pendingyou 0.12.0 → 0.13.0

package/dist/args.js

@@ -76,6 +76,9 @@ const COMMANDS = new Set([
     'posted',
     'listen',
     'mcp',
+    'permission',
+    'permission-done',
+    'permission-card',
 ]);
 /** Flags each command takes; `true` when the flag takes a value. */
 const FLAGS = {
@@ -98,6 +101,9 @@ const FLAGS = {
     stopcheck: { origin: true, app: true },
     posted: { origin: true, app: true },
     listen: { origin: true, app: true, thread: true },
+    permission: { origin: true, app: true },
+    'permission-done': { origin: true, app: true },
+    'permission-card': { origin: true, session: true, worker: true },
     init: {
         origin: true,
         'no-login': false,
@@ -108,6 +114,8 @@ const FLAGS = {
         name: true,
         oauth: false,
         app: true,
+        'permission-cards': false,
+        'no-permission-cards': false,
     },
     uninstall: { origin: true, app: true },
     watch: { origin: true, once: false },
@@ -116,7 +124,7 @@ const FLAGS = {
     mcp: { origin: true, app: true, check: false },
 };
 /** Options that take a value, whichever command they belong to: needed to find the command behind them. */
-const VALUE_OPTIONS = new Set(['origin', 'timeout', 'name', 'app', 'thread']);
+const VALUE_OPTIONS = new Set(['origin', 'timeout', 'name', 'app', 'thread', 'session', 'worker']);
 /** Splits off the options given before the command: [those options, the command, everything after it]. */
 function splitCommand(argv) {
     let index = 0;
@@ -138,6 +146,8 @@ export const HOOK_COMMANDS = new Set([
     'handoff',
     'stopcheck',
     'posted',
+    'permission',
+    'permission-done',
 ]);
 /**
  * A thread's id, as an app's hooks give it (`session_id`): Codex's (letters, digits and dashes), an OpenCode session's
@@ -244,6 +254,16 @@ export function parseArgs(argv, env = {}) {
             throw new UsageError(`${first} takes one app, like: --app ${apps[0]}`);
         return { app: apps[0] };
     };
+    /** `--permission-cards` or `--no-permission-cards`, or neither (as before). */
+    const permissionCards = () => {
+        if (flags.has('permission-cards') && flags.has('no-permission-cards'))
+            throw new UsageError('Use --permission-cards or --no-permission-cards, not both.');
+        return flags.has('permission-cards')
+            ? { permissionCards: true }
+            : flags.has('no-permission-cards')
+                ? { permissionCards: false }
+                : {};
+    };
     /** `--app`, one or several; none when it isn't given (every app). */
     const apps = () => {
         const given = text('app');
@@ -295,6 +315,23 @@ export function parseArgs(argv, env = {}) {
                 throw new UsageError('listen needs the thread it wakes, like: --thread 0199a1b2-…');
             return { name: 'listen', origin, ...app(), thread };
         }
+        // Not in USAGE: Claude Code's permission-prompt hooks (0.13.0, permission.ts).
+        case 'permission':
+        case 'permission-done':
+            none();
+            return { name: first, origin, ...app() };
+        // Not in USAGE: what those hooks start in the background, one per Claude Code session (permission.ts).
+        case 'permission-card': {
+            none();
+            const session = text('session');
+            const worker = text('worker');
+            if (session === undefined ||
+                !THREAD.test(session) ||
+                !worker ||
+                !/^[0-9a-f]{8,64}$/.test(worker))
+                throw new UsageError('permission-card needs --session <id> and --worker <id>.');
+            return { name: 'permission-card', origin, session, worker };
+        }
         case 'uninstall':
             none();
             return { name: 'uninstall', origin, ...apps() };
@@ -321,6 +358,7 @@ export function parseArgs(argv, env = {}) {
                 ...machine(),
                 ...(flags.has('oauth') ? { oauth: true } : {}),
                 ...apps(),
+                ...permissionCards(),
             };
         case 'watch':
             none();
@@ -375,5 +413,6 @@ Options: --origin <url> (default ${DEFAULT_ORIGIN}), --app <app> (init, status,
 the default over SSH), --browser (open the browser anyway), --no-browser (only print the address), --name <name>
 (login, init: what to call this computer; by default its own name on a Mac, its Tailscale name, else its hostname),
 --no-login (init), --oauth (init: every agent signs in to Pending You by itself, as before 0.11.0), --yes (init: switch
-or replace a pendingyou MCP server without asking), --all (logout), --force (login), --once (watch).
+or replace a pendingyou MCP server without asking), --no-permission-cards (init: no card when Claude Code waits for your
+OK; --permission-cards turns them back on), --all (logout), --force (login), --once (watch).
 `;

