pendingyou 0.17.0 → 0.19.0

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # Changelog
 
+## 0.19.0 (2026-10-06)
+
+- The Stop check lets a turn end on a recap of cards already waiting on you. It asked the agent to go on whenever its
+  last message had something for you and the turn posted no card, so a closing line like “Two cards are waiting on
+  you: CLI 0.18.0 (publish it) and the Herdr check (does the amber title show in the sidebar?).” was asked to go on,
+  and Claude Code showed each of those as a “Stop hook error”. Now:
+  - A recap counts as posted, for what it says: a sentence that says its cards wait on you (“Two cards are waiting on
+    you: …”, “the card is still open for your answer”, “both cards are in your queue”, “… (both cards).”), or a heading
+    that does, or names your cards (“**Cards waiting for you:**”, “Your open cards:”), with the list under it.
+    Anything else in the message for you is checked as before, so a new ask beside a recap still goes on a card. Cards
+    that aren't said to wait on you (“the two cards line up”, “add a credit card”) are no recap.
+  - So does a card said to be coming, or one an item already is: “a card is coming”, “there'll be a card”, “I'll
+    create a card”, “that one is already a card”, as “I'll send you a card” and “it's on a card” already did.
+  - Anything else for you, in a message that talks about cards (not a credit card, a SIM card or a card number), is
+    taken as a recap while this folder has a card waiting on you: one request (this folder's open cards, the one the
+    next-message hook makes), made only for such a message and given up after 1.5 seconds. None open: the agent is
+    asked to go on, as before. A permission prompt's card doesn't count. When Pending You can't say (offline, slow, an
+    older server), the turn ends.
+  - Everything else is as before: an ask to type something here, a question handed to the agent, once a turn at most,
+    quiet when not signed in, silent on any error, the 3-second deadline. Codex's, OpenCode's and Pi's Stop checks do
+    the same, each asking for its own app's cards.
+- Hooks run the copy `init` installed: run `npx pendingyou@latest init` once to switch.
+
+## 0.18.0 (2026-10-05)
+
+- Presence says which terminal: in a Herdr pane (`HERDR_ENV=1` with `HERDR_BIN_PATH` and `HERDR_PANE_ID`), every
+  presence report (`POST /mcp/cli/presence`: each session's start, its 5-minute heartbeat and its end, for Claude Code,
+  Codex, OpenCode and Pi) also says where the session runs: `"terminal": { "app": "herdr", "paneId": "w2:p1", "server":
+  "<16 hex>" }`. `server` names the Herdr server without the path of its socket: the first 16 hex characters of a
+  SHA-256 of the computer's name and `HERDR_SOCKET_PATH`, left out when there's no socket path. Pending You keeps it with
+  the session and lists it with the agent's sessions running now, so the Pending You plugin for Herdr can go from a card
+  to its agent's pane. It goes whether or not the badges are on. Anywhere else a report is exactly as before, with no
+  `terminal`. A Pending You from before it refuses the field (400): the same report goes again without it.
+- This computer's key: Pending You knows a computer by a key, not by its name. The first time `init` (or `login`) signs
+  anything in, it makes a P-256 key pair in `~/.config/pendingyou/machine.json` (0600, in the 0700 folder with its
+  `.gitignore`), shared by every Pending You address. The private key never leaves the computer and is never printed or
+  logged; Pending You keeps only its public key's RFC 7638 thumbprint. One that can't be read is never replaced: `init`
+  says so and signs in without it.
+  - Every device sign-in it starts (`POST /oauth/device`) carries `machine_attestation`: a JWS the key signs (ES256,
+    `typ` `pendingyou-machine+jwt`, the public key in its header) for `<origin>/oauth/device`, the client signing in and
+    the computer's name, good for 5 minutes and once (`jti`). It's dated by Pending You's own clock (its answer's
+    `Date`), so a computer whose clock is off still proves its key. Whoever allows the sign-in enrolls the computer, and
+    the connections it makes belong to it. A client registered again (a forgotten one) gets a new attestation of its
+    own.
+  - On the next `init`, each agent already signed in proves the key with its own sign-in (`POST /mcp/cli/machine`,
+    `{ "attestation": … }` for `<origin>/mcp/cli/machine`): nothing to approve and no new sign-in, and the agents'
+    sign-ins stay exactly as they were. That's how a computer set up before 0.18.0 gets its key; until then its hooks
+    keep running the copy `init` installed, and nothing changes on it. A Pending You from before machines answers 404,
+    taken quietly.
+  - `pendingyou machine status` says whether Pending You knows each agent's connection by this key (from
+    `/mcp/cli/answers`' `for.machineKey`), and exits 0 only when it knows every one. `machine attest --client-id <id>`
+    (`--cnf <thumbprint>`, `--name`) prints an attestation for an app's own device sign-in, and nothing else.
+    `machine rotate` makes a new key, after a yes (`--yes`, or at the terminal).
+
 ## 0.17.0 (2026-10-05)
 
 - Herdr: an agent running in a Herdr pane (`HERDR_ENV=1` with `HERDR_BIN_PATH` and `HERDR_PANE_ID`) marks its pane with

package/README.md

@@ -205,6 +205,13 @@ can", "waiting on you" and the like; or a list under a heading like "Your part",
 you" or "Left for you". It lets the turn end when the message says nothing needs a card ("No card needed.", "Nothing
 needs your attention.", "There's nothing waiting on you.").
 
+Since 0.19.0 it also lets the turn end on a recap of cards already waiting on you. A sentence that says its cards wait
+on you ("Two cards are waiting on you: …", "… (both cards).") covers what it asks, and so does a heading that does
+("Cards waiting for you:") over its list; anything else for you in the message is checked as before, so a new ask
+beside a recap still goes on a card. And anything else for you, in a message that talks about cards, is taken as a
+recap while this folder has a card waiting on you: only such a message costs a request (this folder's open cards,
+given up after 1.5 seconds), and when Pending You can't say, the turn ends.
+
 Since 0.9.0 it also catches a message asking you to type or reply something in Claude Code's own chat ("Reply “yes,
 erase disk12” here", "To confirm, type `yes`", "Confirm here"). Some steps an agent takes only on your own words in
 its conversation, never on a card answer; that's fine, but then a card has to send you there. Unless a card posted in
@@ -284,6 +291,11 @@ It's never in your way: the hooks only start it in the background, each send giv
 You from before presence is taken quietly. A sign-in that only hears (`--oauth`) sends nothing. `npx pendingyou status`
 has a Presence line for each agent.
 
