pendingyou 0.14.0 → 0.15.0

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # Changelog
 
+## 0.15.0 (2026-10-05)
+
+- Presence: Pending You hears which of your agents' sessions are open right now. Each app tells it with its own
+  connection here, `POST <origin>/mcp/cli/presence` with `{"source", "name", "sessionId", "cwd", "state"}` (`name` the
+  name the session goes by with Pending You, else null; `cwd` only as `~/…`, else null; `state` `live` or `closed`).
+  Pending You counts a session live for 15 minutes after its last `live`, so an open session says so every 5 minutes,
+  with no model involved:
+  - Claude Code: its session-start hook says live; the wake mod (Claude Code 2.1.287 or later) says live as the
+    session starts, after /clear or /resume, and every 5 minutes while it's open, by running the hooks' script; a new
+    SessionEnd hook, `presence`, through the same script, says closed. Without the wake mod, the next-message hook
+    says live again once the last was 4 minutes ago. Only `init`'s copy of the mod does it, never the plugin's.
+  - Codex: its session-start and next-message hooks start a keeper for the thread (`presence --keep`, detached, a lease
+    of its own), which says live every 5 minutes while the Codex process the hooks ran under is running (Codex CLI, or
+    the Codex app's own codex), and closed once it's gone. A new SessionEnd hook (Codex fires it when a conversation
+    is archived or deleted, when Codex closes, or after 30 idle minutes) says closed and stops the keeper; its timeout
+    is 3 seconds, the most Codex gives one. Where the Codex process can't be found, the hooks say live as they run.
+  - OpenCode's plugin and Pi's extension say live as a session starts (OpenCode: when it's created, or its first
+    message) and every 5 minutes while the app runs, and closed when OpenCode deletes the session or goes, or Pi shuts
+    the session down.
+  A hook only starts the send in the background; a send gives up after 3 seconds; a Pending You from before presence
+  answers 404, which is taken quietly. A sign-in that only hears (`--oauth`) sends nothing. Events are written down in
+  `~/.config/pendingyou/presence/<app>.json` (ids, states and times), so a late `live` never overrides a newer
+  `closed`, and a reload's `live` goes after its `closed`. `status` has a line for each app: “Presence: tells Pending
+  You when this session is open”.
+- Codex's permission prompts on a card, as Claude Code's since 0.13.0. `init` adds Codex's PermissionRequest hook (it
+  fires when Codex is about to ask for approval: a shell command that needs more than the sandbox gives, an
+  `apply_patch`, an MCP tool; `tool_name` Bash, apply_patch or the tool's, and `tool_input.description` when Codex has
+  a reason), through the shim with `--app codex`. Codex reads that hook's output as its decision, so it prints nothing
+  and exits 0: it declines, and Codex asks as before. Once a prompt has waited 10 seconds, the same detached worker
+  posts one card with Codex's own connection: “Codex is waiting for your OK: git push origin main”, “…: edit
+  src/app.ts and 1 more” for a patch (the files its `*** Update File:` lines name), “…: create_issue on github” for an
+  MCP tool, with Codex's reason (redacted) in the summary, under the name the thread went by on Pending You's card tools,
+  else “Codex”, and the same redaction. It's withdrawn when the call runs (a PostToolUse hook for every tool, which
+  also settles a prompt for the same tool when Codex gives the call that ran its input in another form), with your
+  next message, at the end of the turn, or when the thread ends (SessionEnd). `--no-permission-cards` leaves Codex's
+  out too. The Codex app's browser-use prompts run no PermissionRequest hook, so they get no card.
+- Presence keeps to Pending You's contract: the name trimmed to one line of at most 60 characters, a folder over 300
+  characters sent as null, a 401 tried once more after a refresh in the background, a 429 waited out once (its
+  `retry-after`, 60 seconds) by a send in its own process (never a hook), and 400, 403 and 404 taken quietly; Codex's
+  keeper stops once a send is refused, its sign-in is gone, or the server has no presence.
+- A question you handed an agent, when the assistant that asked answers what the helper asked it on the card (or you
+  write in to them both, guide 2.30), wakes the helper with those words, not the handed question again: “Pending You:
+  billing-webhooks replied on the question handed to you, “Which queue?” (req_…): “It's the jobs queue.”. Call
+  get_request (requestId req_…, name “infra”) to read what you've said to each other. If you know now,
+  answer_delegated …; if you need more, reply_in_thread to “asker”; if it's your person's to decide, reply_in_thread
+  with escalate true; if not, hand_back …” (“your person wrote to you both …” for yours). The same from the hooks, the
+  wake mod, OpenCode's plugin and Pi's extension; Codex's `codex queue` leaves the words out of its arguments, where any
+  program could read them, and get_request has them. The wake mod now wakes a session for such a reply after it read
+  the question itself (before, a question it had read never woke it again), and the Stop check and the hooks know a
+  turn such a wake started.