package/dist/bridge.js

@@ -536,6 +536,88 @@ export async function bridge(io, options) {
     await io.flush();
     return 0;
 }
+/** A tool call Pending You refused, in its own words: a card that's closed, or changed since it was last read. */
+export class ToolRefused extends Error {
+    name = 'ToolRefused';
+}
+/** Pending You couldn't be asked: the sign-in (SIGN_IN_ERROR: init has to run again) or the network (BRIDGE_ERROR). */
+export class McpFailure extends Error {
+    name = 'McpFailure';
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+/** A tool's answer as Pending You gives it (worker/mcp/server.ts): its structured content, or its text as JSON. */
+function resultOf(result) {
+    if (isObject(result.structuredContent))
+        return result.structuredContent;
+    const blocks = Array.isArray(result.content) ? result.content : [];
+    for (const block of blocks) {
+        if (!isObject(block) || typeof block.text !== 'string')
+            continue;
+        try {
+            const parsed = JSON.parse(block.text);
+            if (isObject(parsed))
+                return parsed;
+        }
+        catch { }
+    }
+    return {};
+}
+/** The words of a refused tool call (its text content), cut short. */
+function refusalOf(result) {
+    const blocks = Array.isArray(result.content) ? result.content : [];
+    const text = blocks.find((block) => isObject(block) && typeof block.text === 'string');
+    return typeof text?.text === 'string' ? text.text.slice(0, 300) : 'Pending You refused that.';
+}
+/**
+ * A small MCP client over the bridge's own relay (0.13.0): what the permission-prompt cards' worker (permission.ts)
+ * asks Pending You with. The handshake, then one tools/call at a time, each given up after `callMs`, with the app's
+ * own connection (its token refreshed in the background, never a redirect followed), exactly as the bridge sends an
+ * app's messages. Throws McpFailure when the handshake can't be made.
+ */
+export async function mcpClient(io, origin, app, callMs = 15_000) {
+    const replies = new Map();
+    const relay = relayFor(io, origin, app, AbortSignal.timeout(callMs), (message) => {
+        for (const each of Array.isArray(message) ? message : [message])
+            if (isObject(each) && !('method' in each) && isId(each.id))
+                replies.set(each.id, each);
+    }, () => { });
+    let next = 0;
+    const send = async (message) => {
+        // Each message gets its own time limit; the session it keeps carries over.
+        relay.signal = AbortSignal.timeout(callMs);
+        await relayOne(relay, JSON.stringify(message), message);
+    };
+    const request = async (method, params) => {
+        const id = `pendingyou-${++next}`;
+        await send({ jsonrpc: '2.0', id, method, params });
+        const reply = replies.get(id);
+        replies.delete(id);
+        if (!reply)
+            throw new McpFailure(BRIDGE_ERROR, words.noAnswer);
+        if (isObject(reply.error))
+            throw new McpFailure(typeof reply.error.code === 'number' ? reply.error.code : BRIDGE_ERROR, typeof reply.error.message === 'string' ? reply.error.message : words.noAnswer);
+        return isObject(reply.result) ? reply.result : {};
+    };
+    await request('initialize', {
+        protocolVersion: '2025-06-18',
+        capabilities: {},
+        clientInfo: { name: 'pendingyou', version: VERSION },
+    });
+    await send({ jsonrpc: '2.0', method: 'notifications/initialized' });
+    return {
+        async call(name, args) {
+            const result = await request('tools/call', { name, arguments: args });
+            if (result.isError === true)
+                throw new ToolRefused(refusalOf(result));
+            return resultOf(result);
+        },
+        close: () => endSession(relay),
+    };
+}
 /**
  * Whether the app's MCP server would reach Pending You through the bridge now (status): the handshake, sent as the
  * bridge sends it, with the app's sign-in. Null when it answered; else why not, in the words the bridge would use.

