pendingyou 0.7.0 → 0.9.0

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## 0.9.0
+
+- The Stop check catches a final message that asks you to type or reply something in Claude Code's own chat
+  ("Reply “yes, erase disk12” here", "To confirm, type `yes`", "Confirm here"). Some steps an agent takes only on your
+  own words in its conversation, not on a card answer (something that can't be undone, credentials, anything outside
+  its sandbox), and that's right; but when it asks only in its chat, you never learn where you're needed. Unless a
+  Pending You card posted in that turn, or one still open from this folder, asks for the same thing, Claude Code is
+  asked once to post an action card that sends you there (about 76 tokens, plus the link): titled “Confirm in Claude
+  Code on <computer>: <step>”, with the exact words as a step's command (so the card shows them with a copy button),
+  where to type them, and what it'll do then; or, for a card you already answered, to reopen it with the same ask.
+- The link is the session's own when Claude Code says it: `https://claude.ai/code/<id>` from
+  `CLAUDE_CODE_BRIDGE_SESSION_ID` while Remote Control is on, or from `CLAUDE_CODE_REMOTE_SESSION_ID` on the web.
+- It counts as an ask: an imperative or a request to you ("please …", "can you …", "I need you to …") with the words
+  quoted, in backticks, or a plain "yes", tied to this chat ("here", "in this chat") or to going ahead ("to confirm",
+  "and I'll …"). Not in code, block quotes or quoted text; not what a program, prompt, page or message says; not a step
+  in your terminal, at a prompt or on a page; not a standing offer ("anytime"); not a command or slash command. A card
+  matches when its words name what's being confirmed ("erase" and "disk12"), or, with only a "yes" to go on, when it
+  was posted in the turn or its title asks to confirm.
+- Only such a message costs a request: this folder's open cards (the same one the next-message hook makes), given up
+  after 1.5 seconds. When Pending You can't say (offline, slow, an older server), the message's own word that it's on
+  a card is taken. Everything else the Stop check does is as before, with no request.
+- Hooks still run this version from `~/.config/pendingyou/cli/0.9.0/`: run `npx pendingyou@latest init` once to switch.
+
+## 0.8.0
+
+- The hooks say when a session is on another Pending You. A Claude Code session stayed connected to staging after its
+  person moved to production, so its cards went where they no longer looked. Now both hooks (`pickup` at session
+  start, `handoff` with every message) compare the `pendingyou` MCP server Claude Code uses in the session's folder
+  with the origin they run against (`--origin`), and when they're different sites add one line (about 45 tokens):
+  `Pending You: your MCP server is https://staging.pendingyou.com but your hooks and sign-in are
+  https://www.pendingyou.com, so your cards and their answers may not meet. Ask your person which one they use, and
+  restart the session after fixing it (npx pendingyou init --origin <that one>).` The server is the one Claude Code
+  would use there: local scope (`~/.claude.json`'s `projects`), then the folder's `.mcp.json`, then user scope, then
+  the Pending You plugin when `~/.claude/settings.json` enables it (production's server). All read only, and only the
+  `pendingyou` server's address is looked at; nothing is sent. `pendingyou.com` and `www.pendingyou.com` are the same
+  site; a file that can't be read is never a mismatch. The line is said even when the hooks' origin isn't signed in,
+  and it's kept when a hook reaches its 3-second deadline.
+- `status` says the same: a `Mismatch:` line naming both sites and what to do, a line for a folder's own
+  (local- or project-scope) server that points elsewhere, and "Not ready" (exit 1) until they agree.
+
 ## 0.7.0
 
 - Faster hooks. They ran `npx -y --prefer-offline pendingyou@<version> …`, and npx alone took about half a second

package/README.md

@@ -26,13 +26,18 @@ that. If Claude Code already has a `pendingyou` server pointing somewhere else (
 asks before replacing it; `--yes` replaces it without asking, and with nobody to ask it prints the two commands to
 run. Afterwards restart Claude Code, run `/mcp`, choose pendingyou and Authenticate.
 
+If the `pendingyou` MCP server Claude Code uses in a session's folder is another Pending You than the hooks' (staging
+and production, say), both hooks add one line telling Claude Code so, and to ask you which one you use: its cards
+would otherwise go where you don't look. `npx pendingyou status` flags it too. Fix it with `npx pendingyou init
+--origin <the one you use>`, then restart the session.
+
 The hooks never get in your way: if anything goes wrong (no network, not signed in, a bad option), they print nothing
 and let your message through. Each one stops within 3 seconds whatever happens, with at most its one-line reminder, and
 never refreshes the sign-in itself: when that's due, it starts the refresh in the background, which finishes on its
 own. Running `init` again updates them in place, and adds any a newer version brings.
 
 The hooks run that copy with Node directly, like
-`"/opt/homebrew/bin/node" "~/.config/pendingyou/cli/0.7.0/node_modules/pendingyou/dist/cli.js" handoff || true` (the
+`"/opt/homebrew/bin/node" "~/.config/pendingyou/cli/0.9.0/node_modules/pendingyou/dist/cli.js" handoff || true` (the
 paths in full). If the copy can't be made (no npm, no network), they run through `npx -y --prefer-offline
 pendingyou@<version>` instead. `npx pendingyou status` says which. If you remove the Node they run with, run `init`
 again.
@@ -53,13 +58,21 @@ Deep into a long conversation, Claude Code tends to end a turn with a question f
   Claude Code is asked to go on once (about 31 tokens): post them as cards, or say they don't need one. It never asks
   twice in a row.
 