+Since 0.18.0, a session in a [Herdr](https://herdr.dev) pane also says which pane (`HERDR_PANE_ID`, such as `w2:p1`)
+and which Herdr server (16 hex characters of a hash of the computer's name and Herdr's socket path, never the path
+itself), so Pending You can list where each of an agent's running sessions is and the Pending You plugin for Herdr can
+take you to it. Anywhere else nothing of the kind is sent.
+
 ## In Herdr
 
 Since 0.17.0, an agent running in a [Herdr](https://herdr.dev) pane marks its pane with what it's waiting on you for,
@@ -401,6 +413,29 @@ Only want this command's own sign-in (for `watch`, below)? `npx pendingyou login
 hearing answers only, and adds no connection. Your phone asks "Let build-01 hear your answers for the assistants
 running on it?", with no choice of assistant.
 
+## This computer's key
+
+The first time `init` (or `login`) signs anything in, it makes this computer a key pair, kept in
+`~/.config/pendingyou/machine.json`: readable only by you, beside your sign-ins. Pending You knows the computer by that
+key, not by its name: two computers called "MacBook Pro" are two computers, and one you rename is still one. The
+private key never leaves this computer and is never printed; Pending You keeps only its public key's fingerprint.
+
+Every sign-in with a code proves the key, for that sign-in only and only once, so pressing Allow adds this computer,
+by its key, with the agents' connections it makes. A computer set up before 0.18.0 gets its key the next time you run
+`npx -y pendingyou@latest init`: each agent already signed in proves it with its own sign-in, with nothing to approve,
+and its sign-ins stay exactly as they are. Until then nothing changes on it. Pending You uses the key to keep your
+computers apart: an app you sign in on one computer later (such as the Pending You plugin for Herdr) sees only that
+computer's agents.
+
+- `npx pendingyou machine status` says whether Pending You knows each agent's connection here by this key.
+- `npx pendingyou machine rotate` makes a new key (it asks first; `--yes` doesn't). Pending You then knows this
+  computer as a new one, and its agents' connections stay with the old key until you remove that computer from your
+  account; the next `init` then proves the new one.
+- `npx pendingyou machine attest --client-id <id>` prints a proof of this computer for an app's own sign-in with a code
+  (`--cnf <thumbprint>` for that app's own key, `--name` for another name). It never prints the key.
+
+`uninstall` leaves the key: it names the computer and grants nothing on its own.
+
 ## Always-on scripts
 
 `watch` runs a command each time an answer is ready, for a script on your assistant's own machine:
@@ -431,6 +466,7 @@ its environment. A failing command is tried twice more, then skipped. `--once` s
 | `uninstall` | Remove what `init` added, and sign out (`--app`) |
 | `mcp --app <app>` | The stdio bridge: a local MCP server for an agent that can't run a headers helper (OpenCode, Pi), which passes each message on to Pending You with that agent's own sign-in here (`--check`) |
 | `herdr doctor` | Pending You in Herdr: the badges, the plugin, its toasts and its sidebar row. The plugin runs `herdr next`, `open`, `setup`, `view` and `unconfigure`; the agents' writers `herdr report` |
+| `machine status` / `attest` / `rotate` | This computer's key: whether Pending You knows each agent's connection by it (exits 0 when it does), a proof of it for an app's own sign-in (`--client-id`, `--cnf`, `--name`), or a new key (`--yes`) |
 
 Every command takes `--origin` (default `https://www.pendingyou.com`, or `$PENDINGYOU_ORIGIN`). `--app` takes
 `claude-code`, `codex`, `opencode` or `pi` (several with commas where a command sets up or reports several); with none,
@@ -446,7 +482,8 @@ answer or change anything, and doesn't show up as an assistant. They're stored i
 (readable only by you, in a folder with a `.gitignore` of `*` so a dotfiles repository never takes it), refresh
 themselves, and end after 30 days or on `logout`. The headers helper hands an agent's token only to that agent's
 Pending You (Claude Code says which server it's for; Codex's is the one `init` wrote). `clients.json` remembers which
-sign-in each agent's connection used, so signing in again keeps it.
+sign-in each agent's connection used, so signing in again keeps it. `machine.json` (0.18.0) holds this computer's key
+pair, private like the rest; only its proofs leave the computer, each for one sign-in, once.
 
 `state.json` beside them remembers which answers were already handed over (ids only) and how many session starts
 reminded an unfinished setup, and when; `permission-cards/` each Claude Code session's (and Codex thread's) prompts
@@ -461,7 +498,8 @@ command line. `init`, `status` and the hooks read `~/.claude.json` (and a folder
 whether the agent has a `pendingyou` MCP server and where it points. In a Herdr pane (0.17.0) the agents' writers hand
 Herdr's own command line, on this computer, the badges above: a card's title (redacted, 80 characters at most) and its
 request id, never an answer or a note; `<app>-threads.json` remembers the pane each session runs in, and `herdr.json`
-whether the badges are off. With a sign-in that only hears, the hooks and
+whether the badges are off. Presence there (0.18.0) also sends Pending You the pane's id and the hash that names its
+Herdr server. With a sign-in that only hears, the hooks and
 listeners tell this computer's handed questions from another's by its names: its hostname, the names its sign-ins by
 code were given, a Mac's own name (`scutil --get ComputerName`) and, outside a hook, Tailscale's (`tailscale status`). For a permission prompt's card, the worker reads
 the end of the Claude Code session's transcript only for the name the session gave Pending You, and `git remote

