pendingyou 0.12.0 → 0.13.0

package/dist/pickup.js

@@ -31,6 +31,7 @@ import { environmentWarning } from "./environment.js";
 import { configDir, readJson } from "./files.js";
 import { clip, describe } from "./format.js";
 import { holdCommand } from "./hold.js";
+import { isPermissionCard, settlePrompts } from "./permission.js";
 import { setupReminder } from "./setup.js";
 import { markHanded, momentOf, wasHanded } from "./state.js";
 /** Each request's own limit, inside the hook's 3-second deadline (main.ts). */
@@ -52,14 +53,16 @@ export function openLine(open) {
     const { requests, total } = open;
     if (!Array.isArray(requests))
         return REMINDER;
-    const cards = requests
-        .filter((card) => typeof card?.requestId === 'string' &&
+    const valid = requests.filter((card) => typeof card?.requestId === 'string' &&
         /^req_[A-Za-z0-9-]{1,40}$/.test(card.requestId) &&
-        typeof card.title === 'string')
-        .slice(0, OPEN_SHOWN);
+        typeof card.title === 'string');
+    // A permission prompt's card is the hooks' own, and closes by itself (0.13.0, permission.ts): not the agent's to settle.
+    const theirs = valid.filter((card) => !isPermissionCard(card.title));
+    const cards = theirs.slice(0, OPEN_SHOWN);
     if (cards.length === 0)
         return REMINDER;
-    const more = typeof total === 'number' && total > cards.length ? total - cards.length : 0;
+    const waiting = typeof total === 'number' ? total - (valid.length - theirs.length) : 0;
+    const more = waiting > cards.length ? waiting - cards.length : 0;
     const named = cards
         .map((card) => {
         const by = typeof card.name === 'string' && card.name.trim()
@@ -111,6 +114,9 @@ export async function pickup(io, options, hook = { fallback: '' }) {
     try {
         const input = await hookInput(io);
         const { cwd } = input;
+        // The person wrote: whatever Claude Code asked their OK for there is answered (0.13.0, permission.ts).
+        if (mode === 'handoff' && app === DEFAULT_APP)
+            await settlePrompts(io, { session: input.session, event: 'prompt' });
         warning = await environmentWarning(io, cwd, origin, app);
         if (warning)
             hook.fallback = `${warning}\n`;
@@ -152,7 +158,8 @@ export async function pickup(io, options, hook = { fallback: '' }) {
             return 0;
         const fresh = [];
         for (const heard of body.requests)
-            if (!(await wasHanded(io, origin, heard.requestId, momentOf(heard))))
+            if (!isPermissionCard(heard.title) &&
+                !(await wasHanded(io, origin, heard.requestId, momentOf(heard))))
                 fresh.push(heard);
         if (fresh.length === 0)
             return 0;

