pendingyou 0.12.0 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,80 @@
 # Changelog
 
+## 0.13.0 (2026-10-04)
+
+- Claude Code's permission prompts on a card (Darin, 2026-10-04: "Tell me: a card and a push, cleared once I answer in
+  the terminal"). A Claude Code agent kept asking to remove files and sat waiting until Darin happened to look. `init`
+  now adds Claude Code's PermissionRequest hook (https://code.claude.com/docs/en/hooks: it runs as Claude Code is about
+  to ask for permission to use a tool, with `tool_name` and `tool_input`), through the shim with `--app claude-code`.
+  It never decides: it prints nothing, so the prompt shows exactly as before, and it's done in about a tenth of a
+  second. It writes the prompt down (its card's redacted words, never the tool's input) in the session's own file,
+  `~/.config/pendingyou/permission-cards/<session>.json`, and starts that session's one worker, detached (`pendingyou
+  permission-card`). Once a prompt has waited 10 seconds (one answered sooner gets no card), the worker posts one card
+  through Pending You's MCP with Claude Code's own connection here (whoami, match_area, post_request): an action card
+  titled “Claude Code is waiting for your OK: rm -rf dist/” (at most 90 characters; “…waiting for your answer: …” for
+  a question it asked, “…on its plan” for a plan), the folder and the computer in its summary, one step, “Answer it in
+  Claude Code on Ann-MBP” (with the session's link while Remote Control is on), asked in both places (`askedFirst`
+  terminal, at the prompt's time) so a push comes only after the person's hand-off wait, not blocking, urgency now. It
+  goes in the area `match_area` picks for the folder and its git remote (a new one for the work when nothing fits, as
+  the guide says), under the name the session gave Pending You (read from its transcript), else “Claude Code”, with an
+  idempotency key per prompt. One card per session: a newer prompt changes its words (`update_request`, with a
+  changeNote), never a second card. It goes once the person answers: the call running (PostToolUse, or
+  PostToolUseFailure) withdraws it with `answeredHere`; a denial runs neither, so the person's next message (the
+  hand-off hook) or the end of the turn (the Stop hook) does; the session ending (SessionEnd) withdraws it without. A
+  card they pressed Done on is acknowledged instead. A subagent's prompt outlasts the person's message, and the end of a
+  turn while a subagent still runs in the background. No card where nobody sees the prompt (`claude -p` and the Agent
+  SDK, whose CLAUDE_CODE_ENTRYPOINT starts `sdk-`; a dontAsk or bypassPermissions session), for a sign-in that only
+  hears (`--oauth`), or on Windows.
+- Nothing secret on those cards (`src/redact.ts`). A command is cut to 120 characters, with the values after anything
+  named like a secret blanked (`--token …`, `--password=…`, `-p …` but not `mkdir -p`, `mysql -p…`, `-u user:…`,
+  `Authorization: …`, `Cookie: …`, `Bearer …`, `FOO_TOKEN=…`, `"password": "…"`, `aws_secret_access_key …`), a URL's
+  user and password and every query and fragment value blanked, and anything that looks like a key or token (the
+  well-known prefixes, JWTs, private keys, long hex, long runs of letters and digits in both cases, a webhook's secret
+  in a URL's path). A command that can't be shown safely (more than one line, a heredoc, inline code such as `node -e`
+  or `bash -c`, `eval`, or one that takes or sets a secret, like `sudo -S`, `--password-stdin` or `gh secret set`)
+  shows as the tool and its first word: “Bash: node …”. A path is shown under `~`, its end kept when it's long; a
+  question or a search keeps its words with any key taken out. The git remote `match_area` gets has no user name or
+  password.
+- `init --no-permission-cards` leaves them out (later runs keep them out; `--permission-cards` puts them back), and
+  `status` has a line: “Permission prompts: a card when Claude Code waits for your OK”, off as the person chose, or why
+  this Claude Code can't have them. They need Claude Code 2.1.119 or later (PermissionRequest came in 2.0.45, and
+  before 2.1.101 a hook event Claude Code didn't know made it ignore the whole settings file) and Claude Code signing
+  in through this computer's sign-in. The SessionEnd hook sets no timeout of its own, so Claude Code's 1.5 seconds for
+  SessionEnd hooks stays as it was. The shim skips Node for `permission-done` while no session has a prompt written
+  down, so a tool call costs a few milliseconds (20 ms measured, 8 of them the shell's own); the PermissionRequest hook
+  takes about 0.14 s, as long as the other hooks. `uninstall` takes the hooks and the sessions' files out.
+- The hand-off hook names no permission prompt's card among the agent's open cards, and neither hook hands an agent a
+  Done the person pressed on one: those close by themselves.
+- The Codex app for macOS ("ChatGPT.app", bundle id com.openai.codex; 26.928 carries codex 0.159.2), which shares
+  `~/.codex` with Codex CLI: its MCP servers (the headers helper too), `~/.agents/skills` and `~/.codex/hooks.json`
+  with the same trust. Where `codex` isn't on PATH, `init` and `status` find the app's own codex
+  (`Contents/Resources/codex-cli/bin/codex`, or the `CodexCLI.app` the app's own code looks for there, in
+  `/Applications` or `~/Applications`, as ChatGPT.app or Codex.app) and run it for the version check (0.152 or later,
+  for the headers helper), `codex mcp list` and `codex mcp logout`; init says it found "Codex 0.159.2 (the Codex
+  app’s)", and `status` names its path. The listener runs it for `codex queue`: the app's own server reads the queue
+  while the app is open, so a chat it has loaded is woken when you answer (0.149 or later; one it let go, idle 3 hours
+  or behind 10 newer idle chats, hears it when it's opened again), and `status`'s Wake line says so.
+- Codex's last lines name both ways to trust its hooks (“In Codex CLI choose “Trust all and continue” (or trust them in
+  /hooks); in the Codex app click Review hooks › Allow all (or Settings › Hooks › Trust all)”; the app alone: open it
+  and click Review hooks › Allow all), and say not to press Save on pendingyou in the Codex app's MCP settings: that
+  writes the table again without `http_headers_helper` (and `default_tools_approval_mode`), so Codex no longer signs in
+  through this computer's sign-in. `status` says so when the table has lost the helper init gave it (“has lost its
+  http_headers_helper … (saving it in the Codex app’s MCP settings does that) … run npx pendingyou init --app codex
+  again”), and init puts it back (“Put this computer’s sign-in back on Codex’s pendingyou MCP server”). Its Hooks line
+  names both ways to trust them.
+- The setup line every app's session start gives, and the Claude Code wake mod's setup turn, say exactly the three
+  calls: “Pending You: Codex on Ann-MBP is connected, but its setup isn’t finished. Three calls, nothing to install or
+  approve: 1. whoami with your name. If it says app.setUp is true, another session did this: stop. 2. report_setup with
+  source codex, your name, skillSaved true, hears instant, and skillVersion set to whoami’s skill.latest. Its answer
+  has a testAreaId. 3. post_request a short test question in that testAreaId, tell your person it’s on its way, and end
+  your turn: you’re woken when they answer, so don’t ask them to type anything.” Pi's first setup on Darin's devbox
+  spent about 20,000 tokens on the words before: “whoami with your name and guide true” answered with the whole guide
+  (87,000 characters), which Pi cut into a file the model then parsed, and “your test question in its testAreaId” sent
+  it looking for testAreaId in whoami's answer, where it isn't (report_setup's has it). A setup that has reported gets
+  the same calls without whoami's way out (its whoami says app.setUp is true); a test card answered says who picks it
+  up, with the call's exact arguments. Pi's extension knows the new lines (and 0.12.0's) to start the setup turn; the
+  wake mod names the connection from whoami's answer.
+
 ## 0.12.0 (2026-10-04)
 