package/dist/api.js

@@ -127,7 +127,13 @@ function either(signal, ms) {
     timeout.addEventListener('abort', abort, { once: true });
     return controller.signal;
 }
-export async function getJson(io, origin, path, timeoutMs, signal, options = {}) {
+export function getJson(io, origin, path, timeoutMs, signal, options = {}) {
+    return callJson(io, origin, path, null, timeoutMs, signal, options);
+}
+export function sendJson(io, origin, path, body, timeoutMs, options = {}) {
+    return callJson(io, origin, path, { body }, timeoutMs, undefined, options);
+}
+async function callJson(io, origin, path, send, timeoutMs, signal, options = {}) {
     const app = options.app ?? DEFAULT_APP;
     for (let attempt = 0;; attempt++) {
         let token;
@@ -147,7 +153,12 @@ export async function getJson(io, origin, path, timeoutMs, signal, options = {})
         let response;
         try {
             response = await io.fetch(`${origin}${path}`, {
-                headers: { authorization: `Bearer ${token}`, accept: 'application/json' },
+                ...(send ? { method: 'POST', body: JSON.stringify(send.body), redirect: 'manual' } : {}),
+                headers: {
+                    authorization: `Bearer ${token}`,
+                    accept: 'application/json',
+                    ...(send ? { 'content-type': 'application/json' } : {}),
+                },
                 signal: either(signal, timeoutMs),
             });
         }

package/dist/args.js

@@ -2,6 +2,7 @@ import { APP_IDS, APP_NAMES, DEFAULT_APP, isAppId } from "./apps/ids.js";
 export const DEFAULT_ORIGIN = 'https://www.pendingyou.com';
 export const DEFAULT_TIMEOUT_MS = 4 * 60 * 60 * 1000;
 const MAX_TIMEOUT_MS = 24 * 60 * 60 * 1000;
+export const MACHINE_SUBS = ['status', 'attest', 'rotate'];
 export const HERDR_SUBS = [
     'report',
     'next',
@@ -80,6 +81,7 @@ const COMMANDS = new Set([
     'permission-card',
     'presence',
     'herdr',
+    'machine',
 ]);
 const FLAGS = {
     help: {},
@@ -148,6 +150,7 @@ const FLAGS = {
         wait: false,
         ensure: false,
     },
+    machine: { origin: true, 'client-id': true, cnf: true, name: true, yes: false },
 };
 const VALUE_OPTIONS = new Set([
     'origin',
@@ -162,6 +165,8 @@ const VALUE_OPTIONS = new Set([
     'transcript',
     'pid',
     'at',
+    'client-id',
+    'cnf',
 ]);
 function splitCommand(argv) {
     let index = 0;
@@ -410,6 +415,8 @@ export function parseArgs(argv, env = {}) {
             return { name: 'mcp', origin, ...app(), check: flags.has('check') };
         case 'herdr':
             return herdrCommand(origin, positional, flags, app);
+        case 'machine':
+            return machineCommand(origin, positional, flags, machine);
         case 'init':
             none();
             return {
@@ -525,6 +532,43 @@ function herdrCommand(origin, positional, flags, app) {
             return command;
     }
 }
+const CLIENT_ID = /^[\x21-\x7e]{1,2048}$/;
+const THUMBPRINT = /^[A-Za-z0-9_-]{43}$/;
+function machineCommand(origin, positional, flags, machine) {
+    const [sub, ...extra] = positional;
+    if (sub === undefined)
+        throw new UsageError('machine needs what to do, like: pendingyou machine status');
+    if (!MACHINE_SUBS.includes(sub))
+        throw new UsageError(`machine has no “${sub}”. Use ${MACHINE_SUBS.join(', ')}.`);
+    if (extra.length)
+        throw new UsageError(`machine ${sub} takes no “${extra[0]}”.`);
+    const allowed = {
+        status: [],
+        attest: ['client-id', 'cnf', 'name'],
+        rotate: ['yes'],
+    };
+    for (const key of flags.keys())
+        if (key !== 'origin' && !allowed[sub].includes(key))
+            throw new UsageError(`machine ${sub} has no --${key} option.`);
+    if (sub === 'status')
+        return { name: 'machine', origin, sub };
+    if (sub === 'rotate')
+        return { name: 'machine', origin, sub, yes: flags.has('yes') };
+    const clientId = flags.get('client-id');
+    if (typeof clientId !== 'string' || !CLIENT_ID.test(clientId))
+        throw new UsageError('machine attest needs the client the app signs in with, like: --client-id <its client id>');
+    const cnf = flags.get('cnf');
+    if (cnf !== undefined && (typeof cnf !== 'string' || !THUMBPRINT.test(cnf)))
+        throw new UsageError('--cnf is the app’s own key’s RFC 7638 thumbprint: 43 base64url characters.');
+    return {
+        name: 'machine',
+        origin,
+        sub: 'attest',
+        clientId,
+        ...(typeof cnf === 'string' ? { cnf } : {}),
+        ...machine(),
+    };
+}
 export const USAGE = `pendingyou: Pending You for your coding agents (Claude Code, Codex, OpenCode and Pi)
 
   npx -y pendingyou@latest init
@@ -553,6 +597,11 @@ export const USAGE = `pendingyou: Pending You for your coding agents (Claude Cod
   npx pendingyou herdr doctor  Pending You in Herdr: the badges on your agents' panes, the plugin, its
                                toasts and its sidebar row. The plugin runs herdr next, open, setup,
                                view and unconfigure
+  npx pendingyou machine status | attest | rotate
+                               This computer's key, which Pending You knows it by (init makes it; it
+                               never leaves the computer): whether Pending You knows each agent's
+                               connection by it, a proof of it for an app's own sign-in
+                               (--client-id, --cnf), or a new key (--yes: without asking)
 
 Apps (for --app): ${APP_IDS.map((app) => `${app} (${APP_NAMES[app]})`).join(', ')}.
 

