pendingyou 0.10.0 → 0.12.0

package/dist/api.js

@@ -9,15 +9,15 @@
 // a hook that needs a new token starts `pendingyou refresh` detached (background), which runs to the end under the
 // lock whatever happens to the hook, and waits for it only briefly; until it lands the hook uses the token it has, or
 // gives up and prints its plain fallback.
+//
+// Since 0.11.0 each app has its own sign-in (credentials.ts), and every call names the app it's for: its sign-in is
+// the one used, and a session's request names it as `source` (routing by sender, 2026-10-04), so Pending You returns
+// only that app's cards, never one Codex posted from the same folder to a Claude Code session there. `watch` names no
+// app: it hands answers to a script, not a session, with Claude Code's sign-in as before.
+import { DEFAULT_APP } from "./apps/ids.js";
 import { credentialsPath, readCredential, updateCredential, } from "./credentials.js";
 import { isLocked } from "./files.js";
 import { OAuthError, refresh } from "./oauth.js";
-/**
- * The app whose sessions the command line hands answers to: its hooks and holds run in Claude Code. Routing by sender
- * (2026-10-04): every request for a session names it, so Pending You returns only Claude Code's cards, never one Codex
- * or another app posted from the same folder. `watch` names none: it hands answers to a script, not a session.
- */
-export const SESSION_APP = 'claude-code';
 /** Refresh this long before the access token runs out. */
 const EARLY_MS = 60_000;
 /** A hook starts a background refresh this long before the access token runs out, and goes on with the old one. */
@@ -49,7 +49,7 @@ export class Unavailable extends Error {
  * Refreshes the sign-in under the lock unless it no longer needs it: a token with more than `earlyMs` left (or, when
  * `force`d after a 401, a refresh token another process already replaced) is used as it is.
  */
-async function refreshStored(io, origin, stored, options) {
+async function refreshStored(io, origin, stored, options, app) {
     let ended = false;
     const updated = await updateCredential(io, origin, async (current) => {
         if (!current)
@@ -71,35 +71,43 @@ async function refreshStored(io, origin, stored, options) {
             }
             throw error;
         }
-    });
+    }, app);
     if (!updated)
         throw new SignInNeeded(ended);
     return updated;
 }
-async function freshToken(io, origin, force) {
-    const stored = await readCredential(io, origin);
+async function freshToken(io, origin, force, app) {
+    const stored = await readCredential(io, origin, app);
     if (!stored)
         throw new SignInNeeded(false);
     if (!force && stored.expiresAt - EARLY_MS > io.now())
         return stored.accessToken;
-    return (await refreshStored(io, origin, stored, { force, earlyMs: EARLY_MS })).accessToken;
+    return (await refreshStored(io, origin, stored, { force, earlyMs: EARLY_MS }, app)).accessToken;
 }
+/** What a process starts to refresh an app's sign-in in the background: `--app` only for an app but Claude Code. */
+export const refreshArgs = (origin, app, force = false) => [
+    'refresh',
+    '--origin',
+    origin,
+    ...(app === DEFAULT_APP ? [] : ['--app', app]),
+    ...(force ? ['--force'] : []),
+];
 /**
  * `pendingyou refresh`, what a hook starts in the background: refreshes the sign-in when it runs out within SOON_MS
  * (or `force`, after a 401), under the lock, to the end. Quiet; true when there's a sign-in afterwards.
  */
-export async function refreshInBackground(io, origin, force) {
-    const stored = await readCredential(io, origin);
+export async function refreshInBackground(io, origin, force, app = DEFAULT_APP) {
+    const stored = await readCredential(io, origin, app);
     if (!stored)
         return false;
     if (!force && stored.expiresAt - SOON_MS > io.now())
         return true;
-    await refreshStored(io, origin, stored, { force, earlyMs: SOON_MS });
+    await refreshStored(io, origin, stored, { force, earlyMs: SOON_MS }, app);
     return true;
 }
 /** A hook's token: never refreshed here (see the top of this file). */
-async function hookToken(io, origin, force, signal) {
-    const stored = await readCredential(io, origin);
+async function hookToken(io, origin, force, signal, app) {
+    const stored = await readCredential(io, origin, app);
     if (!stored)
         throw new SignInNeeded(false);
     const left = stored.expiresAt - io.now();
@@ -107,14 +115,14 @@ async function hookToken(io, origin, force, signal) {
         return stored.accessToken;
     // One refresher at a time: a lock held now is a refresh (or a write) already under way.
