pendingyou 0.20.1 → 0.22.0

package/CHANGELOG.md

@@ -1,5 +1,49 @@
 # Changelog
 
+## 0.22.0 (2026-10-06)
+
+- Trusting Codex's hooks is one command now. When `init` or `status` finds Pending You's hooks in Codex but not trusted
+  yet, it prints the command that opens a Codex here (`codex` on PATH, else the Codex command line the ChatGPT app
+  brings, by its full path, quoted) and says to type `/hooks` there, look over Pending You's hooks and trust them. At a
+  terminal it then waits, looking again every 3 seconds for up to 10 minutes, and says "Ready: Codex hears answers
+  right away" once they're trusted (Ctrl-C stops the wait; `npx pendingyou status` checks later). Run by an agent, it
+  prints the same steps without waiting. It never trusts them for you.
+- The instructions no longer send you to a Hooks page in the Codex app's Settings, which people couldn't find, nor to
+  other ways of trusting the hooks that haven't been seen working: init's last lines and `status` lead with `/hooks`.
+- Looking for the Codex inside the ChatGPT or Codex app, the command line tries the `CodexCLI.app` it carries first,
+  then its `bin` folder.
+
+## 0.21.0 (2026-10-06)
+
+- Answer from Herdr. The Pending You plugin for Herdr (0.2) can now answer your cards from its popup, once you sign
+  Herdr in. The command line itself still never answers anything: the plugin's popup does, with Herdr's own sign-in
+  and its own key, only when you press a key in it, and never a high-stakes card.
+- `pendingyou app login herdr` (also the plugin's setup) signs Herdr in to Pending You with a code, as `login --device`
+  does: your phone or browser shows one card naming Herdr and this computer, with a tick for all your cards (off: it
+  sees this computer's agents' cards only). This computer's key (0.18.0) vouches for the sign-in, naming Herdr and the
+  new sign-in's own key, so run `npx -y pendingyou@latest init` here first. The sign-in and its private key are kept
+  in `~/.config/pendingyou/apps/herdr.json` (readable only by you), which none of the agents' hooks, helpers or
+  `hold` read; its tokens are useless without that key (DPoP). Signing in again on the same computer replaces it.
+  `pendingyou app status` says what each app signed in here may do and until when (and warns in its last 3 days);
+  `pendingyou app logout herdr` ends it at Pending You and removes it. Another registered app signs in with
+  `--client-id` (and `--scope`).
+- The popup (`prefix+y`), signed in: your cards from Pending You, the chosen one open with what it asks, how many wait
+  elsewhere, and a key per decision: 1–9 for a choice (and Enter to send several), y or n to approve or decline, Enter
+  to write an answer, y or n for a step done or not, Tab between a grouped card's questions. r writes to the agent, l
+  puts the card in Later, d hands it to another of your agents, u undoes for 5 seconds, t goes to the agent's pane
+  (from its badges, or its session running in this Herdr), o opens the card in Pending You (high-stakes cards are
+  answered there), a opens all your cards. It follows Pending You's change feed while it's open. Not signed in, it's
+  the read-only list it was, with a line saying how to sign in. `herdr open --demo` shows made-up cards, for
+  screenshots.
+- Your phone stays quiet while you're active in Herdr (moving between panes, tabs and workspaces, or pressing keys in
+  the popup), for the cards Herdr can show, as it does while Pending You is open on your desk. The plugin's watcher
+  also says in a toast when Herdr's sign-in has ended, and in its last 3 days that it's about to.
+- The plugin's `unconfigure` signs Herdr out too. `doctor` says whether it's signed in.
+- The plugin 0.2 runs the command line `init` put here only once that one can answer (`pendingyou app` exists);
+  until then it runs 0.21.0 through npx. Run `npx pendingyou@latest init` once to switch.
+- Answering works once Pending You turns on its person API for its own apps; until then sign-in says Pending You
+  doesn't let Herdr sign in yet.
+
 ## 0.20.1 (2026-10-06)
 
 - An older answer is no longer hidden behind newer ones. The session-start and next-message hooks asked for a folder's

package/README.md

@@ -41,8 +41,8 @@ Finish setting up Pending You: it’s connected here already.
