pendingyou 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.7.0
+
+- Faster hooks. They ran `npx -y --prefer-offline pendingyou@<version> …`, and npx alone took about half a second
+  (and real CPU) before each one started; sessions starting or resuming together queued on npm's cache lock. `init`
+  now keeps a copy of this version in `~/.config/pendingyou/cli/<version>/` (copied from the package it runs from, or
+  installed with `npm install --prefix`, checked before it's used) and the hooks run it with Node directly:
+  `"<node>" "~/.config/pendingyou/cli/0.7.0/node_modules/pendingyou/dist/cli.js" handoff || true`. A signed-out
+  pickup went from 0.42 s to 0.04 s; a hand-off with its request from 0.77 s to 0.26 s. When the copy can't be made,
+  the hooks keep the npx form. Running `init` again upgrades the copy in place and removes old versions;
+  `uninstall` removes it; `status` says how the hooks run. To switch: `npx pendingyou@latest init`.
+- `init` no longer looks hung: it says before each slow step what it's waiting on ("Adding the pendingyou MCP server
+  to Claude Code (this can take a minute)…"), gives Claude Code 3 minutes, and says plainly if it ran out. It reads
+  the MCP server from `~/.claude.json` (read only) instead of asking `claude mcp get`, which takes a minute, so a
+  server that's already there costs no `claude` call at all.
+- Fixed: `init` kept a `pendingyou` MCP server that pointed at another origin (staging, when you asked for
+  production) and only said "check Claude Code didn't add the MCP server". It now names both addresses and replaces
+  the old one once you say so: asked at the terminal, or `--yes` to replace without asking. With nobody to ask, it
+  prints the two `claude mcp` commands. Then restart Claude Code, run `/mcp` and Authenticate.
+- Everything from 0.6.0 stays: the 3-second deadline (which no longer loses half a second to npx), the background
+  refresh and the Stop check.
+
 ## 0.6.0
 
 - Fixed: a hook could run past Claude Code's 10 seconds (`UserPromptSubmit hook … timed out after 10s — output

package/README.md

@@ -15,15 +15,28 @@ Run it once on each computer. It:
 - adds three hooks to `~/.claude/settings.json`: a new session picks up answers that arrived while nothing was
   running, your next message brings a waiting answer with it, and a check when Claude Code finishes a turn (below),
 - lets Claude Code start `npx pendingyou hold` and use Pending You's tools without a permission prompt, so a question
-  it asks while you're away doesn't wait on one.
+  it asks while you're away doesn't wait on one,
+- keeps a copy of this version for the hooks in `~/.config/pendingyou/cli/<version>/`, so they start in a few
+  hundredths of a second instead of waiting on npx (about half a second each).
 
 Your other settings are kept as they are. `npx pendingyou uninstall` removes exactly what `init` added.
 
+Adding the MCP server can take Claude Code a minute or more (it checks its servers); `init` says when it's waiting on
+that. If Claude Code already has a `pendingyou` server pointing somewhere else (staging, say), `init` names both and
+asks before replacing it; `--yes` replaces it without asking, and with nobody to ask it prints the two commands to
+run. Afterwards restart Claude Code, run `/mcp`, choose pendingyou and Authenticate.
+
 The hooks never get in your way: if anything goes wrong (no network, not signed in, a bad option), they print nothing
 and let your message through. Each one stops within 3 seconds whatever happens, with at most its one-line reminder, and
 never refreshes the sign-in itself: when that's due, it starts the refresh in the background, which finishes on its
 own. Running `init` again updates them in place, and adds any a newer version brings.
 
+The hooks run that copy with Node directly, like
+`"/opt/homebrew/bin/node" "~/.config/pendingyou/cli/0.7.0/node_modules/pendingyou/dist/cli.js" handoff || true` (the
+paths in full). If the copy can't be made (no npm, no network), they run through `npx -y --prefer-offline
+pendingyou@<version>` instead. `npx pendingyou status` says which. If you remove the Node they run with, run `init`
+again.
+
 ## Nothing left only in chat
 
 Deep into a long conversation, Claude Code tends to end a turn with a question for you, a step only you can do, or a
@@ -94,7 +107,7 @@ more, then skipped. `--once` stops after the first.
 
 | Command | What it does |
 | --- | --- |
-| `init` | Set up Claude Code on this computer (`--no-login`, `--no-browser`, `--device`) |
+| `init` | Set up Claude Code on this computer (`--no-login`, `--no-browser`, `--device`, `--yes`) |
 | `hold <requestId>` | Wait for the answer, print it, exit (`--timeout 4h`) |
 | `status` | What's set up; exits 0 when Claude Code hears answers right away |
 | `login` / `logout` | Sign this computer in or out (`--device`, `--force`, `--all`) |
@@ -111,7 +124,9 @@ before or after the command.
 The sign-in only hears answers to your own Claude Code assistants' questions, or to the one assistant you picked. It isn't an assistant: it can't ask,
 answer or change anything, and it doesn't show up as one. It's stored in `~/.config/pendingyou/credentials.json`
 (readable only by you), refreshes itself, and ends after 30 days or on `logout`. `state.json` beside it remembers
-which answers were already handed over (ids only). Nothing is sent anywhere but Pending You.
+which answers were already handed over (ids only), `claude-code.json` what `init` added, and `cli/` the hooks' copy
+of the command line. `init` reads `~/.claude.json` only to see whether Claude Code has a `pendingyou` MCP server and
+where it points. Nothing is sent anywhere but Pending You.
 