 - The stdio bridge, `pendingyou mcp --app <app>`: a local MCP server for an agent that can't give its MCP client a

package/README.md

@@ -24,7 +24,8 @@ Run it once on each computer, in a terminal. It finds the agents on the computer
   Pi reads Codex's, else `~/.pi/agent/skills/pendingyou/SKILL.md`),
 - adds the hooks that hand it your answers: a new session picks up answers that arrived while nothing was running,
   your next message brings a waiting answer with it, and a check when it finishes a turn catches what it left you only
-  in chat ([below](#nothing-left-only-in-chat)),
+  in chat ([below](#nothing-left-only-in-chat)); and, for Claude Code, a card when it waits for your OK to run something
+  ([below](#when-claude-code-waits-for-your-ok)),
 - and wakes it when you answer: Claude Code 2.1.287 or later through the wake mod, Codex through `codex queue`, OpenCode
   through its plugin and Pi through its extension (which also do the hooks' work there).
 
@@ -38,8 +39,9 @@ Finish setting up Pending You: it’s connected here already.
 ```
 
 The first session finishes setting up on its own: it checks in with Pending You, reports what's set up and sends you a
-test card. Claude Code 2.1.287 or later starts that turn by itself; otherwise (and in Codex, after you choose “Trust all
-and continue” for its hooks) the session start adds one line saying what's left, and you say the sentence.
+test card. Claude Code 2.1.287 or later starts that turn by itself; otherwise (and in Codex, after you trust its hooks:
+“Trust all and continue” in Codex CLI, Review hooks › Allow all in the Codex app) the session start adds one line with
+the three calls that are left, and you say the sentence.
 `npx pendingyou status` says what's set up for each agent, what's missing with the command that fixes it, and how setup
 stands. `npx pendingyou uninstall` removes exactly what `init` added.
 
@@ -92,14 +94,24 @@ default_tools_approval_mode = "approve"
 ```
 