 ```
 
 The first session finishes setting up on its own: it checks in with Pending You, reports what's set up and sends you a
-test card. Claude Code 2.1.287 or later starts that turn by itself; otherwise (and in Codex, after you trust its hooks:
-“Trust all and continue” in Codex CLI, Review hooks › Allow all in the Codex app) the session start adds one line with
+test card. Claude Code 2.1.287 or later starts that turn by itself; otherwise (and in Codex, after you trust its hooks in
+`/hooks`) the session start adds one line with
 the three calls that are left, and you say the sentence.
 `npx pendingyou status` says what's set up for each agent, what's missing with the command that fixes it, and how setup
 stands. `npx pendingyou uninstall` removes exactly what `init` added.
@@ -99,9 +99,11 @@ default_tools_approval_mode = "approve"
 and hooks in `~/.codex/hooks.json`: a session start, each message, Pending You's card tools (so the Stop check knows a
 turn posted, and so the thread is woken), and the Stop check; and (0.15.0) Codex's permission prompt and every tool
 call that ran (a card when Codex waits for your OK, [below](#when-claude-code-waits-for-your-ok)) and the session's end
-([below](#which-sessions-are-open)). **Codex runs a hook only once you trust it**: in Codex CLI, start `codex` and
-choose “Trust all and continue” (or trust them in `/hooks`); in the Codex app, click Review hooks › Allow all (or
-Settings › Hooks › Trust all). `status` says which are trusted. Upgrading from 0.14.0 adds three hooks, which Codex
+([below](#which-sessions-are-open)). **Codex runs a hook only once you trust it**, in Codex's `/hooks`. When `init` or
+`status` finds Pending You's hooks not trusted yet, it prints the one command that opens a Codex here (`codex`, or
+the one the ChatGPT app brings, by its full path) and says to type `/hooks` there and trust them; at a terminal it
+then waits (every 3 seconds, for up to 10 minutes; Ctrl-C stops it) until Codex trusts them, and says whether Codex is
+ready. It never trusts them for you. `status` says which are trusted. Upgrading from 0.14.0 adds three hooks, which Codex
 skips until you trust them once; `init` says so, and the ones you trusted stay trusted. A `pendingyou` server or
 hooks Codex's `/import` copied from Claude Code (without its sign-in) are replaced.
 
@@ -316,8 +318,30 @@ them after 15 minutes unless told again.
 The Pending You plugin for Herdr puts them to use: the card on each waiting agent's row in the sidebar, a toast when a
 pane gains one, a key to the next pane waiting on you, a popup that lists them (Enter opens the card in Pending You), and
 an Agents view with them first. Its commands are this command line's: `npx pendingyou herdr doctor` says what's set
-up. Its `unconfigure` takes the badges off every pane and stops writing them on this computer; its setup turns them on
-again.
+up. Its `unconfigure` takes the badges off every pane and stops writing them on this computer (and signs Herdr out);
+its setup turns them on again.
+
+### Answering from Herdr (0.21.0)
+
+Sign Herdr in, from the plugin's setup or here:
+
+```sh
+npx pendingyou app login herdr
+```
+
+Your phone or browser shows one card naming Herdr and this computer: press and hold Allow. Herdr then sees the cards
+of this computer's agents (tick "all" on that card for every card of yours), and its popup (`prefix+y`) answers them
+with a key: 1–9 for a choice (Enter sends several), y or n to approve or decline, Enter to write an answer, y or n for
+a step done or not, Tab between a grouped card's questions; r writes to the agent, l puts it in Later, d hands it to
+another of your agents, u undoes for 5 seconds, t goes to the agent's pane, o opens the card in Pending You. A
+high-stakes card (it spends money, can't be undone or goes public) is never answered from Herdr: o opens it where you
+hold to approve. Pending You says on the card and to the agent "Answered in Herdr on build-01". While you're active in
+Herdr (moving between panes, tabs and workspaces, or pressing keys in the popup) your phone stays quiet for those cards,
+as it does while Pending You is open on your desk.