+- Switching an agent's own sign-in to this computer's says what becomes of the old one: once the agent shows up on this
+  computer's sign-in, Pending You moves the old sign-in's agents over, with their cards and the questions you delegated
+  to them, and signs it out. Where there's no browser (an SSH session) init says what it switched instead of switching
+  without a word.
+- Codex runs a hook only once you trust it, so the three new hooks (PermissionRequest, PostToolUse for every tool,
+  SessionEnd) need trusting once. They go at the end of their lists, so the ones you trusted stay trusted. `init` says
+  so when it adds them to a Codex set up before (“Codex has new Pending You hooks (session end and permission prompts),
+  which it skips until you trust them once: …”), and `status` has a line for each, with each hook's trust:
+  “Permission prompts: a card when Codex waits for your OK” and “Presence: …”. Neither keeps `status` from saying
+  Ready. Codex's record of its hooks (`codex.json`) now names each by its event and command.
+
 ## 0.14.0 (2026-10-05)
 
 - Questions your person hands one of your agents from another assistant (Delegate: Pending You's card link, or D on the

package/README.md

@@ -24,8 +24,9 @@ Run it once on each computer, in a terminal. It finds the agents on the computer
   Pi reads Codex's, else `~/.pi/agent/skills/pendingyou/SKILL.md`),
 - adds the hooks that hand it your answers: a new session picks up answers that arrived while nothing was running,
   your next message brings a waiting answer with it, and a check when it finishes a turn catches what it left you only
-  in chat ([below](#nothing-left-only-in-chat)); and, for Claude Code, a card when it waits for your OK to run something
-  ([below](#when-claude-code-waits-for-your-ok)),
+  in chat ([below](#nothing-left-only-in-chat)); for Claude Code and Codex, a card when it waits for your OK to run
+  something ([below](#when-claude-code-waits-for-your-ok)); and they tell Pending You which sessions are open
+  ([below](#which-sessions-are-open)),
 - and wakes it when you answer: Claude Code 2.1.287 or later through the wake mod, Codex through `codex queue`, OpenCode
   through its plugin and Pi through its extension (which also do the hooks' work there); and when you hand it a
   question from another of your assistants ([below](#when-you-hand-an-agent-a-question)).
@@ -54,10 +55,11 @@ in each, every other byte as it was), and running it again changes nothing it do
 **A pendingyou server that's there already** is decided on before anyone signs in. One at another Pending You
 (staging, say) is named and replaced only once you say so (`--yes` replaces it without asking); keep it and that agent
 is left as it is. One at this Pending You that signs in by itself (Claude Code's `/mcp` → Authenticate, Codex's
-`codex mcp login`, or the Pending You plugin for Claude) is moved to this computer's sign-in: without asking where
-there's no browser (it can't finish there anyway), on Yes (the default) at a terminal, or with `--yes`; with nobody to
-ask it's kept, and `init` prints the command that switches it. The connection it had stays on your Assistants page for
-you to remove, and answers to the cards it asked through that one won't reach the agent by themselves. A kept plugin
+`codex mcp login`, or the Pending You plugin for Claude) is moved to this computer's sign-in: where there's no browser
+(it can't finish there anyway) without asking, saying what it switched; on Yes (the default) at a terminal; or with
+`--yes`; with nobody to ask it's kept, and `init` prints the command that switches it. Once the agent shows up on this
+computer's sign-in, Pending You moves the old sign-in's agents over to it, with their cards and the questions you
+delegated to them, and signs the old one out. A kept plugin
 carries the skill, so none is saved. `--oauth` keeps every agent signing in by itself, as before 0.11.0.
 
 The hooks run a copy of this version kept in `~/.config/pendingyou/cli/<version>/`, through a small script with a path
@@ -94,10 +96,13 @@ http_headers_helper = "/Users/ann/.config/pendingyou/bin/pendingyou-mcp-headers
 default_tools_approval_mode = "approve"
 ```
 
-and four hooks in `~/.codex/hooks.json`: a session start, each message, Pending You's card tools (so the Stop check
-knows a turn posted, and so the thread is woken), and the Stop check. **Codex runs a hook only once you trust it**: in
-Codex CLI, start `codex` and choose “Trust all and continue” (or trust them in `/hooks`); in the Codex app, click
-Review hooks › Allow all (or Settings › Hooks › Trust all). `status` says which are trusted. A `pendingyou` server or
+and hooks in `~/.codex/hooks.json`: a session start, each message, Pending You's card tools (so the Stop check knows a
+turn posted, and so the thread is woken), and the Stop check; and (0.15.0) Codex's permission prompt and every tool
+call that ran (a card when Codex waits for your OK, [below](#when-claude-code-waits-for-your-ok)) and the session's end
+([below](#which-sessions-are-open)). **Codex runs a hook only once you trust it**: in Codex CLI, start `codex` and
+choose “Trust all and continue” (or trust them in `/hooks`); in the Codex app, click Review hooks › Allow all (or
+Settings › Hooks › Trust all). `status` says which are trusted. Upgrading from 0.14.0 adds three hooks, which Codex
+skips until you trust them once; `init` says so, and the ones you trusted stay trusted. A `pendingyou` server or
 hooks Codex's `/import` copied from Claude Code (without its sign-in) are replaced.
