pendingyou 0.17.0 → 0.18.0

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## 0.18.0 (2026-10-05)
+
+- Presence says which terminal: in a Herdr pane (`HERDR_ENV=1` with `HERDR_BIN_PATH` and `HERDR_PANE_ID`), every
+  presence report (`POST /mcp/cli/presence`: each session's start, its 5-minute heartbeat and its end, for Claude Code,
+  Codex, OpenCode and Pi) also says where the session runs: `"terminal": { "app": "herdr", "paneId": "w2:p1", "server":
+  "<16 hex>" }`. `server` names the Herdr server without the path of its socket: the first 16 hex characters of a
+  SHA-256 of the computer's name and `HERDR_SOCKET_PATH`, left out when there's no socket path. Pending You keeps it with
+  the session and lists it with the agent's sessions running now, so the Pending You plugin for Herdr can go from a card
+  to its agent's pane. It goes whether or not the badges are on. Anywhere else a report is exactly as before, with no
+  `terminal`. A Pending You from before it refuses the field (400): the same report goes again without it.
+- This computer's key: Pending You knows a computer by a key, not by its name. The first time `init` (or `login`) signs
+  anything in, it makes a P-256 key pair in `~/.config/pendingyou/machine.json` (0600, in the 0700 folder with its
+  `.gitignore`), shared by every Pending You address. The private key never leaves the computer and is never printed or
+  logged; Pending You keeps only its public key's RFC 7638 thumbprint. One that can't be read is never replaced: `init`
+  says so and signs in without it.
+  - Every device sign-in it starts (`POST /oauth/device`) carries `machine_attestation`: a JWS the key signs (ES256,
+    `typ` `pendingyou-machine+jwt`, the public key in its header) for `<origin>/oauth/device`, the client signing in and
+    the computer's name, good for 5 minutes and once (`jti`). It's dated by Pending You's own clock (its answer's
+    `Date`), so a computer whose clock is off still proves its key. Whoever allows the sign-in enrolls the computer, and
+    the connections it makes belong to it. A client registered again (a forgotten one) gets a new attestation of its
+    own.
+  - On the next `init`, each agent already signed in proves the key with its own sign-in (`POST /mcp/cli/machine`,
+    `{ "attestation": … }` for `<origin>/mcp/cli/machine`): nothing to approve and no new sign-in, and the agents'
+    sign-ins stay exactly as they were. That's how a computer set up before 0.18.0 gets its key; until then its hooks
+    keep running the copy `init` installed, and nothing changes on it. A Pending You from before machines answers 404,
+    taken quietly.
+  - `pendingyou machine status` says whether Pending You knows each agent's connection by this key (from
+    `/mcp/cli/answers`' `for.machineKey`), and exits 0 only when it knows every one. `machine attest --client-id <id>`
+    (`--cnf <thumbprint>`, `--name`) prints an attestation for an app's own device sign-in, and nothing else.
+    `machine rotate` makes a new key, after a yes (`--yes`, or at the terminal).
+
 ## 0.17.0 (2026-10-05)
 
 - Herdr: an agent running in a Herdr pane (`HERDR_ENV=1` with `HERDR_BIN_PATH` and `HERDR_PANE_ID`) marks its pane with

package/README.md

@@ -284,6 +284,11 @@ It's never in your way: the hooks only start it in the background, each send giv
 You from before presence is taken quietly. A sign-in that only hears (`--oauth`) sends nothing. `npx pendingyou status`
 has a Presence line for each agent.
 
+Since 0.18.0, a session in a [Herdr](https://herdr.dev) pane also says which pane (`HERDR_PANE_ID`, such as `w2:p1`)
+and which Herdr server (16 hex characters of a hash of the computer's name and Herdr's socket path, never the path
+itself), so Pending You can list where each of an agent's running sessions is and the Pending You plugin for Herdr can
+take you to it. Anywhere else nothing of the kind is sent.
+
 ## In Herdr
 
 Since 0.17.0, an agent running in a [Herdr](https://herdr.dev) pane marks its pane with what it's waiting on you for,
@@ -401,6 +406,29 @@ Only want this command's own sign-in (for `watch`, below)? `npx pendingyou login
 hearing answers only, and adds no connection. Your phone asks "Let build-01 hear your answers for the assistants
 running on it?", with no choice of assistant.
 