     if (!(await isLocked(credentialsPath(io))))
-        io.background(['refresh', '--origin', origin, ...(force ? ['--force'] : [])]);
+        io.background(refreshArgs(origin, app, force));
     // Still good for a few seconds: this request goes with it, the next one with the new token.
     if (!force && left > USABLE_MS)
         return stored.accessToken;
     const until = io.now() + REFRESH_WAIT_MS;
     while (io.now() < until && !signal?.aborted) {
         await io.sleep(50, signal);
-        const current = await readCredential(io, origin);
+        const current = await readCredential(io, origin, app);
         if (!current)
             throw new SignInNeeded(true);
         if (current.refreshToken !== stored.refreshToken)
@@ -123,29 +131,31 @@ async function hookToken(io, origin, force, signal) {
     throw new Unavailable('The sign-in is being refreshed in the background.');
 }
 /**
- * The token `pendingyou mcp-headers` hands Claude Code (remote.ts). Claude Code runs the helper each time it connects
- * and gives it 10 seconds, so, as for a hook, a refresh is never made in this process: within 5 minutes of expiry it
+ * The token `pendingyou mcp-headers` hands an app's MCP server (remote.ts), and the stdio bridge sends with each
+ * message (bridge.ts). The app runs the helper each time it connects and gives it 10 seconds, and the bridge may be
+ * stopped at any moment, so, as for a hook, a refresh is never made in this process: within 5 minutes of expiry it
  * starts `pendingyou refresh` detached and waits for its token, up to `waitMs`, then uses the old one while it still
- * works. A token handed over has at least 10 seconds left; Claude Code runs the helper again on a 401.
+ * works. A token handed over has at least 10 seconds left; the app runs the helper again on a 401. `force` (the bridge,
+ * after a 401) refreshes whatever the expiry says, and hands over only the new token.
  */
-export async function helperToken(io, origin, waitMs) {
-    const stored = await readCredential(io, origin);
+export async function helperToken(io, origin, waitMs, app = DEFAULT_APP, force = false) {
+    const stored = await readCredential(io, origin, app);
     if (!stored)
         throw new SignInNeeded(false);
-    if (stored.expiresAt - io.now() > SOON_MS)
+    if (!force && stored.expiresAt - io.now() > SOON_MS)
         return stored.accessToken;
     if (!(await isLocked(credentialsPath(io))))
-        io.background(['refresh', '--origin', origin]);
+        io.background(refreshArgs(origin, app, force));
     const until = io.now() + waitMs;
     while (io.now() < until) {
         await io.sleep(100);
-        const current = await readCredential(io, origin);
+        const current = await readCredential(io, origin, app);
         if (!current)
             throw new SignInNeeded(true);
         if (current.refreshToken !== stored.refreshToken)
             return current.accessToken;
     }
-    if (stored.expiresAt - io.now() > USABLE_MS)
+    if (!force && stored.expiresAt - io.now() > USABLE_MS)
         return stored.accessToken;
     throw new Unavailable('Pending You couldn’t be reached to refresh the sign-in.');
 }
@@ -163,17 +173,19 @@ function either(signal, ms) {
     return controller.signal;
 }
 /**
- * GETs `path` on `origin` as the command line, and returns the JSON body with its status. 401 after a refresh means
- * the sign-in is over (revoked, or 30 days passed). Network failures and 5xx are `Unavailable`.
+ * GETs `path` on `origin` as the command line, with an app's sign-in (Claude Code's unless `app` says), and returns the
+ * JSON body with its status. 401 after a refresh means the sign-in is over (revoked, or 30 days passed). Network
+ * failures and 5xx are `Unavailable`.