package/dist/herdr.js

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto';
 import { isAbsolute, join } from 'node:path';
 import { configDir, readJson, writeWhole } from "./files.js";
 import { cut, redactText } from "./redact.js";
@@ -42,6 +43,19 @@ export function herdrPane(env) {
         return null;
     return { bin, pane };
 }
+export function herdrServer(env, host) {
+    const socket = env.HERDR_SOCKET_PATH ?? '';
+    if (!socket || !isAbsolute(socket) || /[\0\r\n]/.test(socket))
+        return null;
+    return createHash('sha256').update(`${host}${socket}`).digest('hex').slice(0, 16);
+}
+export function herdrTerminal(env, host) {
+    const pane = herdrPane(env);
+    if (!pane)
+        return null;
+    const server = herdrServer(env, host);
+    return { app: 'herdr', paneId: pane.pane, ...(server ? { server } : {}) };
+}
 const settingsPath = (io) => join(configDir(io), 'herdr.json');
 export async function badgesOn(io) {
     const settings = await readJson(settingsPath(io)).catch(() => null);

package/dist/index.js

@@ -1,6 +1,7 @@
 export { getJson, SignInNeeded, Unavailable } from "./api.js";
 export { DEFAULT_ORIGIN, parseArgs } from "./args.js";
 export { readCredential, updateCredential } from "./credentials.js";
+export { attest, ensureMachine, machinePath, proveConnections, readMachine, thumbprintOf, } from "./machine.js";
 export { main } from "./main.js";
 export { CLIENT_NAME, deviceLink, discover, register, revoke, SCOPE, signIn, signInWithDevice, startDevice, waitForDevices, } from "./oauth.js";
 export { qrCode, qrLines } from "./qr.js";

package/dist/init.js

@@ -5,6 +5,7 @@ import { hookCommand } from "./claude.js";
 import { readCredential, saveConnectionClient } from "./credentials.js";
 import { hookLine, originArgs } from "./hooks.js";
 import { installCli, pruneCli, removeCli } from "./install.js";
+import { keyForSignIn, proveConnections } from "./machine.js";
 import { headlessReason, helperCommand, removeHelper, writeHelper } from "./remote.js";
 import { FINISH_SAY } from "./setup.js";
 import { removeShim, shimPath, writeShim } from "./shim.js";
@@ -145,12 +146,16 @@ export async function init(io, options) {
     if (options.login) {
         if (ctx.headless && !options.device)
             io.out(`No browser here (${ctx.headless}), so you approve with a code on your phone.\n`);
+        const key = await keyForSignIn(io);
         signed = await signInApps(io, going.map((each) => ({ app: each.app.id, kind: each.signIn })), {
             origin: options.origin,
             device: options.device,
             browser: options.browser,
             ...(options.machine ? { machine: options.machine } : {}),
+            key,
         });
+        if (key)
+            await proveConnections(io, options.origin, [...signed].flatMap(([app, how]) => (how === 'already' ? [app] : [])), key);
     }
     else
         io.out(going.length === 1

package/dist/machine-command.js

@@ -0,0 +1,101 @@
+import { APP_NAMES } from "./apps/ids.js";
+import { readCredential, signedInSlots } from "./credentials.js";
+import { originArgs } from "./hooks.js";
+import { attest, clockOffset, machinePath, readMachine, rotateMachine } from "./machine.js";
+import { computerName } from "./remote.js";
+import { checkSignIn } from "./signin.js";
+export async function machineStatus(io, origin) {
+    const flag = originArgs(origin);
+    const machine = await readMachine(io);
+    if (!machine) {
+        io.out(`This computer has no key yet. npx -y pendingyou@latest init${flag} makes one, and proves it to Pending You.\n`);
+        return 1;
+    }
+    const lines = [
+        `This computer’s key: ${machinePath(io)} (made ${machine.createdAt.slice(0, 10)})`,
+        `Its fingerprint: ${machine.thumbprint}`,
+    ];
+    let ready = true;
+    const apps = [];
+    for (const slot of await signedInSlots(io))
+        if (slot.origin === origin &&
+            (await readCredential(io, origin, slot.app))?.kind === 'connection')
+            apps.push(slot.app);
+    lines.push(apps.length
+        ? `At ${origin}:`
+        : `No agent here is signed in to ${origin} with a connection of its own, so there’s nothing to prove there.`);
+    for (const app of apps) {
+        const check = await checkSignIn(io, origin, app);
+        const name = APP_NAMES[app];
+        if (check.state !== 'ok') {
+            ready = false;
+            lines.push(check.state === 'unreachable'
+                ? `  ${name}: Pending You couldn’t be reached.`
+                : `  ${name}: not signed in; run npx -y pendingyou@latest init${flag}.`);
+            continue;
+        }
+        const key = check.for?.machineKey;
+        if (key === machine.thumbprint) {
+            lines.push(`  ${name}: known by this key${check.for?.machine ? ` (as ${check.for.machine})` : ''}.`);
+            continue;
+        }
+        ready = false;
+        lines.push(key
+            ? `  ${name}: known by another key, this computer’s before it was replaced. Once that computer is removed from your Pending You account, npx -y pendingyou@latest init${flag} proves this one.`
+            : `  ${name}: not yet. npx -y pendingyou@latest init${flag} proves this key, with nothing to approve.`);
+    }
+    io.out(`${lines.join('\n')}\n`);
+    return ready ? 0 : 1;
+}
+export async function machineAttest(io, command) {
+    const machine = await readMachine(io);
+    if (!machine) {
+        io.err(`pendingyou: This computer has no key yet. Run npx -y pendingyou@latest init${originArgs(command.origin)} first.\n`);
+        return 1;
+    }
+    const name = command.machine ?? (await computerName(io)).name;
+    const offset = await clockOffset(io, command.origin);
+    const attestation = await attest(machine, {
+        aud: `${command.origin}/oauth/device`,
+        client_id: command.clientId,
+        name,
+        ...(command.cnf ? { cnf: { jkt: command.cnf } } : {}),
+    }, io.now() + offset);
+    io.out(`${attestation}\n`);
+    return 0;
+}
+export async function machineRotate(io, command) {
+    const flag = originArgs(command.origin);
+    const had = await readMachine(io).then((machine) => machine !== null, () => true);
+    if (had && !command.yes) {
+        if (!io.interactive) {
+            io.err('pendingyou: This replaces this computer’s key, and Pending You will know it as a new computer. Run it again with --yes to go ahead.\n');
+            return 1;
+        }
+        const answer = await io.ask('Replace this computer’s key? Pending You will know it as a new computer. [y/N] ');
+        if (!/^y(es)?$/i.test(answer.trim())) {
+            io.out('Kept this computer’s key.\n');
+            return 1;
+        }
+    }
+    const { before, machine } = await rotateMachine(io);
+    const lines = [
+        `New key for this computer: ${machinePath(io)}`,
+        `Its fingerprint: ${machine.thumbprint}${before ? ` (it was ${before})` : ''}`,
+        before
+            ? `Pending You knows this computer’s connections by the old key until that computer is removed from your account; then npx -y pendingyou@latest init${flag} proves this one for them.`
+            : `npx -y pendingyou@latest init${flag} proves it to Pending You.`,
+    ];
+    io.out(`${lines.join('\n')}\n`);
+    return 0;
+}
+export function machine(io, command) {
+    switch (command.sub) {
+        case 'status':
+            return machineStatus(io, command.origin);
+        case 'attest':
+            return machineAttest(io, command);
+        case 'rotate':
+            return machineRotate(io, command);
+    }
+}