+## This computer's key
+
+The first time `init` (or `login`) signs anything in, it makes this computer a key pair, kept in
+`~/.config/pendingyou/machine.json`: readable only by you, beside your sign-ins. Pending You knows the computer by that
+key, not by its name: two computers called "MacBook Pro" are two computers, and one you rename is still one. The
+private key never leaves this computer and is never printed; Pending You keeps only its public key's fingerprint.
+
+Every sign-in with a code proves the key, for that sign-in only and only once, so pressing Allow adds this computer,
+by its key, with the agents' connections it makes. A computer set up before 0.18.0 gets its key the next time you run
+`npx -y pendingyou@latest init`: each agent already signed in proves it with its own sign-in, with nothing to approve,
+and its sign-ins stay exactly as they are. Until then nothing changes on it. Pending You uses the key to keep your
+computers apart: an app you sign in on one computer later (such as the Pending You plugin for Herdr) sees only that
+computer's agents.
+
+- `npx pendingyou machine status` says whether Pending You knows each agent's connection here by this key.
+- `npx pendingyou machine rotate` makes a new key (it asks first; `--yes` doesn't). Pending You then knows this
+  computer as a new one, and its agents' connections stay with the old key until you remove that computer from your
+  account; the next `init` then proves the new one.
+- `npx pendingyou machine attest --client-id <id>` prints a proof of this computer for an app's own sign-in with a code
+  (`--cnf <thumbprint>` for that app's own key, `--name` for another name). It never prints the key.
+
+`uninstall` leaves the key: it names the computer and grants nothing on its own.
+
 ## Always-on scripts
 
 `watch` runs a command each time an answer is ready, for a script on your assistant's own machine:
@@ -431,6 +459,7 @@ its environment. A failing command is tried twice more, then skipped. `--once` s
 | `uninstall` | Remove what `init` added, and sign out (`--app`) |
 | `mcp --app <app>` | The stdio bridge: a local MCP server for an agent that can't run a headers helper (OpenCode, Pi), which passes each message on to Pending You with that agent's own sign-in here (`--check`) |
 | `herdr doctor` | Pending You in Herdr: the badges, the plugin, its toasts and its sidebar row. The plugin runs `herdr next`, `open`, `setup`, `view` and `unconfigure`; the agents' writers `herdr report` |
+| `machine status` / `attest` / `rotate` | This computer's key: whether Pending You knows each agent's connection by it (exits 0 when it does), a proof of it for an app's own sign-in (`--client-id`, `--cnf`, `--name`), or a new key (`--yes`) |
 
 Every command takes `--origin` (default `https://www.pendingyou.com`, or `$PENDINGYOU_ORIGIN`). `--app` takes
 `claude-code`, `codex`, `opencode` or `pi` (several with commas where a command sets up or reports several); with none,
@@ -446,7 +475,8 @@ answer or change anything, and doesn't show up as an assistant. They're stored i
 (readable only by you, in a folder with a `.gitignore` of `*` so a dotfiles repository never takes it), refresh
 themselves, and end after 30 days or on `logout`. The headers helper hands an agent's token only to that agent's
 Pending You (Claude Code says which server it's for; Codex's is the one `init` wrote). `clients.json` remembers which
-sign-in each agent's connection used, so signing in again keeps it.
+sign-in each agent's connection used, so signing in again keeps it. `machine.json` (0.18.0) holds this computer's key
+pair, private like the rest; only its proofs leave the computer, each for one sign-in, once.
 
 `state.json` beside them remembers which answers were already handed over (ids only) and how many session starts
 reminded an unfinished setup, and when; `permission-cards/` each Claude Code session's (and Codex thread's) prompts
@@ -461,7 +491,8 @@ command line. `init`, `status` and the hooks read `~/.claude.json` (and a folder
 whether the agent has a `pendingyou` MCP server and where it points. In a Herdr pane (0.17.0) the agents' writers hand
 Herdr's own command line, on this computer, the badges above: a card's title (redacted, 80 characters at most) and its
 request id, never an answer or a note; `<app>-threads.json` remembers the pane each session runs in, and `herdr.json`
-whether the badges are off. With a sign-in that only hears, the hooks and
+whether the badges are off. Presence there (0.18.0) also sends Pending You the pane's id and the hash that names its
+Herdr server. With a sign-in that only hears, the hooks and
 listeners tell this computer's handed questions from another's by its names: its hostname, the names its sign-ins by
 code were given, a Mac's own name (`scutil --get ComputerName`) and, outside a hook, Tailscale's (`tailscale status`). For a permission prompt's card, the worker reads
 the end of the Claude Code session's transcript only for the name the session gave Pending You, and `git remote