  */
 export async function getJson(io, origin, path, timeoutMs, signal, options = {}) {
+    const app = options.app ?? DEFAULT_APP;
     for (let attempt = 0;; attempt++) {
         let token;
         try {
             token =
                 options.hook && io.background
-                    ? await hookToken(io, origin, attempt > 0, signal)
-                    : await freshToken(io, origin, attempt > 0);
+                    ? await hookToken(io, origin, attempt > 0, signal, app)
+                    : await freshToken(io, origin, attempt > 0, app);
         }
         catch (error) {
             if (error instanceof Unavailable)
@@ -198,7 +210,7 @@ export async function getJson(io, origin, path, timeoutMs, signal, options = {})
             await response.body?.cancel();
             if (attempt === 0)
                 continue;
-            await updateCredential(io, origin, () => null);
+            await updateCredential(io, origin, () => null, app);
             throw new SignInNeeded(true);
         }
         if (response.status >= 500 || response.status === 429) {

package/dist/apps/claude-code.js

@@ -0,0 +1,365 @@
+// Claude Code (0.11.0's module of what claude.ts carries out): what `pendingyou init` decides before anyone signs in,
+// what it does after, `status`'s section and the lines init ends with.
+//
+// Its MCP server signs in through this computer's own connection ("Claude Code on devbox"), by the headers helper, on
+// every computer but Windows (where Claude Code runs a headersHelper through cmd) or with `--oauth`; the hooks use the
+// same connection, so one approval covers both. A pendingyou server that's there decides the rest, before signing in:
+// - ours, through the helper, at this Pending You: kept.
+// - one at this Pending You that signs in by itself (Claude Code's own /mcp → Authenticate), or no server beside an
+//   enabled Pending You plugin for it (whose server is OAuth): with no browser here it's switched without a word (as
+//   0.10.0 did: that sign-in can't finish here); at a terminal init asks, Yes by default; `--yes` switches; with nobody
+//   to ask it's kept, and init says how to switch. Kept, Claude Code signs in by itself and the hooks get a sign-in
+//   that only hears; kept beside the plugin, no skill is saved either: the plugin carries it.
+// - one at another Pending You: replaced once the person says so (or `--yes`), or else Claude Code is left alone.
+import { addCommand, claudeState, helperServer, installClaude, mcpFromClaude, mcpFromFile, PLUGIN_ORIGINS, pluginFor, readManifest, removeCommand, sameUrl, uninstallClaude, } from "../claude.js";
+import { connectionMachine, readCredential } from "../credentials.js";
+import { differs, serverForFolder, siteOf } from "../environment.js";
+import { originArgs } from "../hooks.js";
+import { claudeVersion, loadsMods, MOD_CLAUDE } from "../mod.js";
+import { checkHelper, foundBy, headlessReason, helperCommand, helperPath, isOurHelper, machineOf, usesHelper, } from "../remote.js";
+import { connectionTitle, FINISH_SAY, setupOf, setupStatus } from "../setup.js";
+import { shimPath } from "../shim.js";
+import { APP_NAMES } from "./ids.js";
+const NAME = APP_NAMES['claude-code'];
+/** The sentence's lead-in, and what restarting means, in init's last lines. */
+const RESTART = 'restart Claude Code here (/exit, then claude --continue), or start it in the folder you work in';
+/**
+ * Whether to move a server that signs in by itself to this computer's sign-in: without a word where there's no
+ * browser, `--yes`, or Yes (the default) at a terminal; kept, with nobody to ask.