 ## Development
 

package/dist/args.js

@@ -62,7 +62,7 @@ const FLAGS = {
     pickup: { origin: true },
     handoff: { origin: true },
     stopcheck: { origin: true },
-    init: { origin: true, 'no-login': false, 'no-browser': false, device: false },
+    init: { origin: true, 'no-login': false, 'no-browser': false, device: false, yes: false },
     uninstall: { origin: true },
     watch: { origin: true, once: false },
     refresh: { origin: true, force: false },
@@ -191,6 +191,7 @@ export function parseArgs(argv, env = {}) {
                 login: !flags.has('no-login'),
                 browser: !flags.has('no-browser'),
                 device: flags.has('device'),
+                yes: flags.has('yes'),
             };
         case 'watch':
             none();
@@ -230,5 +231,6 @@ export const USAGE = `pendingyou: Pending You for Claude Code
   npx pendingyou stopcheck     Questions or steps for you left only in chat (the Stop hook)
 
 Options: --origin <url> (default ${DEFAULT_ORIGIN}), --timeout 4h (hold), --no-browser and --device (login,
-init), --no-login (init), --all (logout), --force (login), --once (watch).
+init), --no-login (init), --yes (init: replace a pendingyou MCP server that points elsewhere without asking),
+--all (logout), --force (login), --once (watch).
 `;

