pendingyou 0.25.0 → 0.27.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 0.27.0 (2026-10-07)
+
+- Claude Code's pendingyou MCP server no longer gets stuck on “needs authentication” after a computer sleeps. When it
+  reconnected during a brief wake, the sign-in's 15-minute access token had run out, the refresh couldn't land in the
+  headers helper's time, and the helper printed nothing. With no `Authorization` from its helper, Claude Code turns on
+  its own OAuth, and the 401 left the server needing authentication, every pendingyou tool failing, until `/mcp`. Now
+  the helper tries the refresh again every 1.5 seconds within its time when one fails (a network still coming up), and
+  while it has a sign-in it always hands over a token, even one that has run out: that's refused as a failed connect,
+  which Claude Code tries again by running the helper, never as a reason to start its own sign-in. It still prints
+  nothing when there's no sign-in or the sign-in has ended.
+- When the helper last handed over a token that had run out, the next-message hook says so: if a pendingyou tool fails,
+  the agent tells you in chat to run `/mcp`, choose pendingyou and Reconnect (or restart Claude Code; Codex: restart
+  it), and asks in chat until it works. Said only within 12 hours, and no more once a later connect got a fresh token.
+
+## 0.26.0 (2026-10-07)
+
+- A session that sat idle past its sign-in's 15-minute access token hears its answers again. The next message's
+  hand-off started the background refresh, waited 1.2 seconds for it and gave up, often just before it landed, so an
+  answered card went unannounced. Now the hand-off and the session start's pickup wait for an expired token until 0.9
+  seconds before their 3-second deadline, leaving room to ask for answers; a token with seconds left still waits 1.2.
+- Never silent: when the hand-off or the session start's pickup can't check for answers (Pending You unreachable, a
+  server error, or the sign-in still being refreshed), they add “Pending You couldn't check for answers just now: call
+  list_pending before you go on.” instead of only the plain reminder.
+
 ## 0.25.0 (2026-10-06)
 
 - An answer reaches only the session that asked. The hooks asked Pending You for their folder's answers and open

package/dist/api.js

@@ -5,6 +5,8 @@ import { OAuthError, refresh } from "./oauth.js";
 const EARLY_MS = 60_000;
 export const SOON_MS = 5 * 60_000;
 export const REFRESH_WAIT_MS = 1200;
+export const HOOK_DEADLINE_MS = 3000;
+export const ANSWERS_ROOM_MS = 900;
 const USABLE_MS = 10_000;
 export class SignInNeeded extends Error {
     name = 'SignInNeeded';
@@ -72,7 +74,7 @@ export async function refreshInBackground(io, origin, force, app = DEFAULT_APP)
     await refreshStored(io, origin, stored, { force, earlyMs: SOON_MS }, app);
     return true;
 }
-async function hookToken(io, origin, force, signal, app) {
+async function hookToken(io, origin, force, signal, app, expiredWaitMs) {
     const stored = await readCredential(io, origin, app);
     if (!stored)
         throw new SignInNeeded(false);
@@ -83,7 +85,8 @@ async function hookToken(io, origin, force, signal, app) {
         io.background(refreshArgs(origin, app, force));
     if (!force && left > USABLE_MS)
         return stored.accessToken;
-    const until = io.now() + REFRESH_WAIT_MS;
+    const wait = !force && left <= 0 && expiredWaitMs !== undefined ? expiredWaitMs : REFRESH_WAIT_MS;
+    const until = io.now() + wait;
     while (io.now() < until && !signal?.aborted) {
         await io.sleep(50, signal);
         const current = await readCredential(io, origin, app);
@@ -94,14 +97,22 @@ async function hookToken(io, origin, force, signal, app) {
     }
     throw new Unavailable('The sign-in is being refreshed in the background.');
 }
+export const REFRESH_RETRY_MS = 1500;
 export async function helperToken(io, origin, waitMs, app = DEFAULT_APP, force = false) {
     const stored = await readCredential(io, origin, app);
     if (!stored)
         throw new SignInNeeded(false);
     if (!force && stored.expiresAt - io.now() > SOON_MS)
         return stored.accessToken;
-    if (!(await isLocked(credentialsPath(io))))
+    const lock = credentialsPath(io);
+    let started = Number.NEGATIVE_INFINITY;
+    const start = async () => {
+        if (await isLocked(lock))
+            return;
         io.background(refreshArgs(origin, app, force));
+        started = io.now();
+    };
+    await start();
     const until = io.now() + waitMs;
     while (io.now() < until) {
         await io.sleep(100);
@@ -110,6 +121,8 @@ export async function helperToken(io, origin, waitMs, app = DEFAULT_APP, force =
             throw new SignInNeeded(true);
         if (current.refreshToken !== stored.refreshToken)
             return current.accessToken;
+        if (io.now() - started >= REFRESH_RETRY_MS && io.now() + REFRESH_WAIT_MS < until)
+            await start();
     }
     if (!force && stored.expiresAt - io.now() > USABLE_MS)
         return stored.accessToken;
@@ -133,6 +146,7 @@ export function getJson(io, origin, path, timeoutMs, signal, options = {}) {
 export function sendJson(io, origin, path, body, timeoutMs, options = {}) {
     return callJson(io, origin, path, { body }, timeoutMs, undefined, options);
 }
+export const expiredWait = (uptime) => Math.max(0, HOOK_DEADLINE_MS - ANSWERS_ROOM_MS - uptime);
 async function callJson(io, origin, path, send, timeoutMs, signal, options = {}) {
     const app = options.app ?? DEFAULT_APP;
     for (let attempt = 0;; attempt++) {
@@ -140,7 +154,7 @@ async function callJson(io, origin, path, send, timeoutMs, signal, options = {})
         try {
             token =
                 options.hook && io.background
-                    ? await hookToken(io, origin, attempt > 0, signal, app)
+                    ? await hookToken(io, origin, attempt > 0, signal, app, options.patient && io.uptime ? expiredWait(io.uptime()) : undefined)
                     : await freshToken(io, origin, attempt > 0, app);
         }
         catch (error) {

