pendingyou 0.8.0 → 0.9.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 0.9.0
+
+- The Stop check catches a final message that asks you to type or reply something in Claude Code's own chat
+  ("Reply “yes, erase disk12” here", "To confirm, type `yes`", "Confirm here"). Some steps an agent takes only on your
+  own words in its conversation, not on a card answer (something that can't be undone, credentials, anything outside
+  its sandbox), and that's right; but when it asks only in its chat, you never learn where you're needed. Unless a
+  Pending You card posted in that turn, or one still open from this folder, asks for the same thing, Claude Code is
+  asked once to post an action card that sends you there (about 76 tokens, plus the link): titled “Confirm in Claude
+  Code on <computer>: <step>”, with the exact words as a step's command (so the card shows them with a copy button),
+  where to type them, and what it'll do then; or, for a card you already answered, to reopen it with the same ask.
+- The link is the session's own when Claude Code says it: `https://claude.ai/code/<id>` from
+  `CLAUDE_CODE_BRIDGE_SESSION_ID` while Remote Control is on, or from `CLAUDE_CODE_REMOTE_SESSION_ID` on the web.
+- It counts as an ask: an imperative or a request to you ("please …", "can you …", "I need you to …") with the words
+  quoted, in backticks, or a plain "yes", tied to this chat ("here", "in this chat") or to going ahead ("to confirm",
+  "and I'll …"). Not in code, block quotes or quoted text; not what a program, prompt, page or message says; not a step
+  in your terminal, at a prompt or on a page; not a standing offer ("anytime"); not a command or slash command. A card
+  matches when its words name what's being confirmed ("erase" and "disk12"), or, with only a "yes" to go on, when it
+  was posted in the turn or its title asks to confirm.
+- Only such a message costs a request: this folder's open cards (the same one the next-message hook makes), given up
+  after 1.5 seconds. When Pending You can't say (offline, slow, an older server), the message's own word that it's on
+  a card is taken. Everything else the Stop check does is as before, with no request.
+- Hooks still run this version from `~/.config/pendingyou/cli/0.9.0/`: run `npx pendingyou@latest init` once to switch.
+
 ## 0.8.0
 
 - The hooks say when a session is on another Pending You. A Claude Code session stayed connected to staging after its

package/README.md

@@ -37,7 +37,7 @@ never refreshes the sign-in itself: when that's due, it starts the refresh in th
 own. Running `init` again updates them in place, and adds any a newer version brings.
 
 The hooks run that copy with Node directly, like
-`"/opt/homebrew/bin/node" "~/.config/pendingyou/cli/0.8.0/node_modules/pendingyou/dist/cli.js" handoff || true` (the
+`"/opt/homebrew/bin/node" "~/.config/pendingyou/cli/0.9.0/node_modules/pendingyou/dist/cli.js" handoff || true` (the
 paths in full). If the copy can't be made (no npm, no network), they run through `npx -y --prefer-offline
 pendingyou@<version>` instead. `npx pendingyou status` says which. If you remove the Node they run with, run `init`
 again.
@@ -58,13 +58,21 @@ Deep into a long conversation, Claude Code tends to end a turn with a question f
   Claude Code is asked to go on once (about 31 tokens): post them as cards, or say they don't need one. It never asks
   twice in a row.
 
-The check is pattern matching on your computer: no model, no network. It reads only the last turn from the end of the
+The check is pattern matching on your computer: no model. It reads only the last turn from the end of the
 transcript (at most 4 MB) and skips code blocks and quotes. It counts as for you: a question to you (a sentence ending
 in "?" with "you" or "your"); "you'll need to", "your step", "can you", "please run", "in your terminal", "only you
 can", "waiting on you" and the like; or a list under a heading like "Your part", "Your steps", "For you", "Waiting on
 you" or "Left for you". It lets the turn end when the message says nothing needs a card ("No card needed.", "Nothing
 needs your attention.", "There's nothing waiting on you.").
 