+
+`npx pendingyou app status` says what each app signed in here may do and until when (a sign-in lasts 30 days; it warns
+in the last 3), and `npx pendingyou app logout herdr` ends Herdr's sign-in. Settings › Apps and devices in Pending You
+lists it too, with Remove. It needs `init` to have run here first: this computer's key vouches for the sign-in.
 
 ## How Claude Code hears your answer
 
@@ -472,6 +496,7 @@ its environment. A failing command is tried twice more, then skipped. `--once` s
 | `mcp --app <app>` | The stdio bridge: a local MCP server for an agent that can't run a headers helper (OpenCode, Pi), which passes each message on to Pending You with that agent's own sign-in here (`--check`) |
 | `herdr doctor` | Pending You in Herdr: the badges, the plugin, its toasts and its sidebar row. The plugin runs `herdr next`, `open`, `setup`, `view` and `unconfigure`; the agents' writers `herdr report` |
 | `machine status` / `attest` / `rotate` | This computer's key: whether Pending You knows each agent's connection by it (exits 0 when it does), a proof of it for an app's own sign-in (`--client-id`, `--cnf`, `--name`), or a new key (`--yes`) |
+| `app login` / `logout` / `status` | An app that answers your cards when you press a key in it, signed in on this computer (`herdr`, or another app with `--client-id` and `--scope`; `--device`, `--browser`, `--name`), out again, or what each may do and until when |
 
 Every command takes `--origin` (default `https://www.pendingyou.com`, or `$PENDINGYOU_ORIGIN`). `--app` takes
 `claude-code`, `codex`, `opencode` or `pi` (several with commas where a command sets up or reports several); with none,
@@ -479,6 +504,12 @@ a command that acts for one agent acts for Claude Code. Options can come before
 
 ## What it can see, and where it keeps things
 
+**The command line never answers for you.** None of its commands, hooks or helpers answers, replies to, snoozes or
+hands over a card, and no agent's sign-in can. An app you sign in with `pendingyou app login` (the Pending You plugin
+for Herdr) answers only from its own sign-in and its own key, kept apart in `apps/<app>.json`, which nothing an agent
+runs here reads, and only when you press a key in it; never a high-stakes card, and Pending You labels every answer
+with the app and the computer.
+
 Each agent's sign-in is that agent's own connection on Pending You, signed in from this computer: it can post cards,
 change or cancel its own, read the answers to them and reply in their threads, and it can't answer anything for you.
 The hooks use the same sign-in, and hand a session only the cards its own app posted from its folder. An agent that
@@ -488,7 +519,10 @@ answer or change anything, and doesn't show up as an assistant. They're stored i
 themselves, and end after 30 days or on `logout`. The headers helper hands an agent's token only to that agent's
 Pending You (Claude Code says which server it's for; Codex's is the one `init` wrote). `clients.json` remembers which
 sign-in each agent's connection used, so signing in again keeps it. `machine.json` (0.18.0) holds this computer's key
-pair, private like the rest; only its proofs leave the computer, each for one sign-in, once.
+pair, private like the rest; only its proofs leave the computer, each for one sign-in, once. `apps/<app>.json` (0.21.0)
+holds an app's own sign-in and the private key its tokens are bound to (DPoP), private like the rest; the Pending You
+plugin for Herdr also keeps, in Herdr's state folder for it, when you last pressed a key in its popup (a time, nothing
+else).