package/dist/claude.js

@@ -23,7 +23,8 @@ import { PlainError } from "./errors.js";
 import { claudeDir, configDir, readJson, readText, writeWhole } from "./files.js";
 import { findHook, hooksOf, mergeHooks, originArgs, removeHooks } from "./hooks.js";
 import { cliPackage, hookForm, hookRuns, shellQuote, } from "./install.js";
-import { claudeVersion, isOurModDir, loadsMods, modDir, PLUGIN_DIRS, pluginDirs, pluginEnabled, separatorFor, withModDir, } from "./mod.js";
+import { atLeast, claudeVersion, isOurModDir, loadsMods, modDir, PLUGIN_DIRS, pluginDirs, pluginEnabled, separatorFor, withModDir, } from "./mod.js";
+import { removePermissionFiles } from "./permission.js";
 import { helperPath } from "./remote.js";
 import { readShim, SHIM } from "./shim.js";
 import { VERSION } from "./version.js";
@@ -37,6 +38,23 @@ export const HOOKS = {
 };
 /** The same, as hooks.ts takes them. SessionStart has no matcher: pickup itself skips a compaction (setup.ts). */
 export const CLAUDE_HOOKS = Object.keys(HOOKS).map((event) => ({ event, sub: HOOKS[event] }));
+/**
+ * The permission-prompt hooks (0.13.0, permission.ts), for every tool: the prompt (PermissionRequest), the call it
+ * asked about running (PostToolUse, PostToolUseFailure) and the session ending (SessionEnd, with no timeout of ours:
+ * a longer one would make Claude Code wait longer for every SessionEnd hook). The next message's and the Stop hooks
+ * settle a session's prompts too.
+ */
+export const PERMISSION_HOOKS = [
+    { event: 'PermissionRequest', sub: 'permission' },
+    { event: 'PostToolUse', sub: 'permission-done' },
+    { event: 'PostToolUseFailure', sub: 'permission-done' },
+    { event: 'SessionEnd', sub: 'permission-done', timeout: null },
+];
+/**
+ * The first Claude Code with all of them (PermissionRequest came in 2.0.45, PostToolUseFailure by 2.1.119). An older
+ * one gets none: before 2.1.101, a hook event Claude Code didn't know made it ignore the whole settings file.
+ */
+export const PERMISSION_CLAUDE = '2.1.119';
 /**
  * What Claude Code may do without stopping to ask: start the background wait, and use Pending You's own tools (ask
  * the person, read their answers). Without them, a question posted while the person is away would wait on a
@@ -100,12 +118,23 @@ const objectAt = (parent, key) => {
 /**
  * Adds our hooks and permissions, or updates our hooks in place (a new version, or a line an older version wrote, like
  * 0.2.0's `… --origin <url> handoff`, which 0.2.0 itself can't read). Returns the permissions it added.
+ * `permission` (0.13.0): the permission-prompt hooks' lines, by event, to add or update; null takes ours out (the
+ * person turned them off, or this Claude Code can't run them); left out, they're left as they are.
  */
-export function mergeSettings(settings, commands) {
+export function mergeSettings(settings, commands, permission) {
     const next = structuredClone(settings);
     const merged = mergeHooks(hooksOf(next, 'Claude Code’s settings'), CLAUDE_HOOKS, commands, 'Claude Code');
-    let changed = merged.changed;
-    next.hooks = merged.hooks;
+    let hooks = merged.hooks;
+    let permissionChanged = false;
+    if (permission !== undefined) {
+        const prompts = permission