package/dist/claude.js

@@ -3,12 +3,17 @@
 // ~/.claude/settings.json. Settings are merged, never replaced: a file that isn't JSON is left alone, entries that
 // aren't ours are never touched, and running init again changes nothing it doesn't need to. What init added is written
 // down in ~/.config/pendingyou/claude-code.json, so uninstall removes exactly that.
+//
+// Since 0.7.0 the hooks run a private copy of this version with Node directly (install.ts), and init asks Claude Code
+// itself as little as it can: `claude mcp get` and `claude mcp add` each take up to a minute or more (Claude Code checks
+// its servers), so the MCP server is looked up in ~/.claude.json first (read only), and init says what it's waiting on.
 import { createHash } from 'node:crypto';
 import { rm, rmdir } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { DEFAULT_ORIGIN } from "./args.js";
 import { PlainError } from "./errors.js";
 import { claudeDir, configDir, readJson, readText, writeWhole } from "./files.js";
+import { hookForm, hookRuns, installCli, pruneCli, removeCli, shellQuote, } from "./install.js";
 import { VERSION } from "./version.js";
 export const MCP_NAME = 'pendingyou';
 /** The hooks, by Claude Code event, and the command each runs. */
@@ -46,13 +51,15 @@ export function selfCommand(io) {
                 : `node ${quote(io.script)}`;
 }
 /**
- * A hook's command line: the command first, then `--origin` only when it isn't the default. `|| true` keeps the hook
- * from ever blocking the person, even when npx can't fetch the package or the command fails before it starts (Claude
- * Code blocks a message when its UserPromptSubmit hook exits 2, and flags any other non-zero exit).
+ * A hook's command line: the private copy run by Node directly when there is one (`"<node>" "<…/cli.js>"`, both
+ * quoted), otherwise selfCommand; the command first, then `--origin` only when it isn't the default. `|| true` keeps
+ * the hook from ever blocking the person, even when npx can't fetch the package or the command fails before it starts
+ * (Claude Code blocks a message when its UserPromptSubmit hook exits 2, and flags any other non-zero exit).
  */
-export function hookCommand(io, origin, sub) {
+export function hookCommand(io, origin, sub, direct) {
     const flag = origin === DEFAULT_ORIGIN ? '' : ` --origin ${quote(origin)}`;
-    return `${selfCommand(io)} ${sub}${flag} || true`;
+    const self = direct ? `${shellQuote(direct.node)} ${shellQuote(direct.script)}` : selfCommand(io);
+    return `${self} ${sub}${flag} || true`;
 }
 /** Whether a hook command is one of ours: it runs pendingyou's `pickup`, `handoff` or `stopcheck`. */
 export function isOurHook(command, sub) {
@@ -170,39 +177,157 @@ export function unmergeSettings(settings, permissionsAdded) {
     return { settings: next, changed };
 }
 const writeSettings = (io, settings) => writeWhole(settingsPath(io), `${JSON.stringify(settings, null, 2)}\n`);
-/** The MCP server at user scope, unless Claude Code already has one called pendingyou. */
-async function addMcp(io, origin) {
+/** How long Claude Code may take to look up, add or remove an MCP server (it checks each server it has). */
+const MCP_TIMEOUT_MS = 180_000;
+/** Claude Code's own state file: ~/.claude.json, or .claude.json in $CLAUDE_CONFIG_DIR. */
+export const claudeJsonPath = (io) => io.env.CLAUDE_CONFIG_DIR
+    ? join(io.env.CLAUDE_CONFIG_DIR, '.claude.json')
+    : join(io.home, '.claude.json');
+/**
+ * The user-scope pendingyou MCP server, read from ~/.claude.json without asking Claude Code (which takes a minute):
+ * the server, null when there isn't one, or 'unknown' when the file isn't there or isn't the shape expected. Only
+ * mcpServers.pendingyou is looked at; nothing is written.
+ */
+export async function mcpFromFile(io) {
+    let parsed;
+    try {
+        const text = await readText(claudeJsonPath(io));
+        if (text === null)
+            return 'unknown';
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return 'unknown';
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+        return 'unknown';
+    const servers = parsed.mcpServers;
+    if (servers === undefined)
+        return null;
+    if (typeof servers !== 'object' || servers === null || Array.isArray(servers))
+        return 'unknown';
+    const server = servers[MCP_NAME];
+    if (server === undefined)
+        return null;
+    if (typeof server !== 'object' || server === null)
+        return 'unknown';
+    const url = server.url;
+    return { url: typeof url === 'string' ? url : null, scope: 'user' };
+}
+/** `claude mcp get pendingyou`'s answer: the server, null when there isn't one, 'timeout' when it took too long. */
+async function mcpFromClaude(io) {
+    const result = await io.run('claude', ['mcp', 'get', MCP_NAME], MCP_TIMEOUT_MS);
+    if (result.code === 124)
+        return 'timeout';
+    if (result.code !== 0)
+        return null;
+    const url = /^\s*URL:\s*(\S+)/m.exec(result.stdout)?.[1] ?? null;
+    const scope = /^\s*Scope:\s*(\w+)/m.exec(result.stdout)?.[1]?.toLowerCase();
+    return {
+        url,
+        scope: scope === 'user' || scope === 'local' || scope === 'project' ? scope : null,
+    };
+}
+const sameUrl = (a, b) => a.replace(/\/+$/, '') === b.replace(/\/+$/, '');
+const addCommand = (url) => `claude mcp add --scope user --transport http ${MCP_NAME} ${url}`;
+const removeCommand = (scope) => `claude mcp remove${scope ? ` --scope ${scope}` : ''} ${MCP_NAME}`;
+/**
+ * The MCP server at user scope. One already there pointing at this origin is kept; one pointing elsewhere (staging