package/dist/machine.js

@@ -0,0 +1,151 @@
+import { createHash, randomBytes, webcrypto } from 'node:crypto';
+import { chmod, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { sendJson } from "./api.js";
+import { connectionMachine, ignoreFolder, readCredential } from "./credentials.js";
+import { PlainError } from "./errors.js";
+import { configDir, readJson, withLock, writeWhole } from "./files.js";
+import { discover } from "./oauth.js";
+import { machineOf } from "./remote.js";
+export const ATTESTATION_TYPE = 'pendingyou-machine+jwt';
+const ATTESTATION_SECONDS = 300;
+export const MACHINE_PATH = '/mcp/cli/machine';
+export const machinePath = (io) => join(configDir(io), 'machine.json');
+const base64url = (bytes) => Buffer.from(bytes).toString('base64url');
+const isCoordinate = (value) => typeof value === 'string' &&
+    /^[A-Za-z0-9_-]{43}$/.test(value) &&
+    Buffer.from(value, 'base64url').length === 32;
+export function thumbprintOf(jwk) {
+    return createHash('sha256')
+        .update(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y }))
+        .digest('base64url');
+}
+function keyOf(value) {
+    if (typeof value !== 'object' || value === null)
+        return null;
+    const { kty, crv, x, y, d } = value;
+    if (kty !== 'EC' || crv !== 'P-256' || !isCoordinate(x) || !isCoordinate(y) || !isCoordinate(d))
+        return null;
+    return { kty, crv, x, y, d };
+}
+async function loaded(key, createdAt) {
+    const signer = await webcrypto.subtle.importKey('jwk', key, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign']);
+    const jwk = { kty: key.kty, crv: key.crv, x: key.x, y: key.y };
+    return { thumbprint: thumbprintOf(jwk), createdAt, jwk, signer };
+}
+const unreadable = (path) => new PlainError(`This computer’s key (${path}) can’t be read. Run npx pendingyou machine rotate to make a new one.`);
+export async function readMachine(io) {
+    const path = machinePath(io);
+    let file;
+    try {
+        file = await readJson(path);
+    }
+    catch {
+        throw unreadable(path);
+    }
+    if (file === null)
+        return null;
+    const key = file?.version === 1 && typeof file.createdAt === 'string' ? keyOf(file.key) : null;
+    if (!key || typeof file?.createdAt !== 'string')
+        throw unreadable(path);
+    if ((await stat(path)).mode & 0o077)
+        await chmod(path, 0o600);
+    try {
+        return await loaded(key, file.createdAt);
+    }
+    catch {
+        throw unreadable(path);
+    }
+}
+async function writeNew(io) {
+    const pair = await webcrypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, true, [
+        'sign',
+        'verify',
+    ]);
+    const key = keyOf(await webcrypto.subtle.exportKey('jwk', pair.privateKey));
+    if (!key)
+        throw new PlainError('This computer’s key couldn’t be made.');
+    const createdAt = new Date(io.now()).toISOString();
+    const file = {
+        version: 1,
+        createdAt,
+        key: { kty: key.kty, crv: key.crv, x: key.x, y: key.y, d: key.d },
+    };
+    await writeWhole(machinePath(io), `${JSON.stringify(file, null, 2)}\n`, { secret: true });
+    await ignoreFolder(io).catch(() => { });
+    return loaded(key, createdAt);
+}
+export async function ensureMachine(io) {
+    return withLock(machinePath(io), io, async () => {
+        const machine = await readMachine(io);
+        return machine ? { machine, made: false } : { machine: await writeNew(io), made: true };
+    });
+}
+export async function rotateMachine(io) {
+    return withLock(machinePath(io), io, async () => {
+        const before = await readMachine(io).catch(() => null);
+        return { before: before?.thumbprint ?? null, machine: await writeNew(io) };
+    });
+}
+export async function attest(machine, claims, now) {
+    const iat = Math.floor(now / 1000);
+    const header = { typ: ATTESTATION_TYPE, alg: 'ES256', jwk: machine.jwk };
+    const payload = {
+        ...claims,
+        iat,
+        exp: iat + ATTESTATION_SECONDS,
+        jti: randomBytes(16).toString('base64url'),
+    };
+    const signing = `${base64url(JSON.stringify(header))}.${base64url(JSON.stringify(payload))}`;
+    const signature = await webcrypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, machine.signer, Buffer.from(signing));
+    return `${signing}.${base64url(new Uint8Array(signature))}`;
+}
+export async function keyForSignIn(io) {
+    try {
+        const { machine, made } = await ensureMachine(io);
+        if (made)
+            io.out(`Made this computer’s key for Pending You (${machinePath(io)}): it stays on this computer, and Pending You knows the computer by it.\n`);
+        return machine;
+    }
+    catch (error) {
+        io.err(`pendingyou: ${error instanceof PlainError ? error.message : 'This computer’s key couldn’t be made.'} Signing in without it.\n`);
+        return null;
+    }
+}
+export async function clockOffset(io, origin) {
+    return discover(io, origin, 5000).then((metadata) => metadata.clockOffsetMs ?? 0, () => 0);
+}
+export async function proveConnections(io, origin, apps, machine) {
+    const results = new Map();
+    const connected = [];
+    for (const app of apps) {
+        const credential = await readCredential(io, origin, app);
+        if (credential?.kind === 'connection')
+            connected.push({ app, clientId: credential.clientId });
+    }
+    if (connected.length === 0)
+        return results;
+    const offset = await clockOffset(io, origin);
+    for (const { app, clientId } of connected) {
+        try {
+            const attestation = await attest(machine, {
+                aud: `${origin}${MACHINE_PATH}`,
+                client_id: clientId,
+                name: (await connectionMachine(io, origin, app)) ?? machineOf(io.host),
+            }, io.now() + offset);
+            const { status, body } = await sendJson(io, origin, MACHINE_PATH, { attestation }, 15_000, { app });
+            const said = body.connection;
+            results.set(app, status === 200 && (said === 'joined' || said === 'already' || said === 'elsewhere')
+                ? said
+                : status === 404
+                    ? 'absent'
+                    : status >= 400 && status < 500
+                        ? 'refused'
+                        : 'failed');
+        }
+        catch {
+            results.set(app, 'failed');
+        }
+    }
+    return results;
+}