 
 **The Codex app** (on a Mac, in the ChatGPT app) shares all of this with Codex CLI: the same `~/.codex`, server, hooks
@@ -245,6 +250,32 @@ It needs Claude Code 2.1.119 or later, signing in through this computer's sign-i
 Windows yet. Don't want it? `npx pendingyou init --no-permission-cards` (later runs keep it off; `--permission-cards`
 turns it back on). `npx pendingyou status` says which.
 
+**Codex** (0.15.0) gets the same: when Codex stops to ask for your approval (a command that needs more than its sandbox
+gives, a patch, an MCP tool) and you don't answer within 10 seconds, a card says “Codex is waiting for your OK: git push
+origin main” (“…: edit src/app.ts and 1 more” for a patch), with Codex's reason for asking, blanked like the rest. Its
+PermissionRequest hook prints nothing, so Codex asks exactly as before; the card goes once the call runs, you write to
+Codex, the turn ends or the thread closes. It needs Codex signing in through this computer's sign-in, and trusting the
+new hooks once. The Codex app's browser-use prompts don't run that hook, so they get no card.
+
+## Which sessions are open
+
+Since 0.15.0 Pending You hears which of your agents' sessions are open right now, so it can say so and offer an open
+one a question. Each app tells it with its own connection here: the session's id, the name it goes by with Pending You,
+its folder (under `~` only) and `live` or `closed`. Pending You counts a session open for 15 minutes after its last
+`live`, so an open session says so every 5 minutes, with no model involved:
+
+- **Claude Code**: as a session starts (its session-start hook, and the wake mod), then every 5 minutes from the wake
+  mod while it's open (without the mod, with your messages); closed as it ends (a SessionEnd hook).
+- **Codex**: as a thread starts or you write to it, a small process in the background says so every 5 minutes while
+  Codex (or the Codex app) runs, and closed once it's gone; its SessionEnd hook (a conversation archived or closed, or
+  idle 30 minutes) says closed.
+- **OpenCode and Pi**: the plugin and the extension, as a session starts and every 5 minutes while the app runs, and
+  closed as it goes.
+
+It's never in your way: the hooks only start it in the background, each send gives up after 3 seconds, and a Pending
+You from before presence is taken quietly. A sign-in that only hears (`--oauth`) sends nothing. `npx pendingyou status`
+has a Presence line for each agent.
+
 ## How Claude Code hears your answer
 
 **Claude Code 2.1.287 or later: the wake mod.** There's nothing to run. In each session the mod learns the cards
@@ -386,8 +417,9 @@ Pending You (Claude Code says which server it's for; Codex's is the one `init` w
 sign-in each agent's connection used, so signing in again keeps it.
 
 `state.json` beside them remembers which answers were already handed over (ids only) and how many session starts
-reminded an unfinished setup, and when; `permission-cards/` each Claude Code session's prompts still waiting on your OK
-and its card (ids, hashes and the card's redacted words: never what the tool was given), gone once nothing waits;
+reminded an unfinished setup, and when; `permission-cards/` each Claude Code session's (and Codex thread's) prompts
+still waiting on your OK and its card (ids, hashes and the card's redacted words: never what the tool was given), gone once nothing waits;
+`presence/` the last presence each session said (ids, states and times), and Codex threads' keepers;
 `claude-code.json`, `codex.json`, `opencode.json` and `pi.json` what `init`
 added; `codex-threads.json`, `opencode-threads.json` and `pi-threads.json` which cards each Codex thread or OpenCode or
 Pi session waits on, and (0.14.0) the names it went by and its folder, kept 12 hours for a question you may hand it
@@ -398,8 +430,9 @@ whether the agent has a `pendingyou` MCP server and where it points. With a sign
 listeners tell this computer's handed questions from another's by its names: its hostname, the names its sign-ins by
 code were given, a Mac's own name (`scutil --get ComputerName`) and, outside a hook, Tailscale's (`tailscale status`). For a permission prompt's card, the worker reads
 the end of the Claude Code session's transcript only for the name the session gave Pending You, and `git remote
-get-url origin` in its folder (sent without any user name or password in it). Nothing is sent anywhere but Pending
-You. OpenCode's plugin reads its session's messages only when it goes idle, for the check that
+get-url origin` in its folder (sent without any user name or password in it). To tell when a Codex thread's Codex has quit, its
+keeper asks `ps` about the Codex process its hooks ran under (its id and program name, nothing else). Nothing is sent
+anywhere but Pending You. OpenCode's plugin reads its session's messages only when it goes idle, for the check that
 nothing was left in chat, and hands the hooks' script just that turn's words and tool names.