 
 `state.json` beside them remembers which answers were already handed over (ids only) and how many session starts
 reminded an unfinished setup, and when; `permission-cards/` each Claude Code session's (and Codex thread's) prompts

package/dist/app-login.js

@@ -0,0 +1,304 @@
+import { readdir, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { ignoreFolder } from "./credentials.js";
+import { PlainError } from "./errors.js";
+import { configDir } from "./files.js";
+import { originArgs } from "./hooks.js";
+import { attest, clockOffset, readMachine } from "./machine.js";
+import { showDevices } from "./oauth.js";
+import { computerName, headlessReason } from "./remote.js";
+import { ApiError, createClient, deviceSignIn, SignedOutError, SignInError, signOut, } from "./sdk/index.js";
+import { fileStore } from "./sdk/node.js";
+import { memoryStore } from "./sdk/store.js";
+export const APP_SCOPES = [
+    'cards:read',
+    'cards:read:all',
+    'cards:answer',
+    'cards:reply',
+    'cards:later',
+    'cards:delegate',
+    'assistants:read',
+    'presence:desk',
+];
+export const FIRST_PARTY_APPS = {
+    herdr: { name: 'Herdr', scopes: APP_SCOPES },
+};
+export const DEFAULT_SCOPES = ['cards:read'];
+export const APP_NAME = /^[a-z0-9][a-z0-9-]{0,39}$/;
+export const RENEW_WITHIN_MS = 3 * 24 * 60 * 60 * 1000;
+export const appsDir = (io) => join(configDir(io), 'apps');
+export const appPath = (io, app) => join(appsDir(io), `${app}.json`);
+export const appStore = (io, app) => fileStore(appPath(io, app));
+export const appLabel = (app) => FIRST_PARTY_APPS[app]?.name ?? app;
+export async function readAppSignIn(io, app) {
+    try {
+        return await appStore(io, app).load();
+    }
+    catch {
+        throw new PlainError(`${appLabel(app)}’s sign-in (${appPath(io, app)}) can’t be read. Sign in again to replace it: npx pendingyou app login ${app}`);
+    }
+}
+export function appClient(io, app) {
+    return createClient({
+        store: appStore(io, app),
+        fetch: io.fetch,
+        now: () => io.now(),
+        sleep: (ms, signal) => io.sleep(ms, signal),
+    });
+}
+const MAY = {
+    'cards:read': 'see your cards',
+    'cards:read:all': 'see all your cards',
+    'cards:answer': 'answer them',
+    'cards:reply': 'write to the assistant that asked',
+    'cards:later': 'put them in Later',
+    'cards:delegate': 'hand them to another assistant',
+    'assistants:read': 'see your assistants',
+    'presence:desk': 'keep your phone quiet while you use it',
+};
+const listed = (items) => items.length <= 1 ? (items[0] ?? '') : `${items.slice(0, -1).join(', ')} and ${items.at(-1)}`;
+export function reachWords(me) {
+    return me.grant.reach === 'all' || !me.grant.machine
+        ? 'all your cards'
+        : `cards from ${me.grant.machine.name}’s agents`;
+}
+export function signedInAs(app, me) {
+    const name = FIRST_PARTY_APPS[app] ? appLabel(app) : (me?.app.name ?? app);
+    return me?.grant.machine ? `${name} on ${me.grant.machine.name}` : name;
+}
+function signInWords(error, app) {
+    const name = appLabel(app);
+    switch (error.code) {
+        case 'access_denied':
+            return `You pressed Cancel, so ${name} isn’t signed in.`;
+        case 'expired_token':
+            return 'The code ran out. Run the command again for a new one.';
+        case 'invalid_client':
+            return FIRST_PARTY_APPS[app]
+                ? `Pending You doesn’t let ${name} sign in yet.`
+                : 'Pending You doesn’t know that app, or it doesn’t sign in with a code.';
+        case 'invalid_request':
+            return `Pending You didn’t take this computer’s key. Run npx -y pendingyou@latest init, then try again.`;
+        case 'invalid_scope':
+            return `Pending You doesn’t let ${name} ask for that.`;
+        case 'slow_down':
+            return 'Too many sign-ins from here. Wait 10 minutes, then try again.';
+        case 'aborted':
+            return 'Signing in was stopped.';
+        default:
+            return error.message;
+    }
+}
+export async function signInApp(io, options) {
+    const { app, origin } = options;
+    const name = appLabel(app);
+    const firstParty = FIRST_PARTY_APPS[app];