package/dist/redact.js

@@ -0,0 +1,369 @@
+// What a card may say about a command, a file or an address (0.13.0, the permission-prompt cards: permission.ts): what
+// Claude Code is waiting for the person's OK on, in a line, with anything that could be a secret taken out. A card's
+// words sit in notifications, on every device it's opened on and in history, so this errs on the side of saying less:
+//
+// - the values after anything named like a secret: a flag (`--token …`, `--password=…`, `-p…`), a header
+//   (`Authorization: …`, `Cookie: …`), an environment variable or a key in JSON, YAML or a form (`FOO_TOKEN=…`,
+//   `"password": …`), and a bearer, basic or token credential;
+// - a URL's user name and password, and the value of every query and fragment parameter;
+// - anything that looks like a key or token: the well-known prefixes (ghp_, sk-, AKIA, xoxb-…), a JWT, a private key,
+//   a long run of letters and digits that mixes upper and lower case, one long random-looking part, and long hex;
+// - and when a command can't be read safely (more than one line, a heredoc, inline code like `node -e`, `eval`, or a
+//   command that takes a secret on stdin), only the tool and the command's first word: "Bash: node …".
+//
+// Everything is cut to SUMMARY_MAX characters; the card's title is cut again to fit. Pure functions: nothing here reads
+// or writes anything.
+/** What stands in for whatever was taken out. */
+export const BLANK = '…';
+/** The most of a command, a path or a question a card shows. */
+export const SUMMARY_MAX = 120;
+/** Parts of a flag's name that make its value secret: `--api-key`, `--auth-token`, `--session`. */
+const SECRET_PARTS = new Set([
+    'pass',
+    'password',
+    'passwd',
+    'passphrase',
+    'pwd',
+    'pw',
+    'secret',
+    'secrets',
+    'token',
+    'tokens',
+    'key',
+    'keys',
+    'apikey',
+    'auth',
+    'authorization',
+    'credential',
+    'credentials',
+    'cred',
+    'creds',
+    'cookie',
+    'cookies',
+    'session',
+    'sessionid',
+    'sid',
+    'signature',
+    'sig',
+    'otp',
+    'bearer',
+    'private',
+    'dsn',
+    'jwt',
+    'pat',
+]);
+/**
+ * Words that make a name secret wherever they are in it (in snake case): PGPASSWORD, GITHUB_TOKEN, client_secret,
+ * BASIC_AUTH. Not "author".
+ */
+const SECRET_WORDS = /pass(?:word|wd|phrase)?|pwd|secret|token|api_?key|access_?key|private_?key|credential|cookie|signature|bearer|session|(?:^|_)auth(?:_|$|orization)|dsn|jwt|(?:^|_)keys?(?:_|$)|key$/i;
+/** Whether a flag's name (`--api-key`, `-p`) says its value is secret. */
+export function isSecretFlag(flag) {
+    const name = flag.replace(/^-+/, '');
+    if (/^[pP]$/.test(name))
+        return true;
+    // openssl's -pass, -passin and -passout; --password, --passphrase.
+    if (/^pass|password|passwd|secret|token|apikey|credential/i.test(name))
+        return true;
+    return name
+        .toLowerCase()
+        .split(/[-_.]/)
+        .some((part) => SECRET_PARTS.has(part));
+}
+/** Whether a variable's or a key's name (`GITHUB_TOKEN`, `"password"`, `clientSecret`) says its value is secret. */
+export function isSecretName(name) {
+    const bare = name.replace(/^-+/, '');
+    if (isSecretFlag(bare))
+        return true;
+    // camelCase and SCREAMING_CASE alike: clientSecret → client_secret.
+    const snake = bare.replace(/([a-z0-9])([A-Z])/g, '$1_$2');
+    return SECRET_WORDS.test(snake);
+}
+/** Letters and digits, and enough different characters that it isn't a placeholder like xxxx or 0000. */
+const looksRandom = (run) => /\d/.test(run) && /[A-Za-z]/.test(run) && new Set(run).size >= 8;
+/** The well-known shapes of keys and tokens, at any length that could be real. */
+const KEY_SHAPES = [
+    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)/g,
+    /\bgh[pousr]_[A-Za-z0-9]{16,}/g,
+    /\bgithub_pat_[A-Za-z0-9_]{16,}/g,
+    /\bglpat-[A-Za-z0-9_-]{16,}/g,
+    /\bsk-[A-Za-z0-9_-]{16,}/g,
+    /\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{12,}/g,
+    /\bwhsec_[A-Za-z0-9+/=]{16,}/g,
+    /\bxox[abposr]-[A-Za-z0-9-]{8,}/g,
+    /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
+    /\bsntry[su]_[A-Za-z0-9+/=_-]{16,}/g,
