pendingyou 0.27.0 → 0.29.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.29.0 (2026-10-07)
+
+- The command line links this computer's sign-ins to it by its key, so Pending You names every assistant here by this
+  computer and shows one computer, not two. Besides the connections `init` made, it now finds the sign-ins your apps
+  made on their own at this Pending You (Claude Code's `/mcp` Authenticate, or the Pending You plugin's server, kept in
+  Claude Code's own credentials; Codex's and OpenCode's MCP sign-ins kept in their files) and proves this computer's key
+  for each, reading only their OAuth clients, never a token. Pending You links the ones that are yours and on no other
+  computer, and merges an app's older sign-ins here into the one in use. Nothing is ever linked by a computer's name.
+  `init` links at once; the hooks, `hold`, the MCP headers helper and the wake do it in the background every few hours.
+  `npx pendingyou machine link` does it now.
+- Proving the key again no longer renames the computer: a name you gave it in Pending You stays.
+
+## 0.28.0 (2026-10-07)
+
+- When a card you asked was handed to another assistant and comes back to your person without its answer (handed
+  back, brought back after the two of you traded too many messages or went quiet, taken back, its answer back with
+  your person to send, or the helper removed), the session that asked hears it: “Pending You: req_… came back from
+  codex-setup to your person.”, Pending You's line saying why, and to ack_answer it (nothing to answer; your person's
+  answer reaches you as usual). Codex threads are woken with the same. Before, the card went quiet.
+
 ## 0.27.0 (2026-10-07)
 
 - Claude Code's pendingyou MCP server no longer gets stuck on “needs authentication” after a computer sleeps. When it

package/README.md

@@ -467,6 +467,12 @@ computer's agents.
   account; the next `init` then proves the new one.
 - `npx pendingyou machine attest --client-id <id>` prints a proof of this computer for an app's own sign-in with a code
   (`--cnf <thumbprint>` for that app's own key, `--name` for another name). It never prints the key.
+- `npx pendingyou machine link` (0.29.0) links this computer's sign-ins to it now: the agents' connections, and the
+  sign-ins your apps made on their own (Claude Code's `/mcp` Authenticate or the Pending You plugin, Codex's and
+  OpenCode's MCP sign-ins), found by their OAuth clients in those apps' own stores here, never a token. Pending You then
+  names them all by this computer and merges an app's older sign-ins here into the one in use. `init` does it, and the
+  hooks every few hours in the background; nothing is linked by a computer's name. Rename a computer once, in Settings
+  › Apps and devices, and every assistant on it follows.
 
 `uninstall` leaves the key: it names the computer and grants nothing on its own.
 
@@ -500,7 +506,7 @@ its environment. A failing command is tried twice more, then skipped. `--once` s
 | `uninstall` | Remove what `init` added, and sign out (`--app`) |
 | `mcp --app <app>` | The stdio bridge: a local MCP server for an agent that can't run a headers helper (OpenCode, Pi), which passes each message on to Pending You with that agent's own sign-in here (`--check`) |
 | `herdr doctor` | Pending You in Herdr: the badges, the plugin, its toasts and its sidebar row. The plugin runs `herdr next`, `open`, `setup`, `view` and `unconfigure`; the agents' writers `herdr report` |
-| `machine status` / `attest` / `rotate` | This computer's key: whether Pending You knows each agent's connection by it (exits 0 when it does), a proof of it for an app's own sign-in (`--client-id`, `--cnf`, `--name`), or a new key (`--yes`) |
+| `machine status` / `attest` / `rotate` / `link` | This computer's key: whether Pending You knows each agent's connection by it (exits 0 when it does), a proof of it for an app's own sign-in (`--client-id`, `--cnf`, `--name`), a new key (`--yes`), or this computer's sign-ins linked to it now, your apps' own ones too (`--quiet`) |
 | `app login` / `logout` / `status` | An app that answers your cards when you press a key in it, signed in on this computer (`herdr`, or another app with `--client-id` and `--scope`; `--device`, `--browser`, `--name`), out again, or what each may do and until when |
 