-The check is pattern matching on your computer: no model, no network. It reads only the last turn from the end of the
+The check is pattern matching on your computer: no model. It reads only the last turn from the end of the
 transcript (at most 4 MB) and skips code blocks and quotes. It counts as for you: a question to you (a sentence ending
 in "?" with "you" or "your"); "you'll need to", "your step", "can you", "please run", "in your terminal", "only you
 can", "waiting on you" and the like; or a list under a heading like "Your part", "Your steps", "For you", "Waiting on
 you" or "Left for you". It lets the turn end when the message says nothing needs a card ("No card needed.", "Nothing
 needs your attention.", "There's nothing waiting on you.").
 
+Since 0.9.0 it also catches a message asking you to type or reply something in Claude Code's own chat ("Reply “yes,
+erase disk12” here", "To confirm, type `yes`", "Confirm here"). Some steps an agent takes only on your own words in
+its conversation, never on a card answer; that's fine, but then a card has to send you there. Unless a card posted in
+that turn, or one still open from this folder, asks for the same thing, Claude Code is asked once to post an action
+card titled “Confirm in Claude Code on <computer>: <step>”, with the exact words to copy, where to type them (the
+session's link when Remote Control or Claude Code on the web gives one) and what it'll do then. Only such a message
+costs a request: this folder's open cards, given up after 1.5 seconds.
+
 **On 0.2.0 with another origin?** Its hooks blocked every message (`There's no "--origin" command`). Run
 `npx pendingyou@latest init --origin <url>` again to repair them; see [CHANGELOG.md](CHANGELOG.md).
 
@@ -125,8 +138,9 @@ The sign-in only hears answers to your own Claude Code assistants' questions, or
 answer or change anything, and it doesn't show up as one. It's stored in `~/.config/pendingyou/credentials.json`
 (readable only by you), refreshes itself, and ends after 30 days or on `logout`. `state.json` beside it remembers
 which answers were already handed over (ids only), `claude-code.json` what `init` added, and `cli/` the hooks' copy
-of the command line. `init` reads `~/.claude.json` only to see whether Claude Code has a `pendingyou` MCP server and
-where it points. Nothing is sent anywhere but Pending You.
+of the command line. `init`, `status` and the hooks read `~/.claude.json` (and a folder's `.mcp.json`, and
+`~/.claude/settings.json`'s enabled plugins) only to see whether Claude Code has a `pendingyou` MCP server and where
+it points. Nothing is sent anywhere but Pending You.
 