+            ? mergeHooks(hooks, PERMISSION_HOOKS, permission, 'Claude Code')
+            : removeHooks(hooks, PERMISSION_HOOKS);
+        hooks = prompts.hooks;
+        permissionChanged = prompts.changed;
+    }
+    let changed = merged.changed || permissionChanged;
+    next.hooks = hooks;
     const permissions = objectAt(next, 'permissions') ?? {};
     if (next.permissions !== undefined && objectAt(next, 'permissions') === null)
         throw new PlainError('Claude Code’s “permissions” isn’t an object, so I left the settings alone.');
@@ -116,7 +145,13 @@ export function mergeSettings(settings, commands) {
         next.permissions = permissions;
         changed = true;
     }
-    return { settings: next, permissionsAdded, changed };
+    return {
+        settings: next,
+        permissionsAdded,
+        changed,
+        hooksChanged: merged.changed,
+        permissionChanged,
+    };
 }
 /** Removes our hooks, and the permissions init added; leaves everything else as it was. */
 export function unmergeSettings(settings, permissionsAdded) {
@@ -124,7 +159,7 @@ export function unmergeSettings(settings, permissionsAdded) {
     let changed = false;
     const hooks = objectAt(next, 'hooks');
     if (hooks) {
-        const removed = removeHooks(hooks, CLAUDE_HOOKS);
+        const removed = removeHooks(hooks, [...CLAUDE_HOOKS, ...PERMISSION_HOOKS]);
         changed = removed.changed;
         if (Object.keys(removed.hooks).length === 0)
             delete next.hooks;
@@ -323,6 +358,17 @@ export async function removeSkill(skill) {
     }
     return text !== null ? { ok: true, text: `Kept ${skill.path}: it was changed after init.` } : null;
 }
+/** Why Claude Code here can't have the permission-prompt hooks, in a line; null when it can. */
+export function permissionBlocker(io, version, mode) {
+    if (io.platform === 'win32')
+        return 'not on Windows yet';
+    if (mode !== 'helper')
+        return 'they need Claude Code signed in through this computer’s sign-in, and here it signs in by itself';
+    const found = claudeVersion(version);
+    if (!found || !atLeast(found, PERMISSION_CLAUDE))
+        return `they need Claude Code ${PERMISSION_CLAUDE} or later${found ? ` (this is ${found})` : ''}`;
+    return null;
+}
 /**
  * Everything init does in Claude Code (not the sign-in, nor the shared parts: the copy, the shim, the helper).
  * Idempotent. Each step is reported as it's done.
@@ -359,13 +405,30 @@ export async function installClaude(io, origin, options) {
         skill = await saveSkill(io, origin, skillPath(io), before?.skill ?? null);
     report(skill.step);
     const commands = Object.fromEntries(Object.keys(HOOKS).map((event) => [event, options.hookLine(HOOKS[event])]));
-    const merged = mergeSettings(await readSettings(io), commands);
+    // The permission-prompt hooks (0.13.0): on unless the person turned them off, here or before.
+    const wanted = options.permissionCards ?? before?.permissionCards !== false;
+    const blocker = permissionBlocker(io, options.version, options.mode);
+    const permissionLines = wanted && !blocker
+        ? Object.fromEntries(PERMISSION_HOOKS.map((spec) => [spec.event, options.hookLine(spec.sub)]))