package/dist/api.js

@@ -127,7 +127,13 @@ function either(signal, ms) {
     timeout.addEventListener('abort', abort, { once: true });
     return controller.signal;
 }
-export async function getJson(io, origin, path, timeoutMs, signal, options = {}) {
+export function getJson(io, origin, path, timeoutMs, signal, options = {}) {
+    return callJson(io, origin, path, null, timeoutMs, signal, options);
+}
+export function sendJson(io, origin, path, body, timeoutMs, options = {}) {
+    return callJson(io, origin, path, { body }, timeoutMs, undefined, options);
+}
+async function callJson(io, origin, path, send, timeoutMs, signal, options = {}) {
     const app = options.app ?? DEFAULT_APP;
     for (let attempt = 0;; attempt++) {
         let token;
@@ -147,7 +153,12 @@ export async function getJson(io, origin, path, timeoutMs, signal, options = {})
         let response;
         try {
             response = await io.fetch(`${origin}${path}`, {
-                headers: { authorization: `Bearer ${token}`, accept: 'application/json' },
+                ...(send ? { method: 'POST', body: JSON.stringify(send.body), redirect: 'manual' } : {}),
+                headers: {
+                    authorization: `Bearer ${token}`,
+                    accept: 'application/json',
+                    ...(send ? { 'content-type': 'application/json' } : {}),
+                },
                 signal: either(signal, timeoutMs),
             });
         }

package/dist/args.js

@@ -2,6 +2,7 @@ import { APP_IDS, APP_NAMES, DEFAULT_APP, isAppId } from "./apps/ids.js";
 export const DEFAULT_ORIGIN = 'https://www.pendingyou.com';
 export const DEFAULT_TIMEOUT_MS = 4 * 60 * 60 * 1000;
 const MAX_TIMEOUT_MS = 24 * 60 * 60 * 1000;
+export const MACHINE_SUBS = ['status', 'attest', 'rotate'];
 export const HERDR_SUBS = [
     'report',
     'next',
@@ -80,6 +81,7 @@ const COMMANDS = new Set([
     'permission-card',
     'presence',
     'herdr',
+    'machine',
 ]);
 const FLAGS = {
     help: {},
@@ -148,6 +150,7 @@ const FLAGS = {
         wait: false,
         ensure: false,
     },
+    machine: { origin: true, 'client-id': true, cnf: true, name: true, yes: false },
 };
 const VALUE_OPTIONS = new Set([
     'origin',
@@ -162,6 +165,8 @@ const VALUE_OPTIONS = new Set([
     'transcript',
     'pid',
     'at',
+    'client-id',
+    'cnf',
 ]);
 function splitCommand(argv) {
     let index = 0;
@@ -410,6 +415,8 @@ export function parseArgs(argv, env = {}) {
             return { name: 'mcp', origin, ...app(), check: flags.has('check') };
         case 'herdr':
             return herdrCommand(origin, positional, flags, app);
+        case 'machine':
+            return machineCommand(origin, positional, flags, machine);
         case 'init':
             none();
             return {
@@ -525,6 +532,43 @@ function herdrCommand(origin, positional, flags, app) {
             return command;
     }
 }
+const CLIENT_ID = /^[\x21-\x7e]{1,2048}$/;
+const THUMBPRINT = /^[A-Za-z0-9_-]{43}$/;
+function machineCommand(origin, positional, flags, machine) {
+    const [sub, ...extra] = positional;
+    if (sub === undefined)
+        throw new UsageError('machine needs what to do, like: pendingyou machine status');
+    if (!MACHINE_SUBS.includes(sub))
+        throw new UsageError(`machine has no “${sub}”. Use ${MACHINE_SUBS.join(', ')}.`);
+    if (extra.length)
+        throw new UsageError(`machine ${sub} takes no “${extra[0]}”.`);
+    const allowed = {
+        status: [],
+        attest: ['client-id', 'cnf', 'name'],
+        rotate: ['yes'],
+    };
+    for (const key of flags.keys())
+        if (key !== 'origin' && !allowed[sub].includes(key))
+            throw new UsageError(`machine ${sub} has no --${key} option.`);
+    if (sub === 'status')
+        return { name: 'machine', origin, sub };
+    if (sub === 'rotate')
+        return { name: 'machine', origin, sub, yes: flags.has('yes') };
+    const clientId = flags.get('client-id');
+    if (typeof clientId !== 'string' || !CLIENT_ID.test(clientId))
+        throw new UsageError('machine attest needs the client the app signs in with, like: --client-id <its client id>');
+    const cnf = flags.get('cnf');
+    if (cnf !== undefined && (typeof cnf !== 'string' || !THUMBPRINT.test(cnf)))
+        throw new UsageError('--cnf is the app’s own key’s RFC 7638 thumbprint: 43 base64url characters.');
+    return {
+        name: 'machine',
+        origin,
+        sub: 'attest',
+        clientId,
+        ...(typeof cnf === 'string' ? { cnf } : {}),
+        ...machine(),
+    };
+}
 export const USAGE = `pendingyou: Pending You for your coding agents (Claude Code, Codex, OpenCode and Pi)
 