package/dist/main.js

@@ -8,6 +8,7 @@ import { PlainError } from "./errors.js";
 import { herdr } from "./herdr/command.js";
 import { hold } from "./hold.js";
 import { init, status, uninstall } from "./init.js";
+import { machine } from "./machine-command.js";
 import { OAuthError } from "./oauth.js";
 import { isPromptApp, permissionHook, permissionWorker } from "./permission.js";
 import { pickup } from "./pickup.js";
@@ -95,6 +96,8 @@ async function run(io, command, hook = { fallback: '' }) {
             return bridge(io, command);
         case 'herdr':
             return herdr(io, command);
+        case 'machine':
+            return machine(io, command);
     }
 }
 export const HOOK_DEADLINE_MS = 3000;

package/dist/oauth.js

@@ -14,6 +14,7 @@ export class OAuthError extends Error {
         this.code = code;
     }
 }
+export const serverNow = (io, metadata) => io.now() + (metadata.clockOffsetMs ?? 0);
 const base64url = (bytes) => bytes.toString('base64').replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
 export function pkce() {
     const verifier = base64url(randomBytes(32));
@@ -28,7 +29,11 @@ export async function discover(io, origin, timeoutMs = 15_000) {
     });
     if (!response.ok)
         throw new OAuthError('discovery', `Pending You at ${origin} didn’t answer (${response.status}).`);
-    const metadata = (await response.json());
+    const said = Date.parse(response.headers.get('date') ?? '');
+    const metadata = {
+        ...(await response.json()),
+        ...(io.now && Number.isFinite(said) ? { clockOffsetMs: said - io.now() } : {}),
+    };
     const sameOrigin = (url) => {
         try {
             return url !== undefined && new URL(url).origin === origin;
@@ -218,17 +223,23 @@ export async function revoke(io, origin, clientId, refreshToken) {
 export async function startDevice(io, options) {
     const metadata = await discover(io, options.origin);
     const assistant = options.assistant ?? (options.connection ? 'claude-code' : undefined);
-    const begin = (client) => io.fetch(`${options.origin}/oauth/device`, {
-        method: 'POST',
-        headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
-        body: new URLSearchParams({
-            client_id: client,
-            scope: SCOPE,
-            ...(options.machine ? { machine: options.machine } : {}),
-            ...(assistant ? { assistant } : {}),
-        }).toString(),
-        signal: AbortSignal.timeout(15_000),
-    });
+    const begin = async (client) => {
+        const attestation = options.attest
+            ? await options.attest(client, serverNow(io, metadata))
+            : null;
+        return io.fetch(`${options.origin}/oauth/device`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+            body: new URLSearchParams({
+                client_id: client,
+                scope: SCOPE,
+                ...(options.machine ? { machine: options.machine } : {}),
+                ...(assistant ? { assistant } : {}),
+                ...(attestation ? { machine_attestation: attestation } : {}),
+            }).toString(),
+            signal: AbortSignal.timeout(15_000),
+        });
+    };
     let clientId = options.clientId || (await register(io, metadata));
     let started = await begin(clientId);
     if (started.status === 401 && options.clientId) {

package/dist/presence.js

@@ -6,7 +6,7 @@ import { reportThreads, threadNames } from "./apps/codex-wake.js";
 import { DEFAULT_ORIGIN } from "./args.js";
 import { readCredential } from "./credentials.js";
 import { configDir, readJson, withLock, writeWhole } from "./files.js";
-import { herdrTarget, reportCommand } from "./herdr.js";
+import { herdrTarget, herdrTerminal, reportCommand } from "./herdr.js";
 import { endPrompts, sessionName } from "./permission.js";
 export const PRESENCE_PATH = '/mcp/cli/presence';
 export const PRESENCE_EVERY_MS = 5 * 60_000;
@@ -60,13 +60,15 @@ export async function sendPresence(io, origin, presence, timeoutMs = SEND_MS, op
     try {
         if ((await readCredential(io, origin, presence.app))?.kind !== 'connection')
             return 'skipped';
-        const body = {
+        const plain = {
             source: presence.app,
             name: presenceName(presence.name),
             sessionId: presence.session,
             cwd: presence.cwd && presence.cwd.length <= CWD_MAX ? presence.cwd : null,
             state: presence.state,
         };
+        const terminal = herdrTerminal(io.env, io.host);
+        let body = terminal ? { ...plain, terminal } : plain;
         const send = (force) => postJson(io, origin, PRESENCE_PATH, body, timeoutMs, {
             app: presence.app,
             signal: AbortSignal.timeout(timeoutMs + 2000),
@@ -75,6 +77,10 @@ export async function sendPresence(io, origin, presence, timeoutMs = SEND_MS, op
         let answer = await send(false);
         if (answer.status === 401)
             answer = await send(true);
+        if (answer.status === 400 && terminal) {
+            body = plain;
+            answer = await send(false);
+        }
         if (answer.status === 429 && options.patient) {
             await io.sleep(Math.min(answer.retryAfter ?? 60, RETRY_AFTER_MAX_S) * 1000, io.signal);
             answer = await send(false);

