pendingyou 0.27.0 → 0.28.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.28.0 (2026-10-07)
+
+- When a card you asked was handed to another assistant and comes back to your person without its answer (handed
+  back, brought back after the two of you traded too many messages or went quiet, taken back, its answer back with
+  your person to send, or the helper removed), the session that asked hears it: “Pending You: req_… came back from
+  codex-setup to your person.”, Pending You's line saying why, and to ack_answer it (nothing to answer; your person's
+  answer reaches you as usual). Codex threads are woken with the same. Before, the card went quiet.
+
 ## 0.27.0 (2026-10-07)
 
 - Claude Code's pendingyou MCP server no longer gets stuck on “needs authentication” after a computer sleeps. When it

package/dist/apps/codex-wake.js

@@ -390,6 +390,11 @@ function line(heard, card) {
             `your person handed your open cards to ${from}, ${titled} among them`,
             `stop working on them: ${from} answers them and follows up; ack_answer ${heard.requestId} with its version to say you’ve stopped`,
         ];
+    if (notice?.kind === 'came_back')
+        return [
+            `${titled} came back from ${from} to your person`,
+            `call ${get} to read why (helper.ended), then ack_answer with its version to say you’ve read it; their answer reaches you as usual`,
+        ];
     if (notice?.kind === 'follow_up' && heard.status !== 'answered')
         return [
             `${from} followed up on ${titled}, which it answered for your person`,

package/dist/format.js

@@ -1,11 +1,12 @@
+const NOTICES = ['follow_up', 'handed_over', 'came_back'];
 export function noticeOf(heard) {
     const given = heard.notice;
     if (typeof given !== 'object' || given === null)
         return null;
     const { kind, from } = given;
-    if ((kind !== 'follow_up' && kind !== 'handed_over') || typeof from !== 'string')
+    if (!NOTICES.includes(kind) || typeof from !== 'string')
         return null;
-    return { kind, from };
+    return { kind: kind, from };
 }
 export function handledOf(heard) {
     const given = heard.handled;
@@ -32,10 +33,15 @@ export function delegatedOf(heard) {
     const given = heard.delegated;
     if (typeof given !== 'object' || given === null)
         return null;
-    const { from, mode, note } = given;
+    const { from, mode, note, authority } = given;
     if (typeof from !== 'string' || (mode !== 'freely' && mode !== 'loop'))
         return null;
-    return { from, mode, ...(typeof note === 'string' && note.trim() ? { note } : {}) };
+    return {
+        from,
+        mode,
+        ...(typeof authority === 'string' && authority.trim() ? { authority } : {}),
+        ...(typeof note === 'string' && note.trim() ? { note } : {}),
+    };
 }
 export const modeWords = (mode, from) => mode === 'freely'
     ? `answer freely: your answer goes straight to ${from}`
@@ -44,6 +50,7 @@ export const HANDED_TODO = 'If you know, answer_delegated with your answer and h
 const MAX_ANSWER = 600;
 const MAX_MESSAGE = 400;
 const MAX_TITLE = 140;
+const MAX_AUTHORITY = 500;
 const MAX_QUESTION = 100;
 const MAX_QUESTION_ANSWER = 300;
 export function clip(text, max) {
@@ -91,6 +98,7 @@ function describeHanded(heard, delegated) {
     }
     return [
         `${HANDED_PREFIX} ${id}, a question from ${from} (${modeWords(delegated.mode, from)}).`,
+        ...(delegated.authority ? [clip(delegated.authority, MAX_AUTHORITY).text] : []),
         `Question: ${clip(heard.title, MAX_TITLE).text}`,
         ...(note ? [`Their note: “${note.text}”`] : []),
         `Call get_request (requestId ${id}, name ${named(heard)}) to read it. ${HANDED_TODO}`,
@@ -106,6 +114,16 @@ function describeNotice(heard, notice) {
             `Pending You: your person handed your open cards to ${from}, ${id} among them.`,
             `Stop working on them: ${from} answers them and follows up. Call ${ack} to say you’ve stopped.`,
         ];
+    if (notice.kind === 'came_back') {
+        const why = heard.messages.at(-1)?.body.split(' Nothing to answer:')[0] ?? '';
+        const said = clip(why, MAX_MESSAGE);
+        return [
+            `Pending You: ${id} came back from ${from} to your person.`,
+            ...(said.text ? [said.text] : []),
+            `Nothing to answer: call ${ack} to say you’ve read it. Your person’s answer reaches you as usual.`,
+            ...(said.cut ? [`(Cut short: get_request ${id} has all of it.)`] : []),
+        ];
+    }
     let cut = false;
     const wrote = heard.messages.map((message) => {
         const said = quoted(message.body, MAX_MESSAGE);