 Every command takes `--origin` (default `https://www.pendingyou.com`, or `$PENDINGYOU_ORIGIN`). `--app` takes

package/dist/apps/codex-wake.js

@@ -8,6 +8,7 @@ import { configDir, readJson, withLock, writeWhole } from "../files.js";
 import { APPROVED_DRAFT_NOTICE, approvesDraft, clip, delegatedOf, handledOf, isClosed, noticeOf, } from "../format.js";
 import { chooseThread, goesBy, HANDED_FOR_MS, handedCard, handedMessage, namesAnotherComputer, } from "../handed.js";
 import { clearHerdr, herdrTarget, isUrgency, PANE_ID, reportCommand, writeHerdr, } from "../herdr.js";
+import { linkSoon } from "../link.js";
 import { macName, tailscaleName } from "../remote.js";
 import { claimHanded, markHanded, momentOf, releaseHanded, wasHanded } from "../state.js";
 import { findCodex } from "./codex-app.js";
@@ -390,6 +391,11 @@ function line(heard, card) {
             `your person handed your open cards to ${from}, ${titled} among them`,
             `stop working on them: ${from} answers them and follows up; ack_answer ${heard.requestId} with its version to say you’ve stopped`,
         ];
+    if (notice?.kind === 'came_back')
+        return [
+            `${titled} came back from ${from} to your person`,
+            `call ${get} to read why (helper.ended), then ack_answer with its version to say you’ve read it; their answer reaches you as usual`,
+        ];
     if (notice?.kind === 'follow_up' && heard.status !== 'answered')
         return [
             `${from} followed up on ${titled}, which it answered for your person`,
@@ -558,6 +564,7 @@ export async function listen(io, options) {
     const lease = await takeLease(io, app, thread);
     if (!lease)
         return 0;
+    await linkSoon(io, origin);
     const controller = new AbortController();
     const stop = () => controller.abort();
     if (io.signal.aborted)

package/dist/args.js

@@ -3,7 +3,7 @@ export const DEFAULT_ORIGIN = 'https://www.pendingyou.com';
 export const DEFAULT_TIMEOUT_MS = 4 * 60 * 60 * 1000;
 const MAX_TIMEOUT_MS = 24 * 60 * 60 * 1000;
 export const APP_SUBS = ['login', 'logout', 'status'];
-export const MACHINE_SUBS = ['status', 'attest', 'rotate'];
+export const MACHINE_SUBS = ['status', 'attest', 'rotate', 'link'];
 export const HERDR_SUBS = [
     'report',
     'next',
@@ -152,7 +152,7 @@ const FLAGS = {
         wait: false,
         ensure: false,
     },
-    machine: { origin: true, 'client-id': true, cnf: true, name: true, yes: false },
+    machine: { origin: true, 'client-id': true, cnf: true, name: true, yes: false, quiet: false },
     app: {
         origin: true,
         'client-id': true,
@@ -560,6 +560,7 @@ function machineCommand(origin, positional, flags, machine) {
         status: [],
         attest: ['client-id', 'cnf', 'name'],
         rotate: ['yes'],
+        link: ['quiet'],
     };
     for (const key of flags.keys())
         if (key !== 'origin' && !allowed[sub].includes(key))
@@ -568,6 +569,8 @@ function machineCommand(origin, positional, flags, machine) {
         return { name: 'machine', origin, sub };
     if (sub === 'rotate')
         return { name: 'machine', origin, sub, yes: flags.has('yes') };
+    if (sub === 'link')
+        return { name: 'machine', origin, sub, quiet: flags.has('quiet') };
     const clientId = flags.get('client-id');
     if (typeof clientId !== 'string' || !CLIENT_ID.test(clientId))
         throw new UsageError('machine attest needs the client the app signs in with, like: --client-id <its client id>');
@@ -671,7 +674,7 @@ export const USAGE = `pendingyou: Pending You for your coding agents (Claude Cod
   npx pendingyou herdr doctor  Pending You in Herdr: the badges on your agents' panes, the plugin, its
                                toasts and its sidebar row. The plugin runs herdr next, open, setup,
                                view and unconfigure
-  npx pendingyou machine status | attest | rotate
+  npx pendingyou machine status | attest | rotate | link
                                This computer's key, which Pending You knows it by (init makes it; it
                                never leaves the computer): whether Pending You knows each agent's
                                connection by it, a proof of it for an app's own sign-in