package/dist/main.js

@@ -1,4 +1,4 @@
-import { refreshInBackground, SignInNeeded, Unavailable } from "./api.js";
+import { HOOK_DEADLINE_MS, refreshInBackground, SignInNeeded, Unavailable } from "./api.js";
 import { listen, listenHanded, posted } from "./apps/codex-wake.js";
 import { DEFAULT_APP } from "./apps/ids.js";
 import { appModule } from "./apps/registry.js";
@@ -101,7 +101,7 @@ async function run(io, command, hook = { fallback: '' }) {
             return (await import("./app-login.js")).appCommand(io, command);
     }
 }
-export const HOOK_DEADLINE_MS = 3000;
+export { HOOK_DEADLINE_MS };
 async function runHook(io, command) {
     const hook = { fallback: '' };
     const controller = new AbortController();

package/dist/mcp-health.js

@@ -0,0 +1,48 @@
+import { join } from 'node:path';
+import { APP_NAMES, DEFAULT_APP } from "./apps/ids.js";
+import { slotOf } from "./credentials.js";
+import { configDir, readJson, writeWhole } from "./files.js";
+export const STUCK_FOR_MS = 12 * 60 * 60_000;
+const helperStatePath = (io) => join(configDir(io), 'helper.json');
+async function readAll(io) {
+    const file = await readJson(helperStatePath(io)).catch(() => null);
+    return file && typeof file.slots === 'object' && file.slots !== null ? file.slots : {};
+}
+export async function recordHelper(io, origin, app, outcome) {
+    try {
+        const slots = await readAll(io);
+        const key = slotOf(origin, app);
+        if (slots[key]?.outcome === outcome && outcome === 'ok')
+            return;
+        slots[key] = { at: io.now(), outcome };
+        await writeWhole(helperStatePath(io), `${JSON.stringify({ version: 1, slots }, null, 2)}\n`, {
+            secret: true,
+        });
+    }
+    catch { }
+}
+export async function helperOutcome(io, origin, app = DEFAULT_APP) {
+    const entry = (await readAll(io).catch(() => ({})))[slotOf(origin, app)];
+    return entry &&
+        typeof entry.at === 'number' &&
+        (entry.outcome === 'ok' || entry.outcome === 'stale')
+        ? entry
+        : null;
+}
+export function stuckText(app) {
+    const back = app === DEFAULT_APP
+        ? 'run /mcp, choose pendingyou and Reconnect (no need to Authenticate), or restart Claude Code'
+        : `restart ${APP_NAMES[app]}`;
+    return `Pending You: when ${APP_NAMES[app]} last connected to its pendingyou MCP server, this computer couldn’t refresh its sign-in in time, so that connection may have been refused. If a pendingyou tool fails (not connected, or needs authentication), tell your person in chat: ${back}. Until it works, ask them in chat.`;
+}
+export async function stuckLine(io, origin, app) {
+    try {
+        const last = await helperOutcome(io, origin, app);
+        if (last?.outcome !== 'stale' || io.now() - last.at > STUCK_FOR_MS)
+            return null;
+        return stuckText(app);
+    }
+    catch {
+        return null;
+    }
+}