+        : null;
+    const merged = mergeSettings(await readSettings(io), commands, permissionLines);
     report({
         ok: true,
-        text: merged.changed
+        text: merged.hooksChanged
             ? `Installed or updated the session-start pickup, next-message hand-off and Stop check hooks in ${settingsPath(io)}.`
             : 'The hooks were already installed.',
     });
+    const flag = originArgs(origin);
+    report({
+        ok: true,
+        text: permissionLines
+            ? merged.permissionChanged
+                ? 'Added the permission-prompt hooks: when Claude Code waits for your OK and you don’t answer within a few seconds, a card says so (a push only after your hand-off wait), and it goes once you answer in Claude Code.'
+                : 'The permission-prompt hooks were already installed.'
+            : !wanted
+                ? `${merged.permissionChanged ? 'Took out the permission-prompt hooks' : 'Left out the permission-prompt hooks'}, as you asked: no card when Claude Code waits for your OK. To turn them on: npx pendingyou init --permission-cards${flag}`
+                : `${merged.permissionChanged ? 'Took out' : 'Left out'} the permission-prompt hooks: ${blocker}.`,
+    });
     const mod = await addMod(io, merged.settings, options.copy, options.version);
     if (mod.step)
         report(mod.step);
@@ -389,6 +452,8 @@ export async function installClaude(io, origin, options) {
                 : null,
         setup: { since: new Date(io.now()).toISOString() },
         ...(options.plugin ? { plugin: true } : {}),
+        permissionHooks: permissionLines,
+        permissionCards: wanted,
     };
     await writeWhole(manifestPath(io), `${JSON.stringify(manifest, null, 2)}\n`, { secret: true });
     return steps;
@@ -450,6 +515,8 @@ export async function uninstallClaude(io) {
     });
     if (modRemoved)
         steps.push({ ok: true, text: `Removed the wake mod from ${PLUGIN_DIRS}.` });
+    // Sessions' permission prompts: nothing will settle them now.
+    await removePermissionFiles(io);
     const skill = await removeSkill(manifest?.skill ?? null);
     if (skill)
         steps.push(skill);
@@ -489,6 +556,7 @@ export async function claudeState(io) {
     }
     const skill = (await readText(skillPath(io))) !== null;
     let ours = (_event) => undefined;
+    let permission = false;
     const mod = { loads: false, dirs: [], present: false, plugin: false };
     const loads = claude ? claudeVersion(claude) : null;
     mod.loads = loads !== null && loadsMods(loads);
@@ -500,6 +568,7 @@ export async function claudeState(io) {
         plugins = enabledPlugins(settings);
         const all = objectAt(settings, 'hooks') ?? {};
         ours = (event) => findHook(all, event, HOOKS[event]);
+        permission = Boolean(findHook(all, 'PermissionRequest', 'permission'));
     }
     catch { }
     const start = ours('SessionStart');
@@ -513,6 +582,7 @@ export async function claudeState(io) {
         skill,
         hooks: Boolean(start && ours('UserPromptSubmit')),
         stopcheck: Boolean(ours('Stop')),
+        permission,
         form: form ? { ...form, runs: await hookRuns(form), shim } : null,
         mod,
         plugins,