+Since 0.9.0 it also catches a message asking you to type or reply something in Claude Code's own chat ("Reply “yes,
+erase disk12” here", "To confirm, type `yes`", "Confirm here"). Some steps an agent takes only on your own words in
+its conversation, never on a card answer; that's fine, but then a card has to send you there. Unless a card posted in
+that turn, or one still open from this folder, asks for the same thing, Claude Code is asked once to post an action
+card titled “Confirm in Claude Code on <computer>: <step>”, with the exact words to copy, where to type them (the
+session's link when Remote Control or Claude Code on the web gives one) and what it'll do then. Only such a message
+costs a request: this folder's open cards, given up after 1.5 seconds.
+
 **On 0.2.0 with another origin?** Its hooks blocked every message (`There's no "--origin" command`). Run
 `npx pendingyou@latest init --origin <url>` again to repair them; see [CHANGELOG.md](CHANGELOG.md).
 

package/dist/confirm.js

@@ -0,0 +1,231 @@
+// "Confirm in your agent" (guide 2.21, CLI 0.9.0). Some steps an agent takes only on its person's own words in its
+// conversation: a card answer reaches it as a tool's result, and its rules (or its app's) want more for something that
+// can't be undone, credentials, or anything outside its sandbox. That's right, but on 2026-10-03 a Claude Code agent
+// declined to act on an approved "Erase disk12?" card, asked for "yes, erase disk12" in its own chat, and never told
+// Pending You, so Darin had to go and find the session.
+//
+// The Stop hook (stopcheck.ts) now catches a final message that asks the person to type or reply something in this
+// chat: asksToTypeHere finds it, cardFits says whether a card already asks for it (one posted in the turn, or one still
+// open), and confirmReason is what Claude Code reads when none does: post an action card that sends them here, with
+// the exact words as a step's command and, when Claude Code says it, the session's link.
+//
+// Pattern matching only, deliberately narrow (a block costs a whole extra turn): an ask said to the person (an
+// imperative, "please …", "can you …", "I need you to …"), with the words quoted or a plain "yes", and anchored to this
+// chat ("here", "in this chat") or to going ahead ("to confirm", "and I'll …"). Never in code, block quotes or quoted
+// text; never what a program, a page or a message says; never a step somewhere else (their terminal, a prompt, a page,
+// a link) or a standing offer ("anytime"); never a command or slash command to run.
+/** Verbs that hand the person something to type. */
+const VERB = '(?:type|reply|respond|write|say|send|enter|paste|answer)';
+/**
+ * What comes right before a verb said to the person: the start of a sentence or clause, "and"/"then", a request
+ * ("can you", "I need you to", "I'll wait for you to", "you'll need to", "you can"), then any "please", "just" or
+ * "now".
+ */
+const LEAD = String.raw `(?:^|[,;:(—–→]\s*|\s-\s+|\b(?:and|then|or|so)\s+|\b(?:can|could|would|will)\s+you\s+|\b(?:need|want|like|for)\s+you\s+to\s+|\byou(?:’|')ll\s+(?:need|have)\s+to\s+|\byou\s+(?:need|have)\s+to\s+|\byou\s+can\s+|\ball\s+you\s+need\s+to\s+do\s+is\s+)(?:(?:please|just|simply|kindly|now|then)\s+)*`;
+const ASK = new RegExp(`${LEAD}${VERB}\\b`, 'giu');
+/** "Confirm here", "please confirm in this chat", "can you confirm it here". */
+const CONFIRM_HERE = new RegExp(`${LEAD}confirm(?:\\s+(?:it|this|that|so))?\\s+(?:here|below|in\\s+(?:this|our|the)\\s+(?:chat|conversation|session))\\b`, 'iu');
+/** "Confirm (in this chat) by typing “…”". */
+const CONFIRM_BY = /\bconfirm\b[^.!?\n]{0,30}?\bby\s+(?:typing|replying(?:\s+with)?|saying|sending)\s+⟦(\d+)⟧/iu;
+/** This chat: where the words go. */
+const HERE = /\b(?:here|below|in\s+(?:this|our|the)\s+(?:chat|conversation|session)|in\s+chat|in\s+this\s+(?:terminal|window)|(?:back\s+)?to\s+me)\b/iu;
+/** What typing it does: lets the agent go ahead. */
+const PURPOSE = /\b(?:to\s+(?:confirm|proceed|continue|go\s+ahead|approve|start|begin|carry\s+on|unblock\s+me)|(?:and|so|then)\s+I(?:’|')ll\b|(?:and|so)\s+I\s+(?:can|will)\b|if\s+you\s+want\s+me\s+to\b|when\s+you(?:’|')re\s+ready\b|before\s+I\b)/iu;