package/dist/pickup.js

@@ -1,4 +1,4 @@
-import { getJson, SignInNeeded } from "./api.js";
+import { getJson, SignInNeeded, Unavailable } from "./api.js";
 import { computerNames, hearsOnly, keepListening, markHandedTurn, sessionFor, threadCards, threadNames, touchThread, } from "./apps/codex-wake.js";
 import { APP_NAMES, DEFAULT_APP } from "./apps/ids.js";
 import { connectionMachine, readCredential } from "./credentials.js";
@@ -9,6 +9,7 @@ import { goesBy, HANDED_GRACE_MS, namesAnotherComputer } from "./handed.js";
 import { herdrTarget, reportCommand } from "./herdr.js";
 import { holdCommand } from "./hold.js";
 import { unwokenLine } from "./loaded.js";
+import { stuckLine } from "./mcp-health.js";
 import { isPermissionCard, isPromptApp, POSTED_MAX, sessionName, sessionPosted, settlePrompts, } from "./permission.js";
 import { announce, keepPresent, readSaid } from "./presence.js";
 import { setupReminder } from "./setup.js";
@@ -17,6 +18,7 @@ const TIME_BOX_MS = { pickup: 2500, handoff: 2000 };
 export const ANSWERS_ASKED = 20;
 export const ANSWERS_SHOWN = 5;
 export const REMINDER = 'Pending You: anything you need from your person also goes on a card.';
+export const UNCHECKED = "Pending You couldn't check for answers just now: call list_pending before you go on.";
 export const OPEN_SHOWN = 3;
 export const OPEN_TITLE = 50;
 export const OPEN_NAME = 24;
@@ -141,6 +143,7 @@ export async function pickup(io, options, hook = { fallback: '' }) {
     let warning = null;
     let reminder = null;
     let unwoken = null;
+    let stuck = null;
     try {
         const input = await hookInput(io);
         const { cwd } = input;
@@ -175,6 +178,7 @@ export async function pickup(io, options, hook = { fallback: '' }) {
             hook.fallback = `${[REMINDER, warning].filter(Boolean).join('\n')}\n`;
             if (app === DEFAULT_APP)
                 unwoken = await unwokenLine(io, origin, input.session, known);
+            stuck = await stuckLine(io, origin, app);
         }
         if (app !== DEFAULT_APP && input.session) {
             await touchThread(io, app, input.session, input.given ? input.cwd : null);
@@ -200,6 +204,7 @@ export async function pickup(io, options, hook = { fallback: '' }) {
         ]);
         const { status, body } = await getJson(io, origin, `/mcp/cli/answers?${query}`, TIME_BOX_MS[mode], io.signal, {
             hook: true,
+            patient: true,
             app,
         });
         if (status !== 200)
@@ -279,11 +284,13 @@ export async function pickup(io, options, hook = { fallback: '' }) {
             ...(warning ? [warning] : []),
             ...(reminder ? [reminder] : []),
             ...(unwoken ? [unwoken] : []),
+            ...(stuck ? [stuck] : []),
         ].join('\n')}\n`);
         line = null;
         warning = null;
         reminder = null;
         unwoken = null;
+        stuck = null;
         await markHanded(io, origin, fresh.map((heard) => ({ requestId: heard.requestId, moment: momentOf(heard) })));
         return 0;
     }
@@ -292,10 +299,12 @@ export async function pickup(io, options, hook = { fallback: '' }) {
             io.out(`Pending You: this computer’s pendingyou sign-in has ended, so answers can’t wake ${APP_NAMES[app]}. Ask your person to run \`npx pendingyou login${app === DEFAULT_APP ? '' : ` --app ${app}`}\`.\n`);
         if (error instanceof SignInNeeded)
             line = null;
+        if (error instanceof Unavailable)
+            line = [line, UNCHECKED].filter(Boolean).join('\n');
         return 0;
     }
     finally {
-        const last = [line, warning, reminder, unwoken].filter(Boolean);
+        const last = [line, warning, reminder, unwoken, stuck].filter(Boolean);
         if (last.length)
             io.out(`${last.join('\n')}\n`);
     }