   npx -y pendingyou@latest init
@@ -553,6 +597,11 @@ export const USAGE = `pendingyou: Pending You for your coding agents (Claude Cod
   npx pendingyou herdr doctor  Pending You in Herdr: the badges on your agents' panes, the plugin, its
                                toasts and its sidebar row. The plugin runs herdr next, open, setup,
                                view and unconfigure
+  npx pendingyou machine status | attest | rotate
+                               This computer's key, which Pending You knows it by (init makes it; it
+                               never leaves the computer): whether Pending You knows each agent's
+                               connection by it, a proof of it for an app's own sign-in
+                               (--client-id, --cnf), or a new key (--yes: without asking)
 
 Apps (for --app): ${APP_IDS.map((app) => `${app} (${APP_NAMES[app]})`).join(', ')}.
 

package/dist/herdr.js

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto';
 import { isAbsolute, join } from 'node:path';
 import { configDir, readJson, writeWhole } from "./files.js";
 import { cut, redactText } from "./redact.js";
@@ -42,6 +43,19 @@ export function herdrPane(env) {
         return null;
     return { bin, pane };
 }
+export function herdrServer(env, host) {
+    const socket = env.HERDR_SOCKET_PATH ?? '';
+    if (!socket || !isAbsolute(socket) || /[\0\r\n]/.test(socket))
+        return null;
+    return createHash('sha256').update(`${host}${socket}`).digest('hex').slice(0, 16);
+}
+export function herdrTerminal(env, host) {
+    const pane = herdrPane(env);
+    if (!pane)
+        return null;
+    const server = herdrServer(env, host);
+    return { app: 'herdr', paneId: pane.pane, ...(server ? { server } : {}) };
+}
 const settingsPath = (io) => join(configDir(io), 'herdr.json');
 export async function badgesOn(io) {
     const settings = await readJson(settingsPath(io)).catch(() => null);

package/dist/index.js

@@ -1,6 +1,7 @@
 export { getJson, SignInNeeded, Unavailable } from "./api.js";
 export { DEFAULT_ORIGIN, parseArgs } from "./args.js";
 export { readCredential, updateCredential } from "./credentials.js";
+export { attest, ensureMachine, machinePath, proveConnections, readMachine, thumbprintOf, } from "./machine.js";
 export { main } from "./main.js";
 export { CLIENT_NAME, deviceLink, discover, register, revoke, SCOPE, signIn, signInWithDevice, startDevice, waitForDevices, } from "./oauth.js";
 export { qrCode, qrLines } from "./qr.js";

package/dist/init.js

@@ -5,6 +5,7 @@ import { hookCommand } from "./claude.js";
 import { readCredential, saveConnectionClient } from "./credentials.js";
 import { hookLine, originArgs } from "./hooks.js";
 import { installCli, pruneCli, removeCli } from "./install.js";
+import { keyForSignIn, proveConnections } from "./machine.js";
 import { headlessReason, helperCommand, removeHelper, writeHelper } from "./remote.js";
 import { FINISH_SAY } from "./setup.js";
 import { removeShim, shimPath, writeShim } from "./shim.js";
@@ -145,12 +146,16 @@ export async function init(io, options) {
     if (options.login) {
         if (ctx.headless && !options.device)
             io.out(`No browser here (${ctx.headless}), so you approve with a code on your phone.\n`);
+        const key = await keyForSignIn(io);
         signed = await signInApps(io, going.map((each) => ({ app: each.app.id, kind: each.signIn })), {
             origin: options.origin,
             device: options.device,
             browser: options.browser,
             ...(options.machine ? { machine: options.machine } : {}),
+            key,
         });
+        if (key)
+            await proveConnections(io, options.origin, [...signed].flatMap(([app, how]) => (how === 'already' ? [app] : [])), key);
     }
     else
         io.out(going.length === 1