 ## Development
 

package/dist/confirm.js

@@ -0,0 +1,231 @@
+// "Confirm in your agent" (guide 2.21, CLI 0.9.0). Some steps an agent takes only on its person's own words in its
+// conversation: a card answer reaches it as a tool's result, and its rules (or its app's) want more for something that
+// can't be undone, credentials, or anything outside its sandbox. That's right, but on 2026-10-03 a Claude Code agent
+// declined to act on an approved "Erase disk12?" card, asked for "yes, erase disk12" in its own chat, and never told
+// Pending You, so Darin had to go and find the session.
+//
+// The Stop hook (stopcheck.ts) now catches a final message that asks the person to type or reply something in this
+// chat: asksToTypeHere finds it, cardFits says whether a card already asks for it (one posted in the turn, or one still
+// open), and confirmReason is what Claude Code reads when none does: post an action card that sends them here, with
+// the exact words as a step's command and, when Claude Code says it, the session's link.
+//
+// Pattern matching only, deliberately narrow (a block costs a whole extra turn): an ask said to the person (an
+// imperative, "please …", "can you …", "I need you to …"), with the words quoted or a plain "yes", and anchored to this
+// chat ("here", "in this chat") or to going ahead ("to confirm", "and I'll …"). Never in code, block quotes or quoted
+// text; never what a program, a page or a message says; never a step somewhere else (their terminal, a prompt, a page,
+// a link) or a standing offer ("anytime"); never a command or slash command to run.
+/** Verbs that hand the person something to type. */
+const VERB = '(?:type|reply|respond|write|say|send|enter|paste|answer)';
+/**
+ * What comes right before a verb said to the person: the start of a sentence or clause, "and"/"then", a request
+ * ("can you", "I need you to", "I'll wait for you to", "you'll need to", "you can"), then any "please", "just" or
+ * "now".
+ */
+const LEAD = String.raw `(?:^|[,;:(—–→]\s*|\s-\s+|\b(?:and|then|or|so)\s+|\b(?:can|could|would|will)\s+you\s+|\b(?:need|want|like|for)\s+you\s+to\s+|\byou(?:’|')ll\s+(?:need|have)\s+to\s+|\byou\s+(?:need|have)\s+to\s+|\byou\s+can\s+|\ball\s+you\s+need\s+to\s+do\s+is\s+)(?:(?:please|just|simply|kindly|now|then)\s+)*`;
+const ASK = new RegExp(`${LEAD}${VERB}\\b`, 'giu');
+/** "Confirm here", "please confirm in this chat", "can you confirm it here". */
+const CONFIRM_HERE = new RegExp(`${LEAD}confirm(?:\\s+(?:it|this|that|so))?\\s+(?:here|below|in\\s+(?:this|our|the)\\s+(?:chat|conversation|session))\\b`, 'iu');
+/** "Confirm (in this chat) by typing “…”". */
+const CONFIRM_BY = /\bconfirm\b[^.!?\n]{0,30}?\bby\s+(?:typing|replying(?:\s+with)?|saying|sending)\s+⟦(\d+)⟧/iu;
+/** This chat: where the words go. */
+const HERE = /\b(?:here|below|in\s+(?:this|our|the)\s+(?:chat|conversation|session)|in\s+chat|in\s+this\s+(?:terminal|window)|(?:back\s+)?to\s+me)\b/iu;
+/** What typing it does: lets the agent go ahead. */
+const PURPOSE = /\b(?:to\s+(?:confirm|proceed|continue|go\s+ahead|approve|start|begin|carry\s+on|unblock\s+me)|(?:and|so|then)\s+I(?:’|')ll\b|(?:and|so)\s+I\s+(?:can|will)\b|if\s+you\s+want\s+me\s+to\b|when\s+you(?:’|')re\s+ready\b|before\s+I\b)/iu;
+/** Plain words people are asked to type without quotes. */
+const PLAIN_WORD = /^\s*(?:back\s+)?(?:with\s+)?(go ahead|ship it|do it|yes|y|ok|okay|go|proceed|confirm|confirmed|continue|approve|approved)\b/iu;
+/**
+ * What may come between the verb and the quoted words: "Reply here with “…”", "Type these words in this chat: “…”",
+ * "Reply with the exact phrase “…”". Never a recipient ("Reply to Sarah with “…”").
+ */
+const FILLER = /^(?:\s|[,:]|back\b|me\b|it\b|to me\b|with\b|exactly\b|precisely\b|verbatim\b|just\b|the\b|exact\b|following\b|phrase\b|words?\b|text\b|these\b|this\b|that\b|here\b|below\b|in (?:this|our) (?:chat|conversation|session|terminal|window)\b)*$/iu;
+/** Somewhere else to type it: their terminal, a prompt, a page or a form, or a link (but this session's own). */
+const ELSEWHERE = /\b(?:in|into|at|on)\s+(?:your|a|the|that|their)\s+(?:terminal|shell|browser|console|prompt|form|field|dialog|email|inbox|page|app|site|website|portal|dashboard)\b|\bin\s+(?:Terminal|iTerm)\b|\bwhen\s+(?:prompted|asked|it\s+asks)\b|\bat\s+the\s+prompt\b|https?:\/\/(?!claude\.ai\/code\/)/iu;
+/** This chat, said outright, which wins over another place in the same sentence. */
+const THIS_CHAT = /\bin\s+(?:this|our)\s+(?:chat|conversation|session)\b/iu;
+/** A standing offer, not a wait: "Say “stop” anytime". */
+const OFFER = /\b(?:any\s?time|whenever|at\s+any\s+(?:point|time)|if\s+you\s+change\s+your\s+mind|if\s+(?:anything|something)\s+(?:looks|seems|goes))\b/iu;
+/** What something says rather than an ask: "The email ends with: Reply “STOP” here". */
+const DESCRIBED = /\b(?:says?|said|reads?|ends?\s+with|starts?\s+with|shows?|prints?|displays?|asks?|prompts?|tells?\s+\w+|text|message|copy|label|button|template)\s*[:,]?$/iu;
+/** A command or a slash command: a step to run (the general check's business), not words to type to the agent. */
+const COMMAND_LIKE = /^\s*(?:[!/]|\$\s|(?:cd|npm|npx|pnpm|yarn|bun|git|gh|curl|wget|brew|node|python3?|pip|docker|ssh|scp|sudo|claude|codex|wrangler)\s)/u;
+/** Quoted spans the words come in: “…”, "…", `…`, ‘…’ and '…' (not an apostrophe). */
+const QUOTED = /“([^“”\n]{1,160})”|"([^"\n]{1,160})"|`([^`\n]{1,160})`|‘([^‘’\n]{1,160})’|(?<![\p{L}\p{N}])'([^'\n]{1,160})'(?![\p{L}\p{N}])/gu;
+/**
+ * The text as it reads to the person: without fenced code and block quotes (quoted words stay), and without Markdown's
+ * list markers, headings and emphasis (`**Reply “yes” here**`).
+ */
+export function proseOf(text) {
+    const kept = [];
+    let fence = null;
+    for (const line of text.split('\n')) {
+        const marker = /^\s*(`{3,}|~{3,})/.exec(line)?.[1];
+        if (fence) {
+            if (marker?.startsWith(fence))
+                fence = null;
+            continue;
+        }
+        if (marker) {
+            fence = marker;
+            continue;
+        }
+        if (/^\s*>/.test(line))
+            continue;
+        kept.push(line
+            .replace(/^\s*(?:[-*•+]|\d+[.)])\s+/u, '')
+            .replace(/^\s*#+\s*/u, '')
+            .replace(/\*+|__/gu, ''));
+    }
+    return kept.join('\n');
+}
+/** Each quoted span replaced by ⟦n⟧, with what it held. */
