pendingyou 0.8.0 → 0.10.0

package/dist/credentials.js

@@ -1,7 +1,7 @@
 // The command line's sign-in, one per Pending You address (production, staging, a local server), in
 // ~/.config/pendingyou/credentials.json: readable only by you (0600, in a 0700 folder), written whole, never printed
 // and never logged. A file someone loosened is tightened again on the next read.
-import { chmod, stat } from 'node:fs/promises';
+import { chmod, rm, stat } from 'node:fs/promises';
 import { join } from 'node:path';
 import { configDir, readJson, withLock, writeWhole } from "./files.js";
 export const credentialsPath = (io) => join(configDir(io), 'credentials.json');
@@ -57,3 +57,41 @@ export async function updateCredential(io, origin, change) {
         return next;
     });
 }
+export const clientsPath = (io) => join(configDir(io), 'clients.json');
+async function readClients(io) {
+    const file = await readJson(clientsPath(io)).catch(() => null);
+    return file && typeof file.origins === 'object' && file.origins !== null
+        ? file
+        : { version: 1, origins: {} };
+}
+/** The client this computer's connection for `origin` signed in with last, if any. */
+export async function connectionClient(io, origin) {
+    const entry = (await readClients(io)).origins[origin];
+    return typeof entry?.clientId === 'string' ? entry.clientId : null;
+}
+/** The name this computer's connection for `origin` signed in with ("devbox"), if it's known. */
+export async function connectionMachine(io, origin) {
+    const entry = (await readClients(io)).origins[origin];
+    return typeof entry?.machine === 'string' && entry.machine ? entry.machine : null;
+}
+/**
+ * Remembers the client this computer's connection for `origin` signed in with, or with null forgets it (uninstall),
+ * removing the file once it holds none.
+ */
+export async function saveConnectionClient(io, origin, clientId, machine) {
+    const path = clientsPath(io);
+    if (!clientId && !(await connectionClient(io, origin)))
+        return;
+    await withLock(path, io, async () => {
+        const file = await readClients(io);
+        if (clientId)
+            file.origins[origin] = { clientId, ...(machine ? { machine } : {}) };
+        else
+            delete file.origins[origin];
+        const text = `${JSON.stringify({ version: 1, origins: file.origins }, null, 2)}\n`;
+        if (Object.keys(file.origins).length === 0)
+            await rm(path, { force: true });
+        else
+            await writeWhole(path, text, { secret: true });
+    });
+}

package/dist/files.js

@@ -34,15 +34,15 @@ export async function readJson(path) {
 }
 /**
  * Writes a whole file at once. `secret` files and their folder are private to you (0600 and 0700), however they were
- * before; other files keep the mode they had.
+ * before; a `mode` given is the file's (a script's 0755); other files keep the mode they had.
  */
 export async function writeWhole(path, text, options = {}) {
     const folder = dirname(path);
     await mkdir(folder, { recursive: true, ...(options.secret ? { mode: 0o700 } : {}) });
     if (options.secret)
         await chmod(folder, 0o700);
-    let mode = options.secret ? 0o600 : 0o644;
-    if (!options.secret) {
+    let mode = options.mode ?? (options.secret ? 0o600 : 0o644);
+    if (!options.secret && options.mode === undefined) {
         try {
             mode = (await stat(path)).mode & 0o777;
         }

package/dist/hold.js

@@ -4,20 +4,41 @@
 // person; a fallback that ran; or it closed. Then it prints a few lines and exits, and Claude Code, which re-invokes
 // the model when a background command ends, wakes up with the answer, even if it was idle at the prompt.
 //
-// It lets go cleanly after --timeout (4 hours by default), on Ctrl-C or when Claude Code stops it, saying how the
-// answer will still arrive. Exit codes: 0 when it heard something or stopped cleanly; 1 when it can't wait at all
-// (not signed in, no such request, bad arguments).
-import { getJson, SignInNeeded, Unavailable } from "./api.js";
+// It lets go cleanly after --timeout (4 hours by default), on Ctrl-C or when Claude Code stops it (a background
+// command's own time limit can stop it sooner). Since 0.10.0 it then says to start it again in the background, with the
+// exact command: a session without the wake mod (Claude Code before 2.1.287, or no plugin and no init) has nothing
+// else to wake it, and two sessions missed answers overnight when it said not to (2026-10-04). Exit codes: 0 when it
+// heard something or stopped cleanly; 1 when it can't wait at all (not signed in, no such request, bad arguments).