+/** Plain words people are asked to type without quotes. */
+const PLAIN_WORD = /^\s*(?:back\s+)?(?:with\s+)?(go ahead|ship it|do it|yes|y|ok|okay|go|proceed|confirm|confirmed|continue|approve|approved)\b/iu;
+/**
+ * What may come between the verb and the quoted words: "Reply here with “…”", "Type these words in this chat: “…”",
+ * "Reply with the exact phrase “…”". Never a recipient ("Reply to Sarah with “…”").
+ */
+const FILLER = /^(?:\s|[,:]|back\b|me\b|it\b|to me\b|with\b|exactly\b|precisely\b|verbatim\b|just\b|the\b|exact\b|following\b|phrase\b|words?\b|text\b|these\b|this\b|that\b|here\b|below\b|in (?:this|our) (?:chat|conversation|session|terminal|window)\b)*$/iu;
+/** Somewhere else to type it: their terminal, a prompt, a page or a form, or a link (but this session's own). */
+const ELSEWHERE = /\b(?:in|into|at|on)\s+(?:your|a|the|that|their)\s+(?:terminal|shell|browser|console|prompt|form|field|dialog|email|inbox|page|app|site|website|portal|dashboard)\b|\bin\s+(?:Terminal|iTerm)\b|\bwhen\s+(?:prompted|asked|it\s+asks)\b|\bat\s+the\s+prompt\b|https?:\/\/(?!claude\.ai\/code\/)/iu;
+/** This chat, said outright, which wins over another place in the same sentence. */
+const THIS_CHAT = /\bin\s+(?:this|our)\s+(?:chat|conversation|session)\b/iu;
+/** A standing offer, not a wait: "Say “stop” anytime". */
+const OFFER = /\b(?:any\s?time|whenever|at\s+any\s+(?:point|time)|if\s+you\s+change\s+your\s+mind|if\s+(?:anything|something)\s+(?:looks|seems|goes))\b/iu;
+/** What something says rather than an ask: "The email ends with: Reply “STOP” here". */
+const DESCRIBED = /\b(?:says?|said|reads?|ends?\s+with|starts?\s+with|shows?|prints?|displays?|asks?|prompts?|tells?\s+\w+|text|message|copy|label|button|template)\s*[:,]?$/iu;
+/** A command or a slash command: a step to run (the general check's business), not words to type to the agent. */
+const COMMAND_LIKE = /^\s*(?:[!/]|\$\s|(?:cd|npm|npx|pnpm|yarn|bun|git|gh|curl|wget|brew|node|python3?|pip|docker|ssh|scp|sudo|claude|codex|wrangler)\s)/u;
+/** Quoted spans the words come in: “…”, "…", `…`, ‘…’ and '…' (not an apostrophe). */
+const QUOTED = /“([^“”\n]{1,160})”|"([^"\n]{1,160})"|`([^`\n]{1,160})`|‘([^‘’\n]{1,160})’|(?<![\p{L}\p{N}])'([^'\n]{1,160})'(?![\p{L}\p{N}])/gu;
+/**
+ * The text as it reads to the person: without fenced code and block quotes (quoted words stay), and without Markdown's
+ * list markers, headings and emphasis (`**Reply “yes” here**`).
+ */
+export function proseOf(text) {
+    const kept = [];
+    let fence = null;
+    for (const line of text.split('\n')) {
+        const marker = /^\s*(`{3,}|~{3,})/.exec(line)?.[1];
+        if (fence) {
+            if (marker?.startsWith(fence))
+                fence = null;
+            continue;
+        }
+        if (marker) {
+            fence = marker;
+            continue;
+        }
+        if (/^\s*>/.test(line))
+            continue;
+        kept.push(line
+            .replace(/^\s*(?:[-*•+]|\d+[.)])\s+/u, '')
+            .replace(/^\s*#+\s*/u, '')
+            .replace(/\*+|__/gu, ''));
+    }
+    return kept.join('\n');
+}
+/** Each quoted span replaced by ⟦n⟧, with what it held. */
+function marked(text) {
+    const quotes = [];
+    const out = text.replace(QUOTED, (...groups) => {
+        const inner = groups.slice(1, 6).find((group) => typeof group === 'string');
+        quotes.push(inner.trim());
+        return `⟦${quotes.length - 1}⟧`;
+    });
+    return { text: out, quotes };
+}
+/** One sentence's ask, or null. `quotes` are the message's quoted spans, by marker number. */
+function askIn(sentence, quotes) {
+    if ((ELSEWHERE.test(sentence) && !THIS_CHAT.test(sentence)) || OFFER.test(sentence))
+        return null;
+    const by = CONFIRM_BY.exec(sentence);
+    if (by) {
+        const words = quotes[Number(by[1])] ?? '';
+        if (words && !COMMAND_LIKE.test(words))
+            return { words };
+    }
+    for (const found of sentence.matchAll(ASK)) {
+        const start = found.index ?? 0;
+        // What a program, a page or a message says isn't an ask: "The SMS ends with: Reply “STOP” here".
+        if (DESCRIBED.test(sentence.slice(0, start).trimEnd()))
+            continue;
+        const from = start + found[0].length;