package/dist/files.js

@@ -11,6 +11,11 @@ export function configDir(io) {
     const base = io.env.XDG_CONFIG_HOME || join(io.home, '.config');
     return join(base, 'pendingyou');
 }
+/**
+ * The folder, under configDir, of Claude Code sessions' permission prompts (0.13.0, permission.ts): one file a session
+ * while it has a prompt or a card. The hooks' shim looks for any file here before it starts Node (shim.ts).
+ */
+export const PERMISSION_FOLDER = 'permission-cards';
 /** Claude Code's own folder: ~/.claude, or $CLAUDE_CONFIG_DIR. */
 export function claudeDir(io) {
     return io.env.CLAUDE_CONFIG_DIR || join(io.home, '.claude');

package/dist/hooks.js

@@ -67,19 +67,24 @@ export function mergeHooks(hooks, specs, lines, where) {
             throw new PlainError(`${where}’s ${spec.event} hooks aren’t a list, so I left them alone.`);
         const groups = Array.isArray(next[spec.event]) ? next[spec.event] : [];
         const ours = groups.filter((group) => (group?.hooks ?? []).some((hook) => isOurHook(hook?.command, spec.sub)));
+        const timeout = spec.timeout === undefined ? HOOK_TIMEOUT : spec.timeout;
         if (ours.length === 0) {
             groups.push({
                 ...(spec.matcher ? { matcher: spec.matcher } : {}),
-                hooks: [{ type: 'command', command: wanted, timeout: HOOK_TIMEOUT }],
+                hooks: [{ type: 'command', command: wanted, ...(timeout === null ? {} : { timeout }) }],
             });
             changed = true;
         }
         for (const group of ours) {
             for (const hook of group.hooks ?? [])
                 if (isOurHook(hook.command, spec.sub) &&
-                    (hook.command !== wanted || hook.timeout !== HOOK_TIMEOUT)) {
+                    (hook.command !== wanted ||
+                        (timeout === null ? 'timeout' in hook : hook.timeout !== timeout))) {
                     hook.command = wanted;
-                    hook.timeout = HOOK_TIMEOUT;
+                    if (timeout === null)
+                        delete hook.timeout;
+                    else
+                        hook.timeout = timeout;
                     changed = true;
                 }
             // The matcher is ours to set only on a group that holds nothing but our hook.

package/dist/init.js

@@ -135,7 +135,7 @@ export async function init(io, options) {
         io.out(`Didn’t find ${namesOf([...APP_IDS], 'or')} on this computer’s PATH. Install one, then run: npx -y pendingyou@latest init${flag}\n`);
         return 1;
     }
-    const versions = found.map(({ app, detected }) => `${app.name} ${detected.version}`);
+    const versions = found.map(({ app, detected }) => `${app.name} ${detected.version}${detected.from ? ` (${detected.from})` : ''}`);
     io.out(`Setting up Pending You (${options.origin}) for ${versions.length > 1 ? `${versions.slice(0, -1).join(', ')} and ${versions.at(-1)}` : versions[0]}.\n`);
     for (const problem of problems)
         io.out(`${problem}\n`);
@@ -145,6 +145,7 @@ export async function init(io, options) {
         oauth: Boolean(options.oauth),
         headless: headlessReason(io),
         progress: (text) => io.out(text),
+        ...(options.permissionCards === undefined ? {} : { permissionCards: options.permissionCards }),
     };
     // Everything decided before anyone signs in: Cancel then changes nothing.
     const prepared = [];

package/dist/io.js

@@ -86,7 +86,7 @@ export function sleep(ms, signal) {
         signal?.addEventListener('abort', done, { once: true });
     });
 }
-function readStdin(timeoutMs) {
+function readStdin(timeoutMs, maxChars = 1_000_000) {
     if (process.stdin.isTTY)
         return Promise.resolve('');
     return new Promise((resolve) => {
@@ -100,7 +100,7 @@ function readStdin(timeoutMs) {
         process.stdin.setEncoding('utf8');
         process.stdin.on('data', (chunk) => {
             text += chunk;
-            if (text.length > 1_000_000)
+            if (text.length > maxChars)
                 finish();
         });
         process.stdin.on('end', finish);

package/dist/main.js

@@ -10,6 +10,7 @@ import { PlainError } from "./errors.js";
 import { hold } from "./hold.js";
 import { init, status, uninstall } from "./init.js";
 import { OAuthError } from "./oauth.js";
+import { permissionHook, permissionWorker } from "./permission.js";
 import { pickup } from "./pickup.js";
 import { mcpHeaders } from "./remote.js";
 import { login, logout } from "./signin.js";
@@ -46,6 +47,19 @@ async function run(io, command, hook = { fallback: '' }) {
             return stopcheck(io, { origin: command.origin, app: command.app ?? DEFAULT_APP });
         case 'posted':
             return posted(io, { origin: command.origin, app: command.app ?? DEFAULT_APP });
+        case 'permission':
+        case 'permission-done':
+            // Claude Code's only (0.13.0): a hook line with another app does nothing.
+            if ((command.app ?? DEFAULT_APP) !== DEFAULT_APP)
+                return 0;
+            return permissionHook(io, { origin: command.origin });
+        case 'permission-card':
+            // Detached and quiet, like refresh: nobody reads what it prints.
+            try {
+                await permissionWorker(io, command);
+            }
+            catch { }
+            return 0;
         case 'listen':
             // Codex's is detached, started by `posted`: nobody reads what it prints. OpenCode's plugin and Pi's extension
             // read their own child's.