+    /\bnpm_[A-Za-z0-9]{16,}/g,
+    /\bAIza[0-9A-Za-z_-]{20,}/g,
+    /\bcrsr_[A-Za-z0-9]{16,}/g,
+    /\bya29\.[A-Za-z0-9_-]{16,}/g,
+    /\beyJ[A-Za-z0-9_-]{8,}(?:\.[A-Za-z0-9_-]*){0,2}/g,
+];
+/**
+ * A run that looks like a key or token: long hex; or letters and digits that mix upper and lower case (a base62 or
+ * base64 key); or one long part, split on - _ . /, that mixes letters and digits. Not a branch name, a slug or a path,
+ * whose parts are short and mostly one case.
+ */
+export function looksLikeToken(run) {
+    const bare = run.replace(/^[-_.:/+=]+|[-_.:/+=]+$/g, '');
+    if (bare.length < 20)
+        return false;
+    if (/^[0-9a-f]{32,}$/i.test(bare))
+        return true;
+    if (bare.length >= 24 && /[a-z]/.test(bare) && /[A-Z]/.test(bare) && /\d/.test(bare)) {
+        // A path's parts are words: a run of upper, lower and digits is a key only when it isn't split into short words.
+        const parts = bare.split(/[/.]/);
+        if (parts.some((part) => part.length >= 20 && looksRandom(part)))
+            return true;
+    }
+    return bare.split(/[-_./]/).some((part) => part.length >= 20 && looksRandom(part));
+}
+/** Takes keys and tokens out of any text: their well-known shapes, then long random-looking runs. */
+export function redactTokens(text) {
+    let out = text;
+    for (const shape of KEY_SHAPES)
+        out = out.replace(shape, BLANK);
+    return out.replace(/[A-Za-z0-9+/=_.:-]{20,}/g, (run) => {
+        // A URL's own address isn't a token: only its parts are looked at (redactUrls blanks its query).
+        if (/^[a-z][a-z0-9+.-]*:\/\//i.test(run))
+            return run;
+        return looksLikeToken(run) ? BLANK : run;
+    });
+}
+/**
+ * A URL without its user name and password, with every query and fragment parameter's value blanked, and any part of
+ * its path that looks like a token (a webhook's secret: hooks.slack.com/services/T…/B…/<secret>) blanked too.
+ */
+export function redactUrl(url) {
+    const match = /^([a-z][a-z0-9+.-]*:\/\/)([^/?#\s]*)([^?#\s]*)(.*)$/is.exec(url);
+    if (!match)
+        return url;
+    const [, scheme, authority = '', path = '', rest = ''] = match;
+    const host = authority.includes('@')
+        ? `${BLANK}@${authority.slice(authority.lastIndexOf('@') + 1)}`
+        : authority;
+    const parts = path
+        .split('/')
+        .map((part) => (part.length >= 20 && looksLikeToken(part) ? BLANK : part))
+        .join('/');
+    const tail = rest
+        .replace(/([?&;][^=&#;\s]*)=([^&#;\s]*)/g, (_all, name, value) => value ? `${name}=${BLANK}` : `${name}=`)
+        .replace(/(#|&)([^=&#\s]+)=([^&#\s]*)/g, (_all, mark, name, value) => value ? `${mark}${name}=${BLANK}` : `${mark}${name}=`);
+    return `${scheme}${host}${parts}${tail}`;
+}
+/** Every URL in the text, without its credentials and query values (redactUrl). */
+export function redactUrls(text) {
+    return text.replace(/\b[a-z][a-z0-9+.-]*:\/\/[^\s'"`<>)\]}]+/gi, redactUrl);
+}
+/** A quoted value or a bare word, as a shell or a JSON object writes it. */
+const VALUE = `("(?:[^"\\\\]|\\\\.)*"|'[^']*'|[^\\s"'&;,|}\\])]+)`;
+/** A blanked value, keeping its quotes so the line still reads. */
+function blankValue(value) {
+    if (value.startsWith('"'))
+        return `"${BLANK}"`;
+    if (value.startsWith("'"))
+        return `'${BLANK}'`;
+    return BLANK;
+}
+/** The values of headers that carry credentials: `Authorization: …`, `Cookie: …`, `X-Api-Key: …`. */
+function redactHeaders(text) {
+    return text.replace(/\b((?:proxy-)?authorization|(?:set-)?cookie|x-[a-z0-9-]*(?:key|token|auth|secret|signature|session)[a-z0-9-]*|api-?key|private-token|x-amz-security-token)(\s*:\s*)([^"'\n]+)/gi, (_all, name, colon) => `${name}${colon}${BLANK}`);
+}
+/** `Bearer …`, `Basic …`, `Token …`: a credential after the word that says what it is. */
+function redactSchemes(text) {
+    return text.replace(/\b(Bearer|Basic|Token|Digest)(\s+)(?!…)[A-Za-z0-9._~+/=:-]{6,}/g, (_all, scheme, space) => `${scheme}${space}${BLANK}`);
+}
+/**
+ * Values after names that say they're secret: environment variables and keys (`FOO_TOKEN=…`, `"password": …`,
+ * `password: …`, a form's `&pass=…`) and flags (`--token=…`).
+ */