package/dist/signin.js

@@ -3,6 +3,7 @@ import { APP_NAMES, DEFAULT_APP, namesOf } from "./apps/ids.js";
 import { connectionClient, connectionMachine, readCredential, saveConnectionClient, signedInSlots, updateCredential, } from "./credentials.js";
 import { PlainError } from "./errors.js";
 import { originArgs } from "./hooks.js";
+import { attest, keyForSignIn } from "./machine.js";
 import { OAuthError, revoke, signIn, startDevice, waitForDevices, } from "./oauth.js";
 import { computerName, headlessReason, machineOf } from "./remote.js";
 import { connectionTitle } from "./setup.js";
@@ -56,12 +57,17 @@ export async function signInApps(io, needs, options) {
         return result;
     }
     const named = await computerName(io, options.machine);
+    const key = options.key === undefined ? await keyForSignIn(io) : options.key;
+    const vouch = key
+        ? (clientId, now) => attest(key, { aud: `${origin}/oauth/device`, client_id: clientId, name: named.name }, now).catch(() => null)
+        : undefined;
     const started = [];
     for (const need of todo) {
         try {
             const flow = await startDevice(io, {
                 origin,
                 machine: named.name,
+                ...(vouch ? { attest: vouch } : {}),
                 ...(need.kind === 'connection'
                     ? { assistant: need.app, clientId: await connectionClient(io, origin, need.app) }
                     : {}),