package/dist/format.js

@@ -1,11 +1,12 @@
+const NOTICES = ['follow_up', 'handed_over', 'came_back'];
 export function noticeOf(heard) {
     const given = heard.notice;
     if (typeof given !== 'object' || given === null)
         return null;
     const { kind, from } = given;
-    if ((kind !== 'follow_up' && kind !== 'handed_over') || typeof from !== 'string')
+    if (!NOTICES.includes(kind) || typeof from !== 'string')
         return null;
-    return { kind, from };
+    return { kind: kind, from };
 }
 export function handledOf(heard) {
     const given = heard.handled;
@@ -32,10 +33,15 @@ export function delegatedOf(heard) {
     const given = heard.delegated;
     if (typeof given !== 'object' || given === null)
         return null;
-    const { from, mode, note } = given;
+    const { from, mode, note, authority } = given;
     if (typeof from !== 'string' || (mode !== 'freely' && mode !== 'loop'))
         return null;
-    return { from, mode, ...(typeof note === 'string' && note.trim() ? { note } : {}) };
+    return {
+        from,
+        mode,
+        ...(typeof authority === 'string' && authority.trim() ? { authority } : {}),
+        ...(typeof note === 'string' && note.trim() ? { note } : {}),
+    };
 }
 export const modeWords = (mode, from) => mode === 'freely'
     ? `answer freely: your answer goes straight to ${from}`
@@ -44,6 +50,7 @@ export const HANDED_TODO = 'If you know, answer_delegated with your answer and h
 const MAX_ANSWER = 600;
 const MAX_MESSAGE = 400;
 const MAX_TITLE = 140;
+const MAX_AUTHORITY = 500;
 const MAX_QUESTION = 100;
 const MAX_QUESTION_ANSWER = 300;
 export function clip(text, max) {
@@ -91,6 +98,7 @@ function describeHanded(heard, delegated) {
     }
     return [
         `${HANDED_PREFIX} ${id}, a question from ${from} (${modeWords(delegated.mode, from)}).`,
+        ...(delegated.authority ? [clip(delegated.authority, MAX_AUTHORITY).text] : []),
         `Question: ${clip(heard.title, MAX_TITLE).text}`,
         ...(note ? [`Their note: “${note.text}”`] : []),
         `Call get_request (requestId ${id}, name ${named(heard)}) to read it. ${HANDED_TODO}`,
@@ -106,6 +114,16 @@ function describeNotice(heard, notice) {
             `Pending You: your person handed your open cards to ${from}, ${id} among them.`,
             `Stop working on them: ${from} answers them and follows up. Call ${ack} to say you’ve stopped.`,
         ];
+    if (notice.kind === 'came_back') {
+        const why = heard.messages.at(-1)?.body.split(' Nothing to answer:')[0] ?? '';
+        const said = clip(why, MAX_MESSAGE);
+        return [
+            `Pending You: ${id} came back from ${from} to your person.`,
+            ...(said.text ? [said.text] : []),
+            `Nothing to answer: call ${ack} to say you’ve read it. Your person’s answer reaches you as usual.`,
+            ...(said.cut ? [`(Cut short: get_request ${id} has all of it.)`] : []),
+        ];
+    }
     let cut = false;
     const wrote = heard.messages.map((message) => {
         const said = quoted(message.body, MAX_MESSAGE);

package/dist/hold.js

@@ -4,6 +4,7 @@ import { readPiManifest } from "./apps/pi.js";
 import { DEFAULT_ORIGIN, DEFAULT_TIMEOUT_MS } from "./args.js";
 import { readCredential } from "./credentials.js";
 import { describe } from "./format.js";
+import { linkSoon } from "./link.js";
 import { markHanded, momentOf } from "./state.js";
 export const LONG_POLL_SECONDS = 25;
 const PATIENT_AFTER_MS = 30 * 60 * 1000;
@@ -57,6 +58,7 @@ export async function hold(io, options) {
     };
     if (!(await readCredential(io, origin)))
         return signInNeeded(false);
+    await linkSoon(io, origin);
     let failures = 0;
     for (;;) {
         if (io.signal.aborted) {

package/dist/index.js

@@ -1,6 +1,7 @@
 export { getJson, SignInNeeded, Unavailable } from "./api.js";
 export { DEFAULT_ORIGIN, parseArgs } from "./args.js";
 export { readCredential, updateCredential } from "./credentials.js";
+export { appClients, clientsIn, LINK_PATH, linkClients, machineLink } from "./link.js";
 export { attest, ensureMachine, machinePath, proveConnections, readMachine, thumbprintOf, } from "./machine.js";
 export { main } from "./main.js";
 export { CLIENT_NAME, deviceLink, discover, register, revoke, SCOPE, signIn, signInWithDevice, startDevice, waitForDevices, } from "./oauth.js";