+function redactNamedValues(text) {
+    const pattern = new RegExp(`(["']?)([A-Za-z_][A-Za-z0-9_.-]*)\\1(\\s*[:=]\\s*)${VALUE}`, 'g');
+    return text.replace(pattern, (all, quote, name, sign, value) => {
+        // A URL's own `scheme:` isn't a name and its value.
+        if (sign.trim() === ':' && /^\/\//.test(value))
+            return all;
+        // `--user=name:password` (curl) holds a password too.
+        const user = name === 'user' && sign.trim() === '=' && value.includes(':');
+        if (!isSecretName(name) && !user)
+            return all;
+        return `${quote}${name}${quote}${sign}${blankValue(value)}`;
+    });
+}
+/** Programs whose `-p` (or `-P`) is a switch or a number, never a password: `mkdir -p`, `git add -p`, `ps -p`. */
+const P_IS_PLAIN = new Set([
+    'mkdir',
+    'cp',
+    'ls',
+    'git',
+    'tar',
+    'rsync',
+    'scp',
+    'install',
+    'lsof',
+    'ps',
+    'pgrep',
+    'pkill',
+    'du',
+    'grep',
+    'rg',
+]);
+/** Flags that hold a password for one program only: `redis-cli -a`. */
+const PROGRAM_SECRETS = {
+    'redis-cli': ['-a', '--pass', '--user'],
+};
+/** Programs that take a password glued to `-p` (`mysql -pS3cret`, `7z x -pS3cret`). */
+const P_ATTACHED = /^(?:mysql\w*|mariadb\w*|7z\w*|7za|7zr)$/;
+/** A command line's parts between `&&`, `||`, `;` and `|`, outside quotes, each with what joined it to the next. */
+function segments(text) {
+    const found = [];
+    let current = '';
+    let quote = null;
+    for (let index = 0; index < text.length; index++) {
+        const char = text[index];
+        if (quote) {
+            current += char;
+            if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (char === '"' || char === "'") {
+            quote = char;
+            current += char;
+            continue;
+        }
+        const two = text.slice(index, index + 2);
+        if (two === '&&' || two === '||') {
+            found.push({ text: current, join: two });
+            current = '';
+            index++;
+            continue;
+        }
+        if (char === ';' || char === '|') {
+            found.push({ text: current, join: char });
+            current = '';
+            continue;
+        }
+        current += char;
+    }
+    found.push({ text: current, join: '' });
+    return found;
+}
+/**
+ * The value after a flag that says it's secret, in each part of the command line: `--token abc`, `-p hunter2` (not
+ * `mkdir -p`), `-u user:pass`, `-pS3cret`, `redis-cli -a …`; and after a variable's name that says it's secret,
+ * given as a word of its own (`aws configure set aws_secret_access_key …`, `netlify env:set API_KEY …`).
+ */
+function redactFlags(text) {
+    const spaced = new RegExp(`(^|\\s)(--?[A-Za-z][A-Za-z0-9_.-]*)(\\s+)(?!-)${VALUE}`, 'g');
+    const named = new RegExp(`(^|\\s)([A-Za-z][A-Za-z0-9]*_[A-Za-z0-9_]*|[A-Z][A-Z0-9_]{2,})(\\s+)(?![-|&;])${VALUE}`, 'g');
+    return segments(text)
+        .map((part) => {
+        const program = firstWord(part.text) ?? '';
+        const plainP = P_IS_PLAIN.has(program);
+        const extra = PROGRAM_SECRETS[program] ?? [];
+        const secret = (flag) => extra.includes(flag) || (isSecretFlag(flag) && !(plainP && /^-[pP]$/.test(flag)));
+        let out = part.text.replace(spaced, (all, lead, flag, space, value) => {
+            const user = /^(-u|--user)$/.test(flag) && value.includes(':');
+            if (!secret(flag) && !user)
+                return all;
+            return `${lead}${flag}${space}${blankValue(value)}`;
+        });
+        // A password glued to its flag (mysql -pS3cret).
+        if (P_ATTACHED.test(program))
+            out = out.replace(/(^|\s)(-[pP])(?=[^\s-])(\S+)/g, (_all, lead, flag) => {
+                return `${lead}${flag}${BLANK}`;
+            });
+        out = out.replace(named, (all, lead, name, space, value) => isSecretName(name) && name !== program ? `${lead}${name}${space}${blankValue(value)}` : all);
+        return `${out}${part.join}`;
+    })
+        .join('');
+}
+/** Repeated blanks read as one: "… …" stays, "……" doesn't happen. */
+const tidy = (text) => text
+    .replace(new RegExp(`${BLANK}{2,}`, 'g'), BLANK)
+    .replace(/\s+/g, ' ')