package/dist/sdk/code.js

@@ -0,0 +1,138 @@
+import { generateKey, importKey, sha256 } from "./dpop.js";
+import { SignInError } from "./errors.js";
+import { nonces, tokenRequest } from "./oauth.js";
+export const AUTHORIZE_PATH = '/oauth/authorize';
+const random = (bytes) => {
+    let binary = '';
+    for (const byte of crypto.getRandomValues(new Uint8Array(bytes)))
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
+};
+export async function codeSignIn(options) {
+    const { jwk } = await generateKey();
+    const pending = {
+        version: 1,
+        origin: options.origin.replace(/\/+$/, ''),
+        clientId: options.clientId,
+        redirectUri: options.redirectUri,
+        scopes: [...options.scopes],
+        state: random(16),
+        verifier: random(32),
+        key: jwk,
+    };
+    return resumeCodeSignIn(pending, options);
+}
+export async function resumeCodeSignIn(pending, options = {}) {
+    const http = {
+        fetch: options.fetch ?? ((input, init) => fetch(input, init)),
+        now: options.now ?? (() => Date.now()),
+    };
+    const key = await importKey(pending.key);
+    const url = new URL(`${pending.origin}${AUTHORIZE_PATH}`);
+    url.search = new URLSearchParams({
+        response_type: 'code',
+        client_id: pending.clientId,
+        redirect_uri: pending.redirectUri,
+        scope: pending.scopes.join(' '),
+        state: pending.state,
+        code_challenge: await sha256(pending.verifier),
+        code_challenge_method: 'S256',
+        resource: `${pending.origin}/v1`,
+        dpop_jkt: key.jkt,
+    }).toString();
+    let finished = false;
+    async function finish(callback) {
+        if (finished)
+            throw new SignInError('finished', 'This sign-in is finished already.');
+        const back = new URL(String(callback));
+        if (back.searchParams.get('state') !== pending.state)
+            throw new SignInError('state_mismatch', 'This isn’t the answer to this sign-in.');
+        const iss = back.searchParams.get('iss');
+        if (iss !== null && iss !== pending.origin)
+            throw new SignInError('issuer_mismatch', 'This answer came from somewhere else.');
+        const error = back.searchParams.get('error');
+        if (error)
+            throw new SignInError(error, error === 'access_denied'
+                ? 'The person didn’t allow it.'
+                : `Pending You refused the sign-in (${error}).`);
+        const code = back.searchParams.get('code');
+        if (!code)
+            throw new SignInError('no_code', 'The answer had no code.');
+        finished = true;
+        const result = await tokenRequest(http, pending.origin, key, {
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: pending.redirectUri,
+            client_id: pending.clientId,
+            code_verifier: pending.verifier,
+            resource: `${pending.origin}/v1`,
+        }, nonces());
+        if (!result.ok)
+            throw new SignInError(result.error, `Pending You didn’t finish the sign-in (${result.error}). Start it again.`);
+        const credentials = {
+            version: 1,
+            origin: pending.origin,
+            clientId: pending.clientId,
+            accessToken: result.tokens.access_token,
+            refreshToken: result.tokens.refresh_token,
+            expiresAt: http.now() + result.tokens.expires_in * 1000,
+            scopes: result.tokens.scope ? result.tokens.scope.split(' ') : [...pending.scopes],
+            key: pending.key,
+        };
+        const store = options.store;
+        if (store)
+            await store.exclusive(() => store.save(credentials));
+        return credentials;
+    }
+    return { url: url.toString(), pending, finish };
+}
+export function isPendingCodeSignIn(value) {
+    const entry = value;
+    return (typeof entry === 'object' &&
+        entry !== null &&
+        entry.version === 1 &&
+        typeof entry.origin === 'string' &&
+        typeof entry.clientId === 'string' &&
+        typeof entry.redirectUri === 'string' &&
+        Array.isArray(entry.scopes) &&
+        typeof entry.state === 'string' &&
+        typeof entry.verifier === 'string' &&
+        typeof entry.key === 'object' &&
+        entry.key !== null);
+}
+export const PENDING_KEY = 'pendingyou.signin';
+const sessionStorageHere = () => globalThis.sessionStorage;
+export async function redirectToSignIn(options) {
+    const storage = options.storage ?? sessionStorageHere();
+    if (!storage)
+        throw new TypeError('No sessionStorage here: pass `storage`');
+    const started = await codeSignIn(options);
+    storage.setItem(PENDING_KEY, JSON.stringify(started.pending));
+    const go = options.go ??
+        ((url) => {
+            const here = globalThis.location;
+            if (!here)
+                throw new TypeError('No location here: pass `go`');
+            here.assign(url);
+        });
+    go(started.url);
+}
+export async function finishRedirectSignIn(options = {}) {
+    const storage = options.storage ?? sessionStorageHere();
+    if (!storage)
+        throw new TypeError('No sessionStorage here: pass `storage`');
+    const kept = storage.getItem(PENDING_KEY);
+    storage.removeItem(PENDING_KEY);
+    let pending = null;
+    try {
+        pending = kept ? JSON.parse(kept) : null;
+    }
+    catch { }
+    if (!isPendingCodeSignIn(pending))
+        throw new SignInError('not_started', 'No sign-in was started in this tab.');
+    const url = options.url ?? globalThis.location?.href ?? undefined;
+    if (!url)
+        throw new TypeError('No location here: pass `url`');
+    const started = await resumeCodeSignIn(pending, options);
+    return started.finish(url);
+}