+    if (!firstParty && !options.clientId)
+        return {
+            ok: false,
+            said: `Name ${app}’s client with --client-id, or sign in Pending You’s own: ${Object.keys(FIRST_PARTY_APPS).join(', ')}.`,
+        };
+    const machine = await readMachine(io);
+    if (!machine)
+        return {
+            ok: false,
+            said: `This computer isn’t set up with Pending You yet: run npx -y pendingyou@latest init${originArgs(origin)} first, then sign ${name} in.`,
+        };
+    const computer = (await computerName(io, options.machine)).name;
+    const offset = await clockOffset(io, origin);
+    const before = await readAppSignIn(io, app).catch(() => null);
+    await ignoreFolder(io).catch(() => { });
+    let started;
+    try {
+        started = await deviceSignIn({
+            origin,
+            ...(options.clientId ? { clientId: options.clientId } : { app }),
+            scopes: options.scopes ?? firstParty?.scopes ?? DEFAULT_SCOPES,
+            machine: computer,
+            attest: (request) => attest(machine, {
+                aud: request.audience,
+                ...(request.clientId ? { client_id: request.clientId } : { app }),
+                name: computer,
+                cnf: { jkt: request.jkt },
+            }, io.now() + offset),
+            store: appStore(io, app),
+            fetch: io.fetch,
+            now: () => io.now(),
+            sleep: (ms, signal) => io.sleep(ms, signal),
+            signal: io.signal,
+        });
+    }
+    catch (error) {
+        if (error instanceof SignInError)
+            return { ok: false, said: signInWords(error, app) };
+        return { ok: false, said: `Pending You at ${origin} couldn’t be reached. Try again.` };
+    }
+    io.err(`Signing ${name} in on ${computer}. Once you allow it, ${name} can answer your cards when you press a key in it; high-stakes cards still open in Pending You.\n`);
+    await showDevices(io, [
+        {
+            flow: {
+                page: started.verificationUri,
+                direct: started.verificationUriComplete,
+                userCode: started.userCode,
+            },
+        },
+    ], options.open);
+    try {
+        await started.signedIn;
+    }
+    catch (error) {
+        if (error instanceof SignInError)
+            return { ok: false, said: signInWords(error, app) };
+        return { ok: false, said: `Pending You at ${origin} couldn’t be reached. Try again.` };
+    }
+    if (before && before.origin !== origin)
+        await signOut({ store: memoryStore(before), fetch: io.fetch }).catch(() => 'unreachable');
+    const me = await appClient(io, app)
+        .me()
+        .catch(() => null);
+    return { ok: true, me };
+}
+async function login(io, command) {
+    const headless = headlessReason(io);
+    const open = command.browser && (command.device === false || (command.device === null && !headless));
+    const result = await signInApp(io, {
+        app: command.app,
+        origin: command.origin,
+        ...(command.clientId ? { clientId: command.clientId } : {}),
+        ...(command.machine ? { machine: command.machine } : {}),
+        ...(command.scopes ? { scopes: command.scopes } : {}),
+        open,
+    });
+    if (!result.ok) {
+        io.err(`pendingyou: ${result.said}\n`);
+        return 1;
+    }
+    io.out(`${signedInWords(io, command.app, result.me)}\n`);
+    return 0;
+}
+export function signedInWords(io, app, me) {
+    const name = appLabel(app);
+    const answers = me ? me.grant.scopes.includes('cards:answer') : true;
+    return [
+        me
+            ? `${signedInAs(app, me)} is signed in: it ${answers ? 'answers' : 'sees'} ${reachWords(me)}${answers ? ', only when you press a key in it' : ''}.`
+            : `${name} is signed in.`,
+        `Its sign-in is in ${appPath(io, app)}, with a key that never leaves this computer.`,
+        `To remove it: npx pendingyou app logout ${app}, or Settings › Apps and devices in Pending You.`,
+    ].join('\n');
+}
+export async function signOutApp(io, app) {
+    const stored = await readAppSignIn(io, app).catch(() => undefined);
+    const path = appPath(io, app);
+    if (!stored) {