package/dist/machine-command.js

@@ -0,0 +1,101 @@
+import { APP_NAMES } from "./apps/ids.js";
+import { readCredential, signedInSlots } from "./credentials.js";
+import { originArgs } from "./hooks.js";
+import { attest, clockOffset, machinePath, readMachine, rotateMachine } from "./machine.js";
+import { computerName } from "./remote.js";
+import { checkSignIn } from "./signin.js";
+export async function machineStatus(io, origin) {
+    const flag = originArgs(origin);
+    const machine = await readMachine(io);
+    if (!machine) {
+        io.out(`This computer has no key yet. npx -y pendingyou@latest init${flag} makes one, and proves it to Pending You.\n`);
+        return 1;
+    }
+    const lines = [
+        `This computer’s key: ${machinePath(io)} (made ${machine.createdAt.slice(0, 10)})`,
+        `Its fingerprint: ${machine.thumbprint}`,
+    ];
+    let ready = true;
+    const apps = [];
+    for (const slot of await signedInSlots(io))
+        if (slot.origin === origin &&
+            (await readCredential(io, origin, slot.app))?.kind === 'connection')
+            apps.push(slot.app);
+    lines.push(apps.length
+        ? `At ${origin}:`
+        : `No agent here is signed in to ${origin} with a connection of its own, so there’s nothing to prove there.`);
+    for (const app of apps) {
+        const check = await checkSignIn(io, origin, app);
+        const name = APP_NAMES[app];
+        if (check.state !== 'ok') {
+            ready = false;
+            lines.push(check.state === 'unreachable'
+                ? `  ${name}: Pending You couldn’t be reached.`
+                : `  ${name}: not signed in; run npx -y pendingyou@latest init${flag}.`);
+            continue;
+        }
+        const key = check.for?.machineKey;
+        if (key === machine.thumbprint) {
+            lines.push(`  ${name}: known by this key${check.for?.machine ? ` (as ${check.for.machine})` : ''}.`);
+            continue;
+        }
+        ready = false;
+        lines.push(key
+            ? `  ${name}: known by another key, this computer’s before it was replaced. Once that computer is removed from your Pending You account, npx -y pendingyou@latest init${flag} proves this one.`
+            : `  ${name}: not yet. npx -y pendingyou@latest init${flag} proves this key, with nothing to approve.`);
+    }
+    io.out(`${lines.join('\n')}\n`);
+    return ready ? 0 : 1;
+}
+export async function machineAttest(io, command) {
+    const machine = await readMachine(io);
+    if (!machine) {
+        io.err(`pendingyou: This computer has no key yet. Run npx -y pendingyou@latest init${originArgs(command.origin)} first.\n`);
+        return 1;
+    }
+    const name = command.machine ?? (await computerName(io)).name;
+    const offset = await clockOffset(io, command.origin);
+    const attestation = await attest(machine, {
+        aud: `${command.origin}/oauth/device`,
+        client_id: command.clientId,
+        name,
+        ...(command.cnf ? { cnf: { jkt: command.cnf } } : {}),
+    }, io.now() + offset);
+    io.out(`${attestation}\n`);
+    return 0;
+}
+export async function machineRotate(io, command) {
+    const flag = originArgs(command.origin);
+    const had = await readMachine(io).then((machine) => machine !== null, () => true);
+    if (had && !command.yes) {
+        if (!io.interactive) {
+            io.err('pendingyou: This replaces this computer’s key, and Pending You will know it as a new computer. Run it again with --yes to go ahead.\n');
+            return 1;
+        }
+        const answer = await io.ask('Replace this computer’s key? Pending You will know it as a new computer. [y/N] ');
+        if (!/^y(es)?$/i.test(answer.trim())) {
+            io.out('Kept this computer’s key.\n');
+            return 1;
+        }
+    }
+    const { before, machine } = await rotateMachine(io);
+    const lines = [
+        `New key for this computer: ${machinePath(io)}`,
+        `Its fingerprint: ${machine.thumbprint}${before ? ` (it was ${before})` : ''}`,
+        before
+            ? `Pending You knows this computer’s connections by the old key until that computer is removed from your account; then npx -y pendingyou@latest init${flag} proves this one for them.`
+            : `npx -y pendingyou@latest init${flag} proves it to Pending You.`,
+    ];
+    io.out(`${lines.join('\n')}\n`);
+    return 0;
+}
+export function machine(io, command) {
+    switch (command.sub) {
+        case 'status':
+            return machineStatus(io, command.origin);
+        case 'attest':
+            return machineAttest(io, command);
+        case 'rotate':
+            return machineRotate(io, command);
+    }
+}