+    .trim();
+/** Cuts text to `max` characters, saying so with a final "…". */
+export function cut(text, max = SUMMARY_MAX) {
+    const chars = [...text];
+    if (chars.length <= max)
+        return text;
+    return `${chars
+        .slice(0, max - 1)
+        .join('')
+        .trimEnd()}${BLANK}`;
+}
+/** Any text a card shows (a question, a search): keys, tokens and URLs' secrets out, one line, cut. */
+export function redactText(text, max = SUMMARY_MAX) {
+    return cut(tidy(redactTokens(redactSchemes(redactHeaders(redactUrls(text))))), max);
+}
+/** A shell or an interpreter given its code on the command line: `bash -c …`, `node -e …`, `python3 -c …`. */
+const INLINE_CODE = /(?:^|[\s;&|(`$/])(?:(?:ba|z|da|k)?sh|fish|python[0-9.]*|node(?:js)?|deno|bun|ruby|perl|php|osascript|pwsh|powershell|lua|Rscript)\b[^;&|]*?\s(?:-c|-e|-E|--eval|-p|--print|-r|-Command|-command|-EncodedCommand)(?=\s|=|$)/i;
+/** Commands that take a secret on stdin or set one: what follows them could be the secret itself. */
+const TAKES_SECRET = /\bsudo\s+(?:-\w+\s+)*-S\b|--password-stdin|\b(?:ch)?passwd\b|\bhtpasswd\b|\bsecurity\s+(?:add|set|import)-|\bsecrets?\s+(?:set|put|add|create|edit)\b|\bvault\s+(?:kv\s+)?(?:put|write)\b|\bkubectl\s+create\s+secret\b|\bop\s+(?:item|read|run|inject)\b|\bssh-add\b|\bgpg\b|\bpass\s+(?:insert|edit)\b|\bbase64\s+(?:-d|-D|--decode)\b/i;
+/**
+ * Whether a command can't be shown safely, even with secrets taken out: more than one line, a heredoc or here-string
+ * (its body could be anything), inline code for a shell or an interpreter, `eval`, or a command that takes a secret on
+ * stdin or sets one.
+ */
+export function unsafeCommand(command) {
+    const text = command.trim();
+    if (/[\r\n]/.test(text))
+        return true;
+    if (/<<-?\s*['"]?\w|<<</.test(text))
+        return true;
+    if (/(?:^|[\s;&|(`$])eval\s/.test(text))
+        return true;
+    return INLINE_CODE.test(text) || TAKES_SECRET.test(text);
+}
+/** The command's own name, for "Bash: rm …": past variables, sudo and the like; null when it isn't a plain word. */
+export function firstWord(command) {
+    const words = command.trim().split(/\s+/);
+    for (const word of words) {
+        if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(word))
+            continue;
+        if (/^(?:sudo|env|time|nohup|exec|command|nice|caffeinate)$/.test(word))
+            continue;
+        if (word.startsWith('-'))
+            continue;
+        const name = word
+            .replace(/^['"]|['"]$/g, '')
+            .split('/')
+            .at(-1) ?? '';
+        return /^[A-Za-z0-9][\w.+-]{0,31}$/.test(name) ? name : null;
+    }
+    return null;
+}
+/**
+ * What a card says about a shell command: the command with every secret taken out, on one line, cut to SUMMARY_MAX;
+ * or, when it can't be shown safely (unsafeCommand), the tool and its first word: "Bash: node …".
+ */
+export function redactCommand(command, tool = 'Bash', max = SUMMARY_MAX) {
+    const word = firstWord(command);
+    const doubtful = { text: word ? `${tool}: ${word} ${BLANK}` : `${tool} ${BLANK}`, doubt: true };
+    if (!command.trim() || unsafeCommand(command))
+        return doubtful;
+    let text = redactUrls(command);
+    text = redactHeaders(text);
+    text = redactSchemes(text);
+    text = redactNamedValues(text);
+    text = redactFlags(text);
+    text = redactTokens(text);
+    text = tidy(text);
+    if (!text || text === BLANK)
+        return doubtful;
+    return { text: cut(text, max), doubt: false };
+}
+/** A path as the person reads it: under ~ when it's in their home, its secrets out, and its end kept when it's long. */
+export function shortPath(path, home, max = 60) {
+    const base = home.replace(/\/+$/, '');
+    let shown = base && (path === base || path.startsWith(`${base}/`)) ? `~${path.slice(base.length)}` : path;
+    shown = redactTokens(redactUrls(shown.replace(/\s+/g, ' ').trim()));
+    const chars = [...shown];
+    if (chars.length <= max)
+        return shown;
+    const tail = chars.slice(chars.length - (max - 1)).join('');
+    const slash = tail.indexOf('/');
+    return `${BLANK}${slash > 0 && slash < tail.length - 1 ? tail.slice(slash) : tail}`;
+}