+        const there = await rm(path).then(() => true, () => false);
+        return { said: there ? 'unreadable' : 'none', origin: null };
+    }
+    const said = await signOut({ store: memoryStore(stored), fetch: io.fetch });
+    await rm(path, { force: true });
+    return { said, origin: stored.origin };
+}
+async function logout(io, app) {
+    const { said, origin } = await signOutApp(io, app);
+    const name = appLabel(app);
+    io.out(said === 'none'
+        ? `${name} wasn’t signed in here.\n`
+        : said === 'signed-out'
+            ? `Signed ${name} out of Pending You${origin ? ` at ${origin}` : ''}.\n`
+            : said === 'unreadable'
+                ? `Removed ${name}’s sign-in here, which couldn’t be read: remove it in Settings › Apps and devices too, or it ends by itself within 30 days.\n`
+                : `Signed ${name} out on this computer. Pending You couldn’t be reached to end the sign-in there: remove it in Settings › Apps and devices, or it ends by itself within 30 days.\n`);
+    return 0;
+}
+export async function signedInApps(io) {
+    const names = await readdir(appsDir(io)).catch(() => []);
+    return names
+        .filter((name) => name.endsWith('.json'))
+        .map((name) => name.slice(0, -'.json'.length))
+        .filter((name) => APP_NAME.test(name))
+        .sort();
+}
+export async function appStatusLines(io, app) {
+    const name = appLabel(app);
+    let stored;
+    try {
+        stored = await readAppSignIn(io, app);
+    }
+    catch (error) {
+        return { ok: false, lines: [`${name}: ${error.message}`] };
+    }
+    if (!stored)
+        return {
+            ok: false,
+            lines: [`${name}: not signed in here. To sign it in: npx pendingyou app login ${app}`],
+        };
+    const again = `npx pendingyou app login ${app}${originArgs(stored.origin)}`;
+    let me;
+    try {
+        me = await appClient(io, app).me();
+    }
+    catch (error) {
+        if (error instanceof SignedOutError)
+            return {
+                ok: false,
+                lines: [
+                    `${name}: signed out at ${stored.origin} (removed in Settings, replaced by another sign-in, or ended). To sign in again: ${again}`,
+                ],
+            };
+        if (error instanceof ApiError && error.code === 'app_not_available')
+            return {
+                ok: false,
+                lines: [`${name}: signed in at ${stored.origin}, but Pending You doesn’t let it in now.`],
+            };
+        return {
+            ok: false,
+            lines: [
+                `${name}: signed in at ${stored.origin}; Pending You couldn’t be reached to say more.`,
+            ],
+        };
+    }
+    const scopes = me.grant.scopes;
+    const may = scopes
+        .filter((scope) => scope !== 'cards:read' || !scopes.includes('cards:read:all'))
+        .map((scope) => MAY[scope] ?? scope);
+    const ends = Date.parse(me.grant.expiresAt);
+    const left = ends - io.now();
+    const days = Math.max(0, Math.ceil(left / 86_400_000));
+    return {
+        ok: true,
+        lines: [
+            `${name}: signed in at ${stored.origin} as ${signedInAs(app, me)}`,
+            `  It reaches ${reachWords(me)}. It may ${listed(may)}; never a high-stakes card.`,
+            left <= RENEW_WITHIN_MS
+                ? `  ! It ends in ${days} day${days === 1 ? '' : 's'} (${me.grant.expiresAt.slice(0, 10)}): sign in again before then: ${again}`
+                : `  It ends on ${me.grant.expiresAt.slice(0, 10)}; sign in again then.`,
+            `  Kept in ${appPath(io, app)}`,
+        ],
+    };
+}
+async function status(io, app) {
+    const apps = app ? [app] : await signedInApps(io);
+    if (apps.length === 0) {
+        io.out('No app is signed in on this computer. The Pending You plugin for Herdr signs in from its setup, or: npx pendingyou app login herdr\n');
+        return 1;
+    }
+    let ok = true;
+    const sections = [];
+    for (const each of apps) {
+        const said = await appStatusLines(io, each);
+        ok &&= said.ok;
+        sections.push(said.lines.join('\n'));
+    }
+    io.out(`${sections.join('\n\n')}\n`);
+    return ok ? 0 : 1;
+}
+export async function appCommand(io, command) {