+import { getJson, SESSION_APP, SignInNeeded, Unavailable } from "./api.js";
+import { DEFAULT_ORIGIN, DEFAULT_TIMEOUT_MS } from "./args.js";
 import { readCredential } from "./credentials.js";
-import { describe, isClosed } from "./format.js";
-import { markHanded, momentOf, startWaiting, stopWaiting } from "./state.js";
+import { describe } from "./format.js";
+import { markHanded, momentOf } from "./state.js";
 /** The longest one long poll asks the server to wait. */
 export const LONG_POLL_SECONDS = 25;
 /** After this long, a pause between long polls: an answer hours later needn't arrive within seconds. */
 const PATIENT_AFTER_MS = 30 * 60 * 1000;
 const PATIENT_PAUSE_MS = 30_000;
 const BACKOFF_MS = [2000, 5000, 10_000, 20_000, 30_000, 60_000];
-const holdCommand = (requestId) => `npx pendingyou hold ${requestId}`;
+/** A duration as `--timeout` takes it: 4h, 90m or 45s. */
+export function durationText(ms) {
+    if (ms % 3_600_000 === 0)
+        return `${ms / 3_600_000}h`;
+    if (ms % 60_000 === 0)
+        return `${ms / 60_000}m`;
+    return `${Math.round(ms / 1000)}s`;
+}
+/**
+ * The command that holds for this request again, as it was started: its origin and timeout when they aren't the
+ * defaults (`--origin` rather than PENDINGYOU_ORIGIN=…, so init's `Bash(npx pendingyou hold:*)` still allows it).
+ */
+export function holdCommand(requestId, origin = DEFAULT_ORIGIN, timeoutMs = DEFAULT_TIMEOUT_MS) {
+    return [
+        `npx pendingyou hold ${requestId}`,
+        ...(origin === DEFAULT_ORIGIN ? [] : [`--origin ${origin}`]),
+        ...(timeoutMs === DEFAULT_TIMEOUT_MS ? [] : [`--timeout ${durationText(timeoutMs)}`]),
+    ].join(' ');
+}
 const minutes = (ms) => {
     if (ms < 60_000)
         return `${Math.round(ms / 1000)} seconds`;
@@ -29,6 +50,7 @@ const minutes = (ms) => {
 };
 export async function hold(io, options) {
     const { origin, requestId } = options;
+    const again = holdCommand(requestId, origin, options.timeoutMs);
     const started = io.now();
     const deadline = started + options.timeoutMs;
     const print = (lines) => io.out(`${lines.join('\n')}\n`);
@@ -43,28 +65,27 @@ export async function hold(io, options) {
     };
     if (!(await readCredential(io, origin)))
         return signInNeeded(false);
-    await startWaiting(io, origin, requestId, io.cwd).catch(() => { });
     let failures = 0;
     for (;;) {
         if (io.signal.aborted) {
             print([
                 `Pending You: stopped waiting on ${requestId}.`,
-                'Their answer still reaches you with your next message or session; or call get_request at a breakpoint.',
+                `If you’re still waiting on their answer, start it again as a background command: ${again}`,
             ]);
             return 0;
         }
         const left = deadline - io.now();
         if (left <= 0) {
             print([
-                `Pending You: no answer on ${requestId} after ${minutes(options.timeoutMs)}, so I stopped waiting.`,
-                'Don’t start another hold now. Their answer reaches you with your next message or session, or check list_pending at a breakpoint.',
+                `Pending You: no answer on ${requestId} after ${minutes(options.timeoutMs)}, so this hold stopped.`,
+                `Start it again now as a background command, so their answer still wakes you: ${again}`,
             ]);
             return 0;
         }
         const wait = Math.max(1, Math.min(LONG_POLL_SECONDS, Math.floor(left / 1000)));
         let result;
         try {
-            result = await getJson(io, origin, `/mcp/cli/requests/${encodeURIComponent(requestId)}?wait=${wait}`, (wait + 20) * 1000, io.signal);
+            result = await getJson(io, origin, `/mcp/cli/requests/${encodeURIComponent(requestId)}?wait=${wait}&source=${SESSION_APP}`, (wait + 20) * 1000, io.signal);