package/dist/setup.js

@@ -50,7 +50,17 @@ export function setupOf(heard) {
     };
 }
 /**
- * The session-start line for a setup that isn't finished (about 70 tokens), or null when there's nothing for the
+ * The three calls that finish a setup, said exactly (0.13.0): Pi's first setup on Darin's devbox spent about 20,000
+ * tokens on "whoami with your name and guide true" (the whole guide, which Pi cut into a file the model then parsed)
+ * and on hunting for testAreaId in whoami's answer (only report_setup's has it). `stopFirst` adds whoami's way out for
+ * a setup another session finished meanwhile; a setup that has reported already says app.setUp is true, so its line
+ * leaves that out. The Claude Code wake mod's setup turn says the same (packages/claude-plugin's setupPrompt).
+ */
+export function setupCalls(app, stopFirst) {
+    return `Three calls, nothing to install or approve: 1. whoami with your name.${stopFirst ? ' If it says app.setUp is true, another session did this: stop.' : ''} 2. report_setup with source ${app}, your name, skillSaved true, hears instant, and skillVersion set to whoami’s skill.latest. Its answer has a testAreaId. 3. post_request a short test question in that testAreaId, tell your person it’s on its way, and end your turn: you’re woken when they answer, so don’t ask them to type anything.`;
+}
+/**
+ * The session-start line for a setup that isn't finished (about 110 tokens), or null when there's nothing for the
  * session to do: verified, or its test card waiting on the person.
  */
 export function setupLine(app, heard, setup) {
@@ -59,15 +69,16 @@ export function setupLine(app, heard, setup) {
     const title = connectionTitle(heard);
     if (setup.test?.turn === 'agent') {
         const { requestId, name } = setup.test;
+        const pickUp = (who) => `call get_request (requestId ${requestId}, ${who}), then ack_answer with its version and a one-line outcome: that finishes setup.`;
         return name
-            ? `Pending You: your person answered setup’s test question (${requestId}), asked by “${name}”: if you’re ${name}, get_request it, then ack_answer.`
-            : `Pending You: your person answered setup’s test question (${requestId}): get_request it, then ack_answer.`;
+            ? `Pending You: your person answered setup’s test question (${requestId}), asked by “${name}”. If you’re ${name}, ${pickUp(`name “${name}”`)} If you aren’t, leave it to ${name}.`
+            : `Pending You: your person answered setup’s test question (${requestId}). C${pickUp('with your name').slice(1)}`;
     }
     if (setup.test)
         return null;
     if (setup.reported)
-        return `Pending You: this computer is connected (${title}) but setup’s test question isn’t sent. Call whoami with your name, then report_setup with source ${app}, and post your test question in its testAreaId. Nothing to add, install or approve.`;
-    return `Pending You: this computer is connected (${title}) but setup isn’t finished. First: whoami with your name and guide true; report_setup with source ${app}, skillSaved true, hears instant and the guide’s skillVersion; then your test question in its testAreaId. Nothing to add, install or approve. If whoami says app.setUp is true, another session did it.`;
+        return `Pending You: ${title} is connected, but setup’s test question isn’t sent yet. ${setupCalls(app, false)}`;
+    return `Pending You: ${title} is connected, but its setup isn’t finished. ${setupCalls(app, true)}`;
 }
 /**
  * The line a session start adds for this app's unfinished setup, or null: only for a new, resumed or cleared session,