 and four hooks in `~/.codex/hooks.json`: a session start, each message, Pending You's card tools (so the Stop check
-knows a turn posted, and so the thread is woken), and the Stop check. **Codex runs a hook only once you trust it**: start
-`codex` and choose “Trust all and continue” (or trust them in `/hooks`). `status` says which are trusted. A
-`pendingyou` server or hooks Codex's `/import` copied from Claude Code (without its sign-in) are replaced.
+knows a turn posted, and so the thread is woken), and the Stop check. **Codex runs a hook only once you trust it**: in
+Codex CLI, start `codex` and choose “Trust all and continue” (or trust them in `/hooks`); in the Codex app, click
+Review hooks › Allow all (or Settings › Hooks › Trust all). `status` says which are trusted. A `pendingyou` server or
+hooks Codex's `/import` copied from Claude Code (without its sign-in) are replaced.
+
+**The Codex app** (on a Mac, in the ChatGPT app) shares all of this with Codex CLI: the same `~/.codex`, server, hooks
+and trust. With no `codex` on PATH, `init` uses the app's own (inside `/Applications/ChatGPT.app` or
+`~/Applications`), for the version and everything else it runs. Don't press Save on pendingyou in the app's MCP
+settings: that writes the table again without `http_headers_helper` (and `default_tools_approval_mode`), so Codex stops
+signing in through this computer's sign-in. `status` says so when it happens; `npx -y pendingyou@latest init` puts it
+back.
 
 When you answer a card a Codex thread posted, a small listener `init`'s hooks start for that thread puts a message into
 it with `codex queue`: “Pending You: your person answered “…” (req_…). Call get_request …”, which reads your answer (the
 answer itself never goes in a command's arguments, where other programs could see it). Codex starts a turn at
-once when the thread is open and idle, after the current one when it's working, or when you next open it.
+once when the thread is open and idle, after the current one when it's working, or when you next open it. In the Codex
+app, a chat it has open is woken while the app runs (one it let go, idle 3 hours or behind 10 newer idle chats, when
+you open it again).
 
 ## OpenCode
 
@@ -199,6 +211,28 @@ and Pi's extension (0.12.0) do the same in theirs.
 **On 0.2.0 with another origin?** Its hooks blocked every message (`There's no "--origin" command`). Run
 `npx pendingyou@latest init --origin <url>` again to repair them; see [CHANGELOG.md](CHANGELOG.md).
 
+## When Claude Code waits for your OK
+
+Claude Code stops to ask before it runs something it isn't allowed to run by itself (`rm -rf dist/`, a push, a file
+outside the folder), and waits, however long you're away. Since 0.13.0, when you don't answer within 10 seconds, a card
+says so: “Claude Code is waiting for your OK: rm -rf dist/”, with the folder and the computer, and one step: answer it
+in Claude Code there (with the session's link while Remote Control is on, where you can answer it from your phone).
+It's asked in both places, so you get a push only once it has waited your hand-off time (3 minutes unless you changed
+it). It goes away by itself once you answer in Claude Code: allowed, denied, or the session closed. One card per
+session: a newer prompt changes it.
+
+The hook (Claude Code's PermissionRequest) never answers for you: it prints nothing, so the prompt shows exactly as
+before, and it's done in about a tenth of a second. A small process in the background posts, changes and withdraws the
+card through Pending You, with Claude Code's own connection here. Nothing secret goes on the card: values after
+anything named like a key, token or password, a URL's user and password and query values, and anything that looks like
+a key are blanked (`curl -H "Authorization: …" https://api.example.com/items?token=…`), and a command that can't be
+shown safely (several lines, inline code like `node -e`, one that takes a secret) shows only as “Bash: node …”. No card
+for `claude -p` or the Agent SDK, where nobody sees a prompt.
+
+It needs Claude Code 2.1.119 or later, signing in through this computer's sign-in (not `--oauth`), and isn't on
+Windows yet. Don't want it? `npx pendingyou init --no-permission-cards` (later runs keep it off; `--permission-cards`
+turns it back on). `npx pendingyou status` says which.
+
 ## How Claude Code hears your answer
 
 **Claude Code 2.1.287 or later: the wake mod.** There's nothing to run. In each session the mod learns the cards
@@ -284,7 +318,7 @@ more, then skipped. `--once` stops after the first.
 
 | Command | What it does |
 | --- | --- |
-| `init` | Set up every agent on this computer (`--app`, `--oauth`, `--no-login`, `--no-browser`, `--device`, `--browser`, `--yes`, `--name`) |
+| `init` | Set up every agent on this computer (`--app`, `--oauth`, `--no-login`, `--no-browser`, `--device`, `--browser`, `--yes`, `--name`, `--no-permission-cards`) |
 | `hold <requestId>` | Wait for the answer, print it, exit (`--timeout 4h`); the wake mod answers it itself |
 | `status` | What's set up for each agent; exits 0 when each hears answers right away (`--app`) |
 | `login` / `logout` | Sign an agent in again, or out (`--app`, `--device`, `--browser`, `--force`, `--name`, `--all`) |
@@ -311,12 +345,17 @@ Pending You (Claude Code says which server it's for; Codex's is the one `init` w
 sign-in each agent's connection used, so signing in again keeps it.
 