 
 The wake mod runs inside Claude Code and reaches Pending You only through the session's own connection, with
@@ -407,7 +440,9 @@ The wake mod runs inside Claude Code and reaches Pending You only through the se
 `list_pending` with the session's name and `get_request` on a question you handed it. It keeps each session's cards (id,
 title, the agent's name, where each stands), and which handed questions a session was told of (ids and when), in Claude
 Code's store for mods, `~/.claude/plugins/store/`, and forgets them once they close or after 7 days. It marks the copy
-acting for a session in that session's environment (`PENDINGYOU_WAKE_OWNER`).
+acting for a session in that session's environment (`PENDINGYOU_WAKE_OWNER`). `init`'s copy (0.15.0) also reads
+`~/.config/pendingyou/claude-code.json` for the Pending You it's for, and runs the hooks' script to say the session is
+open.
 
 ## Development
 

package/dist/api.js

@@ -172,3 +172,30 @@ export async function getJson(io, origin, path, timeoutMs, signal, options = {})
         return { status: response.status, body };
     }
 }
+export async function postJson(io, origin, path, body, timeoutMs, options = {}) {
+    const app = options.app ?? DEFAULT_APP;
+    const token = await hookToken(io, origin, options.force === true, options.signal, app);
+    let response;
+    try {
+        response = await io.fetch(`${origin}${path}`, {
+            method: 'POST',
+            headers: {
+                authorization: `Bearer ${token}`,
+                'content-type': 'application/json',
+                accept: 'application/json',
+            },
+            body: JSON.stringify(body),
+            signal: either(options.signal, timeoutMs),
+            redirect: 'manual',
+        });
+    }
+    catch {
+        throw new Unavailable('Pending You couldn’t be reached.');
+    }
+    await response.body?.cancel().catch(() => { });
+    const retry = Number(response.headers.get('retry-after'));
+    return {
+        status: response.status,
+        ...(Number.isFinite(retry) && retry > 0 ? { retryAfter: retry } : {}),
+    };
+}

package/dist/apps/claude-code.js

@@ -7,16 +7,11 @@ import { checkHelper, foundBy, headlessReason, helperCommand, helperPath, isOurH
 import { connectionTitle, FINISH_SAY, setupOf, setupStatus } from "../setup.js";
 import { shimPath } from "../shim.js";
 import { APP_NAMES } from "./ids.js";
+import { switches } from "./switch.js";
 const NAME = APP_NAMES['claude-code'];
 const RESTART = 'restart Claude Code here (/exit, then claude --continue), or start it in the folder you work in';
-async function switches(io, ctx, what) {
-    if (ctx.headless || ctx.yes)
-        return true;
-    if (!io.interactive)
-        return false;
-    io.out(`${what} init can move Claude Code to this computer’s own sign-in, which the hooks use too: one sign-in for both, and nothing to Authenticate. The connection it has now stays on your Assistants page until you remove it, and answers to cards it asked through that one won’t reach Claude Code by themselves.\n`);
-    const answer = await io.ask('Switch Claude Code to this computer’s sign-in? [Y/n] ');
-    return !/^\s*no?\s*$/i.test(answer);
+async function switchesFor(io, ctx, what) {
+    return switches(io, ctx, { name: 'Claude Code', what, uses: 'the hooks use', headless: true });
 }
 async function replaces(io, ctx, server, url) {
     ctx.progress(`Claude Code’s pendingyou MCP server points at ${server.url}, not ${url}.\n`);
@@ -117,7 +112,7 @@ export const claudeCode = {
                     };
             }
             else if (helperMode &&
-                (await switches(io, ctx, 'Claude Code signs in to Pending You by itself here (/mcp → Authenticate).')))
+                (await switchesFor(io, ctx, 'Claude Code signs in to Pending You by itself here (/mcp → Authenticate).')))
                 plan = { action: 'switch', server };
             else {
                 mode = 'oauth';
@@ -132,7 +127,7 @@ export const claudeCode = {
         }
         else if (plugin) {
             if (helperMode &&
-                (await switches(io, ctx, 'The Pending You plugin signs Claude Code in to Pending You by itself here.')))