package/dist/sdk/index.js

@@ -1,5 +1,6 @@
 export { backoffMs, RESYNC_MS } from "./changes.js";
 export { createClient } from "./client.js";
+export { codeSignIn, finishRedirectSignIn, redirectToSignIn, resumeCodeSignIn, } from "./code.js";
 export { deviceSignIn, } from "./device.js";
 export { generateKey, importKey, thumbprint } from "./dpop.js";
 export { ApiError, SignedOutError, SignInError } from "./errors.js";

package/dist/sdk/node.js

@@ -1,7 +1,10 @@
 import { execFile } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
 import { chmod, mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:http';
 import { dirname, join } from 'node:path';
+import { codeSignIn } from "./code.js";
+import { SignInError } from "./errors.js";
 import { isCredentials } from "./store.js";
 export const STALE_LOCK_MS = 30_000;
 export const LOCK_WAIT_MS = 15_000;
@@ -87,6 +90,77 @@ export function fileStore(path) {
         exclusive: (work) => withFileLock(path, work),
     };
 }
+const page = (title, body) => `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>${title}</title><body style="font:16px/1.5 system-ui,sans-serif;max-width:32rem;margin:15vh auto;padding:0 16px"><h1 style="font-weight:500">${title}</h1><p>${body}</p></body>`;
+export async function loopbackSignIn(options) {
+    const registered = new URL(options.redirectUri ?? 'http://127.0.0.1/callback');
+    if (registered.protocol !== 'http:' ||
+        !['127.0.0.1', '[::1]', 'localhost'].includes(registered.hostname))
+        throw new TypeError('A loopback sign-in comes back to http://127.0.0.1');
+    const server = createServer();
+    await new Promise((done, fail) => {
+        server.once('error', fail);
+        server.listen(options.port ?? 0, registered.hostname === '[::1]' ? '::1' : '127.0.0.1', () => done());
+    });
+    const address = server.address();
+    const port = typeof address === 'object' && address ? address.port : 0;
+    const back = new URL(registered.toString());
+    back.port = String(port);
+    const redirectUri = back.toString();
+    const started = await codeSignIn({ ...options, redirectUri });
+    let timer;
+    let closed = false;
+    const close = () => {
+        if (closed)
+            return;
+        closed = true;
+        if (timer)
+            clearTimeout(timer);
+        server.close();
+    };
+    const html = { 'content-type': 'text/html; charset=utf-8', connection: 'close' };
+    const signedIn = new Promise((resolve, reject) => {
+        const stop = (error) => {
+            close();
+            reject(error);
+        };
+        timer = setTimeout(() => stop(new SignInError('expired_token', 'The browser didn’t come back in time.')), options.timeoutMs ?? 10 * 60_000);
+        options.signal?.addEventListener('abort', () => stop(new SignInError('aborted', 'The sign-in was stopped.')));
+        let taken = false;
+        server.on('request', (request, response) => {
+            const url = new URL(request.url ?? '/', redirectUri);
+            if (request.method !== 'GET' || url.pathname !== back.pathname) {
+                response