+function marked(text) {
+    const quotes = [];
+    const out = text.replace(QUOTED, (...groups) => {
+        const inner = groups.slice(1, 6).find((group) => typeof group === 'string');
+        quotes.push(inner.trim());
+        return `⟦${quotes.length - 1}⟧`;
+    });
+    return { text: out, quotes };
+}
+/** One sentence's ask, or null. `quotes` are the message's quoted spans, by marker number. */
+function askIn(sentence, quotes) {
+    if ((ELSEWHERE.test(sentence) && !THIS_CHAT.test(sentence)) || OFFER.test(sentence))
+        return null;
+    const by = CONFIRM_BY.exec(sentence);
+    if (by) {
+        const words = quotes[Number(by[1])] ?? '';
+        if (words && !COMMAND_LIKE.test(words))
+            return { words };
+    }
+    for (const found of sentence.matchAll(ASK)) {
+        const start = found.index ?? 0;
+        // What a program, a page or a message says isn't an ask: "The SMS ends with: Reply “STOP” here".
+        if (DESCRIBED.test(sentence.slice(0, start).trimEnd()))
+            continue;
+        const from = start + found[0].length;
+        const tail = sentence.slice(from, from + 140);
+        const quote = /⟦(\d+)⟧/u.exec(tail);
+        let words = null;
+        let after = tail;
+        let before = '';
+        if (quote && FILLER.test(tail.slice(0, quote.index))) {
+            words = quotes[Number(quote[1])] ?? null;
+            before = tail.slice(0, quote.index);
+            after = tail.slice(quote.index + quote[0].length);
+        }
+        else {
+            const plain = PLAIN_WORD.exec(tail);
+            if (plain) {
+                words = plain[1].toLowerCase();
+                after = tail.slice(plain[0].length);
+            }
+        }
+        if (words !== null) {
+            if (COMMAND_LIKE.test(words))
+                continue;
+            // Anchored to this chat or to going ahead, or the ask stands alone: "Reply “yes, erase disk12”."
+            const near = after.slice(0, 80);
+            const alone = quote !== null && /^[\s.!)…]*$/u.test(after);
+            if (HERE.test(before) || HERE.test(near) || PURPOSE.test(near) || alone)
+                return { words };
+            continue;
+        }
+        // "Reply here to confirm": no words, but here and going ahead.
+        if (HERE.test(tail.slice(0, 40)) && PURPOSE.test(tail.slice(0, 80)))
+            return { words: null };
+    }
+    return CONFIRM_HERE.test(sentence) ? { words: null } : null;
+}
+/**
+ * Whether the final message asks the person to type or reply something in this chat, and what: "Reply “yes, erase
+ * disk12” here", "To confirm, type `yes`", "Please reply yes here and I'll merge it", "Confirm here". Null otherwise.
+ */
+export function asksToTypeHere(text) {
+    const { text: prose, quotes } = marked(proseOf(text));
+    for (const sentence of prose.split(/(?<=[.!?])\s+|\n+/u)) {
+        const ask = askIn(sentence.trim(), quotes);
+        if (ask)
+            return ask;
+    }
+    return null;
+}
+/** Words that don't tell one card from another: "yes", "confirm", "please"… */
+const COMMON = new Set([
+    'yes',
+    'y',
+    'ok',
+    'okay',
+    'sure',
+    'please',
+    'confirm',
+    'confirmed',
+    'go',
+    'ahead',
+    'proceed',
+    'continue',
+    'approve',
+    'approved',
+    'do',
+    'it',
+    'i',
+    'the',
+    'a',
+    'an',
+    'to',
+    'and',
+    'of',
+    'me',
+    'my',
+    'this',
+    'that',
+]);
+const wordsOf = (text) => text.toLowerCase().match(/[\p{L}\p{N}]+/gu) ?? [];
+/** The words that say what's being confirmed: "yes, erase disk12" → erase, disk12. */
+export const telling = (words) => words === null ? [] : [...new Set(wordsOf(words).filter((word) => !COMMON.has(word)))];
+/**
+ * Whether a card asks for this: one posted in the turn (`posted`: the words its call carried) or one still open
+ * (`open`: its title). A card fits when it names everything that tells the words apart ("erase" and "disk12" for
+ * “yes, erase disk12”). With nothing to tell them by ("yes", or no words at all), any card posted in the turn fits,
+ * and an open one only when its title asks to confirm; an open "Confirm …" card that names some of them fits too.
+ */
+export function cardFits(text, words, where) {
+    const wanted = telling(words);
+    const has = new Set(wordsOf(text));
+    if (wanted.length && wanted.every((word) => has.has(word)))
+        return true;
+    if (where === 'posted')
+        return wanted.length === 0;
+    return /\bconfirm/i.test(text) && (wanted.length === 0 || wanted.some((word) => has.has(word)));
+}
+/**
+ * The session's link when Claude Code says it: Remote Control's session (CLAUDE_CODE_BRIDGE_SESSION_ID, in `session_`
+ * form) or a session on the web (CLAUDE_CODE_REMOTE_SESSION_ID, whose `cse_` is the link's `session_`), as
+ * https://code.claude.com/docs/en/env-vars documents them. Null when neither is set.
+ */
+export function sessionLink(env) {
+    const bridge = env.CLAUDE_CODE_BRIDGE_SESSION_ID?.trim();
+    if (bridge && /^session_[A-Za-z0-9]{8,80}$/.test(bridge))
+        return `https://claude.ai/code/${bridge}`;
+    const remote = env.CLAUDE_CODE_REMOTE_SESSION_ID?.trim();
+    if (remote && /^(?:cse|session)_[A-Za-z0-9]{8,80}$/.test(remote))
+        return `https://claude.ai/code/${remote.replace(/^cse_/, 'session_')}`;
+    return null;
+}
+/** The most of the asked-for words the reason repeats. */
+export const REASON_WORDS = 60;
+/**
+ * What Claude Code reads when it asked for words here and no card says so: post the action card that sends them here,
+ * or reopen the card they already answered (about 65 tokens, 80 with a link).
+ */
+export function confirmReason(words, link) {
+    const chars = [...(words?.replace(/\s+/g, ' ').trim() ?? '')];
+    const shown = chars.length > REASON_WORDS
+        ? `${chars
+            .slice(0, REASON_WORDS - 1)
+            .join('')
+            .trimEnd()}…`
+        : chars.join('');
+    const asked = shown ? `to type “${shown}” here` : 'to confirm here';
+    const what = shown ? 'those exact words' : 'the words to type';
+    return `You asked them ${asked}, but no open Pending You card says so: post an action card “Confirm in Claude Code on <computer>: <step>” with ${what} as a step command, where Claude Code on <computer>${link ? `, ${link}` : ''}, done what you’ll do (a card they answered: reply_in_thread with reopen).`;
+}