package/dist/shim.js

@@ -13,7 +13,7 @@
 // never blocks anyone. When the private copy couldn't be made, it runs this version through npx instead.
 import { readFile, rm, rmdir, stat } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
-import { configDir, writeWhole } from "./files.js";
+import { configDir, PERMISSION_FOLDER, writeWhole } from "./files.js";
 import { USUAL_NODES, usualWords } from "./remote.js";
 import { VERSION } from "./version.js";
 export const SHIM = 'pendingyou-hook';
@@ -32,6 +32,13 @@ export function shimScript(run, config, usual = USUAL_NODES) {
 # agents' hook definitions. Written by npx pendingyou init (pendingyou ${VERSION}); run that again to repair it.
 PENDINGYOU_CONFIG_DIR=${quoted(config)}
 export PENDINGYOU_CONFIG_DIR
+# A Claude Code tool call ran or a session ended: nothing to do unless a permission card may be open.
+if [ "$1" = permission-done ]; then
+  for open in "$PENDINGYOU_CONFIG_DIR"/${PERMISSION_FOLDER}/*.json; do
+    [ -e "$open" ] && break
+    exit 0
+  done
+fi
 `;
     if ('npx' in run)
         return `${head}exec ${run.npx} "$@"\n`;

package/dist/stopcheck.js

@@ -26,6 +26,7 @@ import { markNudged, turnRecord } from "./apps/codex-wake.js";
 import { APP_NAMES, DEFAULT_APP } from "./apps/ids.js";
 import { asksToTypeHere, cardFits, confirmReason, sessionLink } from "./confirm.js";
 import { readCredential } from "./credentials.js";
+import { settlePrompts, subagentsRunning } from "./permission.js";
 import { folderForms } from "./pickup.js";
 /** The most of the transcript it reads, from the end. A turn longer than this is let through. */
 export const READ_CAP = 4 * 1024 * 1024;
@@ -324,7 +325,16 @@ export async function stopcheck(io, options) {
     const app = options.app ?? DEFAULT_APP;
     try {
         const input = JSON.parse(await io.readStdin(1000));
-        if (typeof input !== 'object' || input === null || input.stop_hook_active === true)
+        if (typeof input !== 'object' || input === null)
+            return 0;
+        // The turn ended: nothing it asked the person's OK for is waiting any more (0.13.0, permission.ts).
+        if (app === DEFAULT_APP)
+            await settlePrompts(io, {
+                session: typeof input.session_id === 'string' ? input.session_id : null,
+                event: 'stop',
+                subagents: subagentsRunning(input),
+            });
+        if (input.stop_hook_active === true)
             return 0;
         if (!(await readCredential(io, options.origin, app)))
             return 0;

package/dist/version.js

@@ -1,2 +1,2 @@
 // The command line's version, as published (package.json). A test keeps them the same.
-export const VERSION = '0.12.0';
+export const VERSION = '0.13.0';