 `state.json` beside them remembers which answers were already handed over (ids only) and how many session starts
-reminded an unfinished setup, and when; `claude-code.json`, `codex.json`, `opencode.json` and `pi.json` what `init`
+reminded an unfinished setup, and when; `permission-cards/` each Claude Code session's prompts still waiting on your OK
+and its card (ids, hashes and the card's redacted words: never what the tool was given), gone once nothing waits;
+`claude-code.json`, `codex.json`, `opencode.json` and `pi.json` what `init`
 added; `codex-threads.json`, `opencode-threads.json` and `pi-threads.json` which cards each Codex thread or OpenCode or
 Pi session waits on (ids, names and titles: never an answer); `pi/` Pi's extension; and `cli/` the hooks' copy of the
 command line. `init`, `status` and the hooks read `~/.claude.json` (and a folder's `.mcp.json`, and
 `~/.claude/settings.json`'s enabled plugins), `~/.codex/config.toml`, OpenCode's config and Pi's `mcp.json` only to see
-whether the agent has a `pendingyou` MCP server and where it points. Nothing is sent anywhere but Pending You. OpenCode's plugin reads its session's messages only when it goes idle, for the check that
+whether the agent has a `pendingyou` MCP server and where it points. For a permission prompt's card, the worker reads
+the end of the Claude Code session's transcript only for the name the session gave Pending You, and `git remote
+get-url origin` in its folder (sent without any user name or password in it). Nothing is sent anywhere but Pending
+You. OpenCode's plugin reads its session's messages only when it goes idle, for the check that
 nothing was left in chat, and hands the hooks' script just that turn's words and tool names.
 
 The wake mod runs inside Claude Code and reaches Pending You only through the session's own connection, with

package/dist/apps/claude-code.js

@@ -11,7 +11,7 @@
 //   to ask it's kept, and init says how to switch. Kept, Claude Code signs in by itself and the hooks get a sign-in
 //   that only hears; kept beside the plugin, no skill is saved either: the plugin carries it.
 // - one at another Pending You: replaced once the person says so (or `--yes`), or else Claude Code is left alone.
-import { addCommand, claudeState, helperServer, installClaude, mcpFromClaude, mcpFromFile, PLUGIN_ORIGINS, pluginFor, readManifest, removeCommand, sameUrl, uninstallClaude, } from "../claude.js";
+import { addCommand, claudeState, helperServer, installClaude, mcpFromClaude, mcpFromFile, PLUGIN_ORIGINS, permissionBlocker, pluginFor, readManifest, removeCommand, sameUrl, uninstallClaude, } from "../claude.js";
 import { connectionMachine, readCredential } from "../credentials.js";
 import { differs, serverForFolder, siteOf } from "../environment.js";
 import { originArgs } from "../hooks.js";
@@ -185,6 +185,7 @@ export const claudeCode = {
                 hookLine: ictx.hookLine,
                 report: ictx.report,
                 progress: ictx.progress,
+                ...(ctx.permissionCards === undefined ? {} : { permissionCards: ctx.permissionCards }),
             }),
             next: (ictx) => {
                 if (mode === 'oauth') {
@@ -223,6 +224,23 @@ export const claudeCode = {
         return claudeStatus(io, ctx);
     },
 };
+/**
+ * status's line for the permission-prompt hooks (0.13.0): on; off, as the person chose; or why Claude Code here can't
+ * have them. Never a reason status isn't Ready.
+ */
+function permissionLine(io, claude, manifest, helper, flag) {
+    const label = 'Permission prompts:';
+    if (claude.permission)
+        return `  ok      ${label} a card when Claude Code waits for your OK`;
+    if (manifest?.permissionCards === false)
+        return `          ${label} off, as you chose; for a card when Claude Code waits for your OK, run npx pendingyou init --permission-cards${flag}`;
+    const blocker = claude.claude
+        ? permissionBlocker(io, claude.claude, helper ? 'helper' : 'oauth')
+        : null;
+    return blocker
+        ? `          ${label} no card when Claude Code waits for your OK: ${blocker}`
+        : `  missing ${label} no card when Claude Code waits for your OK; run npx pendingyou@latest init${flag}`;
+}
 /** Claude Code's section of `pendingyou status`: what's set up and what's missing, each with the command that fixes it. */
 async function claudeStatus(io, ctx) {
     const { origin, signIn } = ctx;
@@ -338,7 +356,7 @@ async function claudeStatus(io, ctx) {
         ? [
             `  ok      Plugin: ${plugin} is enabled${pluginServer ? '' : mcp !== false && mcp !== 'unknown' ? '; Claude Code uses the server added by hand instead of its own' : ''}`,
         ]
-        : []), `  ${mark(skillOk)} Skill: ${skillText}`, `  ${mark(claude.hooks && hooksRun)} Hooks: ${claude.hooks ? `session-start pickup and next-message hand-off; ${formText}` : `not installed; run npx pendingyou init${flag}`}`, `  ${mark(claude.stopcheck)} Stop check: ${claude.stopcheck ? 'asks Claude Code to post what it leaves you in chat' : `not installed; run npx pendingyou init${flag}`}`, `  ${mark(modOk)} Wake mod: ${modText}`);
+        : []), `  ${mark(skillOk)} Skill: ${skillText}`, `  ${mark(claude.hooks && hooksRun)} Hooks: ${claude.hooks ? `session-start pickup and next-message hand-off; ${formText}` : `not installed; run npx pendingyou init${flag}`}`, `  ${mark(claude.stopcheck)} Stop check: ${claude.stopcheck ? 'asks Claude Code to post what it leaves you in chat' : `not installed; run npx pendingyou init${flag}`}`, `  ${mark(modOk)} Wake mod: ${modText}`, permissionLine(io, claude, manifest, helper, flag));
     // How setup stands on Pending You (from servers that say): never a reason it isn't Ready.
     const setup = setupStatus(NAME, signIn.state === 'ok' ? setupOf(signIn.for) : null);
     if (setup)