+ */
+async function switches(io, ctx, what) {
+    if (ctx.headless || ctx.yes)
+        return true;
+    if (!io.interactive)
+        return false;
+    io.out(`${what} init can move Claude Code to this computer’s own sign-in, which the hooks use too: one sign-in for both, and nothing to Authenticate. The connection it has now stays on your Assistants page until you remove it, and answers to cards it asked through that one won’t reach Claude Code by themselves.\n`);
+    const answer = await io.ask('Switch Claude Code to this computer’s sign-in? [Y/n] ');
+    return !/^\s*no?\s*$/i.test(answer);
+}
+/** The plan for a server at another Pending You: replaced once the person says so, or Claude Code left alone. */
+async function replaces(io, ctx, server, url) {
+    ctx.progress(`Claude Code’s pendingyou MCP server points at ${server.url}, not ${url}.\n`);
+    if (ctx.yes)
+        return true;
+    if (!io.interactive)
+        return false;
+    const answer = await io.ask(`Replace it with ${url}? [y/N] `);
+    return /^\s*y(es)?\s*$/i.test(answer);
+}
+export const claudeCode = {
+    id: 'claude-code',
+    name: NAME,
+    minVersion: '2.0.0',
+    async detect(io) {
+        const result = await io.run('claude', ['--version'], 20_000);
+        if (result.code !== 0)
+            return null;
+        return {
+            version: claudeVersion(result.stdout) ?? (result.stdout.trim().split(/\s+/)[0] || 'installed'),
+        };
+    },
+    async installed(io) {
+        return (await readManifest(io)) !== null;
+    },
+    async usesHelper(io, origin) {
+        if (io.platform === 'win32')
+            return false;
+        const server = await mcpFromFile(io);
+        if (server !== 'unknown')
+            return usesHelper(server, origin);
+        const manifest = await readManifest(io);
+        return Boolean(manifest?.helper && manifest.origin === origin);
+    },
+    async prepare(io, ctx, detected) {
+        const url = `${ctx.origin}/mcp`;
+        const flag = originArgs(ctx.origin);
+        let server = await mcpFromFile(io);
+        if (server === 'unknown') {
+            ctx.progress('Checking Claude Code’s MCP servers (this can take a minute)…\n');
+            server = await mcpFromClaude(io);
+        }
+        const plugin = await pluginFor(io, ctx.origin);
+        const helperMode = io.platform !== 'win32' && !ctx.oauth;
+        let mode = helperMode ? 'helper' : 'oauth';
+        let plan;
+        const helperAdd = helperServer(url, helperCommand(io, ctx.origin));
+        const add = helperMode ? helperAdd.text : addCommand(url);
+        if (server === 'timeout') {
+            plan = {
+                action: 'keep',
+                ok: false,
+                text: `Claude Code took more than 3 minutes to list its MCP servers, so I left them alone. Check with: claude mcp get pendingyou. If it isn’t there, run: ${add}`,
+            };
+        }
+        else if (server?.url && !sameUrl(server.url, url)) {
+            // Another Pending You (staging, when production was asked for): asked before anyone signs in.
+            if (!(await replaces(io, ctx, server, url))) {
+                const commands = `  ${removeCommand(server.scope)}\n    ${add}`;
+                return {
+                    app: claudeCode,
+                    detected,
+                    signIn: null,
+                    skipped: {
+                        ok: false,
+                        text: `Kept Claude Code’s pendingyou MCP server at ${server.url}, so Claude Code isn’t set up for ${ctx.origin}. To use ${url}, run init again with --yes, or run:\n  ${commands}`,
+                    },
+                    install: async () => [],
+                    next: () => null,
+                };
+            }
+            plan = { action: 'replace', server };
+        }
+        else if (server) {
+            const ours = isOurHelper(server.helper);
+            if (ours && helperMode)
+                plan =
+                    server.helper === helperCommand(io, ctx.origin)
+                        ? {
+                            action: 'keep',
+                            ok: true,
+                            text: `The pendingyou MCP server (${url}) already signs in through this computer’s sign-in.`,
+                        }
+                        : { action: 'switch', server };
+            else if (ours)
+                plan = { action: 'switch', server };
+            else if (server.helper) {
+                // Someone else's headersHelper: theirs to change. The hooks hear through a sign-in of their own.
+                mode = 'oauth';
+                plan = helperMode
+                    ? {
+                        action: 'keep',
+                        ok: false,
+                        text: `Kept the pendingyou MCP server: it signs in through a headersHelper of its own (${server.helper}). To use this computer’s sign-in instead, run:\n  ${removeCommand(server.scope)}\n    ${helperAdd.text}`,
+                    }
+                    : {
+                        action: 'keep',
+                        ok: true,
+                        text: 'The pendingyou MCP server was already in Claude Code.',
+                    };
+            }
+            else if (helperMode &&
+                (await switches(io, ctx, 'Claude Code signs in to Pending You by itself here (/mcp → Authenticate).')))
+                plan = { action: 'switch', server };
+            else {
+                mode = 'oauth';
+                plan = {
+                    action: 'keep',
+                    ok: true,
+                    text: helperMode
+                        ? `Kept Claude Code’s own sign-in to Pending You (${url}). To move it to this computer’s, run: npx -y pendingyou@latest init --yes${flag}`
+                        : `The pendingyou MCP server (${url}) was already in Claude Code.`,
+                };
+            }
+        }
+        else if (plugin) {
+            // No server added by hand, so the Pending You plugin's is Claude Code's: one added by hand would win over it.