package/dist/machine.js

@@ -0,0 +1,151 @@
+import { createHash, randomBytes, webcrypto } from 'node:crypto';
+import { chmod, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { sendJson } from "./api.js";
+import { connectionMachine, ignoreFolder, readCredential } from "./credentials.js";
+import { PlainError } from "./errors.js";
+import { configDir, readJson, withLock, writeWhole } from "./files.js";
+import { discover } from "./oauth.js";
+import { machineOf } from "./remote.js";
+export const ATTESTATION_TYPE = 'pendingyou-machine+jwt';
+const ATTESTATION_SECONDS = 300;
+export const MACHINE_PATH = '/mcp/cli/machine';
+export const machinePath = (io) => join(configDir(io), 'machine.json');
+const base64url = (bytes) => Buffer.from(bytes).toString('base64url');
+const isCoordinate = (value) => typeof value === 'string' &&
+    /^[A-Za-z0-9_-]{43}$/.test(value) &&
+    Buffer.from(value, 'base64url').length === 32;
+export function thumbprintOf(jwk) {
+    return createHash('sha256')
+        .update(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y }))
+        .digest('base64url');
+}
+function keyOf(value) {
+    if (typeof value !== 'object' || value === null)
+        return null;
+    const { kty, crv, x, y, d } = value;
+    if (kty !== 'EC' || crv !== 'P-256' || !isCoordinate(x) || !isCoordinate(y) || !isCoordinate(d))
+        return null;
+    return { kty, crv, x, y, d };
+}
+async function loaded(key, createdAt) {
+    const signer = await webcrypto.subtle.importKey('jwk', key, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign']);
+    const jwk = { kty: key.kty, crv: key.crv, x: key.x, y: key.y };
+    return { thumbprint: thumbprintOf(jwk), createdAt, jwk, signer };
+}
+const unreadable = (path) => new PlainError(`This computer’s key (${path}) can’t be read. Run npx pendingyou machine rotate to make a new one.`);
+export async function readMachine(io) {
+    const path = machinePath(io);
+    let file;
+    try {
+        file = await readJson(path);
+    }
+    catch {
+        throw unreadable(path);
+    }
+    if (file === null)
+        return null;
+    const key = file?.version === 1 && typeof file.createdAt === 'string' ? keyOf(file.key) : null;
+    if (!key || typeof file?.createdAt !== 'string')
+        throw unreadable(path);
+    if ((await stat(path)).mode & 0o077)
+        await chmod(path, 0o600);
+    try {
+        return await loaded(key, file.createdAt);
+    }
+    catch {
+        throw unreadable(path);
+    }
+}
+async function writeNew(io) {
+    const pair = await webcrypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, true, [
+        'sign',
+        'verify',
+    ]);
+    const key = keyOf(await webcrypto.subtle.exportKey('jwk', pair.privateKey));
+    if (!key)
+        throw new PlainError('This computer’s key couldn’t be made.');
+    const createdAt = new Date(io.now()).toISOString();
+    const file = {
+        version: 1,
+        createdAt,
+        key: { kty: key.kty, crv: key.crv, x: key.x, y: key.y, d: key.d },
+    };
+    await writeWhole(machinePath(io), `${JSON.stringify(file, null, 2)}\n`, { secret: true });
+    await ignoreFolder(io).catch(() => { });
+    return loaded(key, createdAt);
+}
+export async function ensureMachine(io) {
+    return withLock(machinePath(io), io, async () => {
+        const machine = await readMachine(io);
+        return machine ? { machine, made: false } : { machine: await writeNew(io), made: true };
+    });
+}
+export async function rotateMachine(io) {
+    return withLock(machinePath(io), io, async () => {
+        const before = await readMachine(io).catch(() => null);
+        return { before: before?.thumbprint ?? null, machine: await writeNew(io) };
+    });
+}
+export async function attest(machine, claims, now) {
+    const iat = Math.floor(now / 1000);
+    const header = { typ: ATTESTATION_TYPE, alg: 'ES256', jwk: machine.jwk };
+    const payload = {
+        ...claims,
+        iat,
+        exp: iat + ATTESTATION_SECONDS,
+        jti: randomBytes(16).toString('base64url'),
+    };
+    const signing = `${base64url(JSON.stringify(header))}.${base64url(JSON.stringify(payload))}`;
+    const signature = await webcrypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, machine.signer, Buffer.from(signing));
+    return `${signing}.${base64url(new Uint8Array(signature))}`;
+}
+export async function keyForSignIn(io) {
+    try {
+        const { machine, made } = await ensureMachine(io);
+        if (made)
+            io.out(`Made this computer’s key for Pending You (${machinePath(io)}): it stays on this computer, and Pending You knows the computer by it.\n`);
+        return machine;
+    }
+    catch (error) {
+        io.err(`pendingyou: ${error instanceof PlainError ? error.message : 'This computer’s key couldn’t be made.'} Signing in without it.\n`);
+        return null;
+    }
+}
+export async function clockOffset(io, origin) {
+    return discover(io, origin, 5000).then((metadata) => metadata.clockOffsetMs ?? 0, () => 0);
+}
+export async function proveConnections(io, origin, apps, machine) {
+    const results = new Map();
+    const connected = [];
+    for (const app of apps) {
+        const credential = await readCredential(io, origin, app);
+        if (credential?.kind === 'connection')
+            connected.push({ app, clientId: credential.clientId });
+    }
+    if (connected.length === 0)
+        return results;
+    const offset = await clockOffset(io, origin);
+    for (const { app, clientId } of connected) {
+        try {
+            const attestation = await attest(machine, {
+                aud: `${origin}${MACHINE_PATH}`,
+                client_id: clientId,
+                name: (await connectionMachine(io, origin, app)) ?? machineOf(io.host),
+            }, io.now() + offset);
+            const { status, body } = await sendJson(io, origin, MACHINE_PATH, { attestation }, 15_000, { app });
+            const said = body.connection;
+            results.set(app, status === 200 && (said === 'joined' || said === 'already' || said === 'elsewhere')
+                ? said
+                : status === 404
+                    ? 'absent'
+                    : status >= 400 && status < 500
+                        ? 'refused'
+                        : 'failed');
+        }
+        catch {
+            results.set(app, 'failed');
+        }
+    }
+    return results;
+}