package/dist/apps/codex-app.js

@@ -0,0 +1,44 @@
+// The Codex app for macOS (0.13.0; research 2026-10-04): "ChatGPT.app" (bundle id com.openai.codex; 26.928 carries codex
+// 0.159.2) has its own codex command line inside it, and shares ~/.codex with Codex CLI: its MCP servers (the headers
+// helper too), ~/.agents/skills, ~/.codex/hooks.json and the hooks' trust. Its hooks run with a PATH that ends in its own
+// codex, and its private Codex server reads ~/.codex/queue_1.sqlite every 10 seconds, so `codex queue --thread` wakes a
+// chat the app has loaded while it's open (an idle chat is let go after 3 hours, or behind 10 newer idle ones; then the
+// message waits until the chat is opened again). Where `codex` isn't on PATH, init, status and the listener
+// (codex-wake.ts) run the app's own instead: these paths, in /Applications or ~/Applications, under either name.
+import { stat } from 'node:fs/promises';
+import { join } from 'node:path';
+/** The app's names: the ChatGPT desktop app that carries Codex, and Codex's own, should it ship as that. */
+const APP_NAMES = ['ChatGPT.app', 'Codex.app'];
+/**
+ * Where a Codex app keeps its own codex: `Contents/Resources/codex-cli/bin/codex`, and the CodexCLI.app inside it that
+ * the app's own code looks for (`codex-cli/CodexCLI.app/Contents/MacOS/codex`), in /Applications, then ~/Applications.
+ * `system` is /Applications unless PENDINGYOU_APPLICATIONS_DIR says otherwise (tests: they never look in the real one).
+ */
+export function appCodexPaths(home, system = '/Applications') {
+    return [system, join(home, 'Applications')].flatMap((root) => APP_NAMES.flatMap((name) => {
+        const cli = join(root, name, 'Contents', 'Resources', 'codex-cli');
+        return [join(cli, 'bin', 'codex'), join(cli, 'CodexCLI.app', 'Contents', 'MacOS', 'codex')];
+    }));
+}
+/** `codex --version`'s version ("codex-cli 0.159.2"), or "installed" when it can't be read. */
+const versionOf = (stdout) => /(\d+\.\d+\.\d+)/.exec(stdout)?.[1] ?? 'installed';
+const executable = (path) => stat(path).then((info) => info.isFile() && (info.mode & 0o111) !== 0, () => false);
+/**
+ * The codex to run: `codex` on PATH; else, on a Mac, the Codex app's own (the first of `paths` there that answers
+ * `--version`); null when there's neither.
+ */
+export async function findCodex(io, paths = appCodexPaths(io.home, io.env.PENDINGYOU_APPLICATIONS_DIR || undefined)) {
+    const onPath = await io.run('codex', ['--version'], 20_000);
+    if (onPath.code === 0)
+        return { command: 'codex', version: versionOf(onPath.stdout), app: false };
+    if (io.platform !== 'darwin')
+        return null;
+    for (const path of paths) {
+        if (!(await executable(path)))
+            continue;
+        const result = await io.run(path, ['--version'], 20_000);
+        if (result.code === 0)
+            return { command: path, version: versionOf(result.stdout), app: true };
+    }
+    return null;
+}

package/dist/apps/codex-wake.js

@@ -31,6 +31,7 @@ import { readCredential } from "../credentials.js";
 import { configDir, readJson, withLock, writeWhole } from "../files.js";
 import { clip, isClosed } from "../format.js";
 import { markHanded, momentOf, wasHanded } from "../state.js";
+import { findCodex } from "./codex-app.js";
 /** How long a turn's record, and a thread untouched, are kept. */
 const KEEP_TURN_MS = 24 * 60 * 60_000;
 const KEEP_THREAD_MS = 7 * 24 * 60 * 60_000;
@@ -320,8 +321,18 @@ async function renew(io, app, thread, id) {
     await utimes(path, now, now).catch(() => { });
     return true;
 }
-/** Codex: `codex queue`, which starts the turn itself. */
-const byCodexQueue = (io, thread) => async (message) => (await io.run('codex', ['queue', '--thread', thread, '--message', message], 30_000)).code === 0;
+/**
+ * Codex: `codex queue`, which starts the turn itself: the codex on PATH, or the Codex app's own (0.13.0, codex-app.ts),
+ * found once, when the listener first wakes the thread.
+ */
+function byCodexQueue(io, thread) {
+    let program = null;
+    return async (message) => {
+        program ??= findCodex(io).then((found) => found?.command ?? 'codex');
+        const queued = await io.run(await program, ['queue', '--thread', thread, '--message', message], 30_000);
+        return queued.code === 0;
+    };
+}
 /**
  * OpenCode and Pi: the plugin (Pi: the extension) that started this listener reads the wake on stdout and starts the
  * turn, then says on stdin whether it did. stdin closing means the plugin (the app) is gone: `gone` stops the listener.