+    switch (command.sub) {
+        case 'login':
+            return login(io, { ...command, app: command.app });
+        case 'logout':
+            return logout(io, command.app);
+        case 'status':
+            return status(io, command.app);
+    }
+}

package/dist/apps/codex-app.js

@@ -4,7 +4,7 @@ const APP_NAMES = ['ChatGPT.app', 'Codex.app'];
 export function appCodexPaths(home, system = '/Applications') {
     return [system, join(home, 'Applications')].flatMap((root) => APP_NAMES.flatMap((name) => {
         const cli = join(root, name, 'Contents', 'Resources', 'codex-cli');
-        return [join(cli, 'bin', 'codex'), join(cli, 'CodexCLI.app', 'Contents', 'MacOS', 'codex')];
+        return [join(cli, 'CodexCLI.app', 'Contents', 'MacOS', 'codex'), join(cli, 'bin', 'codex')];
     }));
 }
 const versionOf = (stdout) => /(\d+\.\d+\.\d+)/.exec(stdout)?.[1] ?? 'installed';

package/dist/apps/codex.js

@@ -19,8 +19,22 @@ export const CODEX_MIN = '0.152.0';
 export const CODEX_WAKE = '0.157.0';
 export const CODEX_APP_WAKE = '0.149.0';
 const FROM_APP = 'the Codex app’s';
-const TRUST_CLI = 'in Codex CLI choose “Trust all and continue” (or trust them in /hooks)';
-const TRUST_APP = 'in the Codex app click Review hooks › Allow all (or Settings › Hooks › Trust all)';
+const TRUST = 'type /hooks in Codex and trust';
+export function trustSteps(found) {
+    const why = 'Codex runs Pending You’s hooks only once you trust them.';
+    if (!found)
+        return [
+            `${why} Open Codex in a terminal (codex, or the one that comes inside the ChatGPT app), type /hooks, look over Pending You’s hooks, and trust them.`,
+        ];
+    const command = found.app ? `'${found.command.replaceAll("'", `'\\''`)}'` : found.command;
+    return [
+        `${why} Open Codex in a terminal:`,
+        '',
+        `  ${command}`,
+        '',
+        'Type /hooks, look over Pending You’s hooks, and trust them.',
+    ];
+}
 const DONT_SAVE = 'In the Codex app, don’t press Save on pendingyou in Settings › MCP: that writes it again without this computer’s sign-in (if you did, run init again to put it back).';
 const CARD_TOOLS = '^mcp__pendingyou__(post_request|update_request|reply_in_thread|cancel_request)$';
 export const CODEX_HOOKS = [
@@ -161,7 +175,7 @@ async function readHooksFile(io) {
         };
     return { path, json: parsed };
 }
-async function hookTrust(io) {
+async function readHookTrust(io) {
     const file = await readHooksFile(io);
     const config = (await readText(await configPath(io)).catch(() => null)) ?? '';
     const hooks = 'json' in file && file.json.hooks && typeof file.json.hooks === 'object'
@@ -193,6 +207,7 @@ async function hookTrust(io) {
         return { event: spec.event, sub: spec.sub, trust: 'missing' };
     });
 }
+const untrusted = async (io) => (await readHookTrust(io)).filter((hook) => hook.trust === 'untrusted' || hook.trust === 'changed');
 async function signedInByItself(io, program) {
     const result = await io.run(program, ['mcp', 'list', '--json'], 30_000);
     if (result.code !== 0)
@@ -433,7 +448,7 @@ export const codex = {
                         report({
                             ok: true,
                             text: merged.changed
-                                ? `Installed or updated Codex’s session-start pickup, next-message hand-off, card and Stop check hooks${extra ? `, ${cards ? 'its permission-prompt hooks (a card when Codex waits for your OK; --no-permission-cards leaves them out) ' : ''}and its session-end hook (Pending You hears when a thread is open)` : ''} in ${file.path}. Codex asks you to trust them once.`
+                                ? `Installed or updated Codex’s session-start pickup, next-message hand-off, card and Stop check hooks${extra ? `, ${cards ? 'its permission-prompt hooks (a card when Codex waits for your OK; --no-permission-cards leaves them out) ' : ''}and its session-end hook (Pending You hears when a thread is open)` : ''} in ${file.path}. Codex runs them once you trust them (how: below).`
                                 : removed.changed
