the sign-in is over (revoked, or 30 days passed). Network
+ * failures and 5xx are `Unavailable`.
  */
 export async function getJson(io, origin, path, timeoutMs, signal, options = {}) {
+    const app = options.app ?? DEFAULT_APP;
     for (let attempt = 0;; attempt++) {
         let token;
         try {
             token =
                 options.hook && io.background
-                    ? await hookToken(io, origin, attempt > 0, signal)
-                    : await freshToken(io, origin, attempt > 0);
+                    ? await hookToken(io, origin, attempt > 0, signal, app)
+                    : await freshToken(io, origin, attempt > 0, app);
         }
         catch (error) {
             if (error instanceof Unavailable)
@@ -198,7 +208,7 @@ export async function getJson(io, origin, path, timeoutMs, signal, options = {})
             await response.body?.cancel();
             if (attempt === 0)
                 continue;
-            await updateCredential(io, origin, () => null);
+            await updateCredential(io, origin, () => null, app);
             throw new SignInNeeded(true);
         }
         if (response.status >= 500 || response.status === 429) {