package/dist/apps/codex.js

@@ -20,17 +20,22 @@
 //   which it does by itself from 0.157): codex-wake.ts.
 // - Codex's /import can copy Claude Code's Pending You server (without its headersHelper, so it never signs in) and its
 //   hooks (with Claude Code's app): init replaces both.
+// - The Codex app for macOS (0.13.0, codex-app.ts) shares all of ~/.codex with Codex CLI, and carries its own codex:
+//   with none on PATH, init, status and the listener run the app's. Its trust is "Review hooks › Allow all", and Save on
+//   pendingyou in its MCP settings writes the table again without http_headers_helper (and the approval mode): init's
+//   last lines say both, status names the dropped helper, and running init again puts it back.
 import { createHash } from 'node:crypto';
 import { realpath, rm } from 'node:fs/promises';
 import { join } from 'node:path';
 import { removeSkill, saveSkill } from "../claude.js";
 import { readCredential } from "../credentials.js";
 import { configDir, readJson, readText, writeWhole } from "../files.js";
-import { isOurHook, mergeHooks, originArgs, removeHooks, } from "../hooks.js";
+import { isOurHook, mergeHooks, originArgs, removeHooks, shWord, } from "../hooks.js";
 import { atLeast } from "../mod.js";
 import { checkHelper, foundBy, headlessReason, helperCommand, helperPath, isOurHelper, } from "../remote.js";
 import { connectionTitle, FINISH_SAY, setupOf, setupStatus } from "../setup.js";
 import { basicString, definedInline, headerOf, renameTable, tableSpans, tableValues, withTable, } from "../toml.js";
+import { findCodex } from "./codex-app.js";
 import { APP_NAMES } from "./ids.js";
 const NAME = APP_NAMES.codex;
 const SERVER = ['mcp_servers', 'pendingyou'];
@@ -38,6 +43,18 @@ const SERVER = ['mcp_servers', 'pendingyou'];
 export const CODEX_MIN = '0.152.0';
 /** From here interactive Codex starts its shared background server by itself, so `codex queue` wakes an idle thread. */
 export const CODEX_WAKE = '0.157.0';
+/**
+ * From here `codex queue` is there (0.149), which is all the Codex app needs: its own server reads the queue while the
+ * app is open (codex-app.ts).
+ */
+export const CODEX_APP_WAKE = '0.149.0';
+/** Where init found Codex when it isn't on PATH. */
+const FROM_APP = 'the Codex app’s';
+/** How the person trusts Codex's hooks, in Codex CLI and in the Codex app (0.13.0). */
+const TRUST_CLI = 'in Codex CLI choose “Trust all and continue” (or trust them in /hooks)';
+const TRUST_APP = 'in the Codex app click Review hooks › Allow all (or Settings › Hooks › Trust all)';
+/** What undoes init in the Codex app: its MCP settings' Save writes the table again without the helper. */
+const DONT_SAVE = 'In the Codex app, don’t press Save on pendingyou in Settings › MCP: that writes it again without this computer’s sign-in (if you did, run init again to put it back).';
 /** The Pending You tools whose calls the PostToolUse hook reads (codex-wake.ts). */
 const CARD_TOOLS = '^mcp__pendingyou__(post_request|update_request|reply_in_thread|cancel_request)$';
 /** Codex's hooks, by event: the command each runs, and its matcher. */
@@ -210,8 +227,8 @@ async function hookTrust(io) {
     });
 }
 /** Whether `codex mcp list` says Codex holds an OAuth sign-in for its pendingyou server; null when it can't say. */
-async function signedInByItself(io) {
-    const result = await io.run('codex', ['mcp', 'list', '--json'], 30_000);
+async function signedInByItself(io, program) {
+    const result = await io.run(program, ['mcp', 'list', '--json'], 30_000);
     if (result.code !== 0)
         return null;
     try {
@@ -279,10 +296,14 @@ export const codex = {
     name: NAME,
     minVersion: CODEX_MIN,
     async detect(io) {
-        const result = await io.run('codex', ['--version'], 20_000);
-        if (result.code !== 0)
+        // `codex` on PATH, else the Codex app's own (codex-app.ts): init, status and the listener run that one.
+        const found = await findCodex(io);
+        if (!found)
             return null;
-        return { version: /(\d+\.\d+\.\d+)/.exec(result.stdout)?.[1] ?? 'installed' };
+        return {
+            version: found.version,
+            ...(found.app ? { command: found.command, from: FROM_APP } : {}),
+        };
     },
     async installed(io) {
         return (await readCodexManifest(io)) !== null;
@@ -311,6 +332,8 @@ export const codex = {
                 text: 'Codex on Windows isn’t set up by init yet: paste Pending You’s setup message for Codex into it instead.',
             });
         const helperMode = !ctx.oauth;
+        // The codex init runs: the one on PATH, or the Codex app's own.
+        const program = detected.command ?? 'codex';
         const server = await codexServer(io).catch(() => null);
         if (server?.inline)
             return skip({
@@ -351,7 +374,7 @@ export const codex = {
                     text: `Kept Codex’s pendingyou MCP server: it signs in through a headers helper of its own (${server.helper}).`,
                 };
             }
-            else if ((await signedInByItself(io)) !== true) {
+            else if ((await signedInByItself(io, program)) !== true) {
                 // Never signed in: copied from Claude Code by /import (which leaves its helper behind), or left half-made.
                 action = 'write';
             }
@@ -397,7 +420,7 @@ export const codex = {
                     });
                 else {