         }
         catch (error) {
             if (io.signal.aborted)
@@ -80,7 +101,6 @@ export async function hold(io, options) {
         }
         failures = 0;
         if (result.status === 404) {
-            await stopWaiting(io, origin, [requestId]).catch(() => { });
             print([
                 `Pending You: can’t find ${requestId} among your person’s Claude Code questions on ${origin}.`,
                 'Check the id from post_request. If this Claude Code signed in to Pending You as someone else, use get_request instead.',
@@ -93,10 +113,8 @@ export async function hold(io, options) {
             continue;
         }
         if (heard.ready) {
-            print(describe(heard, `run \`${holdCommand(requestId)}\` in the background again`));
-            await markHanded(io, origin, [
-                { requestId, moment: momentOf(heard), closed: isClosed(heard) },
-            ]).catch(() => { });
+            print(describe(heard, `run \`${again}\` in the background again`));
+            await markHanded(io, origin, [{ requestId, moment: momentOf(heard) }]).catch(() => { });
             return 0;
         }
         if (io.now() - started > PATIENT_AFTER_MS)

package/dist/index.js

@@ -4,4 +4,5 @@ export { DEFAULT_ORIGIN, parseArgs } from "./args.js";
 export { readCredential, updateCredential } from "./credentials.js";
 export { main } from "./main.js";
 export { CLIENT_NAME, discover, register, revoke, SCOPE, signIn, signInWithDevice, } from "./oauth.js";
+export { qrCode, qrLines } from "./qr.js";
 export { VERSION } from "./version.js";

package/dist/install.js

@@ -21,6 +21,8 @@ export const cliRoot = (io) => join(configDir(io), 'cli');
 export const cliPrefix = (io, version = VERSION) => join(cliRoot(io), version);
 /** The command line inside a prefix. */
 export const cliScript = (prefix) => join(prefix, 'node_modules', 'pendingyou', 'dist', 'cli.js');
+/** The package inside a prefix, where its mod/ is (0.10.0). */
+export const cliPackage = (prefix) => join(prefix, 'node_modules', 'pendingyou');
 /** How long npm may take to install the package (it usually takes a few seconds). */
 const NPM_TIMEOUT_MS = 180_000;
 const exists = (path) => stat(path).then(() => true, () => false);
@@ -55,10 +57,10 @@ async function runningPackage(io) {
     const manifest = await readJson(join(root, 'package.json')).catch(() => null);
     return manifest?.name === 'pendingyou' && manifest.version === VERSION ? root : null;
 }
-/** Copies the package's published files (no dependencies to bring: it has none). */
+/** Copies the package's published files (no dependencies to bring: it has none), the wake mod included. */
 async function copyPackage(from, to) {
     await mkdir(to, { recursive: true });
-    for (const name of ['package.json', 'dist', 'README.md', 'CHANGELOG.md', 'LICENSE'])
+    for (const name of ['package.json', 'dist', 'mod', 'README.md', 'CHANGELOG.md', 'LICENSE'])
         if (await exists(join(from, name)))
             await cp(join(from, name), join(to, name), { recursive: true });
 }

package/dist/io.js

@@ -3,7 +3,7 @@
 import { spawn } from 'node:child_process';
 import { homedir, hostname } from 'node:os';
 import { createInterface } from 'node:readline';
-export function runProgram(command, args, timeoutMs = 60_000) {
+export function runProgram(command, args, timeoutMs = 60_000, options = {}) {
     return new Promise((resolve) => {
         let stdout = '';
         let stderr = '';
@@ -12,6 +12,8 @@ export function runProgram(command, args, timeoutMs = 60_000) {
             child = spawn(command, [...args], {
                 stdio: ['ignore', 'pipe', 'pipe'],
                 windowsHide: true,
+                // Exactly that environment, nothing of this process's.