+ * when you asked for production) is replaced once you say so: asked at the terminal, `--yes` without asking, or, with
+ * nobody to ask, the two commands are printed.
+ */
+async function addMcp(io, origin, options, progress) {
+    const url = `${origin}/mcp`;
+    let existing = await mcpFromFile(io);
+    if (existing !== 'unknown' && existing?.url && sameUrl(existing.url, url))
+        return {
+            added: false,
+            step: { ok: true, text: `The pendingyou MCP server (${url}) was already in Claude Code.` },
+        };
     const version = await io.run('claude', ['--version'], 20_000);
     if (version.code === 127)
         return {
             added: false,
             step: {
                 ok: false,
-                text: `Claude Code isn’t on this computer’s PATH. Install it, then run: claude mcp add --scope user --transport http ${MCP_NAME} ${origin}/mcp`,
+                text: `Claude Code isn’t on this computer’s PATH. Install it, then run: ${addCommand(url)}`,
             },
         };
-    const existing = await io.run('claude', ['mcp', 'get', MCP_NAME], 20_000);
-    if (existing.code === 0)
+    if (existing === 'unknown') {
+        progress('Checking Claude Code’s MCP servers (this can take a minute)…\n');
+        existing = await mcpFromClaude(io);
+        if (existing === 'timeout')
+            return {
+                added: false,
+                step: {
+                    ok: false,
+                    text: `Claude Code took more than 3 minutes to list its MCP servers, so I left them alone. Check with: claude mcp get ${MCP_NAME}. If it isn’t there, run: ${addCommand(url)}`,
+                },
+            };
+    }
+    let replacing = null;
+    if (existing) {
+        if (!existing.url || sameUrl(existing.url, url))
+            return {
+                added: false,
+                step: { ok: true, text: 'The pendingyou MCP server was already in Claude Code.' },
+            };
+        progress(`Claude Code’s pendingyou MCP server points at ${existing.url}, not ${url}.\n`);
+        const commands = `  ${removeCommand(existing.scope)}\n    ${addCommand(url)}`;
+        let replace = options.yes;
+        if (!replace && io.interactive) {
+            const answer = await io.ask(`Replace it with ${url}? [y/N] `);
+            replace = /^\s*y(es)?\s*$/i.test(answer);
+            if (!replace)
+                return {
+                    added: false,
+                    step: {
+                        ok: false,
+                        text: `Kept the MCP server at ${existing.url}. To switch later, run:\n  ${commands}`,
+                    },
+                };
+        }
+        if (!replace)
+            return {
+                added: false,
+                step: {
+                    ok: false,
+                    text: `Kept the MCP server at ${existing.url}. To use ${url}, run init again with --yes, or run:\n  ${commands}`,
+                },
+            };
+        progress('Removing the old pendingyou MCP server (this can take a minute)…\n');
+        const removed = await io.run('claude', ['mcp', 'remove', ...(existing.scope ? ['--scope', existing.scope] : []), MCP_NAME], MCP_TIMEOUT_MS);
+        if (removed.code !== 0)
+            return {
+                added: false,
+                step: {
+                    ok: false,
+                    text: `${removed.code === 124 ? 'Claude Code took more than 3 minutes to remove' : 'Claude Code didn’t remove'} the old MCP server. Run:\n  ${commands}`,
+                },
+            };
+        replacing = existing;
+    }
+    progress('Adding the pendingyou MCP server to Claude Code (this can take a minute)…\n');
+    const add = await io.run('claude', ['mcp', 'add', '--scope', 'user', '--transport', 'http', MCP_NAME, url], MCP_TIMEOUT_MS);
+    if (add.code === 0)
         return {
-            added: false,
-            step: { ok: true, text: 'The pendingyou MCP server was already in Claude Code.' },
-        };
-    const add = await io.run('claude', ['mcp', 'add', '--scope', 'user', '--transport', 'http', MCP_NAME, `${origin}/mcp`], 30_000);
-    return add.code === 0
-        ? {
             added: true,
             step: {
                 ok: true,
-                text: `Added the pendingyou MCP server (${origin}/mcp) for every project.`,
-            },
-        }
-        : {
-            added: false,
-            step: {
-                ok: false,
-                text: `Claude Code didn’t add the MCP server. Run: claude mcp add --scope user --transport http ${MCP_NAME} ${origin}/mcp`,
+                text: replacing
+                    ? `Replaced the pendingyou MCP server (was ${replacing.url}) with ${url}. Restart Claude Code, then run /mcp, choose pendingyou and Authenticate.`
+                    : `Added the pendingyou MCP server (${url}) for every project.`,
             },
         };
+    return {
+        added: false,
+        step: {
+            ok: false,
+            text: add.code === 124
+                ? `Claude Code took more than 3 minutes to add the MCP server. Check with: claude mcp get ${MCP_NAME}. If it isn’t there, run: ${addCommand(url)}`
+                : `Claude Code didn’t add the MCP server. Run: ${addCommand(url)}`,
+        },
+    };
 }
 /** The stub skill: written when it isn't there, or refreshed while it's still the one init wrote. */
 async function saveSkill(io, origin, before) {
@@ -238,27 +363,50 @@ async function saveSkill(io, origin, before) {