+            if (helperMode &&
+                (await switches(io, ctx, 'The Pending You plugin signs Claude Code in to Pending You by itself here.')))
+                plan = { action: 'add', plugin: true };
+            else {
+                mode = 'oauth';
+                plan = {
+                    action: 'keep',
+                    ok: true,
+                    text: helperMode
+                        ? `Kept the Pending You plugin as Claude Code’s connection. To move Claude Code to this computer’s sign-in, run: npx -y pendingyou@latest init --yes${flag}`
+                        : 'The Pending You plugin is Claude Code’s connection here.',
+                };
+            }
+        }
+        else
+            plan = { action: 'add' };
+        const signIn = mode === 'helper' ? 'connection' : 'hear';
+        const added = plan.action !== 'keep';
+        return {
+            app: claudeCode,
+            detected,
+            signIn,
+            install: (ictx) => installClaude(io, ctx.origin, {
+                version: detected.version,
+                mcp: plan,
+                mode,
+                helper: ictx.helper,
+                plugin: Boolean(plugin),
+                copy: ictx.copy,
+                hookLine: ictx.hookLine,
+                report: ictx.report,
+                progress: ictx.progress,
+            }),
+            next: (ictx) => {
+                if (mode === 'oauth') {
+                    const authenticate = added || !ictx.signedIn;
+                    return {
+                        lines: [
+                            authenticate
+                                ? 'Next, in Claude Code: if it’s open, restart it (/exit, then claude --continue), run /mcp, choose pendingyou and Authenticate. Then ask Claude Code to finish setting up Pending You.'
+                                : 'Next, in Claude Code: if it’s open, restart it (/exit, then claude --continue), so the hooks load. Then ask Claude Code to finish setting up Pending You.',
+                        ],
+                        together: `- Claude Code: restart it (/exit, then claude --continue)${authenticate ? ', run /mcp, choose pendingyou and Authenticate' : ''}, then ask it to finish setting up Pending You.`,
+                        say: false,
+                    };
+                }
+                const version = claudeVersion(detected.version);
+                const byItself = version !== null && loadsMods(version);
+                return {
+                    lines: [
+                        `Next: ${RESTART}.`,
+                        byItself
+                            ? 'It finishes setting up by itself and sends you a test card. If it doesn’t, say this to it:'
+                            : 'Then say this to it:',
+                        '',
+                        FINISH_SAY,
+                    ],
+                    together: `- Claude Code: ${RESTART}. ${byItself ? 'It finishes setting up by itself and sends you a test card.' : 'Then say the line below to it.'}`,
+                    say: true,
+                };
+            },
+        };
+    },
+    async uninstall(io) {
+        return uninstallClaude(io);
+    },
+    async status(io, ctx) {
+        return claudeStatus(io, ctx);
+    },
+};
+/** Claude Code's section of `pendingyou status`: what's set up and what's missing, each with the command that fixes it. */
+async function claudeStatus(io, ctx) {
+    const { origin, signIn } = ctx;
+    const [claude, here, manifest] = await Promise.all([
+        claudeState(io),
+        serverForFolder(io, io.cwd),
+        readManifest(io),
+    ]);
+    const credential = await readCredential(io, origin);
+    const flag = originArgs(origin);
+    const mcp = claude.mcp;
+    // Through the helper (this computer's own sign-in): Claude Code's server runs ours, init set it up so, or nothing is
+    // set up yet and init would (everywhere but Windows).
+    const helped = usesHelper(mcp, origin);
+    const helper = io.platform !== 'win32' &&
+        (helped ||
+            Boolean(manifest?.helper && manifest.origin === origin) ||
+            (mcp === false && !manifest && !claude.plugins.length));
+    const why = headlessReason(io);
+    const lines = [
+        `Pending You for Claude Code · ${origin}${why ? ` · no browser here (${why})` : ''}`,
+    ];
+    const mark = (ok) => (ok ? 'ok     ' : 'missing');
+    const url = `${origin}/mcp`;
+    const plugin = claude.plugins.find((id) => siteOf(PLUGIN_ORIGINS[id] ?? '') === siteOf(origin));
+    const sameServer = mcp !== false && mcp !== 'unknown' && (!mcp.url || mcp.url.replace(/\/+$/, '') === url);
+    // The plugin's server is Claude Code's when nobody added one by hand.