+                ...(options.env ? { env: options.env } : {}),
             });
         }
         catch {

package/dist/main.js

@@ -2,13 +2,15 @@
 // it with their own Io.
 import { getJson, refreshInBackground, SignInNeeded, Unavailable } from "./api.js";
 import { commandOf, DEFAULT_ORIGIN, HOOK_COMMANDS, parseArgs, USAGE, UsageError, } from "./args.js";
-import { claudeState, installClaude, uninstallClaude } from "./claude.js";
-import { readCredential, signedInOrigins, updateCredential } from "./credentials.js";
+import { claudeState, installClaude, mcpFromFile, readManifest, uninstallClaude } from "./claude.js";
+import { connectionClient, connectionMachine, readCredential, saveConnectionClient, signedInOrigins, updateCredential, } from "./credentials.js";
 import { differs, serverForFolder, siteOf } from "./environment.js";
 import { PlainError } from "./errors.js";
 import { hold } from "./hold.js";
+import { MOD_CLAUDE, PLUGIN_DIRS } from "./mod.js";
 import { OAuthError, revoke, signIn, signInWithDevice } from "./oauth.js";
 import { pickup } from "./pickup.js";
+import { checkHelper, computerName, foundBy, headlessReason, helperPath, isRemoteSetup, machineOf, mcpHeaders, usesHelper, } from "./remote.js";
 import { stopcheck } from "./stopcheck.js";
 import { VERSION } from "./version.js";
 import { watch } from "./watch.js";
@@ -30,27 +32,89 @@ async function checkSignIn(io, origin) {
         return { state: 'unreachable' };
     }
 }
+/** `--origin <it>` for a command to run next, when it isn't production. */
+const originFlag = (origin) => (origin === DEFAULT_ORIGIN ? '' : ` --origin ${origin}`);
+/** What a computer's Claude Code connection is called: "Claude Code on devbox". */
+const titleOf = (machine) => machine ? `Claude Code on ${machine}` : 'Claude Code on this computer';
+/** This computer's connection's title: by the name it signed in with, else its hostname. */
+const connectionTitle = async (io, origin) => titleOf((await connectionMachine(io, origin)) ?? machineOf(io.host));
+/** A connection's title as Pending You has it: "Claude Code on devbox". */
+const serverTitle = (heard) => heard.machine ? `${heard.name} on ${heard.machine}` : heard.name;
+/** How to give this computer's connection another name: sign in again under it, which renames the connection. */
+const renameAdvice = (origin) => `To call it something friendlier, run: npx pendingyou login --name <name>${originFlag(origin)}\n`;
+/**
+ * Whether Claude Code here signs in through this computer's own sign-in for `origin` (remote.ts): its pendingyou MCP
+ * server runs our headersHelper, or init recorded that it set it up so. Then a sign-in must be that connection.
+ */
+async function signsInThroughHelper(io, origin) {
+    if (io.platform === 'win32')
+        return false;
+    const server = await mcpFromFile(io);
+    if (server !== 'unknown')
+        return usesHelper(server, origin);
+    const manifest = await readManifest(io);
+    return Boolean(manifest?.helper && manifest.origin === origin);
+}
 async function login(io, options) {
-    if (!options.force && (await readCredential(io, options.origin))) {
+    const connection = options.connection ?? (await signsInThroughHelper(io, options.origin));
+    if (connection && options.device === false)
+        throw new PlainError(`Claude Code on this computer signs in through this computer’s own sign-in, which you approve with a code on your phone. Run npx pendingyou login${originFlag(options.origin)} without --browser.`);
+    const current = await readCredential(io, options.origin);
+    if (!options.force && current && (!connection || current.kind === 'connection')) {
         const check = await checkSignIn(io, options.origin);
-        if (check.state === 'ok') {
+        // Another name for this computer's connection signs in again (one approval), which renames it on Pending You.
+        const known = check.state === 'ok' ? check.for?.machine : undefined;
+        const renaming = connection &&
+            options.machine !== undefined &&
+            options.machine !== (known ?? (await connectionMachine(io, options.origin)));
+        if (check.state === 'ok' && !renaming) {
             io.out(`Already signed in to Pending You at ${options.origin}.\n`);
             return 0;
         }
     }
     const previous = await readCredential(io, options.origin);
-    const { clientId, tokens } = options.device
-        ? await signInWithDevice(io, { origin: options.origin })
-        : await signIn(io, { origin: options.origin, browser: options.browser });
+    // A code on the phone: for a connection, when asked, or with no browser here (an SSH session).