package/dist/remote.js

@@ -5,6 +5,7 @@ import { APP_NAMES, DEFAULT_APP } from "./apps/ids.js";
 import { cleanName, DEFAULT_ORIGIN } from "./args.js";
 import { readCredential } from "./credentials.js";
 import { configDir, writeWhole } from "./files.js";
+import { recordHelper } from "./mcp-health.js";
 import { VERSION } from "./version.js";
 export const HELPER = 'pendingyou-mcp-headers';
 export const helperPath = (io) => join(configDir(io), 'bin', HELPER);
@@ -255,12 +256,23 @@ export async function mcpHeaders(io, options) {
         io.err(`pendingyou: this computer’s sign-in only hears answers, so ${name} can’t use it. Run: ${login}\n`);
         return 1;
     }
+    const headers = (token) => io.out(`${JSON.stringify({ Authorization: `Bearer ${token}` })}\n`);
     try {
         const token = await helperToken(io, options.origin, HELPER_WAIT_MS, app);
-        io.out(`${JSON.stringify({ Authorization: `Bearer ${token}` })}\n`);
+        headers(token);
+        await recordHelper(io, options.origin, app, 'ok');
         return 0;
     }
     catch (error) {
+        if (error instanceof Unavailable) {
+            const current = await readCredential(io, options.origin, app).catch(() => null);
+            if (current?.kind === 'connection') {
+                headers(current.accessToken);
+                io.err('pendingyou: couldn’t refresh the sign-in in time (is this computer online?), so this token may be refused; the refresh goes on in the background.\n');
+                await recordHelper(io, options.origin, app, current.expiresAt > io.now() ? 'ok' : 'stale');
+                return 0;
+            }
+        }
         io.err(error instanceof SignInNeeded
             ? `pendingyou: this computer’s sign-in has ended. Run: ${login}\n`
             : error instanceof Unavailable

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = '0.25.0';
+export const VERSION = '0.27.0';

package/mod/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pendingyou-wake",
   "displayName": "Pending You",
-  "version": "2.37.0",
+  "version": "2.39.0",
   "description": "Wakes Claude Code when your person answers a Pending You card it posted, even while it sits idle. Installed by `npx pendingyou init`.",
   "author": {
     "name": "RecordPlane",

package/mod/README.md

@@ -4,4 +4,4 @@ The pendingyou command line’s copy of the Pending You plugin’s wake mod, for
 
 In each session it learns the cards the session posts to Pending You, checks them through the session’s own Pending You connection, and starts a turn when your person answers, writes back or a fallback comes due, or hands the session a question from another of their assistants (CLI 0.14.0), even while it sits idle. It answers `npx pendingyou hold` itself, so nothing waits in the background, and shows “2 waiting on you” under the prompt, after the plugin’s name. With the Pending You plugin installed too, only one copy acts.
 
-Generated from recordplane/pendingyou (packages/claude-plugin/src/wake) with Pending You’s guide 2.37.0; send changes there.
+Generated from recordplane/pendingyou (packages/claude-plugin/src/wake) with Pending You’s guide 2.39.0; send changes there.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pendingyou",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "description": "Pending You for your coding agents: one command sets up Claude Code, Codex, OpenCode and Pi to ask you through Pending You and hear your answers, even while they sit idle.",
   "license": "Apache-2.0",
   "homepage": "https://www.pendingyou.com",