package/mod/hooks/register.js

@@ -19,7 +19,7 @@
 // if Claude Code may call whoami without asking anyone, it does (no name), and when Pending You says Claude Code isn't
 // set up here, it starts one turn with the setup prompt once the session is idle. Once per session, in at most three
 // sessions, never two within ten minutes, and never again once whoami says it's set up (wake.ts's setupNeeded).
-import { argumentsOf, blockedNote, CLI_COPY, cardTool, checked, claimLease, dueCards, emptyBook, failed, holdOf, holdReply, isRefusal, isStale, isWaitingOnYou, learn, leaseHolder, momentOf, prompted, put, readBook, readSetup, resultObject, SETUP_AFTER_MS, SETUP_RETRY_MS, SETUP_SERVER, SETUP_TRIES, settle, setUpOf, setupNeeded, setupPrompt, stateOf, statusText, TICK_MS, told, toTell, untold, wakeText, } from "./wake.js";
+import { argumentsOf, blockedNote, CLI_COPY, cardTool, checked, claimLease, connectionOf, dueCards, emptyBook, failed, holdOf, holdReply, isRefusal, isStale, isWaitingOnYou, learn, leaseHolder, momentOf, prompted, put, readBook, readSetup, resultObject, SETUP_AFTER_MS, SETUP_RETRY_MS, SETUP_SERVER, SETUP_TRIES, settle, setUpOf, setupNeeded, setupPrompt, stateOf, statusText, TICK_MS, told, toTell, untold, wakeText, } from "./wake.js";
 /** After a prompt that didn't go, how long before the mod tries again. */
 const RETRY_MS = 60_000;
 /** What the mod holds while its module is loaded. The cards themselves are kept in the store. */
@@ -44,6 +44,8 @@ const live = {
     noted: new Set(),
     /** Pending You said Claude Code isn't set up here: start the setup turn once the session is idle. */
     setupDue: false,
+    /** The connection whoami named ("Claude Code on devbox"), for the setup turn's words. */
+    setupConnection: 'Claude Code',
 };
 const keyOf = (sessionId) => `session:${sessionId}`;
 /** A server Claude Code refuses checks on, while the session has a card there. */
@@ -172,7 +174,7 @@ async function deliverSetup($) {
     if (!setupNeeded(record, live.sessionId, now))
         return;
     await $.store.set('setup', prompted(record, live.sessionId, now));
-    $.prompt.submit({ text: setupPrompt() }).catch(() => { });
+    $.prompt.submit({ text: setupPrompt(live.setupConnection) }).catch(() => { });
 }
 /**
  * Asks Pending You whether Claude Code is set up here (whoami, no name, only when Claude Code allows it without asking),
@@ -187,7 +189,9 @@ async function checkSetup($, attempt) {
             return;
         let setUp = null;
         try {
-            setUp = setUpOf(resultObject(await $.mcp.call(SETUP_SERVER, 'whoami', {})));
+            const output = resultObject(await $.mcp.call(SETUP_SERVER, 'whoami', {}));
+            setUp = setUpOf(output);
+            live.setupConnection = connectionOf(output);
         }
         catch { }
         if (setUp === null) {

package/mod/hooks/wake.js

@@ -644,9 +644,22 @@ export const prompted = (record, sessionId, now) => ({
     lastAt: now,
 });
 /**
- * The turn that finishes setting up, as the session reads it: the sentence a person would say (the command line's
- * FINISH_SAY; a test holds them equal), then exactly what to do, so it needs nothing else.
+ * The connection whoami names ("Claude Code on Darin’s MacBook Pro"): its app's name, and the machine it signed in
+ * from; "Claude Code" when whoami's answer doesn't say.
  */
-export function setupPrompt() {
-    return 'Finish setting up Pending You: it’s connected here already. Call whoami with your name and guide true; report_setup with source claude-code, skillSaved true, hears instant and the guide’s skillVersion; then send your test question to its testAreaId. Nothing to add, install or approve. If whoami says app.setUp is true, another session did it: just introduce yourself.';
+export function connectionOf(output) {
+    const app = output && isObject(output.app) ? output.app : null;
+    const agent = output && isObject(output.agent) ? output.agent : null;
+    const name = typeof app?.name === 'string' && app.name.trim() ? app.name.trim() : 'Claude Code';
+    const machine = typeof agent?.machine === 'string' ? agent.machine.trim() : '';
+    return machine ? `${name} on ${machine}` : name;
+}
+/**
+ * The turn that finishes setting up (CLI 0.13.0), as the session reads it: exactly the three calls, as the command
+ * line's session-start line says them (its setupLine; a test holds them equal), so it needs nothing else. Before, it
+ * asked for whoami with guide true, whose answer is the whole guide (87,000 characters), and for testAreaId, which
+ * only report_setup's answer has: Pi spent about 20,000 tokens on that line on Darin's devbox.
+ */
+export function setupPrompt(connection = 'Claude Code') {
+    return `Pending You: ${connection} is connected, but its setup isn’t finished. Three calls, nothing to install or approve: 1. whoami with your name. If it says app.setUp is true, another session did this: stop. 2. report_setup with source claude-code, your name, skillSaved true, hears instant, and skillVersion set to whoami’s skill.latest. Its answer has a testAreaId. 3. post_request a short test question in that testAreaId, tell your person it’s on its way, and end your turn: you’re woken when they answer, so don’t ask them to type anything.`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pendingyou",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Pending You for your coding agents: one command sets up Claude Code, Codex, OpenCode and Pi to ask you through Pending You and hear your answers, even while they sit idle.",
   "license": "Apache-2.0",
   "homepage": "https://www.pendingyou.com",