+    const device = connection || (options.device ?? headlessReason(io) !== null);
+    // What the phone and the Assistants page call this computer: --name, Tailscale's name, or the hostname.
+    const named = device ? await computerName(io, options.machine) : null;
+    const machine = named?.name ?? '';
+    const { clientId, tokens } = connection
+        ? await signInWithDevice(io, {
+            origin: options.origin,
+            machine,
+            connection: true,
+            clientId: await connectionClient(io, options.origin),
+        })
+        : device
+            ? await signInWithDevice(io, { origin: options.origin, machine })
+            : await signIn(io, { origin: options.origin, browser: options.browser });
     await updateCredential(io, options.origin, () => ({
         clientId,
         ...tokens,
         signedInAt: new Date(io.now()).toISOString(),
+        ...(connection ? { kind: 'connection' } : {}),
     }));
+    if (connection)
+        await saveConnectionClient(io, options.origin, clientId, machine);
     // The sign-in this one replaces is revoked, so only one is live per computer.
     if (previous)
         await revoke(io, options.origin, previous.clientId, previous.refreshToken);
-    io.out('Signed in. Claude Code on this computer can now hear your answers from Pending You, even while it’s idle.\n');
+    if (connection) {
+        // A connection's sign-in hears for that connection, by name. A Pending You from before connections by code
+        // answers with the command line's own sign-in instead, whose token /mcp refuses: say so, rather than hand it to
+        // Claude Code.
+        const check = await checkSignIn(io, options.origin);
+        if (check.state === 'ok' && !check.for) {
+            await updateCredential(io, options.origin, (current) => current ? { ...current, kind: undefined } : null);
+            throw new PlainError(`Pending You at ${options.origin} doesn’t connect Claude Code on a computer with no browser yet, so this computer is signed in only to hear answers. Try again once it’s updated.`);
+        }
+    }
+    io.out(connection
+        ? `Signed in: ${titleOf(machine)} can ask you questions and hear your answers, with no browser here.\n`
+        : 'Signed in. Claude Code on this computer can now hear your answers from Pending You, even while it’s idle.\n');
+    // A cloud's own name ("ip-10-42-1-252"): kept, since there's nothing better, with how to change it.
+    if (connection && named?.unfriendly)
+        io.out(`It’s named after this computer’s hostname. ${renameAdvice(options.origin)}`);
     return 0;
 }
 async function logout(io, options) {
@@ -72,64 +136,150 @@ async function logout(io, options) {
     return 0;
 }
 async function status(io, origin) {
-    const [signIn, claude, here] = await Promise.all([
+    const [signIn, claude, here, credential, manifest] = await Promise.all([
         checkSignIn(io, origin),
         claudeState(io),
         serverForFolder(io, io.cwd),
+        readCredential(io, origin),
+        readManifest(io),
     ]);
-    const lines = [`Pending You for Claude Code · ${origin}`];
+    const flag = originFlag(origin);
+    const mcp = claude.mcp;
+    // A computer with no browser (remote.ts): Claude Code's server signs in through the helper, and the sign-in is its
+    // connection. What's set up and what's missing is said for that, with the command that fixes it.