+    const pluginServer = mcp === false && Boolean(plugin);
+    const mcpOk = helper ? sameServer && helped : sameServer || pluginServer;
+    const mcpText = mcp === 'unknown'
+        ? 'Claude Code didn’t say in time; check with claude mcp get pendingyou'
+        : pluginServer
+            ? `the Pending You plugin’s (${plugin}), which signs in by itself`
+            : mcp === false
+                ? `not added; run npx pendingyou init${flag}`
+                : !sameServer
+                    ? `points at ${mcp.url}, not ${url}, so sessions post cards where these hooks don’t hear them; run npx pendingyou init${flag} to replace it`
+                    : !helper
+                        ? `pendingyou${mcp.url ? ` (${mcp.url})` : ''}`
+                        : helped
+                            ? `pendingyou (${mcp.url}), signed in through ${helperPath(io)}`
+                            : mcp.helper
+                                ? `pendingyou (${mcp.url}) signs in through a headersHelper of its own (${mcp.helper}); run npx pendingyou init${flag} to use this computer’s sign-in`
+                                : `pendingyou (${mcp.url}) signs in through a browser${why ? ', which can’t finish on this computer' : ''}; run npx pendingyou init${flag}`;
+    const form = claude.form;
+    const hooksRun = form?.runs ?? true;
+    // The wake mod (0.10.0): Claude Code 2.1.287 or later loads it from the plugin or from CLAUDE_CODE_PLUGIN_DIRS.
+    const mod = claude.mod;
+    const modOk = mod.loads && (mod.plugin || mod.present);
+    const modText = !claude.claude
+        ? `needs Claude Code ${MOD_CLAUDE} or later`
+        : !mod.loads
+            ? `needs Claude Code ${MOD_CLAUDE} or later (this is ${claude.claude}); until then, a background hold wakes it`
+            : mod.present
+                ? `in CLAUDE_CODE_PLUGIN_DIRS (${mod.dirs.join(', ')}); a session is woken when you answer, with no hold running`
+                : mod.plugin
+                    ? 'in the Pending You plugin; a session is woken when you answer, with no hold running'
+                    : mod.dirs.length
+                        ? `${mod.dirs.join(', ')} is gone; run npx pendingyou@latest init${flag}`
+                        : `not installed; run npx pendingyou@latest init${flag}`;
+    const via = form?.shim ? `, through ${shimPath(io)}` : '';
+    const formText = !form
+        ? ''
+        : form.form === 'direct'
+            ? form.runs
+                ? `they run pendingyou${form.version ? ` ${form.version}` : ''} directly (${form.script})${via}`
+                : `the Node or the copy of pendingyou they run is gone (${form.node}, ${form.script}); run npx pendingyou@latest init${flag}`
+            : form.form === 'npx'
+                ? `they run through npx${via}, which is slower; run npx pendingyou@latest init${flag} to run them directly`
+                : 'they run pendingyou from PATH or a file of your own';
+    // login makes a connection only once Claude Code's server signs in through the helper; init does both.
+    const fix = `npx pendingyou ${helped ? 'login' : 'init'}${flag}`;
+    // The connection's name as Pending You has it, so status never drifts from it; else this computer's own record.
+    const title = signIn.state === 'ok' && signIn.for
+        ? connectionTitle(signIn.for)
+        : `${NAME} on ${(await connectionMachine(io, origin)) ?? (machineOf(io.host) || 'this computer')}`;
+    const connected = credential?.kind === 'connection';
+    const signOk = signIn.state === 'ok' && (!helper || connected);
+    const signText = helper
+        ? signIn.state === 'ok'
+            ? connected
+                ? `this computer’s own connection, ${title}; Claude Code here asks and hears through it`
+                : `this computer’s sign-in only hears answers, so Claude Code here can’t use it; run ${fix}`
+            : signIn.state === 'ended'
+                ? `ended; run ${fix}`
+                : signIn.state === 'none'
+                    ? `not signed in; run ${fix}${why ? ' (you approve a code on your phone)' : ''}`
+                    : 'Pending You couldn’t be reached'
+        : signIn.state === 'ok'
+            ? signIn.for
+                ? `hears for ${signIn.for.name} only (for pendingyou watch)`
+                : `hears for ${signIn.connections} Claude Code connection${signIn.connections === 1 ? '' : 's'}`
+            : signIn.state === 'ended'
+                ? `ended; run npx pendingyou login${flag}`
+                : signIn.state === 'none'
+                    ? `not signed in; run npx pendingyou login${flag}`
+                    : 'Pending You couldn’t be reached';
+    // The helper as Claude Code runs it at its barest: found Node, and runs pendingyou's copy.