package/dist/environment.js

@@ -0,0 +1,98 @@
+// Is this session on the Pending You its hooks are on? A Claude Code session stayed connected to staging after its
+// person moved to production (2026-10-01): its cards went where they no longer looked, and the hooks, signed in to
+// production, never heard them. So the hooks compare the `pendingyou` MCP server Claude Code has for the session's
+// folder (read from ~/.claude.json and the folder's .mcp.json, read only) with the origin they run against (`--origin`),
+// and when they differ, add one line telling the agent to ask its person which one they use. `status` says the same.
+//
+// Only the pendingyou server's url is read, never anything else from those files; nothing is written, nothing is sent.
+// A server Claude Code can't be read for (no file, another shape, a plugin's server) is never called a mismatch.
+import { join } from 'node:path';
+import { claudeJsonPath, MCP_NAME } from "./claude.js";
+import { claudeDir, readText } from "./files.js";
+/**
+ * The published Pending You plugin for Claude (recordplane/pendingyou-plugin) and where its server is. A hand-added
+ * pendingyou server at any scope overrides it in Claude Code, so it counts only when there's none.
+ */
+export const PLUGIN_ID = 'pending-you@pendingyou';
+export const PLUGIN_MCP_URL = 'https://www.pendingyou.com/mcp';
+const objectAt = (value, key) => {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return null;
+    const found = value[key];
+    return typeof found === 'object' && found !== null && !Array.isArray(found)
+        ? found
+        : null;
+};
+const urlOf = (servers) => {
+    const url = objectAt(servers, MCP_NAME)?.url;
+    return typeof url === 'string' && url.length > 0 ? url : null;
+};
+async function readJsonQuietly(path) {
+    try {
+        const text = await readText(path);
+        return text === null ? null : JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The `pendingyou` MCP server Claude Code uses in `folder`: local scope (~/.claude.json's projects[folder]), then the
+ * folder's own .mcp.json, then user scope (~/.claude.json's mcpServers), then the Pending You plugin when
+ * ~/.claude/settings.json enables it. Null when none of them has one with a url.
+ */
+export async function serverForFolder(io, folder) {
+    const [state, project, settings] = await Promise.all([
+        readJsonQuietly(claudeJsonPath(io)),
+        readJsonQuietly(join(folder, '.mcp.json')),
+        readJsonQuietly(join(claudeDir(io), 'settings.json')),
+    ]);
+    const local = urlOf(objectAt(objectAt(objectAt(state, 'projects'), folder), 'mcpServers'));
+    if (local)
+        return { url: local, scope: 'local' };
+    const shared = urlOf(objectAt(project, 'mcpServers'));
+    if (shared)
+        return { url: shared, scope: 'project' };
+    const user = urlOf(objectAt(state, 'mcpServers'));
+    if (user)
+        return { url: user, scope: 'user' };
+    return objectAt(settings, 'enabledPlugins')?.[PLUGIN_ID] === true
+        ? { url: PLUGIN_MCP_URL, scope: 'plugin' }
+        : null;
+}
+/**
+ * The site an address is on, as one name: www.pendingyou.com and pendingyou.com are the same Pending You (the bare
+ * name redirects), so both read https://www.pendingyou.com. Null when it isn't an address.
+ */
+export function siteOf(address) {
+    try {
+        const url = new URL(address);
+        if (url.protocol !== 'https:' && url.protocol !== 'http:')
+            return null;
+        const host = url.host === 'pendingyou.com' ? 'www.pendingyou.com' : url.host;
+        return `${url.protocol}//${host}`;
+    }
+    catch {
+        return null;
+    }
+}
+/** Whether the server and the hooks' origin are different Pending Yous. Unknown addresses never differ. */
+export function differs(server, origin) {
+    if (!server)
+        return false;
+    const a = siteOf(server.url);
+    const b = siteOf(origin);
+    return a !== null && b !== null && a !== b;
+}
+/** The line a hook adds when they differ (about 45 tokens). */
+export const mismatchLine = (server, origin) => `Pending You: your MCP server is ${siteOf(server.url)} but your hooks and sign-in are ${siteOf(origin)}, so your cards and their answers may not meet. Ask your person which one they use, and restart the session after fixing it (npx pendingyou init --origin <that one>).`;
+/** The hook's warning for this folder, or null when the two agree or can't be told. Never throws. */
+export async function environmentWarning(io, folder, origin) {
+    try {
+        const server = await serverForFolder(io, folder);
+        return differs(server, origin) ? mismatchLine(server, origin) : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/main.js