         step: { ok: true, text: `Saved the skill to ${path}.` },
     };
 }
-/** Everything init does in Claude Code (not the sign-in). Idempotent. */
-export async function installClaude(io, origin) {
+/** Everything init does in Claude Code (not the sign-in). Idempotent. Each step is reported as it's done. */
+export async function installClaude(io, origin, options = {}) {
     const before = await readManifest(io);
     const steps = [];
-    const mcp = await addMcp(io, origin);
-    steps.push(mcp.step);
+    const report = (step) => {
+        steps.push(step);
+        options.report?.(step);
+    };
+    const progress = (text) => io.out(text);
+    const mcp = await addMcp(io, origin, { yes: options.yes ?? false }, progress);
+    report(mcp.step);
     const skill = await saveSkill(io, origin, before?.skill ?? null);
-    steps.push(skill.step);
+    report(skill.step);
+    // The hooks' own copy of this version, unless PENDINGYOU_SELF says what they run.
+    let installed = null;
+    if (!io.env.PENDINGYOU_SELF) {
+        const cli = await installCli(io, progress);
+        installed = cli.installed;
+        report(cli.installed
+            ? {
+                ok: true,
+                text: `${cli.installed.how === 'kept' ? `pendingyou ${VERSION} for the hooks was already in` : `Installed pendingyou ${VERSION} for the hooks in`} ${cli.installed.prefix} (they run it with ${cli.installed.node}, no npx).`,
+            }
+            : {
+                ok: true,
+                text: `Couldn’t install pendingyou for the hooks (${cli.error}), so they run it through npx, which is slower. Run init again to retry.`,
+            });
+    }
     const commands = Object.fromEntries(Object.keys(HOOKS).map((event) => [
         event,
-        hookCommand(io, origin, HOOKS[event]),
+        hookCommand(io, origin, HOOKS[event], installed),
     ]));
     const merged = mergeSettings(await readSettings(io), commands);
     if (merged.changed)
         await writeSettings(io, merged.settings);
-    steps.push({
+    report({
         ok: true,
         text: merged.changed
             ? `Installed or updated the session-start pickup, next-message hand-off and Stop check hooks in ${settingsPath(io)}.`
             : 'The hooks were already installed.',
     });
+    // The hooks run this version now (or npx): the copies of other versions are no longer used.
+    if (!io.env.PENDINGYOU_SELF)
+        await pruneCli(io, installed?.version ?? null);
     const manifest = {
         version: 1,
         origin,
@@ -267,6 +415,7 @@ export async function installClaude(io, origin) {
         skill: skill.skill,
         hooks: commands,
         permissions: [...new Set([...(before?.permissions ?? []), ...merged.permissionsAdded])],
+        cli: installed ? { version: installed.version, prefix: installed.prefix } : null,
     };
     await writeWhole(manifestPath(io), `${JSON.stringify(manifest, null, 2)}\n`, { secret: true });
     return steps;
@@ -295,8 +444,11 @@ export async function uninstallClaude(io) {
         else if (text !== null)
             steps.push({ ok: true, text: `Kept ${manifest.skill.path}: it was changed after init.` });
     }
+    if (await removeCli(io))
+        steps.push({ ok: true, text: 'Removed the hooks’ copy of pendingyou.' });
     if (manifest?.mcpAdded) {
-        const result = await io.run('claude', ['mcp', 'remove', '--scope', 'user', MCP_NAME], 30_000);
+        io.out('Removing the pendingyou MCP server from Claude Code (this can take a minute)…\n');
+        const result = await io.run('claude', ['mcp', 'remove', '--scope', 'user', MCP_NAME], MCP_TIMEOUT_MS);
         steps.push(result.code === 0
             ? { ok: true, text: 'Removed the pendingyou MCP server from Claude Code.' }
             : {
@@ -311,20 +463,33 @@ export async function uninstallClaude(io) {
 export async function claudeState(io) {
     const version = await io.run('claude', ['--version'], 20_000);
     const claude = version.code === 0 ? version.stdout.trim().split(/\s+/)[0] || 'installed' : null;
-    const mcp = claude ? (await io.run('claude', ['mcp', 'get', MCP_NAME], 20_000)).code === 0 : false;
+    let mcp = false;
+    const fromFile = await mcpFromFile(io);
+    if (fromFile !== 'unknown')
+        mcp = fromFile ?? false;
+    else if (claude) {
+        const fromClaude = await mcpFromClaude(io);
+        mcp = fromClaude === 'timeout' ? 'unknown' : (fromClaude ?? false);
+    }
     const skill = (await readText(skillPath(io))) !== null;
-    let installed = (_event) => false;
+    let ours = (_event) => undefined;
     try {
         const all = objectAt(await readSettings(io), 'hooks') ?? {};
-        installed = (event) => Array.isArray(all[event]) &&
-            all[event].some((group) => (group.hooks ?? []).some((hook) => isOurHook(hook.command, HOOKS[event])));
+        ours = (event) => Array.isArray(all[event])
+            ? all[event]
+                .flatMap((group) => group.hooks ?? [])
+                .find((hook) => isOurHook(hook.command, HOOKS[event]))
+            : undefined;
     }
     catch { }
+    const start = ours('SessionStart');
+    const form = typeof start?.command === 'string' ? hookForm(start.command) : null;
     return {
         claude,
         mcp,
         skill,
-        hooks: installed('SessionStart') && installed('UserPromptSubmit'),
-        stopcheck: installed('Stop'),
+        hooks: Boolean(start && ours('UserPromptSubmit')),
+        stopcheck: Boolean(ours('Stop')),
+        form: form ? { ...form, runs: await hookRuns(form) } : null,
     };
 }