                                     ? `Took out Codex’s permission-prompt hooks, as you asked: no card when Codex waits for your OK. To turn them on: npx pendingyou init --app codex --permission-cards${originArgs(ictx.origin)}`
                                     : 'Codex’s hooks were already installed.',
@@ -469,14 +484,17 @@ export const codex = {
                 });
                 return steps;
             },
-            next: () => {
+            next: async () => {
                 const login = mode === 'oauth' && action !== 'keep';
                 const first = login ? `run ${shWord(program)} mcp login pendingyou, then ` : '';
-                const start = detected.command
-                    ? `open the Codex app, start a chat in the folder you work in, and trust Pending You’s hooks: click Review hooks › Allow all (or Settings › Hooks › Trust all)`
-                    : `start codex here, or in the folder you work in, and trust Pending You’s hooks: ${TRUST_CLI}; ${TRUST_APP}`;
-                const again = newHooks
-                    ? `Codex has new Pending You hooks (${newHooks}), which it skips until you trust them once: ${detected.command ? TRUST_APP : `${TRUST_CLI}; ${TRUST_APP}`}.`
+                const waiting = (await untrusted(io)).length > 0;
+                const start = waiting
+                    ? 'open Codex as above, type /hooks and trust Pending You’s hooks'
+                    : detected.command
+                        ? 'open the Codex app and start a chat in the folder you work in'
+                        : 'start codex here, or in the folder you work in';
+                const again = newHooks && waiting
+                    ? `Codex has new Pending You hooks (${newHooks}), which it skips until you trust them once.`
                     : null;
                 return {
                     lines: [
@@ -542,7 +560,7 @@ export const codex = {
             codex.detect(io),
             codexServer(io),
             readCodexManifest(io),
-            hookTrust(io),
+            readHookTrust(io),
             readText(codexSkillPath(io)).catch(() => null),
         ]);
         const credential = await readCredential(io, origin, 'codex');
@@ -593,7 +611,7 @@ export const codex = {
         const hooksOk = core.every((hook) => hook.trust === 'trusted');
         const hooksText = core.some((hook) => hook.trust === 'missing')
             ? `not installed; run npx pendingyou init --app codex${flag}`
-            : `${core.map((hook) => `${hook.event} ${words[hook.trust]}`).join(', ')}${hooksOk ? '' : `. Codex skips a hook you haven’t trusted: ${TRUST_CLI}; ${TRUST_APP}`}`;
+            : `${core.map((hook) => `${hook.event} ${words[hook.trust]}`).join(', ')}${hooksOk ? '' : `. Codex skips a hook you haven’t trusted: ${TRUST} them`}`;
         const extraLine = (label, what, subs, off) => {
             const hooks = trust.filter((hook) => subs.includes(hook.sub));
             if (off)
@@ -603,7 +621,7 @@ export const codex = {
             const trusted = hooks.every((hook) => hook.trust === 'trusted');
             return trusted
                 ? `  ok      ${label} ${what} (${hooks.map((hook) => `${hook.event} trusted`).join(', ')})`
-                : `  missing ${label} ${what}, once you trust ${hooks.length === 1 ? 'its hook' : 'its hooks'} (${hooks.map((hook) => `${hook.event} ${words[hook.trust]}`).join(', ')}): ${TRUST_CLI}; ${TRUST_APP}`;
+                : `  missing ${label} ${what}, once you trust ${hooks.length === 1 ? 'its hook' : 'its hooks'} (${hooks.map((hook) => `${hook.event} ${words[hook.trust]}`).join(', ')}): ${TRUST} ${hooks.length === 1 ? 'it' : 'them'}`;
         };
         const ownConnection = credential?.kind === 'connection' && helper;
         const notOwn = 'off: it needs Codex signed in through this computer’s own connection';
@@ -650,4 +668,12 @@ export const codex = {
                 : 'Not ready: Codex here can’t reach Pending You until the lines marked missing are fixed.');
         return { lines, ready };
     },
+    async untrustedHooks(io) {
+        if ((await untrusted(io)).length === 0)
+            return null;
+        return {
+            lines: trustSteps(await findCodex(io)),
+            trusted: async () => (await untrusted(io)).length === 0,
+        };
+    },
 };