+                (await switchesFor(io, ctx, 'The Pending You plugin signs Claude Code in to Pending You by itself here.')))
                 plan = { action: 'add', plugin: true };
             else {
                 mode = 'oauth';
@@ -215,6 +210,14 @@ function permissionLine(io, claude, manifest, helper, flag) {
         ? `          ${label} no card when Claude Code waits for your OK: ${blocker}`
         : `  missing ${label} no card when Claude Code waits for your OK; run npx pendingyou@latest init${flag}`;
 }
+function presenceLine(claude, connected, mod, flag) {
+    const label = 'Presence:';
+    if (!connected)
+        return `          ${label} off: it needs Claude Code signed in through this computer’s own connection`;
+    if (!claude.presence || !claude.hooks)
+        return `  missing ${label} Pending You isn’t told when a session closes; run npx pendingyou@latest init${flag}`;
+    return `  ok      ${label} tells Pending You when this session is open (${mod ? 'as it starts, then every 5 minutes from the wake mod' : 'as it starts and with your messages'}; closed as it ends)`;
+}
 async function claudeStatus(io, ctx) {
     const { origin, signIn } = ctx;
     const [claude, here, manifest] = await Promise.all([
@@ -322,7 +325,7 @@ async function claudeStatus(io, ctx) {
         ? [
             `  ok      Plugin: ${plugin} is enabled${pluginServer ? '' : mcp !== false && mcp !== 'unknown' ? '; Claude Code uses the server added by hand instead of its own' : ''}`,
         ]
-        : []), `  ${mark(skillOk)} Skill: ${skillText}`, `  ${mark(claude.hooks && hooksRun)} Hooks: ${claude.hooks ? `session-start pickup and next-message hand-off; ${formText}` : `not installed; run npx pendingyou init${flag}`}`, `  ${mark(claude.stopcheck)} Stop check: ${claude.stopcheck ? 'asks Claude Code to post what it leaves you in chat' : `not installed; run npx pendingyou init${flag}`}`, `  ${mark(modOk)} Wake mod: ${modText}`, permissionLine(io, claude, manifest, helper, flag));
+        : []), `  ${mark(skillOk)} Skill: ${skillText}`, `  ${mark(claude.hooks && hooksRun)} Hooks: ${claude.hooks ? `session-start pickup and next-message hand-off; ${formText}` : `not installed; run npx pendingyou init${flag}`}`, `  ${mark(claude.stopcheck)} Stop check: ${claude.stopcheck ? 'asks Claude Code to post what it leaves you in chat' : `not installed; run npx pendingyou init${flag}`}`, `  ${mark(modOk)} Wake mod: ${modText}`, permissionLine(io, claude, manifest, helper, flag), presenceLine(claude, helper && connected, modOk, flag));
     const setup = setupStatus(NAME, signIn.state === 'ok' ? setupOf(signIn.for) : null);
     if (setup)
         lines.push(`  ${setup === 'finished' ? 'ok     ' : '       '} Setup: ${setup}`);

package/dist/apps/codex-wake.js

@@ -636,7 +636,7 @@ export async function listenHanded(io, options) {
                 ]);
             }
             for (const [thread, list] of byThread) {
-                const message = handedMessage(list.map(({ card }) => card));
+                const message = handedMessage(list.map(({ card }) => card), { words: false });
                 if (message && (await queue(thread, message)))
                     continue;
                 await giveBack(io, origin, list);

package/dist/apps/codex.js

@@ -4,13 +4,15 @@ import { join } from 'node:path';
 import { removeSkill, saveSkill } from "../claude.js";
 import { readCredential } from "../credentials.js";
 import { configDir, readJson, readText, writeWhole } from "../files.js";
-import { isOurHook, mergeHooks, originArgs, removeHooks, shWord, } from "../hooks.js";
+import { isOurHook, lineKey, mergeHooks, originArgs, removeHooks, shWord, } from "../hooks.js";
 import { atLeast } from "../mod.js";
+import { removePresenceFiles } from "../presence.js";
 import { checkHelper, foundBy, headlessReason, helperCommand, helperPath, isOurHelper, } from "../remote.js";
 import { connectionTitle, FINISH_SAY, setupOf, setupStatus } from "../setup.js";
 import { basicString, definedInline, headerOf, renameTable, tableSpans, tableValues, withTable, } from "../toml.js";
 import { findCodex } from "./codex-app.js";
 import { APP_NAMES } from "./ids.js";
+import { switches } from "./switch.js";
 const NAME = APP_NAMES.codex;
 const SERVER = ['mcp_servers', 'pendingyou'];
 export const CODEX_MIN = '0.152.0';
@@ -27,11 +29,25 @@ export const CODEX_HOOKS = [
     { event: 'PostToolUse', sub: 'posted', matcher: CARD_TOOLS },
     { event: 'Stop', sub: 'stopcheck' },
 ];
+export const CODEX_PERMISSION_HOOKS = [
+    { event: 'PermissionRequest', sub: 'permission' },
+    { event: 'PostToolUse', sub: 'permission-done' },
+];
+export const CODEX_PRESENCE_HOOKS = [
+    { event: 'SessionEnd', sub: 'presence', timeout: 3 },
+];
+export const ALL_CODEX_HOOKS = [
+    ...CODEX_HOOKS,
+    ...CODEX_PERMISSION_HOOKS,
+    ...CODEX_PRESENCE_HOOKS,
+];
 const EVENT_LABELS = {
     SessionStart: 'session_start',
     UserPromptSubmit: 'user_prompt_submit',