package/dist/init.js

@@ -5,11 +5,13 @@ import { hookCommand } from "./claude.js";
 import { readCredential, saveConnectionClient } from "./credentials.js";
 import { hookLine, originArgs } from "./hooks.js";
 import { installCli, pruneCli, removeCli } from "./install.js";
+import { linkClients } from "./link.js";
 import { keyForSignIn, proveConnections } from "./machine.js";
 import { headlessReason, helperCommand, removeHelper, writeHelper } from "./remote.js";
 import { FINISH_SAY } from "./setup.js";
 import { removeShim, shimPath, writeShim } from "./shim.js";
 import { checkSignIn, logout, signInApps, titleFrom, titleHere } from "./signin.js";
+import { markLinked } from "./state.js";
 import { trustHooks } from "./trust.js";
 import { VERSION } from "./version.js";
 const line = (step) => `  ${step.ok ? 'ok     ' : 'check  '} ${step.text}\n`;
@@ -155,8 +157,13 @@ export async function init(io, options) {
             ...(options.machine ? { machine: options.machine } : {}),
             key,
         });
-        if (key)
+        if (key) {
             await proveConnections(io, options.origin, [...signed].flatMap(([app, how]) => (how === 'already' ? [app] : [])), key);
+            const linked = await linkClients(io, options.origin, key);
+            await markLinked(io, options.origin).catch(() => { });
+            if (linked.joined)
+                io.out(`Linked ${linked.joined === 1 ? 'a sign-in' : `${linked.joined} sign-ins`} your apps made on this computer to it, so Pending You names them by this computer.\n`);
+        }
     }
     else
         io.out(going.length === 1