package/dist/main.js

@@ -8,6 +8,7 @@ import { PlainError } from "./errors.js";
 import { herdr } from "./herdr/command.js";
 import { hold } from "./hold.js";
 import { init, status, uninstall } from "./init.js";
+import { machine } from "./machine-command.js";
 import { OAuthError } from "./oauth.js";
 import { isPromptApp, permissionHook, permissionWorker } from "./permission.js";
 import { pickup } from "./pickup.js";
@@ -95,6 +96,8 @@ async function run(io, command, hook = { fallback: '' }) {
             return bridge(io, command);
         case 'herdr':
             return herdr(io, command);
+        case 'machine':
+            return machine(io, command);
     }
 }
 export const HOOK_DEADLINE_MS = 3000;

package/dist/oauth.js

@@ -14,6 +14,7 @@ export class OAuthError extends Error {
         this.code = code;
     }
 }
+export const serverNow = (io, metadata) => io.now() + (metadata.clockOffsetMs ?? 0);
 const base64url = (bytes) => bytes.toString('base64').replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
 export function pkce() {
     const verifier = base64url(randomBytes(32));
@@ -28,7 +29,11 @@ export async function discover(io, origin, timeoutMs = 15_000) {
     });
     if (!response.ok)
         throw new OAuthError('discovery', `Pending You at ${origin} didn’t answer (${response.status}).`);
-    const metadata = (await response.json());
+    const said = Date.parse(response.headers.get('date') ?? '');
+    const metadata = {
+        ...(await response.json()),
+        ...(io.now && Number.isFinite(said) ? { clockOffsetMs: said - io.now() } : {}),
+    };
     const sameOrigin = (url) => {
         try {
             return url !== undefined && new URL(url).origin === origin;
@@ -218,17 +223,23 @@ export async function revoke(io, origin, clientId, refreshToken) {
 export async function startDevice(io, options) {
     const metadata = await discover(io, options.origin);
     const assistant = options.assistant ?? (options.connection ? 'claude-code' : undefined);
-    const begin = (client) => io.fetch(`${options.origin}/oauth/device`, {
-        method: 'POST',
-        headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
-        body: new URLSearchParams({
-            client_id: client,
-            scope: SCOPE,
-            ...(options.machine ? { machine: options.machine } : {}),
-            ...(assistant ? { assistant } : {}),
-        }).toString(),
-        signal: AbortSignal.timeout(15_000),
-    });
+    const begin = async (client) => {
+        const attestation = options.attest
+            ? await options.attest(client, serverNow(io, metadata))
+            : null;
+        return io.fetch(`${options.origin}/oauth/device`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+            body: new URLSearchParams({
+                client_id: client,
+                scope: SCOPE,
+                ...(options.machine ? { machine: options.machine } : {}),
+                ...(assistant ? { assistant } : {}),
+                ...(attestation ? { machine_attestation: attestation } : {}),
+            }).toString(),
+            signal: AbortSignal.timeout(15_000),
+        });
+    };
     let clientId = options.clientId || (await register(io, metadata));
     let started = await begin(clientId);
     if (started.status === 401 && options.clientId) {