                     if (mode === 'helper' && server)
-                        await io.run('codex', ['mcp', 'logout', 'pendingyou'], 60_000);
+                        await io.run(program, ['mcp', 'logout', 'pendingyou'], 60_000);
                     const doc = (await readText(config).catch(() => null)) ?? '';
                     const next = withTable(doc, SERVER, serverTable(doc, url, mode === 'helper' ? ictx.helper : null));
                     if (await writeConfig(config, next)) {
@@ -408,11 +431,13 @@ export const codex = {
                                 ? `Added the pendingyou MCP server (${url}) to ${config}${mode === 'helper' ? ', signed in through this computer’s sign-in' : ''}; its tools run without asking.`
                                 : server.url && !sameUrl(server.url, url)
                                     ? `Replaced Codex’s pendingyou MCP server (was ${server.url}) with ${url}.`
-                                    : mode === 'helper'
-                                        ? `Switched Codex’s pendingyou MCP server (${url}) to this computer’s sign-in: one sign-in for it and its hooks.`
-                                        : server.helper
-                                            ? `Switched Codex’s pendingyou MCP server (${url}) to Codex’s own sign-in: run codex mcp login pendingyou.`
-                                            : `Codex’s pendingyou MCP server (${url}) signs in by itself, and its tools now run without asking.`,
+                                    : mode === 'helper' && before?.helper && !server.helper
+                                        ? `Put this computer’s sign-in back on Codex’s pendingyou MCP server (${url}): it had lost its http_headers_helper, which saving it in the Codex app’s MCP settings does.`
+                                        : mode === 'helper'
+                                            ? `Switched Codex’s pendingyou MCP server (${url}) to this computer’s sign-in: one sign-in for it and its hooks.`
+                                            : server.helper
+                                                ? `Switched Codex’s pendingyou MCP server (${url}) to Codex’s own sign-in: run codex mcp login pendingyou.`
+                                                : `Codex’s pendingyou MCP server (${url}) signs in by itself, and its tools now run without asking.`,
                         });
                     }
                     else
@@ -450,10 +475,12 @@ export const codex = {
                         });
                     }
                 }
-                if (!atLeast(version, CODEX_WAKE))
+                if (!atLeast(version, detected.command ? CODEX_APP_WAKE : CODEX_WAKE))
                     report({
                         ok: true,
-                        text: `Codex ${version} wakes an idle thread with your answer only while its background server runs, which Codex starts by itself from ${CODEX_WAKE}. Until you update, an answer reaches a thread when you next write in it.`,
+                        text: detected.command
+                            ? `The Codex app’s codex ${version} has no codex queue, so an answer reaches a chat only when you next write in it. Update the Codex app, then run init again.`
+                            : `Codex ${version} wakes an idle thread with your answer only while its background server runs, which Codex starts by itself from ${CODEX_WAKE}. Until you update, an answer reaches a thread when you next write in it.`,
                     });
                 const manifest = {
                     version: 1,
@@ -472,15 +499,14 @@ export const codex = {
             },
             next: () => {
                 const login = mode === 'oauth' && action !== 'keep';
-                const start = `start codex here, or in the folder you work in, and choose “Trust all and continue” when it asks about hooks (or trust Pending You’s in /hooks)`;
+                const first = login ? `run ${shWord(program)} mcp login pendingyou, then ` : '';
+                // Codex CLI and the Codex app share ~/.codex: name both ways to trust the hooks (0.13.0).
+                const start = detected.command
+                    ? `open the Codex app, start a chat in the folder you work in, and trust Pending You’s hooks: click Review hooks › Allow all (or Settings › Hooks › Trust all)`
+                    : `start codex here, or in the folder you work in, and trust Pending You’s hooks: ${TRUST_CLI}; ${TRUST_APP}`;
                 return {
-                    lines: [
-                        `Next: ${login ? 'run codex mcp login pendingyou, then ' : ''}${start}.`,
-                        'Then say this to it:',
-                        '',
-                        FINISH_SAY,
-                    ],
-                    together: `- Codex: ${login ? 'run codex mcp login pendingyou, then ' : ''}${start}, then say the line below to it.`,
+                    lines: [`Next: ${first}${start}.`, DONT_SAVE, 'Then say this to it:', '', FINISH_SAY],
+                    together: `- Codex: ${first}${start}, then say the line below to it. ${DONT_SAVE}`,
                     say: true,
                 };
             },
@@ -560,6 +586,8 @@ export const codex = {
                     ? `not signed in; run ${fix}`
                     : 'Pending You couldn’t be reached';
         const mcpOk = Boolean(server?.url && sameUrl(server.url, url) && (!helper || helped));