package/dist/link.js

@@ -0,0 +1,143 @@
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
+import { sendJson } from "./api.js";
+import { APP_IDS } from "./apps/ids.js";
+import { connectionMachine, readCredential } from "./credentials.js";
+import { claudeDir, readJson } from "./files.js";
+import { attest, clockOffset, proveConnections, readMachine } from "./machine.js";
+import { machineOf } from "./remote.js";
+import { linkDue, markLinked } from "./state.js";
+export const LINK_PATH = '/mcp/cli/machine/link';
+export const LINK_EVERY_MS = 6 * 60 * 60 * 1000;
+const MAX_LINKS = 8;
+const CLIENT_ID = /^[\x21-\x7e]{1,300}$/;
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const sameUrl = (a, b) => a.replace(/\/+$/, '') === b.replace(/\/+$/, '');
+export function clientsIn(entries, url) {
+    if (!isRecord(entries))
+        return [];
+    const found = [];
+    for (const entry of Object.values(entries)) {
+        if (!isRecord(entry))
+            continue;
+        const address = entry.serverUrl ?? entry.server_url ?? entry.url;
+        const info = isRecord(entry.clientInfo) ? entry.clientInfo : {};
+        const client = entry.clientId ?? entry.client_id ?? info.clientId ?? info.client_id;
+        if (typeof address !== 'string' || !sameUrl(address, url))
+            continue;
+        if (typeof client === 'string' && CLIENT_ID.test(client) && !found.includes(client))
+            found.push(client);
+    }
+    return found;
+}
+async function claudeCodeStore(io) {
+    if (io.platform === 'darwin') {
+        const custom = io.env.CLAUDE_SECURESTORAGE_CONFIG_DIR ?? io.env.CLAUDE_CONFIG_DIR;
+        const suffix = custom
+            ? `-${createHash('sha256').update(custom.normalize('NFC')).digest('hex').slice(0, 8)}`
+            : '';
+        const user = io.env.USER || io.env.LOGNAME || '';
+        const account = /^[a-zA-Z0-9._-]+$/.test(user) ? user : 'claude-code-user';
+        const found = await io
+            .run('security', ['find-generic-password', '-a', account, '-w', '-s', `Claude Code-credentials${suffix}`], 5000)
+            .catch(() => null);
+        if (found?.code === 0 && found.stdout.trim()) {
+            try {
+                return JSON.parse(found.stdout.trim());
+            }
+            catch { }
+        }
+    }
+    return readJson(join(claudeDir(io), '.credentials.json')).catch(() => null);
+}
+export async function appClients(io, origin) {
+    const url = `${origin}/mcp`;
+    const found = [];
+    const add = (app, clients) => {
+        for (const clientId of clients)
+            if (!found.some((each) => each.clientId === clientId))
+                found.push({ app, clientId });
+    };
+    const claude = await claudeCodeStore(io);
+    add('claude-code', clientsIn(isRecord(claude) ? claude.mcpOAuth : null, url));
+    const codexHome = io.env.CODEX_HOME || join(io.home, '.codex');
+    add('codex', clientsIn(await readJson(join(codexHome, '.credentials.json')).catch(() => null), url));
+    const data = io.env.XDG_DATA_HOME || join(io.home, '.local', 'share');
+    add('opencode', clientsIn(await readJson(join(data, 'opencode', 'mcp-auth.json')).catch(() => null), url));
+    return found.slice(0, MAX_LINKS);
+}
+export async function linkClients(io, origin, machine) {
+    const clients = await appClients(io, origin);
+    const none = { found: clients.length, joined: 0, merged: 0, failed: false };
+    if (clients.length === 0)
+        return none;
+    let signedIn = null;
+    for (const app of APP_IDS)
+        if (await readCredential(io, origin, app)) {
+            signedIn = app;
+            break;
+        }
+    if (!signedIn)
+        return { ...none, failed: true };
+    try {
+        const name = (await connectionMachine(io, origin, signedIn)) ?? machineOf(io.host);
+        const offset = await clockOffset(io, origin);
+        const links = [];
+        for (const { clientId } of clients)
+            links.push({
+                clientId,
+                attestation: await attest(machine, { aud: `${origin}${LINK_PATH}`, client_id: clientId, name }, io.now() + offset),
+            });
+        const { status, body } = await sendJson(io, origin, LINK_PATH, { links }, 15_000, { app: signedIn });
+        if (status !== 200)
+            return { ...none, failed: true };
+        return {
+            found: clients.length,
+            joined: (body.links ?? []).filter((each) => each.connection === 'joined').length,
+            merged: typeof body.merged === 'number' ? body.merged : 0,
+            failed: false,
+        };
+    }
+    catch {
+        return { ...none, failed: true };
+    }
+}
+export async function machineLink(io, command) {
+    const say = (text) => {
+        if (!command.quiet)
+            io.out(text);
+    };
+    const machine = await readMachine(io).catch(() => null);
+    if (!machine) {
+        say('This computer has no key yet. npx -y pendingyou@latest init makes one, and links its sign-ins.\n');
+        return 1;
+    }
+    await markLinked(io, command.origin).catch(() => { });
+    const own = [];
+    for (const app of APP_IDS)
+        if ((await readCredential(io, command.origin, app))?.kind === 'connection')
+            own.push(app);
+    const proven = own.length
+        ? await proveConnections(io, command.origin, own, machine).catch(() => new Map())
+        : new Map();
+    const linked = await linkClients(io, command.origin, machine);
+    const joined = [...proven.values()].filter((each) => each === 'joined').length + linked.joined;
+    if (linked.failed && linked.found > 0)
+        say(`Found ${linked.found === 1 ? 'a sign-in' : `${linked.found} sign-ins`} of this computer’s apps, but Pending You couldn’t be asked to link ${linked.found === 1 ? 'it' : 'them'} now. Try again later.\n`);
+    else if (joined === 0)
+        say('Every sign-in on this computer is linked to it already.\n');
+    else
+        say(`Linked ${joined === 1 ? 'a sign-in' : `${joined} sign-ins`} on this computer to it${linked.merged ? `, and Pending You merged ${linked.merged === 1 ? 'an older one' : `${linked.merged} older ones`} into the one in use` : ''}.\n`);
+    return 0;
+}
+export async function linkSoon(io, origin) {
+    try {
+        if (!(await linkDue(io, origin, LINK_EVERY_MS)))
+            return;
+        if (!(await readMachine(io)))
+            return;
+        await markLinked(io, origin);
+        io.background(['machine', 'link', '--quiet', '--origin', origin]);
+    }
+    catch { }
+}

package/dist/machine-command.js

@@ -1,6 +1,7 @@
 import { APP_NAMES } from "./apps/ids.js";
 import { readCredential, signedInSlots } from "./credentials.js";
 import { originArgs } from "./hooks.js";
+import { machineLink } from "./link.js";
 import { attest, clockOffset, machinePath, readMachine, rotateMachine } from "./machine.js";
 import { computerName } from "./remote.js";
 import { checkSignIn } from "./signin.js";
@@ -97,5 +98,7 @@ export function machine(io, command) {
             return machineAttest(io, command);
         case 'rotate':
             return machineRotate(io, command);
+        case 'link':
+            return machineLink(io, command);
     }
 }