@@ -4,6 +4,7 @@ import { getJson, refreshInBackground, SignInNeeded, Unavailable } from "./api.j
 import { commandOf, DEFAULT_ORIGIN, HOOK_COMMANDS, parseArgs, USAGE, UsageError, } from "./args.js";
 import { claudeState, installClaude, uninstallClaude } from "./claude.js";
 import { readCredential, signedInOrigins, updateCredential } from "./credentials.js";
+import { differs, serverForFolder, siteOf } from "./environment.js";
 import { PlainError } from "./errors.js";
 import { hold } from "./hold.js";
 import { OAuthError, revoke, signIn, signInWithDevice } from "./oauth.js";
@@ -71,7 +72,11 @@ async function logout(io, options) {
     return 0;
 }
 async function status(io, origin) {
-    const [signIn, claude] = await Promise.all([checkSignIn(io, origin), claudeState(io)]);
+    const [signIn, claude, here] = await Promise.all([
+        checkSignIn(io, origin),
+        claudeState(io),
+        serverForFolder(io, io.cwd),
+    ]);
     const lines = [`Pending You for Claude Code · ${origin}`];
     const mark = (ok) => (ok ? 'ok     ' : 'missing');
     const url = `${origin}/mcp`;
@@ -83,7 +88,7 @@ async function status(io, origin) {
             ? 'not added; run npx pendingyou init'
             : mcpOk
                 ? `pendingyou${mcp.url ? ` (${mcp.url})` : ''}`
-                : `points at ${mcp.url}, not ${url}; run npx pendingyou init${origin === DEFAULT_ORIGIN ? '' : ` --origin ${origin}`} to replace it`;
+                : `points at ${mcp.url}, not ${url}, so sessions post cards where these hooks don’t hear them; run npx pendingyou init${origin === DEFAULT_ORIGIN ? '' : ` --origin ${origin}`} to replace it`;
     const form = claude.form;
     const hooksRun = form?.runs ?? true;
     const formText = !form
@@ -104,7 +109,15 @@ async function status(io, origin) {
             : signIn.state === 'none'
                 ? 'not signed in; run npx pendingyou login'
                 : 'Pending You couldn’t be reached'}`, `  ${mark(claude.claude !== null)} Claude Code: ${claude.claude ?? 'not found on PATH'}`, `  ${mark(mcpOk)} MCP server: ${mcpText}`, `  ${mark(claude.skill)} Skill: ${claude.skill ? 'saved' : 'not saved; run npx pendingyou init'}`, `  ${mark(claude.hooks && hooksRun)} Hooks: ${claude.hooks ? `session-start pickup and next-message hand-off; ${formText}` : 'not installed; run npx pendingyou init'}`, `  ${mark(claude.stopcheck)} Stop check: ${claude.stopcheck ? 'asks Claude Code to post what it leaves you in chat' : 'not installed; run npx pendingyou init'}`);
-    const ready = signIn.state === 'ok' && claude.hooks && hooksRun;
+    // A folder's own server (local or project scope) wins over the user one in Claude Code: say when it's elsewhere. (The
+    // plugin's server counts only when no server was added by hand, and is production's.)
+    if (here && (here.scope === 'local' || here.scope === 'project') && differs(here, origin))
+        lines.push(`  ${mark(false)} This folder: its ${here.scope}-scope pendingyou MCP server (${here.url}) is another Pending You than ${origin}; Claude Code uses it here instead`);
+    const user = mcp !== false && mcp !== 'unknown' && mcp.url ? { url: mcp.url, scope: 'user' } : null;
+    const other = differs(here, origin) ? here : differs(user, origin) ? user : null;
+    const ready = signIn.state === 'ok' && claude.hooks && hooksRun && !other;
+    if (other)
+        lines.push(`Mismatch: Claude Code’s MCP server is ${siteOf(other.url)} but the hooks and sign-in are ${siteOf(origin) ?? origin}. Use the one you look at (npx pendingyou init --origin <it>), then restart your Claude Code sessions.`);
     lines.push(ready
         ? 'Ready: Claude Code hears answers right away (report_setup hears "instant").'
         : 'Not ready: Claude Code hears answers while it’s working (report_setup hears "while-working").');