+        // init gave it the helper, and it's gone: saving it in the Codex app's MCP settings writes the table again without.
+        const dropped = Boolean(server?.url && sameUrl(server.url, url) && !server.helper && manifest?.helper);
         const mcpText = !server
             ? `not added; run npx pendingyou init --app codex${flag}`
             : server.inline
@@ -568,9 +596,11 @@ export const codex = {
                     ? `points at ${server.url}, not ${url}; run npx pendingyou init --app codex${flag} to replace it`
                     : helped
                         ? `pendingyou (${server.url}), signed in through ${helperPath(io)} --app codex${server.approval === 'approve' ? '; its tools run without asking' : ''}`
-                        : helper
-                            ? `pendingyou (${server.url}) signs in by itself; run npx pendingyou init --app codex${flag} to use this computer’s sign-in`
-                            : `pendingyou (${server.url}), signed in by Codex itself`;
+                        : dropped
+                            ? `pendingyou (${server.url}) has lost its http_headers_helper${server.approval === 'approve' ? '' : ' and default_tools_approval_mode'} (saving it in the Codex app’s MCP settings does that), so Codex can’t sign in through this computer’s sign-in; run npx pendingyou init --app codex${flag} again`
+                            : helper
+                                ? `pendingyou (${server.url}) signs in by itself; run npx pendingyou init --app codex${flag} to use this computer’s sign-in`
+                                : `pendingyou (${server.url}), signed in by Codex itself`;
         const check = helper ? await checkHelper(io, origin, 'codex') : null;
         const words = {
             trusted: 'trusted',
@@ -582,12 +612,14 @@ export const codex = {
         const hooksOk = trust.every((hook) => hook.trust === 'trusted');
         const hooksText = trust.some((hook) => hook.trust === 'missing')
             ? `not installed; run npx pendingyou init --app codex${flag}`
-            : `${trust.map((hook) => `${hook.event} ${words[hook.trust]}`).join(', ')}${hooksOk ? '' : '. Start codex and choose “Trust all and continue”, or trust them in /hooks: Codex skips a hook you haven’t trusted'}`;
-        const wakes = detected ? atLeast(detected.version, CODEX_WAKE) : false;
+            : `${trust.map((hook) => `${hook.event} ${words[hook.trust]}`).join(', ')}${hooksOk ? '' : `. Codex skips a hook you haven’t trusted: ${TRUST_CLI}; ${TRUST_APP}`}`;
+        const wakes = detected
+            ? atLeast(detected.version, detected.command ? CODEX_APP_WAKE : CODEX_WAKE)
+            : false;
         const lines = [
             `Pending You for Codex · ${origin}${why ? ` · no browser here (${why})` : ''}`,
             `  ${mark(signOk)} Sign-in: ${signText}`,
-            `  ${mark(detected !== null)} Codex: ${detected?.version ?? 'not found on PATH'}`,
+            `  ${mark(detected !== null)} Codex: ${detected ? `${detected.version}${detected.command ? ` (${FROM_APP}: ${detected.command})` : ''}` : 'not found on PATH, nor the Codex app'}`,
             `  ${mark(mcpOk)} MCP server: ${mcpText}`,
             ...(check
                 ? [
@@ -598,7 +630,11 @@ export const codex = {
                 : []),
             `  ${mark(skill !== null)} Skill: ${skill !== null ? `saved (${codexSkillPath(io)})` : `not saved; run npx pendingyou init --app codex${flag}`}`,
             `  ${mark(hooksOk)} Hooks: ${hooksText}`,
-            `  ${mark(wakes)} Wake: ${wakes ? 'codex queue wakes a thread when you answer, even while it’s idle' : `needs Codex ${CODEX_WAKE} or later${detected ? ` (this is ${detected.version})` : ''}; until then an answer reaches a thread when you next write in it`}`,
+            `  ${mark(wakes)} Wake: ${wakes
+                ? detected?.command
+                    ? 'codex queue wakes a chat the Codex app has open when you answer, while the app runs (one it let go, idle 3 hours or behind 10 newer idle chats, hears it when you open it again)'
+                    : 'codex queue wakes a thread when you answer, even while it’s idle'
+                : `needs Codex ${detected?.command ? CODEX_APP_WAKE : CODEX_WAKE} or later${detected ? ` (this is ${detected.version})` : ''}; until then an answer reaches a thread when you next write in it`}`,
         ];
         const setup = setupStatus(NAME, signIn.state === 'ok' ? setupOf(signIn.for) : null);
         if (setup)

package/dist/apps/pi-extension.js

@@ -53,10 +53,15 @@ const SOURCES = {
     resume: 'resume',
     fork: 'resume',
 };
-/** How the session-start hook's setup lines begin (the command line's setup.ts): these start a turn. */
+/**
+ * What the session-start hook's setup lines say (the command line's setup.ts): these start a turn. 0.13.0's, and the
+ * words before them (0.12.0's), which a shim run by an older init's copy may still print.
+ */
 export const SETUP_LINES = [
-    'Pending You: this computer is connected (',
+    ' is connected, but its setup isn’t finished. ',
+    ' is connected, but setup’s test question isn’t sent yet. ',
     'Pending You: your person answered setup’s test question',
+    'Pending You: this computer is connected (',
 ];
 /** The most of one string a card's call hands the hook: what a card says, to match an ask against (stopcheck.ts). */
 const MAX_STRING = 20_000;