package/dist/pickup.js

@@ -8,6 +8,7 @@ import { clip, delegatedOf, describe, HANDED_PREFIX, isHandedWake, } from "./for
 import { goesBy, HANDED_GRACE_MS, namesAnotherComputer } from "./handed.js";
 import { herdrTarget, reportCommand } from "./herdr.js";
 import { holdCommand } from "./hold.js";
+import { linkSoon } from "./link.js";
 import { unwokenLine } from "./loaded.js";
 import { stuckLine } from "./mcp-health.js";
 import { isPermissionCard, isPromptApp, POSTED_MAX, sessionName, sessionPosted, settlePrompts, } from "./permission.js";
@@ -147,6 +148,7 @@ export async function pickup(io, options, hook = { fallback: '' }) {
     try {
         const input = await hookInput(io);
         const { cwd } = input;
+        await linkSoon(io, origin);
         if (mode === 'handoff' && isPromptApp(app))
             await settlePrompts(io, { session: input.session, event: 'prompt' });
         const known = mode === 'handoff' && app === DEFAULT_APP && input.session

package/dist/remote.js

@@ -5,6 +5,7 @@ import { APP_NAMES, DEFAULT_APP } from "./apps/ids.js";
 import { cleanName, DEFAULT_ORIGIN } from "./args.js";
 import { readCredential } from "./credentials.js";
 import { configDir, writeWhole } from "./files.js";
+import { linkSoon } from "./link.js";
 import { recordHelper } from "./mcp-health.js";
 import { VERSION } from "./version.js";
 export const HELPER = 'pendingyou-mcp-headers';
@@ -261,6 +262,7 @@ export async function mcpHeaders(io, options) {
         const token = await helperToken(io, options.origin, HELPER_WAIT_MS, app);
         headers(token);
         await recordHelper(io, options.origin, app, 'ok');
+        await linkSoon(io, options.origin);
         return 0;
     }
     catch (error) {

package/dist/sdk/code.js

@@ -0,0 +1,138 @@
+import { generateKey, importKey, sha256 } from "./dpop.js";
+import { SignInError } from "./errors.js";
+import { nonces, tokenRequest } from "./oauth.js";
+export const AUTHORIZE_PATH = '/oauth/authorize';
+const random = (bytes) => {
+    let binary = '';
+    for (const byte of crypto.getRandomValues(new Uint8Array(bytes)))
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
+};
+export async function codeSignIn(options) {
+    const { jwk } = await generateKey();
+    const pending = {
+        version: 1,
+        origin: options.origin.replace(/\/+$/, ''),
+        clientId: options.clientId,
+        redirectUri: options.redirectUri,
+        scopes: [...options.scopes],
+        state: random(16),
+        verifier: random(32),
+        key: jwk,
+    };
+    return resumeCodeSignIn(pending, options);
+}
+export async function resumeCodeSignIn(pending, options = {}) {
+    const http = {
+        fetch: options.fetch ?? ((input, init) => fetch(input, init)),
+        now: options.now ?? (() => Date.now()),
+    };
+    const key = await importKey(pending.key);
+    const url = new URL(`${pending.origin}${AUTHORIZE_PATH}`);
+    url.search = new URLSearchParams({
+        response_type: 'code',
+        client_id: pending.clientId,
+        redirect_uri: pending.redirectUri,
+        scope: pending.scopes.join(' '),
+        state: pending.state,
+        code_challenge: await sha256(pending.verifier),
+        code_challenge_method: 'S256',
+        resource: `${pending.origin}/v1`,
+        dpop_jkt: key.jkt,
+    }).toString();
+    let finished = false;
+    async function finish(callback) {
+        if (finished)
+            throw new SignInError('finished', 'This sign-in is finished already.');
+        const back = new URL(String(callback));
+        if (back.searchParams.get('state') !== pending.state)
+            throw new SignInError('state_mismatch', 'This isn’t the answer to this sign-in.');