package/dist/install.js

@@ -0,0 +1,163 @@
+// The command line's own copy for Claude Code's hooks (0.7.0). Hooks used to run `npx -y --prefer-offline
+// pendingyou@<version> …`: npx costs about half a second before the command starts, and sessions starting together
+// queue on npm's cache lock. Now `init` puts this exact version in a private folder,
+// ~/.config/pendingyou/cli/<version>/node_modules/pendingyou, and the hooks run it with Node directly:
+//
+//   "<node>" "<config>/cli/<version>/node_modules/pendingyou/dist/cli.js" handoff || true
+//
+// The copy comes from the package init is running from when that's this very version (npx's copy: no network), and
+// otherwise from `npm install --prefix`. It's built in a temporary folder, checked (`--version` must print this
+// version), then moved into place, so a hook never runs half a copy. Running init again keeps a copy that checks out,
+// and removes the other versions once the hooks point at this one. When none of that works, the hooks keep the npx
+// form, which is slower but works.
+import { randomBytes } from 'node:crypto';
+import { cp, mkdir, readdir, realpath, rename, rm, stat } from 'node:fs/promises';
+import { basename, dirname, isAbsolute, join } from 'node:path';
+import { configDir, readJson } from "./files.js";
+import { VERSION } from "./version.js";
+/** Where the private copies live: ~/.config/pendingyou/cli. */
+export const cliRoot = (io) => join(configDir(io), 'cli');
+/** One version's prefix: ~/.config/pendingyou/cli/<version>. */
+export const cliPrefix = (io, version = VERSION) => join(cliRoot(io), version);
+/** The command line inside a prefix. */
+export const cliScript = (prefix) => join(prefix, 'node_modules', 'pendingyou', 'dist', 'cli.js');
+/** How long npm may take to install the package (it usually takes a few seconds). */
+const NPM_TIMEOUT_MS = 180_000;
+const exists = (path) => stat(path).then(() => true, () => false);
+/**
+ * The Node the hooks should run: the running one, by the path on PATH that leads to it when there is one
+ * (Homebrew's /opt/homebrew/bin/node outlives an upgrade; the versioned folder it points into doesn't).
+ */
+export async function hookNode(io) {
+    const running = await realpath(io.execPath).catch(() => null);
+    if (running)
+        for (const dir of (io.env.PATH ?? '').split(':')) {
+            if (!dir || !isAbsolute(dir))
+                continue;
+            const candidate = join(dir, 'node');
+            if ((await realpath(candidate).catch(() => null)) === running)
+                return candidate;
+        }
+    return io.execPath;
+}
+/** Whether `script` run by `node` is this version of the command line. */
+async function works(io, node, script) {
+    if (!(await exists(script)))
+        return false;
+    const result = await io.run(node, [script, '--version'], 30_000);
+    return result.code === 0 && result.stdout.trim() === VERSION;
+}
+/** The package init is running from, when it's this version of pendingyou (npx's copy, or a global install). */
+async function runningPackage(io) {
+    if (!io.script || basename(io.script) !== 'cli.js' || basename(dirname(io.script)) !== 'dist')
+        return null;
+    const root = dirname(dirname(io.script));
+    const manifest = await readJson(join(root, 'package.json')).catch(() => null);
+    return manifest?.name === 'pendingyou' && manifest.version === VERSION ? root : null;
+}
+/** Copies the package's published files (no dependencies to bring: it has none). */
+async function copyPackage(from, to) {
+    await mkdir(to, { recursive: true });
+    for (const name of ['package.json', 'dist', 'README.md', 'CHANGELOG.md', 'LICENSE'])
+        if (await exists(join(from, name)))
+            await cp(join(from, name), join(to, name), { recursive: true });
+}
+/**
+ * Puts this version in its private prefix, or keeps the one already there. Null (and why) when it couldn't: the hooks
+ * then use npx.
+ */
+export async function installCli(io, progress) {
+    const node = await hookNode(io);
+    const prefix = cliPrefix(io);
+    const script = cliScript(prefix);
+    if (await works(io, node, script))
+        return { installed: { version: VERSION, prefix, node, script, how: 'kept' } };
+    const root = cliRoot(io);
+    const staging = join(root, `.tmp-${VERSION}-${randomBytes(4).toString('hex')}`);
+    try {
+        await mkdir(root, { recursive: true, mode: 0o700 });
+        let how = null;
+        const from = await runningPackage(io);
+        if (from) {
+            try {
+                await copyPackage(from, join(staging, 'node_modules', 'pendingyou'));
+                if (await works(io, node, cliScript(staging)))
+                    how = 'copied';
+            }
+            catch { }
+        }
+        if (!how) {
+            await rm(staging, { recursive: true, force: true });
+            await mkdir(staging, { recursive: true });
+            progress(`Installing pendingyou@${VERSION} with npm, so the hooks start fast…\n`);
+            const result = await io.run('npm', [
+                'install',
+                '--prefix',
+                staging,
+                '--no-save',
+                '--no-package-lock',
+                '--no-audit',
+                '--no-fund',
+                '--prefer-offline',
+                '--loglevel=error',
+                `pendingyou@${VERSION}`,
+            ], NPM_TIMEOUT_MS);
+            if (result.code === 127)
+                return { installed: null, error: 'npm isn’t on this computer’s PATH' };
+            if (result.code === 124)
+                return { installed: null, error: 'npm took more than 3 minutes to install it' };
+            if (result.code !== 0)
+                return { installed: null, error: 'npm couldn’t install it' };
+            if (!(await works(io, node, cliScript(staging))))
+                return { installed: null, error: 'the installed copy didn’t run' };
+            how = 'npm';
+        }
+        await rm(prefix, { recursive: true, force: true });
+        await rename(staging, prefix);
+        return { installed: { version: VERSION, prefix, node, script, how } };
+    }
+    catch {
+        return { installed: null, error: `couldn’t write to ${root}` };
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true }).catch(() => { });
+    }
+}
+/** Removes every private copy but `keep` (the versions the hooks no longer run, and leftovers). */
+export async function pruneCli(io, keep) {
+    const root = cliRoot(io);
+    const entries = await readdir(root).catch(() => []);
+    for (const entry of entries)
+        if (entry !== keep)
+            await rm(join(root, entry), { recursive: true, force: true }).catch(() => { });
+}
+/** Removes the private copies altogether (uninstall). True when there were any. */
+export async function removeCli(io) {
+    const root = cliRoot(io);
+    if (!(await exists(root)))
+        return false;
+    await rm(root, { recursive: true, force: true });
+    return true;
+}
+/** A double-quoted shell word: safe for any path, spaces and quotes included. */
+export const shellQuote = (text) => `"${text.replace(/["$`\\]/g, '\\$&')}"`;
+const QUOTED = /^"((?:[^"\\]|\\.)*)"\s+"((?:[^"\\]|\\.)*)"\s/;
+const unquote = (text) => text.replace(/\\(.)/g, '$1');
+export function hookForm(command) {
+    const direct = QUOTED.exec(command);
+    if (direct) {
+        const script = unquote(direct[2]);
+        const version = /\/cli\/([^/]+)\/node_modules\/pendingyou\/dist\/cli\.js$/.exec(script);
+        return {
+            form: 'direct',
+            node: unquote(direct[1]),
+            script,
+            version: version?.[1] ?? null,
+        };
+    }
+    if (/^npx\s/.test(command))
+        return { form: 'npx', version: /pendingyou@([^\s]+)/.exec(command)?.[1] ?? null };
+    return { form: 'other' };
+}
+/** Whether a direct hook's Node and script are both still there. */
+export const hookRuns = async (form) => form.form !== 'direct' || ((await exists(form.node)) && (await exists(form.script)));