package/dist/pickup.js

@@ -9,11 +9,15 @@
 //   one small request per message (the open cards, and answers too while a hold from this computer is outstanding),
 //   time-boxed short; on any error, or from a server too old to list open cards, the line is the plain reminder.
 //
+// Both also add one line when the session's pendingyou MCP server is another Pending You than the hooks' origin
+// (environment.ts): its cards would go where these hooks, and maybe its person, don't look.
+//
 // Whatever they print, Claude Code adds to the conversation. A hook must never get in the way: each is time-boxed,
 // has a hard deadline (main.ts) after which it prints only its fallback, never refreshes the sign-in itself (api.ts),
 // prints nothing when there's nothing new, never repeats an answer it handed over, and always exits 0.
 import { getJson, SignInNeeded } from "./api.js";
 import { readCredential } from "./credentials.js";
+import { environmentWarning } from "./environment.js";
 import { clip, describe, isClosed } from "./format.js";
 import { markHanded, momentOf, waitingOn, wasHanded } from "./state.js";
 /** Each request's own limit, inside the hook's 3-second deadline (main.ts). */
@@ -76,15 +80,20 @@ export async function pickup(io, options, hook = { fallback: '' }) {
     const { origin, mode } = options;
     // The hand-off's line, printed at the end unless something else was printed with it.
     let line = null;
+    // Said by either hook, signed in or not, when the session's MCP server is another Pending You (environment.ts).
+    let warning = null;
     try {
         const cwd = await sessionFolder(io);
+        warning = await environmentWarning(io, cwd, origin);
+        if (warning)
+            hook.fallback = `${warning}\n`;
         // The hand-off hears answers only while a hold from this computer is outstanding; it always asks for open cards.
         let answers = true;
         if (mode === 'handoff') {
             if ((await readCredential(io, origin)) === null)
                 return 0;
             line = REMINDER;
-            hook.fallback = `${REMINDER}\n`;
+            hook.fallback = `${[REMINDER, warning].filter(Boolean).join('\n')}\n`;
             answers = (await waitingOn(io, origin)).length > 0;
         }
         const query = new URLSearchParams([
@@ -116,8 +125,10 @@ export async function pickup(io, options, hook = { fallback: '' }) {
             ...fresh.flatMap((heard) => [...describe(heard, again(heard.requestId)), '']),
             'Tell them in one line first (“You answered in Pending You: …”), then act.',
             ...(line ? [line] : []),
+            ...(warning ? [warning] : []),
         ].join('\n')}\n`);
         line = null;
+        warning = null;
         await markHanded(io, origin, fresh.map((heard) => ({
             requestId: heard.requestId,
             moment: momentOf(heard),
@@ -133,7 +144,8 @@ export async function pickup(io, options, hook = { fallback: '' }) {
         return 0;
     }
     finally {
-        if (line)
-            io.out(`${line}\n`);
+        const last = [line, warning].filter(Boolean);
+        if (last.length)
+            io.out(`${last.join('\n')}\n`);
     }
 }