+        const iss = back.searchParams.get('iss');
+        if (iss !== null && iss !== pending.origin)
+            throw new SignInError('issuer_mismatch', 'This answer came from somewhere else.');
+        const error = back.searchParams.get('error');
+        if (error)
+            throw new SignInError(error, error === 'access_denied'
+                ? 'The person didn’t allow it.'
+                : `Pending You refused the sign-in (${error}).`);
+        const code = back.searchParams.get('code');
+        if (!code)
+            throw new SignInError('no_code', 'The answer had no code.');
+        finished = true;
+        const result = await tokenRequest(http, pending.origin, key, {
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: pending.redirectUri,
+            client_id: pending.clientId,
+            code_verifier: pending.verifier,
+            resource: `${pending.origin}/v1`,
+        }, nonces());
+        if (!result.ok)
+            throw new SignInError(result.error, `Pending You didn’t finish the sign-in (${result.error}). Start it again.`);
+        const credentials = {
+            version: 1,
+            origin: pending.origin,
+            clientId: pending.clientId,
+            accessToken: result.tokens.access_token,
+            refreshToken: result.tokens.refresh_token,
+            expiresAt: http.now() + result.tokens.expires_in * 1000,
+            scopes: result.tokens.scope ? result.tokens.scope.split(' ') : [...pending.scopes],
+            key: pending.key,
+        };
+        const store = options.store;
+        if (store)
+            await store.exclusive(() => store.save(credentials));
+        return credentials;
+    }
+    return { url: url.toString(), pending, finish };
+}
+export function isPendingCodeSignIn(value) {
+    const entry = value;
+    return (typeof entry === 'object' &&
+        entry !== null &&
+        entry.version === 1 &&
+        typeof entry.origin === 'string' &&
+        typeof entry.clientId === 'string' &&
+        typeof entry.redirectUri === 'string' &&
+        Array.isArray(entry.scopes) &&
+        typeof entry.state === 'string' &&
+        typeof entry.verifier === 'string' &&
+        typeof entry.key === 'object' &&
+        entry.key !== null);
+}
+export const PENDING_KEY = 'pendingyou.signin';
+const sessionStorageHere = () => globalThis.sessionStorage;
+export async function redirectToSignIn(options) {
+    const storage = options.storage ?? sessionStorageHere();
+    if (!storage)
+        throw new TypeError('No sessionStorage here: pass `storage`');
+    const started = await codeSignIn(options);
+    storage.setItem(PENDING_KEY, JSON.stringify(started.pending));
+    const go = options.go ??
+        ((url) => {
+            const here = globalThis.location;
+            if (!here)
+                throw new TypeError('No location here: pass `go`');
+            here.assign(url);
+        });
+    go(started.url);
+}
+export async function finishRedirectSignIn(options = {}) {
+    const storage = options.storage ?? sessionStorageHere();
+    if (!storage)
+        throw new TypeError('No sessionStorage here: pass `storage`');
+    const kept = storage.getItem(PENDING_KEY);
+    storage.removeItem(PENDING_KEY);
+    let pending = null;
+    try {
+        pending = kept ? JSON.parse(kept) : null;
+    }
+    catch { }
+    if (!isPendingCodeSignIn(pending))
+        throw new SignInError('not_started', 'No sign-in was started in this tab.');
+    const url = options.url ?? globalThis.location?.href ?? undefined;
+    if (!url)
+        throw new TypeError('No location here: pass `url`');
+    const started = await resumeCodeSignIn(pending, options);
+    return started.finish(url);
+}