     PostToolUse: 'post_tool_use',
     Stop: 'stop',
+    PermissionRequest: 'permission_request',
+    SessionEnd: 'session_end',
 };
 const NO_MATCHER = new Set(['UserPromptSubmit', 'Stop']);
 const SIGN_IN_KEYS = new Set([
@@ -151,7 +167,7 @@ async function hookTrust(io) {
     const hooks = 'json' in file && file.json.hooks && typeof file.json.hooks === 'object'
         ? file.json.hooks
         : {};
-    return CODEX_HOOKS.map((spec) => {
+    return ALL_CODEX_HOOKS.map((spec) => {
         const groups = Array.isArray(hooks[spec.event]) ? hooks[spec.event] : [];
         for (const [g, group] of groups.entries())
             for (const [h, handler] of (group?.hooks ?? []).entries()) {
@@ -159,13 +175,14 @@ async function hookTrust(io) {
                     continue;
                 const state = tableValues(config, ['hooks', 'state', trustKey(file.path, spec.event, g, h)]);
                 if (state.enabled === false)
-                    return { event: spec.event, trust: 'off' };
+                    return { event: spec.event, sub: spec.sub, trust: 'off' };
                 const hash = hookHash(spec.event, group.matcher, {
                     command: handler.command,
                     ...(typeof handler.timeout === 'number' ? { timeout: handler.timeout } : {}),
                 });
                 return {
                     event: spec.event,
+                    sub: spec.sub,
                     trust: state.trusted_hash === hash
                         ? 'trusted'
                         : typeof state.trusted_hash === 'string'
@@ -173,7 +190,7 @@ async function hookTrust(io) {
                             : 'untrusted',
                 };
             }
-        return { event: spec.event, trust: 'missing' };
+        return { event: spec.event, sub: spec.sub, trust: 'missing' };
     });
 }
 async function signedInByItself(io, program) {
@@ -191,15 +208,12 @@ async function signedInByItself(io, program) {
         return null;
     }
 }
-async function switches(io, ctx) {
-    if (ctx.headless || ctx.yes)
-        return true;
-    if (!io.interactive)
-        return false;
-    io.out('Codex signs in to Pending You by itself here (codex mcp login). init can move it to this computer’s own sign-in, which its hooks use too: one sign-in for both. The connection it has now stays on your Assistants page until you remove it, and answers to cards it asked through that one won’t reach Codex by themselves.\n');
-    const answer = await io.ask('Switch Codex to this computer’s sign-in? [Y/n] ');
-    return !/^\s*no?\s*$/i.test(answer);
-}
+const switchesFor = (io, ctx) => switches(io, ctx, {
+    name: 'Codex',
+    what: 'Codex signs in to Pending You by itself here (codex mcp login).',
+    uses: 'its hooks use',
+    headless: true,
+});
 async function writeConfig(path, text) {
     return writeWhole(path, text).then(() => true, () => false);
 }
@@ -210,24 +224,26 @@ function keepTheirTrust(config, file, before) {
         'state',
         trustKey(file, event, group, handler),
     ];
-    for (const spec of CODEX_HOOKS) {
-        const groups = Array.isArray(before[spec.event]) ? before[spec.event] : [];
+    for (const event of [...new Set(ALL_CODEX_HOOKS.map((spec) => spec.event))]) {
+        const subs = ALL_CODEX_HOOKS.filter((spec) => spec.event === event).map((spec) => spec.sub);
+        const ours = (hook) => subs.some((sub) => isOurHook(hook?.command, sub));
+        const groups = Array.isArray(before[event]) ? before[event] : [];
         for (const [g, group] of groups.entries())
             for (const [h, hook] of (Array.isArray(group?.hooks) ? group.hooks : []).entries())
-                if (isOurHook(hook?.command, spec.sub))
-                    next = withTable(next, state(spec.event, g, h), null);
+                if (ours(hook))
+                    next = withTable(next, state(event, g, h), null);
         let at = 0;
         for (const [g, group] of groups.entries()) {
             if (!Array.isArray(group?.hooks)) {
                 at++;
                 continue;
             }
-            const kept = group.hooks.flatMap((hook, h) => (isOurHook(hook?.command, spec.sub) ? [] : [h]));
+            const kept = group.hooks.flatMap((hook, h) => (ours(hook) ? [] : [h]));
             if (kept.length === 0)
                 continue;
             for (const [h, was] of kept.entries())
                 if (g !== at || was !== h)
-                    next = renameTable(next, state(spec.event, g, was), state(spec.event, at, h));
+                    next = renameTable(next, state(event, g, was), state(event, at, h));
             at++;
         }
     }
@@ -315,7 +331,7 @@ export const codex = {
             else if ((await signedInByItself(io, program)) !== true) {
                 action = 'write';
             }
-            else if (await switches(io, ctx))
+            else if (await switchesFor(io, ctx))
                 action = 'write';
             else {