package/dist/io.js

@@ -2,6 +2,7 @@
 // network, a fake browser and a fake `claude`. `realIo()` is the real thing.
 import { spawn } from 'node:child_process';
 import { homedir, hostname } from 'node:os';
+import { createInterface } from 'node:readline';
 export function runProgram(command, args, timeoutMs = 60_000) {
     return new Promise((resolve) => {
         let stdout = '';
@@ -10,7 +11,6 @@ export function runProgram(command, args, timeoutMs = 60_000) {
         try {
             child = spawn(command, [...args], {
                 stdio: ['ignore', 'pipe', 'pipe'],
-                timeout: timeoutMs,
                 windowsHide: true,
             });
         }
@@ -18,14 +18,23 @@ export function runProgram(command, args, timeoutMs = 60_000) {
             resolve({ code: 127, stdout, stderr });
             return;
         }
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill('SIGTERM');
+        }, timeoutMs);
+        const done = (code) => {
+            clearTimeout(timer);
+            resolve({ code: timedOut ? 124 : code, stdout, stderr });
+        };
         child.stdout?.on('data', (chunk) => {
             stdout += String(chunk);
         });
         child.stderr?.on('data', (chunk) => {
             stderr += String(chunk);
         });
-        child.on('error', (error) => resolve({ code: error.code === 'ENOENT' ? 127 : 1, stdout, stderr }));
-        child.on('close', (code) => resolve({ code: code ?? 1, stdout, stderr }));
+        child.on('error', (error) => done(error.code === 'ENOENT' ? 127 : 1));
+        child.on('close', (code) => done(code ?? 1));
     });
 }
 export function execProgram(command, args, options) {
@@ -96,6 +105,21 @@ function readStdin(timeoutMs) {
         process.stdin.on('error', finish);
     });
 }
+function ask(question) {
+    return new Promise((resolve) => {
+        const prompt = createInterface({ input: process.stdin, output: process.stdout });
+        let answered = false;
+        prompt.on('close', () => {
+            if (!answered)
+                resolve('');
+        });
+        prompt.question(question, (answer) => {
+            answered = true;
+            prompt.close();
+            resolve(answer);
+        });
+    });
+}
 async function openBrowser(url) {
     const [command, args] = process.platform === 'darwin'
         ? ['open', [url]]
@@ -138,6 +162,9 @@ export function realIo() {
         out: (text) => process.stdout.write(text),
         err: (text) => process.stderr.write(text),
         fetch: (input, init) => fetch(input, init),
+        execPath: process.execPath,
+        interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+        ask,
         run: runProgram,
         exec: execProgram,
         openBrowser,