package/dist/sdk/index.js

@@ -1,5 +1,6 @@
 export { backoffMs, RESYNC_MS } from "./changes.js";
 export { createClient } from "./client.js";
+export { codeSignIn, finishRedirectSignIn, redirectToSignIn, resumeCodeSignIn, } from "./code.js";
 export { deviceSignIn, } from "./device.js";
 export { generateKey, importKey, thumbprint } from "./dpop.js";
 export { ApiError, SignedOutError, SignInError } from "./errors.js";

package/dist/sdk/node.js

@@ -1,7 +1,10 @@
 import { execFile } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
 import { chmod, mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:http';
 import { dirname, join } from 'node:path';
+import { codeSignIn } from "./code.js";
+import { SignInError } from "./errors.js";
 import { isCredentials } from "./store.js";
 export const STALE_LOCK_MS = 30_000;
 export const LOCK_WAIT_MS = 15_000;
@@ -87,6 +90,77 @@ export function fileStore(path) {
         exclusive: (work) => withFileLock(path, work),
     };
 }
+const page = (title, body) => `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>${title}</title><body style="font:16px/1.5 system-ui,sans-serif;max-width:32rem;margin:15vh auto;padding:0 16px"><h1 style="font-weight:500">${title}</h1><p>${body}</p></body>`;
+export async function loopbackSignIn(options) {
+    const registered = new URL(options.redirectUri ?? 'http://127.0.0.1/callback');
+    if (registered.protocol !== 'http:' ||
+        !['127.0.0.1', '[::1]', 'localhost'].includes(registered.hostname))
+        throw new TypeError('A loopback sign-in comes back to http://127.0.0.1');
+    const server = createServer();
+    await new Promise((done, fail) => {
+        server.once('error', fail);
+        server.listen(options.port ?? 0, registered.hostname === '[::1]' ? '::1' : '127.0.0.1', () => done());
+    });
+    const address = server.address();
+    const port = typeof address === 'object' && address ? address.port : 0;
+    const back = new URL(registered.toString());
+    back.port = String(port);
+    const redirectUri = back.toString();
+    const started = await codeSignIn({ ...options, redirectUri });
+    let timer;
+    let closed = false;
+    const close = () => {
+        if (closed)
+            return;
+        closed = true;
+        if (timer)
+            clearTimeout(timer);
+        server.close();
+    };
+    const html = { 'content-type': 'text/html; charset=utf-8', connection: 'close' };
+    const signedIn = new Promise((resolve, reject) => {
+        const stop = (error) => {
+            close();
+            reject(error);
+        };
+        timer = setTimeout(() => stop(new SignInError('expired_token', 'The browser didn’t come back in time.')), options.timeoutMs ?? 10 * 60_000);
+        options.signal?.addEventListener('abort', () => stop(new SignInError('aborted', 'The sign-in was stopped.')));
+        let taken = false;
+        server.on('request', (request, response) => {
+            const url = new URL(request.url ?? '/', redirectUri);
+            if (request.method !== 'GET' || url.pathname !== back.pathname) {
+                response
+                    .writeHead(404, { 'content-type': 'text/plain', connection: 'close' })
+                    .end('Not found');
+                return;
+            }
+            if (taken) {
+                response
+                    .writeHead(409, html)
+                    .end(page('Already answered', 'Close this tab and go back to the app.'));
+                return;
+            }
+            taken = true;
+            started.finish(url).then((credentials) => {
+                response
+                    .writeHead(200, html)
+                    .end(page('You’re signed in', 'Close this tab and go back to the app.'));
+                close();
+                resolve(credentials);
+            }, (error) => {
+                response
+                    .writeHead(400, html)
+                    .end(page('Not signed in', 'Go back to the app and start signing in again.'));
+                close();
+                reject(error);
+            });
+        });
+    });
+    signedIn.catch(() => { });
+    if (options.open)
+        await options.open(started.url);
+    return { url: started.url, redirectUri, signedIn, close };
+}
 const runFile = (command, args) => new Promise((resolve, reject) => {
     execFile(command, args, { timeout: 60_000, maxBuffer: 64 * 1024 }, (error, stdout, stderr) => {
         if (error)

package/dist/state.js

@@ -12,6 +12,7 @@ async function load(io) {
         handed: file?.handed && typeof file.handed === 'object' ? file.handed : {},
         ...(file?.reminded && typeof file.reminded === 'object' ? { reminded: file.reminded } : {}),
         ...(file?.unwoken && typeof file.unwoken === 'object' ? { unwoken: file.unwoken } : {}),
+        ...(file?.linked && typeof file.linked === 'object' ? { linked: file.linked } : {}),
     };
 }
 async function change(io, edit) {
@@ -85,3 +86,12 @@ export async function claimUnwoken(io, session) {
     });
     return claimed;
 }
+export async function linkDue(io, origin, every) {
+    const at = (await load(io)).linked?.[origin];
+    return typeof at !== 'number' || io.now() - at >= every || at > io.now();
+}
+export function markLinked(io, origin) {
+    return change(io, (state) => {
+        state.linked = { ...state.linked, [origin]: io.now() };
+    });
+}

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = '0.27.0';
+export const VERSION = '0.29.0';

package/mod/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pendingyou-wake",
   "displayName": "Pending You",
-  "version": "2.39.0",
+  "version": "2.44.0",
   "description": "Wakes Claude Code when your person answers a Pending You card it posted, even while it sits idle. Installed by `npx pendingyou init`.",
   "author": {
     "name": "RecordPlane",

package/mod/README.md

@@ -4,4 +4,4 @@ The pendingyou command line’s copy of the Pending You plugin’s wake mod, for
 
 In each session it learns the cards the session posts to Pending You, checks them through the session’s own Pending You connection, and starts a turn when your person answers, writes back or a fallback comes due, or hands the session a question from another of their assistants (CLI 0.14.0), even while it sits idle. It answers `npx pendingyou hold` itself, so nothing waits in the background, and shows “2 waiting on you” under the prompt, after the plugin’s name. With the Pending You plugin installed too, only one copy acts.
 
-Generated from recordplane/pendingyou (packages/claude-plugin/src/wake) with Pending You’s guide 2.39.0; send changes there.
+Generated from recordplane/pendingyou (packages/claude-plugin/src/wake) with Pending You’s guide 2.44.0; send changes there.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pendingyou",
-  "version": "0.27.0",
+  "version": "0.29.0",
   "description": "Pending You for your coding agents: one command sets up Claude Code, Codex, OpenCode and Pi to ask you through Pending You and hear your answers, even while they sit idle.",
   "license": "Apache-2.0",
   "homepage": "https://www.pendingyou.com",