+    const helped = usesHelper(mcp, origin);
+    const remote = isRemoteSetup(io, null, helped || Boolean(manifest?.helper && manifest.origin === origin));
+    const why = remote ? headlessReason(io) : null;
+    const lines = [
+        `Pending You for Claude Code · ${origin}${remote ? (why ? ` · no browser here (${why})` : ' · signs in without a browser') : ''}`,
+    ];
     const mark = (ok) => (ok ? 'ok     ' : 'missing');
     const url = `${origin}/mcp`;
-    const mcp = claude.mcp;
-    const mcpOk = mcp !== false && mcp !== 'unknown' && (!mcp.url || mcp.url.replace(/\/+$/, '') === url);
+    const sameServer = mcp !== false && mcp !== 'unknown' && (!mcp.url || mcp.url.replace(/\/+$/, '') === url);
+    const mcpOk = remote ? sameServer && helped : sameServer;
     const mcpText = mcp === 'unknown'
         ? 'Claude Code didn’t say in time; check with claude mcp get pendingyou'
         : mcp === false
-            ? 'not added; run npx pendingyou init'
-            : mcpOk
-                ? `pendingyou${mcp.url ? ` (${mcp.url})` : ''}`
-                : `points at ${mcp.url}, not ${url}, so sessions post cards where these hooks don’t hear them; run npx pendingyou init${origin === DEFAULT_ORIGIN ? '' : ` --origin ${origin}`} to replace it`;
+            ? `not added; run npx pendingyou init${flag}`
+            : !sameServer
+                ? `points at ${mcp.url}, not ${url}, so sessions post cards where these hooks don’t hear them; run npx pendingyou init${flag} to replace it`
+                : !remote
+                    ? `pendingyou${mcp.url ? ` (${mcp.url})` : ''}`
+                    : helped
+                        ? `pendingyou (${mcp.url}), signed in through ${helperPath(io)}`
+                        : mcp.helper
+                            ? `pendingyou (${mcp.url}) signs in through a headersHelper of its own (${mcp.helper}); run npx pendingyou init${flag} to use this computer’s sign-in`
+                            : `pendingyou (${mcp.url}) signs in through a browser, which can’t finish on this computer; run npx pendingyou init${flag}`;
     const form = claude.form;
     const hooksRun = form?.runs ?? true;
+    // The wake mod (0.10.0): Claude Code 2.1.287 or later loads it from the plugin or from CLAUDE_CODE_PLUGIN_DIRS.
+    const mod = claude.mod;
+    const modOk = mod.loads && (mod.plugin || mod.present);
+    const modText = !claude.claude
+        ? `needs Claude Code ${MOD_CLAUDE} or later`
+        : !mod.loads
+            ? `needs Claude Code ${MOD_CLAUDE} or later (this is ${claude.claude}); until then, a background hold wakes it`
+            : mod.present
+                ? `in ${PLUGIN_DIRS} (${mod.dirs.join(', ')}); a session is woken when you answer, with no hold running`
+                : mod.plugin
+                    ? 'in the Pending You plugin; a session is woken when you answer, with no hold running'
+                    : mod.dirs.length
+                        ? `${mod.dirs.join(', ')} is gone; run npx pendingyou@latest init${flag}`
+                        : `not installed; run npx pendingyou@latest init${flag}`;
     const formText = !form
         ? ''
         : form.form === 'direct'
             ? form.runs
                 ? `they run pendingyou${form.version ? ` ${form.version}` : ''} directly (${form.script})`
-                : `the Node or the copy of pendingyou they run is gone (${form.node}, ${form.script}); run npx pendingyou@latest init`
+                : `the Node or the copy of pendingyou they run is gone (${form.node}, ${form.script}); run npx pendingyou@latest init${flag}`
             : form.form === 'npx'
-                ? 'they run through npx, which is slower; run npx pendingyou@latest init to run them directly'
+                ? `they run through npx, which is slower; run npx pendingyou@latest init${flag} to run them directly`
                 : 'they run pendingyou from PATH or a file of your own';
-    lines.push(`  ${mark(signIn.state === 'ok')} Sign-in: ${signIn.state === 'ok'
-        ? signIn.for
-            ? `hears for ${signIn.for.name} only (for pendingyou watch)`
-            : `hears for ${signIn.connections} Claude Code connection${signIn.connections === 1 ? '' : 's'}`
-        : signIn.state === 'ended'
-            ? 'ended; run npx pendingyou login'
-            : signIn.state === 'none'
-                ? 'not signed in; run npx pendingyou login'
-                : 'Pending You couldn’t be reached'}`, `  ${mark(claude.claude !== null)} Claude Code: ${claude.claude ?? 'not found on PATH'}`, `  ${mark(mcpOk)} MCP server: ${mcpText}`, `  ${mark(claude.skill)} Skill: ${claude.skill ? 'saved' : 'not saved; run npx pendingyou init'}`, `  ${mark(claude.hooks && hooksRun)} Hooks: ${claude.hooks ? `session-start pickup and next-message hand-off; ${formText}` : 'not installed; run npx pendingyou init'}`, `  ${mark(claude.stopcheck)} Stop check: ${claude.stopcheck ? 'asks Claude Code to post what it leaves you in chat' : 'not installed; run npx pendingyou init'}`);
+    // Remote: login makes a connection only once Claude Code's server signs in through the helper; init does both.