                 mode = 'oauth';
@@ -327,6 +343,7 @@ export const codex = {
             }
         }
         const version = detected.version;
+        let newHooks = null;
         return {
             app: codex,
             detected,
@@ -384,7 +401,15 @@ export const codex = {
                 }
                 const skill = await saveSkill(io, ictx.origin, codexSkillPath(io), before?.skill ?? null);
                 report(skill.step);
-                const lines = Object.fromEntries(CODEX_HOOKS.map((spec) => [spec.event, ictx.hookLine(spec.sub)]));
+                const cards = ctx.permissionCards ?? before?.permissionCards !== false;
+                const extra = mode === 'helper' && ictx.helper !== null;
+                const wanted = [
+                    ...CODEX_HOOKS,
+                    ...(extra && cards ? CODEX_PERMISSION_HOOKS : []),
+                    ...(extra ? CODEX_PRESENCE_HOOKS : []),
+                ];
+                const unwanted = ALL_CODEX_HOOKS.filter((spec) => !wanted.includes(spec));
+                const lines = Object.fromEntries(wanted.map((spec) => [lineKey(spec), ictx.hookLine(spec.sub)]));
                 const file = await readHooksFile(io);
                 if ('invalid' in file)
                     report({ ok: false, text: file.invalid });
@@ -393,14 +418,25 @@ export const codex = {
                         const hooks = file.json.hooks && typeof file.json.hooks === 'object'
                             ? file.json.hooks
                             : {};
-                        const merged = mergeHooks(hooks, CODEX_HOOKS, lines, file.path);
-                        if (merged.changed)
-                            await writeWhole(file.path, `${JSON.stringify({ ...file.json, hooks: merged.hooks }, null, 2)}\n`);
+                        const merged = mergeHooks(hooks, wanted, lines, file.path);
+                        const removed = removeHooks(merged.hooks, unwanted);
+                        if (merged.changed || removed.changed)
+                            await writeWhole(file.path, `${JSON.stringify({ ...file.json, hooks: removed.hooks }, null, 2)}\n`);
+                        const fresh = wanted.filter((spec) => !CODEX_HOOKS.includes(spec) && !(lineKey(spec) in (before?.hooks ?? {})));
+                        if (before && merged.changed && fresh.length)
+                            newHooks = [
+                                ...(fresh.some((spec) => spec.sub === 'presence') ? ['session end'] : []),
+                                ...(fresh.some((spec) => spec.sub.startsWith('permission'))
+                                    ? ['permission prompts']
+                                    : []),
+                            ].join(' and ');
                         report({
                             ok: true,
                             text: merged.changed
-                                ? `Installed or updated Codex’s session-start pickup, next-message hand-off, card and Stop check hooks in ${file.path}. Codex asks you to trust them once.`
-                                : 'Codex’s hooks were already installed.',
+                                ? `Installed or updated Codex’s session-start pickup, next-message hand-off, card and Stop check hooks${extra ? `, ${cards ? 'its permission-prompt hooks (a card when Codex waits for your OK; --no-permission-cards leaves them out) ' : ''}and its session-end hook (Pending You hears when a thread is open)` : ''} in ${file.path}. Codex asks you to trust them once.`
+                                : removed.changed
+                                    ? `Took out Codex’s permission-prompt hooks, as you asked: no card when Codex waits for your OK. To turn them on: npx pendingyou init --app codex --permission-cards${originArgs(ictx.origin)}`
+                                    : 'Codex’s hooks were already installed.',
                         });
                     }
                     catch (error) {
@@ -426,6 +462,7 @@ export const codex = {
                     hooks: lines,
                     helper: mode === 'helper' ? ictx.helper : null,
                     setup: { since: new Date(io.now()).toISOString() },
+                    permissionCards: cards,
                 };
                 await writeWhole(manifestPath(io), `${JSON.stringify(manifest, null, 2)}\n`, {
                     secret: true,
@@ -438,9 +475,19 @@ export const codex = {
                 const start = detected.command
                     ? `open the Codex app, start a chat in the folder you work in, and trust Pending You’s hooks: click Review hooks › Allow all (or Settings › Hooks › Trust all)`
                     : `start codex here, or in the folder you work in, and trust Pending You’s hooks: ${TRUST_CLI}; ${TRUST_APP}`;
+                const again = newHooks
+                    ? `Codex has new Pending You hooks (${newHooks}), which it skips until you trust them once: ${detected.command ? TRUST_APP : `${TRUST_CLI}; ${TRUST_APP}`}.`