package/dist/presence.js

@@ -6,7 +6,7 @@ import { reportThreads, threadNames } from "./apps/codex-wake.js";
 import { DEFAULT_ORIGIN } from "./args.js";
 import { readCredential } from "./credentials.js";
 import { configDir, readJson, withLock, writeWhole } from "./files.js";
-import { herdrTarget, reportCommand } from "./herdr.js";
+import { herdrTarget, herdrTerminal, reportCommand } from "./herdr.js";
 import { endPrompts, sessionName } from "./permission.js";
 export const PRESENCE_PATH = '/mcp/cli/presence';
 export const PRESENCE_EVERY_MS = 5 * 60_000;
@@ -60,13 +60,15 @@ export async function sendPresence(io, origin, presence, timeoutMs = SEND_MS, op
     try {
         if ((await readCredential(io, origin, presence.app))?.kind !== 'connection')
             return 'skipped';
-        const body = {
+        const plain = {
             source: presence.app,
             name: presenceName(presence.name),
             sessionId: presence.session,
             cwd: presence.cwd && presence.cwd.length <= CWD_MAX ? presence.cwd : null,
             state: presence.state,
         };
+        const terminal = herdrTerminal(io.env, io.host);
+        let body = terminal ? { ...plain, terminal } : plain;
         const send = (force) => postJson(io, origin, PRESENCE_PATH, body, timeoutMs, {
             app: presence.app,
             signal: AbortSignal.timeout(timeoutMs + 2000),
@@ -75,6 +77,10 @@ export async function sendPresence(io, origin, presence, timeoutMs = SEND_MS, op
         let answer = await send(false);
         if (answer.status === 401)
             answer = await send(true);
+        if (answer.status === 400 && terminal) {
+            body = plain;
+            answer = await send(false);
+        }
         if (answer.status === 429 && options.patient) {
             await io.sleep(Math.min(answer.retryAfter ?? 60, RETRY_AFTER_MAX_S) * 1000, io.signal);
             answer = await send(false);

package/dist/signin.js

@@ -3,6 +3,7 @@ import { APP_NAMES, DEFAULT_APP, namesOf } from "./apps/ids.js";
 import { connectionClient, connectionMachine, readCredential, saveConnectionClient, signedInSlots, updateCredential, } from "./credentials.js";
 import { PlainError } from "./errors.js";
 import { originArgs } from "./hooks.js";
+import { attest, keyForSignIn } from "./machine.js";
 import { OAuthError, revoke, signIn, startDevice, waitForDevices, } from "./oauth.js";
 import { computerName, headlessReason, machineOf } from "./remote.js";
 import { connectionTitle } from "./setup.js";
@@ -56,12 +57,17 @@ export async function signInApps(io, needs, options) {
         return result;
     }
     const named = await computerName(io, options.machine);
+    const key = options.key === undefined ? await keyForSignIn(io) : options.key;
+    const vouch = key
+        ? (clientId, now) => attest(key, { aud: `${origin}/oauth/device`, client_id: clientId, name: named.name }, now).catch(() => null)
+        : undefined;
     const started = [];
     for (const need of todo) {
         try {
             const flow = await startDevice(io, {
                 origin,
                 machine: named.name,
+                ...(vouch ? { attest: vouch } : {}),
                 ...(need.kind === 'connection'
                     ? { assistant: need.app, clientId: await connectionClient(io, origin, need.app) }
                     : {}),

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = '0.17.0';
+export const VERSION = '0.18.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pendingyou",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Pending You for your coding agents: one command sets up Claude Code, Codex, OpenCode and Pi to ask you through Pending You and hear your answers, even while they sit idle.",
   "license": "Apache-2.0",
   "homepage": "https://www.pendingyou.com",