+    const fix = `npx pendingyou ${helped ? 'login' : 'init'}${flag}`;
+    // The connection's name as Pending You has it, so status never drifts from it; else this computer's own record.
+    const title = signIn.state === 'ok' && signIn.for
+        ? serverTitle(signIn.for)
+        : await connectionTitle(io, origin);
+    const connected = credential?.kind === 'connection';
+    const signOk = signIn.state === 'ok' && (!remote || connected);
+    const signText = remote
+        ? signIn.state === 'ok'
+            ? connected
+                ? `this computer’s own connection, ${title}; Claude Code here asks and hears through it`
+                : `this computer’s sign-in only hears answers, so Claude Code here can’t use it; run ${fix}`
+            : signIn.state === 'ended'
+                ? `ended; run ${fix}`
+                : signIn.state === 'none'
+                    ? `not signed in; run ${fix} (you approve a code on your phone)`
+                    : 'Pending You couldn’t be reached'
+        : signIn.state === 'ok'
+            ? signIn.for
+                ? `hears for ${signIn.for.name} only (for pendingyou watch)`
+                : `hears for ${signIn.connections} Claude Code connection${signIn.connections === 1 ? '' : 's'}`
+            : signIn.state === 'ended'
+                ? `ended; run npx pendingyou login${flag}`
+                : signIn.state === 'none'
+                    ? `not signed in; run npx pendingyou login${flag}`
+                    : 'Pending You couldn’t be reached';
+    // The helper as Claude Code runs it at its barest: found Node, and runs pendingyou's copy.
+    const helper = remote ? await checkHelper(io, origin) : null;
+    lines.push(`  ${mark(signOk)} Sign-in: ${signText}`, `  ${mark(claude.claude !== null)} Claude Code: ${claude.claude ?? 'not found on PATH'}`, `  ${mark(mcpOk)} MCP server: ${mcpText}`, ...(helper
+        ? [
+            `  ${mark(helper.ok)} Sign-in helper: ${helper.ok
+                ? `${helper.node} (${foundBy(helper.from)}) runs pendingyou ${helper.version}, even for a Claude Code started without your shell’s PATH`
+                : `${helper.why}; run npx pendingyou init${flag}`}`,
+        ]
+        : []), `  ${mark(claude.skill)} Skill: ${claude.skill ? 'saved' : `not saved; run npx pendingyou init${flag}`}`, `  ${mark(claude.hooks && hooksRun)} Hooks: ${claude.hooks ? `session-start pickup and next-message hand-off; ${formText}` : `not installed; run npx pendingyou init${flag}`}`, `  ${mark(claude.stopcheck)} Stop check: ${claude.stopcheck ? 'asks Claude Code to post what it leaves you in chat' : `not installed; run npx pendingyou init${flag}`}`, `  ${mark(modOk)} Wake mod: ${modText}`);
     // A folder's own server (local or project scope) wins over the user one in Claude Code: say when it's elsewhere. (The
     // plugin's server counts only when no server was added by hand, and is production's.)
     if (here && (here.scope === 'local' || here.scope === 'project') && differs(here, origin))
         lines.push(`  ${mark(false)} This folder: its ${here.scope}-scope pendingyou MCP server (${here.url}) is another Pending You than ${origin}; Claude Code uses it here instead`);
     const user = mcp !== false && mcp !== 'unknown' && mcp.url ? { url: mcp.url, scope: 'user' } : null;
     const other = differs(here, origin) ? here : differs(user, origin) ? user : null;
-    const ready = signIn.state === 'ok' && claude.hooks && hooksRun && !other;
+    // Remote, Claude Code reaches Pending You only through the helper, the connection and the server together.
+    const reaches = !remote || (signOk && mcpOk && helper?.ok === true);
+    const ready = reaches && signIn.state === 'ok' && claude.hooks && hooksRun && !other;
     if (other)
         lines.push(`Mismatch: Claude Code’s MCP server is ${siteOf(other.url)} but the hooks and sign-in are ${siteOf(origin) ?? origin}. Use the one you look at (npx pendingyou init --origin <it>), then restart your Claude Code sessions.`);
     lines.push(ready
-        ? 'Ready: Claude Code hears answers right away (report_setup hears "instant").'