+                    : null;
                 return {
-                    lines: [`Next: ${first}${start}.`, DONT_SAVE, 'Then say this to it:', '', FINISH_SAY],
-                    together: `- Codex: ${first}${start}, then say the line below to it. ${DONT_SAVE}`,
+                    lines: [
+                        `Next: ${first}${start}.`,
+                        ...(again ? [again] : []),
+                        DONT_SAVE,
+                        'Then say this to it:',
+                        '',
+                        FINISH_SAY,
+                    ],
+                    together: `- Codex: ${first}${start}, then say the line below to it.${again ? ` ${again}` : ''} ${DONT_SAVE}`,
                     say: true,
                 };
             },
@@ -454,7 +501,7 @@ export const codex = {
         let doc = (await readText(config).catch(() => null)) ?? null;
         if ('json' in file) {
             const hooks = file.json.hooks && typeof file.json.hooks === 'object' ? file.json.hooks : {};
-            const removed = removeHooks(hooks, CODEX_HOOKS);
+            const removed = removeHooks(hooks, ALL_CODEX_HOOKS);
             if (removed.changed) {
                 const rest = { ...file.json, hooks: removed.hooks };
                 if (Object.keys(removed.hooks).length === 0)
@@ -484,6 +531,7 @@ export const codex = {
             steps.push(skill);
         await rm(join(configDir(io), 'codex-threads.json'), { force: true });
         await rm(join(configDir(io), 'codex-listen'), { recursive: true, force: true });
+        await removePresenceFiles(io, 'codex');
         await rm(manifestPath(io), { force: true });
         return steps;
     },
@@ -541,10 +589,30 @@ export const codex = {
             off: 'turned off',
             missing: 'missing',
         };
-        const hooksOk = trust.every((hook) => hook.trust === 'trusted');
-        const hooksText = trust.some((hook) => hook.trust === 'missing')
+        const core = trust.filter((hook) => CODEX_HOOKS.some((spec) => spec.sub === hook.sub));
+        const hooksOk = core.every((hook) => hook.trust === 'trusted');
+        const hooksText = core.some((hook) => hook.trust === 'missing')
             ? `not installed; run npx pendingyou init --app codex${flag}`
-            : `${trust.map((hook) => `${hook.event} ${words[hook.trust]}`).join(', ')}${hooksOk ? '' : `. Codex skips a hook you haven’t trusted: ${TRUST_CLI}; ${TRUST_APP}`}`;
+            : `${core.map((hook) => `${hook.event} ${words[hook.trust]}`).join(', ')}${hooksOk ? '' : `. Codex skips a hook you haven’t trusted: ${TRUST_CLI}; ${TRUST_APP}`}`;
+        const extraLine = (label, what, subs, off) => {
+            const hooks = trust.filter((hook) => subs.includes(hook.sub));
+            if (off)
+                return `          ${label} ${off}`;
+            if (hooks.some((hook) => hook.trust === 'missing'))
+                return `  missing ${label} ${what}: not installed; run npx pendingyou@latest init --app codex${flag}`;
+            const trusted = hooks.every((hook) => hook.trust === 'trusted');
+            return trusted
+                ? `  ok      ${label} ${what} (${hooks.map((hook) => `${hook.event} trusted`).join(', ')})`
+                : `  missing ${label} ${what}, once you trust ${hooks.length === 1 ? 'its hook' : 'its hooks'} (${hooks.map((hook) => `${hook.event} ${words[hook.trust]}`).join(', ')}): ${TRUST_CLI}; ${TRUST_APP}`;
+        };
+        const ownConnection = credential?.kind === 'connection' && helper;
+        const notOwn = 'off: it needs Codex signed in through this computer’s own connection';
+        const permissionText = extraLine('Permission prompts:', 'a card when Codex waits for your OK', CODEX_PERMISSION_HOOKS.map((spec) => spec.sub), !ownConnection
+            ? notOwn
+            : manifest?.permissionCards === false
+                ? `off, as you chose; for a card when Codex waits for your OK, run npx pendingyou init --app codex --permission-cards${flag}`
+                : null);
+        const presenceText = extraLine('Presence:', 'tells Pending You when this session is open', CODEX_PRESENCE_HOOKS.map((spec) => spec.sub), ownConnection ? null : notOwn);
         const wakes = detected
             ? atLeast(detected.version, detected.command ? CODEX_APP_WAKE : CODEX_WAKE)
             : false;
@@ -562,6 +630,8 @@ export const codex = {
                 : []),
             `  ${mark(skill !== null)} Skill: ${skill !== null ? `saved (${codexSkillPath(io)})` : `not saved; run npx pendingyou init --app codex${flag}`}`,
             `  ${mark(hooksOk)} Hooks: ${hooksText}`,
+            permissionText,
+            presenceText,
             `  ${mark(wakes)} Wake: ${wakes
                 ? detected?.command
                     ? 'codex queue wakes a chat the Codex app has open when you answer, while the app runs (one it let go, idle 3 hours or behind 10 newer idle chats, hears it when you open it again)'