+    const check = helper ? await checkHelper(io, origin) : null;
+    const skillOk = claude.skill || Boolean(plugin);
+    const skillText = claude.skill
+        ? 'saved'
+        : plugin
+            ? 'the Pending You plugin carries it'
+            : `not saved; run npx pendingyou init${flag}`;
+    lines.push(`  ${mark(signOk)} Sign-in: ${signText}`, `  ${mark(claude.claude !== null)} Claude Code: ${claude.claude ?? 'not found on PATH'}`, `  ${mark(mcpOk)} MCP server: ${mcpText}`, ...(check
+        ? [
+            `  ${mark(check.ok)} Sign-in helper: ${check.ok
+                ? `${check.node} (${foundBy(check.from)}) runs pendingyou ${check.version}, even for a Claude Code started without your shell’s PATH`
+                : `${check.why}; run npx pendingyou init${flag}`}`,
+        ]
+        : []), ...(plugin
+        ? [
+            `  ok      Plugin: ${plugin} is enabled${pluginServer ? '' : mcp !== false && mcp !== 'unknown' ? '; Claude Code uses the server added by hand instead of its own' : ''}`,
+        ]
+        : []), `  ${mark(skillOk)} Skill: ${skillText}`, `  ${mark(claude.hooks && hooksRun)} Hooks: ${claude.hooks ? `session-start pickup and next-message hand-off; ${formText}` : `not installed; run npx pendingyou init${flag}`}`, `  ${mark(claude.stopcheck)} Stop check: ${claude.stopcheck ? 'asks Claude Code to post what it leaves you in chat' : `not installed; run npx pendingyou init${flag}`}`, `  ${mark(modOk)} Wake mod: ${modText}`);
+    // How setup stands on Pending You (from servers that say): never a reason it isn't Ready.
+    const setup = setupStatus(NAME, signIn.state === 'ok' ? setupOf(signIn.for) : null);
+    if (setup)
+        lines.push(`  ${setup === 'finished' ? 'ok     ' : '       '} Setup: ${setup}`);
+    // A folder's own server (local or project scope) wins over the user one in Claude Code: say when it's elsewhere. (The
+    // plugin's server counts only when no server was added by hand, and is production's.)
+    if (here && (here.scope === 'local' || here.scope === 'project') && differs(here, origin))
+        lines.push(`  ${mark(false)} This folder: its ${here.scope}-scope pendingyou MCP server (${here.url}) is another Pending You than ${origin}; Claude Code uses it here instead`);
+    const user = mcp !== false && mcp !== 'unknown' && mcp.url ? { url: mcp.url, scope: 'user' } : null;
+    const other = differs(here, origin) ? here : differs(user, origin) ? user : null;
+    // Through the helper, Claude Code reaches Pending You only with the helper, the connection and the server together.
+    const reaches = !helper || (signOk && mcpOk && check?.ok === true);
+    const ready = reaches && signIn.state === 'ok' && claude.hooks && hooksRun && !other;
+    if (other)
+        lines.push(`Mismatch: Claude Code’s MCP server is ${siteOf(other.url)} but the hooks and sign-in are ${siteOf(origin) ?? origin}. Use the one you look at (npx pendingyou init --origin <it>), then restart your Claude Code sessions.`);
+    lines.push(ready
+        ? helper
+            ? 'Ready: Claude Code here signs in through this computer’s sign-in, and hears answers right away (report_setup hears "instant").'
+            : 'Ready: Claude Code hears answers right away (report_setup hears "instant").'
+        : reaches
+            ? 'Not ready: Claude Code hears answers while it’s working (report_setup hears "while-working").'
+            : 'Not ready: Claude Code here can’t reach Pending You until the lines marked missing are fixed.');
+    return { lines, ready };
+}