-        : 'Not ready: Claude Code hears answers while it’s working (report_setup hears "while-working").');
+        ? remote
+            ? 'Ready: Claude Code here signs in with no browser, and hears answers right away (report_setup hears "instant").'
+            : 'Ready: Claude Code hears answers right away (report_setup hears "instant").'
+        : reaches
+            ? 'Not ready: Claude Code hears answers while it’s working (report_setup hears "while-working").'
+            : 'Not ready: Claude Code here can’t reach Pending You until the lines marked missing are fixed.');
     io.out(`${lines.join('\n')}\n`);
     return ready ? 0 : 1;
 }
 async function init(io, options) {
     io.out(`Setting up Pending You for Claude Code (${options.origin}).\n`);
-    const steps = await installClaude(io, options.origin, {
-        yes: options.yes,
-        report: (step) => io.out(`  ${step.ok ? 'ok     ' : 'check  '} ${step.text}\n`),
-    });
+    const name = options.machine ? { machine: options.machine } : {};
+    const report = (step) => io.out(`  ${step.ok ? 'ok     ' : 'check  '} ${step.text}\n`);
+    // A computer with no browser (remote.ts): one code approved on the phone signs Claude Code in, then the rest.
+    if (isRemoteSetup(io, options.device, await signsInThroughHelper(io, options.origin))) {
+        const why = options.device ? null : headlessReason(io);
+        io.out(`${why ? `No browser here (${why}), so ` : ''}Claude Code here signs in through this computer’s own sign-in, which you approve once with a code on your phone.\n`);
+        if (options.login)
+            await login(io, {
+                origin: options.origin,
+                browser: false,
+                force: false,
+                device: true,
+                connection: true,
+                ...name,
+            });
+        else
+            io.out(`Skipped signing in. Run npx pendingyou login${originFlag(options.origin)} when you’re ready: you approve a code on your phone.\n`);
+        const steps = await installClaude(io, options.origin, {
+            yes: options.yes,
+            report,
+            remote: true,
+        });
+        io.out('Next: start Claude Code here (claude, in the folder you work in) and ask it to finish setting up Pending You. It’s signed in already, so there’s nothing to Authenticate in /mcp. If it’s running, restart it first (/exit, then claude --continue).\n');
+        return steps.every((step) => step.ok) ? 0 : 1;
+    }
+    const steps = await installClaude(io, options.origin, { yes: options.yes, report });
     if (options.login) {
         io.out('Signing this computer in, so answers can wake Claude Code:\n');
         await login(io, {
@@ -137,18 +287,25 @@ async function init(io, options) {
             browser: options.browser,
             device: options.device,
             force: false,
+            ...name,
         });
     }
     else
-        io.out('Skipped signing in. Run npx pendingyou login when you’re ready.\n');
+        io.out(`Skipped signing in. Run npx pendingyou login${originFlag(options.origin)} when you’re ready.\n`);
     io.out('Next, in Claude Code: if it’s open, restart it (/exit, then claude --continue), run /mcp, choose pendingyou and Authenticate. Then ask Claude Code to finish setting up Pending You.\n');
     return steps.every((step) => step.ok) ? 0 : 1;
 }
 async function uninstall(io, origin) {
+    const credential = await readCredential(io, origin);
+    const title = await connectionTitle(io, origin);
     const steps = await uninstallClaude(io);
     for (const step of steps)
         io.out(`  ${step.ok ? 'ok     ' : 'check  '} ${step.text}\n`);
     await logout(io, { origin, all: false });
+    await saveConnectionClient(io, origin, null);
+    // Its connection outlives the sign-in on Pending You's side: only the person removes it.
+    if (credential?.kind === 'connection')
+        io.out(`${title} is still on your Assistants page (${origin}/app/assistants): remove it there if you won’t use it again.\n`);
     return steps.every((step) => step.ok) ? 0 : 1;
 }
 async function run(io, command, hook = { fallback: '' }) {
@@ -186,6 +343,9 @@ async function run(io, command, hook = { fallback: '' }) {
             }
             catch { }
             return 0;
+        case 'mcp-headers':
+            // Claude Code's headersHelper on a computer with no browser: stdout is the headers and nothing else.
+            return mcpHeaders(io, command);
     }
 }
 /**