package/dist/stopcheck.js

@@ -5,17 +5,35 @@ import { APP_NAMES, DEFAULT_APP } from "./apps/ids.js";
 import { asksToTypeHere, cardFits, confirmReason, sessionLink } from "./confirm.js";
 import { readCredential } from "./credentials.js";
 import { isHandedWake } from "./format.js";
-import { isPromptApp, settlePrompts, subagentsRunning } from "./permission.js";
+import { isPermissionCard, isPromptApp, settlePrompts, subagentsRunning } from "./permission.js";
 import { folderForms } from "./pickup.js";
 export const READ_CAP = 4 * 1024 * 1024;
 const CHUNK = 64 * 1024;
 export const STOP_REASON = 'Items for your person are in chat but not in Pending You: post them as cards (ask in both places), or say they don’t need one.';
 export const DELEGATED_REASON = 'Your person handed you that question to answer, not to ask them back: answer_delegated if you know, or hand_back with what you checked, unless you already did. Never post it as a card of your own.';
 const POSTING_TOOL = /^mcp__.+__(post_request|update_request|reply_in_thread|answer_delegated|hand_back)$/;
-const OPEN_TIME_BOX_MS = 1500;
+export const OPEN_TIME_BOX_MS = 1500;
 const OPEN_CARDS = 5;
 const CARD_TEXT = 20_000;
-const SAYS_POSTED = /\b(posted|put|added|raised|filed)\b[^.\n]{0,60}\b(cards?|pending ?you)\b|\bon (a|the|its|their|your|that|this) cards?\b|\b(in|to|through|via|on) pending ?you\b|\bpending ?you cards?\b|\b(i|we|you)(?:(?:'|’)ll| will)\s+(?:\w+\s+)?(post|send|put|add|raise|file|get|see|find)\b[^.\n]{0,40}\bcards?\b/i;
+const SAYS_POSTED = new RegExp([
+    String.raw `\b(posted|put|added|raised|filed)\b[^.\n]{0,60}\b(cards?|pending ?you)\b`,
+    String.raw `\bon (a|the|its|their|your|that|this) cards?\b`,
+    String.raw `\b(in|to|through|via|on) pending ?you\b`,
+    String.raw `\bpending ?you cards?\b`,
+    String.raw `\b(i|we|you)(?:(?:'|’)ll| will)\s+(?:\w+\s+)?(post|send|put|add|raise|file|get|see|find|make|create|open)\b[^.\n]{0,40}\bcards?\b`,
+    String.raw `\balready (?:a |on (?:a )?)?cards?\b`,
+    String.raw `\bcards? (?:is|are|will be) (?:coming|on (?:its|their|the) way)\b(?! (?:together|along))`,
+    String.raw `\bcards? (?:will|to) follow\b`,
+    String.raw `\bthere(?:(?:'|’)ll| will) be (?:a |another |one )?cards?\b`,
+].join('|'), 'i');
+const RECAP = new RegExp([
+    String.raw `\bcards?\b[^.!?\n]{0,40}?\b(?:(?:waiting|pending|open|parked|queued|left)\b[^.!?\n]{0,20}?\b(?:on|for)\s+your?|in\s+your\s+queue)\b`,
+    String.raw `\b(?:waiting|pending|parked)\s+(?:on|for)\s+you\b[^.!?\n]{0,30}?\b(?:as|in)\s+(?:(?:a|two|both|three|its|their|the|separate)\s+)?cards?\b`,
+    String.raw `\((?:(?:both|all|two|three|each)\s+)?(?:(?:are|is|on|as)\s+)?(?:a\s+|(?:its|their)\s+own\s+)?cards?(?:\s+(?:already|too))?\)`,
+].join('|'), 'i');
+const CARDS_HEADING = /\b(?:your|open|pending|waiting)\s+(?:(?:open|pending|waiting)\s+)?cards\b/i;
+const SENTENCE_END = /(?<=[.!?])\s+/;
+const OTHER_CARDS = /\b(?:credit|debit|payment|gift|sim|sd|business|graphics|video|sound|network|memory|smart)\s+cards?\b|\bcards?\s+(?:numbers?|readers?|details|holders?)\b/gi;
 const STEPS_FOR_THEM = /\b(you(?:'|’)ll need to|you will need to|you(?:'|’)ll have to|you will have to|your (?:next )?steps?\b|can you|could you|would you mind|please (?:run|confirm|approve|check|add|set|sign|create|open|paste|reply|send|choose|pick|decide|let me know)|in your terminal|only you can|(?<!\b(?:no|nothing|none|not)\b[^.,;:!?\n]{0,40})waiting (?:on|for) you|(?<!\bif (?:it|he|she|they|that|this|anything|something|someone|anyone|one) )needs? you to|over to you|parked for you|when you(?:'|’)re ready|up to you|your call\b|is yours\b|say the word|let me know (?:which|whether)|tell me (?:which|whether)|needs? your (?:ok|okay|approval|decision|sign-?off|go-ahead))/i;
 const SAYS_NO_CARD = /\bno (?:new |more |further )?cards? (?:is |are )?(?:needed|necessary|required)\b|\b(?:doesn(?:'|’)t|don(?:'|’)t|does not|do not|won(?:'|’)t|will not) need (?:a |any )?(?:new )?cards?\b|\bnothing (?:here |else |more |now )?(?:needs|requires) your (?:attention|input|action|answer)\b|\b(?:nothing|no cards?)\b[^.,;:!?\n]{0,40}\b(?:waiting|pending) (?:on|for) you\b/i;
 const FOR_THEM_HEADING = /\b(your part|your steps?|your to-?dos?|your turn|your call|for you|waiting on you|left for you|parked for you|needs you|over to you|what you need to do|you(?:'|’)ll need)\b/i;
@@ -47,8 +65,7 @@ function headingOf(line) {
         return null;
     return /^\s*#/.test(line) || bare.endsWith(':') || /^\s*\*\*.+\*\*\s*$/.test(line) ? bare : null;
 }
-export function itemsForPerson(text) {
-    const plain = plainText(text);
+function itemsIn(plain) {
     const lines = plain.split('\n');
     for (let index = 0; index < lines.length; index++) {
         const heading = headingOf(lines[index]);
@@ -65,8 +82,50 @@ export function itemsForPerson(text) {
             return 'question';
     return null;
 }
+export function itemsForPerson(text) {
+    return itemsIn(plainText(text));
+}
+function listEnd(lines, index) {
+    let end = index;
+    for (let next = index + 1; next < lines.length; next++) {
+        const line = lines[next];
+        if (!line.trim()) {
+            if (end === index && next - index >= 3)
+                return index;
+        }
+        else if (LIST_ITEM.test(line) || (end > index && /^\s/.test(line)))
+            end = next;
+        else
+            break;
+    }
+    return end;
+}
+function withoutRecaps(plain) {
+    const lines = plain.split('\n');
+    const kept = [];
+    for (let index = 0; index < lines.length; index++) {
+        const line = lines[index];
+        const heading = headingOf(line);
+        if (heading && (RECAP.test(heading) || CARDS_HEADING.test(heading))) {
+            const end = listEnd(lines, index);
+            if (end > index) {
+                index = end;
+                continue;
+            }
+        }
+        kept.push(line
+            .split(SENTENCE_END)
+            .filter((sentence) => !RECAP.test(sentence))
+            .join(' '));
+    }
+    return kept.join('\n');
+}
+export function itemsOutsideRecaps(text) {
+    return itemsIn(withoutRecaps(plainText(text)));
+}
 export const saysPosted = (text) => SAYS_POSTED.test(plainText(text));
 export const saysNoCard = (text) => SAYS_NO_CARD.test(plainText(text));
+export const mentionsCards = (text) => /\bcards?\b/i.test(plainText(text).replace(OTHER_CARDS, ''));
 function wordsIn(value, max = CARD_TEXT) {
     const found = [];
     let left = max;
@@ -306,18 +365,23 @@ export async function stopcheck(io, options) {
                 return 0;
             return asksToTypeHere(text) || itemsForPerson(text) ? block(DELEGATED_REASON) : 0;
         }
+        const cwd = typeof input.cwd === 'string' && input.cwd ? input.cwd : io.cwd;
         const ask = asksToTypeHere(text);
         if (ask) {
             if (saysNoCard(text) || turn.cards.some((card) => cardFits(card, ask.words, 'posted')))
                 return 0;
-            const cwd = typeof input.cwd === 'string' && input.cwd ? input.cwd : io.cwd;
             const open = await openTitles(io, options.origin, cwd, app);
             if (open ? open.some((title) => cardFits(title, ask.words, 'open')) : saysPosted(text))
                 return 0;
             return block(confirmReason(ask.words, sessionLink(io.env), APP_NAMES[app]));
         }
-        if (turn.posted || saysPosted(text) || saysNoCard(text) || !itemsForPerson(text))
+        if (turn.posted || saysPosted(text) || saysNoCard(text) || !itemsOutsideRecaps(text))
             return 0;
+        if (mentionsCards(text)) {
+            const open = await openTitles(io, options.origin, cwd, app);
+            if (open === null || open.some((title) => !isPermissionCard(title)))
+                return 0;
+        }
         return block(STOP_REASON);
     }
     catch {

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = '0.17.0';
+export const VERSION = '0.19.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pendingyou",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "description": "Pending You for your coding agents: one command sets up Claude Code, Codex, OpenCode and Pi to ask you through Pending You and hear your answers, even while they sit idle.",
   "license": "Apache-2.0",
   "homepage": "https://www.pendingyou.com",