+                    .writeHead(404, { 'content-type': 'text/plain', connection: 'close' })
+                    .end('Not found');
+                return;
+            }
+            if (taken) {
+                response
+                    .writeHead(409, html)
+                    .end(page('Already answered', 'Close this tab and go back to the app.'));
+                return;
+            }
+            taken = true;
+            started.finish(url).then((credentials) => {
+                response
+                    .writeHead(200, html)
+                    .end(page('You’re signed in', 'Close this tab and go back to the app.'));
+                close();
+                resolve(credentials);
+            }, (error) => {
+                response
+                    .writeHead(400, html)
+                    .end(page('Not signed in', 'Go back to the app and start signing in again.'));
+                close();
+                reject(error);
+            });
+        });
+    });
+    signedIn.catch(() => { });
+    if (options.open)
+        await options.open(started.url);
+    return { url: started.url, redirectUri, signedIn, close };
+}
 const runFile = (command, args) => new Promise((resolve, reject) => {
     execFile(command, args, { timeout: 60_000, maxBuffer: 64 * 1024 }, (error, stdout, stderr) => {
         if (error)

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = '0.27.0';
+export const VERSION = '0.28.0';

package/mod/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pendingyou-wake",
   "displayName": "Pending You",
-  "version": "2.39.0",
+  "version": "2.44.0",
   "description": "Wakes Claude Code when your person answers a Pending You card it posted, even while it sits idle. Installed by `npx pendingyou init`.",
   "author": {
     "name": "RecordPlane",

package/mod/README.md

@@ -4,4 +4,4 @@ The pendingyou command line’s copy of the Pending You plugin’s wake mod, for
 
 In each session it learns the cards the session posts to Pending You, checks them through the session’s own Pending You connection, and starts a turn when your person answers, writes back or a fallback comes due, or hands the session a question from another of their assistants (CLI 0.14.0), even while it sits idle. It answers `npx pendingyou hold` itself, so nothing waits in the background, and shows “2 waiting on you” under the prompt, after the plugin’s name. With the Pending You plugin installed too, only one copy acts.
 
-Generated from recordplane/pendingyou (packages/claude-plugin/src/wake) with Pending You’s guide 2.39.0; send changes there.
+Generated from recordplane/pendingyou (packages/claude-plugin/src/wake) with Pending You’s guide 2.44.0; send changes there.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pendingyou",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "Pending You for your coding agents: one command sets up Claude Code, Codex, OpenCode and Pi to ask you through Pending You and hear your answers, even while they sit idle.",
   "license": "Apache-2.0",
   "homepage": "https://www.pendingyou.com",