package/dist/main.js

@@ -1,7 +1,7 @@
 // The command line: parse the arguments, run the command, return the exit code. `cli.ts` runs it for real; tests run
 // it with their own Io.
 import { getJson, refreshInBackground, SignInNeeded, Unavailable } from "./api.js";
-import { commandOf, HOOK_COMMANDS, parseArgs, USAGE, UsageError } from "./args.js";
+import { commandOf, DEFAULT_ORIGIN, HOOK_COMMANDS, parseArgs, USAGE, UsageError, } from "./args.js";
 import { claudeState, installClaude, uninstallClaude } from "./claude.js";
 import { readCredential, signedInOrigins, updateCredential } from "./credentials.js";
 import { PlainError } from "./errors.js";
@@ -74,6 +74,27 @@ async function status(io, origin) {
     const [signIn, claude] = await Promise.all([checkSignIn(io, origin), claudeState(io)]);
     const lines = [`Pending You for Claude Code · ${origin}`];
     const mark = (ok) => (ok ? 'ok     ' : 'missing');
+    const url = `${origin}/mcp`;
+    const mcp = claude.mcp;
+    const mcpOk = mcp !== false && mcp !== 'unknown' && (!mcp.url || mcp.url.replace(/\/+$/, '') === url);
+    const mcpText = mcp === 'unknown'
+        ? 'Claude Code didn’t say in time; check with claude mcp get pendingyou'
+        : mcp === false
+            ? 'not added; run npx pendingyou init'
+            : mcpOk
+                ? `pendingyou${mcp.url ? ` (${mcp.url})` : ''}`
+                : `points at ${mcp.url}, not ${url}; run npx pendingyou init${origin === DEFAULT_ORIGIN ? '' : ` --origin ${origin}`} to replace it`;
+    const form = claude.form;
+    const hooksRun = form?.runs ?? true;
+    const formText = !form
+        ? ''
+        : form.form === 'direct'
+            ? form.runs
+                ? `they run pendingyou${form.version ? ` ${form.version}` : ''} directly (${form.script})`
+                : `the Node or the copy of pendingyou they run is gone (${form.node}, ${form.script}); run npx pendingyou@latest init`
+            : form.form === 'npx'
+                ? 'they run through npx, which is slower; run npx pendingyou@latest init to run them directly'
+                : 'they run pendingyou from PATH or a file of your own';
     lines.push(`  ${mark(signIn.state === 'ok')} Sign-in: ${signIn.state === 'ok'
         ? signIn.for
             ? `hears for ${signIn.for.name} only (for pendingyou watch)`
@@ -82,8 +103,8 @@ async function status(io, origin) {
             ? 'ended; run npx pendingyou login'
             : signIn.state === 'none'
                 ? 'not signed in; run npx pendingyou login'
-                : 'Pending You couldn’t be reached'}`, `  ${mark(claude.claude !== null)} Claude Code: ${claude.claude ?? 'not found on PATH'}`, `  ${mark(claude.mcp)} MCP server: ${claude.mcp ? 'pendingyou' : 'not added; run npx pendingyou init'}`, `  ${mark(claude.skill)} Skill: ${claude.skill ? 'saved' : 'not saved; run npx pendingyou init'}`, `  ${mark(claude.hooks)} Hooks: ${claude.hooks ? 'session-start pickup and next-message hand-off' : 'not installed; run npx pendingyou init'}`, `  ${mark(claude.stopcheck)} Stop check: ${claude.stopcheck ? 'asks Claude Code to post what it leaves you in chat' : 'not installed; run npx pendingyou init'}`);
-    const ready = signIn.state === 'ok' && claude.hooks;
+                : 'Pending You couldn’t be reached'}`, `  ${mark(claude.claude !== null)} Claude Code: ${claude.claude ?? 'not found on PATH'}`, `  ${mark(mcpOk)} MCP server: ${mcpText}`, `  ${mark(claude.skill)} Skill: ${claude.skill ? 'saved' : 'not saved; run npx pendingyou init'}`, `  ${mark(claude.hooks && hooksRun)} Hooks: ${claude.hooks ? `session-start pickup and next-message hand-off; ${formText}` : 'not installed; run npx pendingyou init'}`, `  ${mark(claude.stopcheck)} Stop check: ${claude.stopcheck ? 'asks Claude Code to post what it leaves you in chat' : 'not installed; run npx pendingyou init'}`);
+    const ready = signIn.state === 'ok' && claude.hooks && hooksRun;
     lines.push(ready
         ? 'Ready: Claude Code hears answers right away (report_setup hears "instant").'
         : 'Not ready: Claude Code hears answers while it’s working (report_setup hears "while-working").');
@@ -92,9 +113,10 @@ async function status(io, origin) {
 }
 async function init(io, options) {
     io.out(`Setting up Pending You for Claude Code (${options.origin}).\n`);
-    const steps = await installClaude(io, options.origin);
-    for (const step of steps)
-        io.out(`  ${step.ok ? 'ok     ' : 'check  '} ${step.text}\n`);
+    const steps = await installClaude(io, options.origin, {
+        yes: options.yes,
+        report: (step) => io.out(`  ${step.ok ? 'ok     ' : 'check  '} ${step.text}\n`),
+    });
     if (options.login) {
         io.out('Signing this computer in, so answers can wake Claude Code:\n');
         await login(io, {
@@ -155,7 +177,8 @@ async function run(io, command, hook = { fallback: '' }) {
 }
 /**
  * A hook's hard deadline, from the moment this process started: Claude Code gives a hook 10 seconds (init's
- * `timeout`), npx takes about half a second before this process starts, and a normal hook is done in about one.
+ * `timeout`), npx (hooks from before 0.7.0) takes about half a second before this process starts, and a normal hook
+ * is done in well under one.
  * When it's reached, the hook prints its plain fallback (the hand-off's one-line reminder; nothing for pickup and
  * stopcheck) unless it already printed, and exits 0, whatever it was still waiting on.
  */

package/dist/version.js

@@ -1,2 +1,2 @@
 // The command line's version, as published (package.json). A test keeps them the same.
-export const VERSION = '0.6.0';
+export const VERSION = '0.7.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pendingyou",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Pending You for Claude Code: hear your answers from Pending You in the background, and set Claude Code up in one command.",
   "license": "Apache-2.0",
   "homepage": "https://www.pendingyou.com",