package/dist/stopcheck.js

@@ -2,11 +2,20 @@
 // the person in the chat (a question to them, a step only they can do, a "Your part:" list) and it posted nothing to
 // Pending You in that turn, it asks Claude Code to go on and post it (`{"decision":"block","reason":…}`), once.
 //
-// Pattern matching only, no model, no network: it reads the hook's JSON, the final message, and the tail of the
-// transcript back to the person's last message, never more than READ_CAP bytes. It never loops (stop_hook_active),
+// Since 0.9.0 (guide 2.21) it also catches a final message asking them to type or reply something in this chat
+// ("Reply “yes, erase disk12” here", "confirm here"): an agent that won't act on a card answer for that step must say
+// so on a card, or they never learn where they're needed. Unless a card posted in the turn, or one still open from this
+// folder, asks for the same thing, it asks Claude Code to post the action card that sends them here (confirm.ts).
+//
+// Pattern matching only, no model: it reads the hook's JSON, the final message, and the tail of the transcript back to
+// the person's last message, never more than READ_CAP bytes. Only an ask to type here costs a request (this folder's
+// open cards, as the next-message hook asks for them, given up after 1.5 seconds). It never loops (stop_hook_active),
 // stays quiet for anyone not signed in to this origin, and exits 0 silently on any error.
 import { open } from 'node:fs/promises';
+import { getJson } from "./api.js";
+import { asksToTypeHere, cardFits, confirmReason, sessionLink } from "./confirm.js";
 import { readCredential } from "./credentials.js";
+import { folderForms } from "./pickup.js";
 /** The most of the transcript it reads, from the end. A turn longer than this is let through. */
 export const READ_CAP = 4 * 1024 * 1024;
 const CHUNK = 64 * 1024;
@@ -14,6 +23,12 @@ const CHUNK = 64 * 1024;
 export const STOP_REASON = 'Items for your person are in chat but not in Pending You: post them as cards (ask in both places), or say they don’t need one.';
 /** Tools that put something in front of the person: Pending You's, under any MCP server name. */
 const POSTING_TOOL = /^mcp__.+__(post_request|update_request|reply_in_thread)$/;
+/** How long it waits for this folder's open cards, inside the hook's 3-second deadline (main.ts). */
+const OPEN_TIME_BOX_MS = 1500;
+/** As many of them as Pending You lists. */
+const OPEN_CARDS = 5;
+/** The most of one posting call's words it keeps, to match an ask against. */
+const CARD_TEXT = 20_000;
 /**
  * Text that says the items are already in Pending You, or will be: "you'll get a card to publish it once it's merged"
  * announces a card to come, not a step left in chat.
@@ -87,6 +102,27 @@ export function itemsForPerson(text) {
 export const saysPosted = (text) => SAYS_POSTED.test(plainText(text));
 /** Whether the text says nothing in it needs a card. */
 export const saysNoCard = (text) => SAYS_NO_CARD.test(plainText(text));
+/** Every string a tool call carried (a card's title, summary, steps and their commands…), up to `max` characters. */
+function wordsIn(value, max = CARD_TEXT) {
+    const found = [];
+    let left = max;
+    const walk = (item, depth) => {
+        if (left <= 0 || depth > 8)
+            return;
+        if (typeof item === 'string') {
+            found.push(item.slice(0, left));
+            left -= item.length;
+        }
+        else if (Array.isArray(item))
+            for (const each of item)
+                walk(each, depth + 1);
+        else if (item && typeof item === 'object')
+            for (const each of Object.values(item))
+                walk(each, depth + 1);
+    };
+    walk(value, 0);
+    return found.join('\n');
+}
 /** A message from the person (not a tool's result): where a turn starts. */
 function startsTurn(entry) {
     if (entry.type !== 'user' || entry.isMeta || entry.message?.role !== 'user')
@@ -110,6 +146,7 @@ export async function lastTurn(path, cap = READ_CAP) {
         const texts = [];
         let finalDone = false;
         let posted = false;
+        const cards = [];
         const take = (raw) => {
             if (!raw.trim())
                 return false;
@@ -131,8 +168,13 @@ export async function lastTurn(path, cap = READ_CAP) {
                 if (block?.type === 'tool_use') {
                     finalDone = true;
                     const name = typeof block.name === 'string' ? block.name : '';
-                    const command = typeof block.input?.command === 'string' ? block.input.command : '';
-                    if (POSTING_TOOL.test(name) || /\bpendingyou\b.*\bhold\s+req_/.test(command))
+                    const input = (block.input ?? {});
+                    const command = typeof input.command === 'string' ? input.command : '';
+                    if (POSTING_TOOL.test(name)) {
+                        posted = true;
+                        cards.push(wordsIn(block.input));
+                    }
+                    else if (/\bpendingyou\b.*\bhold\s+req_/.test(command))
                         posted = true;
                 }
                 else if (block?.type === 'text' && !finalDone && typeof block.text === 'string')
@@ -150,20 +192,41 @@ export async function lastTurn(path, cap = READ_CAP) {
             let newline = buffer.lastIndexOf(10);
             while (newline !== -1) {
                 if (take(buffer.subarray(newline + 1).toString('utf8')))
-                    return { text: texts.join('\n'), posted, complete: true, bytesRead };
+                    return { text: texts.join('\n'), posted, cards, complete: true, bytesRead };
                 buffer = buffer.subarray(0, newline);
                 newline = buffer.lastIndexOf(10);
             }
             carry = buffer;
         }
         if (position === 0 && take(carry.toString('utf8')))
-            return { text: texts.join('\n'), posted, complete: true, bytesRead };
-        return { text: texts.join('\n'), posted, complete: position === 0, bytesRead };
+            return { text: texts.join('\n'), posted, cards, complete: true, bytesRead };
+        return { text: texts.join('\n'), posted, cards, complete: position === 0, bytesRead };
     }
     finally {
         await file.close();
     }
 }
+/**
+ * The titles of this folder's cards still waiting on the person (what the next-message hook names), or null when that
+ * can't be told: an error, a slow answer, a server too old to list them.
+ */
+async function openTitles(io, origin, cwd) {
+    try {
+        const query = new URLSearchParams([
+            ...folderForms(cwd, io.home).map((form) => ['cwd', form]),
+            ['limit', '0'],
+            ['open', String(OPEN_CARDS)],
+        ]);
+        const { status, body } = await getJson(io, origin, `/mcp/cli/answers?${query}`, OPEN_TIME_BOX_MS, io.signal, { hook: true });
+        const requests = status === 200 ? body.open?.requests : undefined;
+        if (!Array.isArray(requests))
+            return null;
+        return requests.flatMap((card) => typeof card?.title === 'string' ? [card.title] : []);
+    }
+    catch {
+        return null;
+    }
+}
 export async function stopcheck(io, options) {
     try {
         const input = JSON.parse(await io.readStdin(1000));
@@ -180,7 +243,23 @@ export async function stopcheck(io, options) {
         const text = typeof input.last_assistant_message === 'string' && input.last_assistant_message.trim()
             ? input.last_assistant_message
             : turn.text;
-        if (turn.posted || !text || saysPosted(text) || saysNoCard(text) || !itemsForPerson(text))
+        if (!text)
+            return 0;
+        // Words they must type here (guide 2.21): a card has to say so, one from this turn or one still open.
+        const ask = asksToTypeHere(text);
+        if (ask) {
+            if (saysNoCard(text) || turn.cards.some((card) => cardFits(card, ask.words, 'posted')))
+                return 0;
+            const cwd = typeof input.cwd === 'string' && input.cwd ? input.cwd : io.cwd;
+            const open = await openTitles(io, options.origin, cwd);
+            // Not known (offline, slow, an older server): take the message's word that it's on a card.
+            if (open ? open.some((title) => cardFits(title, ask.words, 'open')) : saysPosted(text))
+                return 0;
+            const reason = confirmReason(ask.words, sessionLink(io.env));
+            io.out(`${JSON.stringify({ decision: 'block', reason })}\n`);
+            return 0;
+        }
+        if (turn.posted || saysPosted(text) || saysNoCard(text) || !itemsForPerson(text))
             return 0;
         io.out(`${JSON.stringify({ decision: 'block', reason: STOP_REASON })}\n`);
         return 0;

package/dist/version.js

@@ -1,2 +1,2 @@
 // The command line's version, as published (package.json). A test keeps them the same.
-export const VERSION = '0.7.0';
+export const VERSION = '0.9.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pendingyou",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Pending You for Claude Code: hear your answers from Pending You in the background, and set Claude Code up in one command.",
   "license": "Apache-2.0",
   "homepage": "https://www.pendingyou.com",
@@ -18,11 +18,17 @@
     "node": ">=20"
   },
   "exports": {
-    ".": "./dist/index.js"
+    ".": "./src/index.ts"
+  },
+  "publishConfig": {
+    "exports": {
+      ".": "./dist/index.js"
+    }
   },
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json && chmod +x dist/cli.js",
+    "prepublishOnly": "pnpm run build && pnpm run test",
     "test": "vitest run",
     "typecheck": "tsc -p tsconfig.json"
   }
-}
+}