+        const tail = sentence.slice(from, from + 140);
+        const quote = /⟦(\d+)⟧/u.exec(tail);
+        let words = null;
+        let after = tail;
+        let before = '';
+        if (quote && FILLER.test(tail.slice(0, quote.index))) {
+            words = quotes[Number(quote[1])] ?? null;
+            before = tail.slice(0, quote.index);
+            after = tail.slice(quote.index + quote[0].length);
+        }
+        else {
+            const plain = PLAIN_WORD.exec(tail);
+            if (plain) {
+                words = plain[1].toLowerCase();
+                after = tail.slice(plain[0].length);
+            }
+        }
+        if (words !== null) {
+            if (COMMAND_LIKE.test(words))
+                continue;
+            // Anchored to this chat or to going ahead, or the ask stands alone: "Reply “yes, erase disk12”."
+            const near = after.slice(0, 80);
+            const alone = quote !== null && /^[\s.!)…]*$/u.test(after);
+            if (HERE.test(before) || HERE.test(near) || PURPOSE.test(near) || alone)
+                return { words };
+            continue;
+        }
+        // "Reply here to confirm": no words, but here and going ahead.
+        if (HERE.test(tail.slice(0, 40)) && PURPOSE.test(tail.slice(0, 80)))
+            return { words: null };
+    }
+    return CONFIRM_HERE.test(sentence) ? { words: null } : null;
+}
+/**
+ * Whether the final message asks the person to type or reply something in this chat, and what: "Reply “yes, erase
+ * disk12” here", "To confirm, type `yes`", "Please reply yes here and I'll merge it", "Confirm here". Null otherwise.
+ */
+export function asksToTypeHere(text) {
+    const { text: prose, quotes } = marked(proseOf(text));
+    for (const sentence of prose.split(/(?<=[.!?])\s+|\n+/u)) {
+        const ask = askIn(sentence.trim(), quotes);
+        if (ask)
+            return ask;
+    }
+    return null;
+}
+/** Words that don't tell one card from another: "yes", "confirm", "please"… */
+const COMMON = new Set([
+    'yes',
+    'y',
+    'ok',
+    'okay',
+    'sure',
+    'please',
+    'confirm',
+    'confirmed',
+    'go',
+    'ahead',
+    'proceed',
+    'continue',
+    'approve',
+    'approved',
+    'do',
+    'it',
+    'i',
+    'the',
+    'a',
+    'an',
+    'to',
+    'and',
+    'of',
+    'me',
+    'my',
+    'this',
+    'that',
+]);
+const wordsOf = (text) => text.toLowerCase().match(/[\p{L}\p{N}]+/gu) ?? [];
+/** The words that say what's being confirmed: "yes, erase disk12" → erase, disk12. */
+export const telling = (words) => words === null ? [] : [...new Set(wordsOf(words).filter((word) => !COMMON.has(word)))];
+/**
+ * Whether a card asks for this: one posted in the turn (`posted`: the words its call carried) or one still open
+ * (`open`: its title). A card fits when it names everything that tells the words apart ("erase" and "disk12" for
+ * “yes, erase disk12”). With nothing to tell them by ("yes", or no words at all), any card posted in the turn fits,
+ * and an open one only when its title asks to confirm; an open "Confirm …" card that names some of them fits too.
+ */
+export function cardFits(text, words, where) {
+    const wanted = telling(words);
+    const has = new Set(wordsOf(text));
+    if (wanted.length && wanted.every((word) => has.has(word)))
+        return true;
+    if (where === 'posted')
+        return wanted.length === 0;
+    return /\bconfirm/i.test(text) && (wanted.length === 0 || wanted.some((word) => has.has(word)));
+}
+/**
+ * The session's link when Claude Code says it: Remote Control's session (CLAUDE_CODE_BRIDGE_SESSION_ID, in `session_`
+ * form) or a session on the web (CLAUDE_CODE_REMOTE_SESSION_ID, whose `cse_` is the link's `session_`), as
+ * https://code.claude.com/docs/en/env-vars documents them. Null when neither is set.
+ */
+export function sessionLink(env) {
+    const bridge = env.CLAUDE_CODE_BRIDGE_SESSION_ID?.trim();
+    if (bridge && /^session_[A-Za-z0-9]{8,80}$/.test(bridge))
+        return `https://claude.ai/code/${bridge}`;
+    const remote = env.CLAUDE_CODE_REMOTE_SESSION_ID?.trim();
+    if (remote && /^(?:cse|session)_[A-Za-z0-9]{8,80}$/.test(remote))
+        return `https://claude.ai/code/${remote.replace(/^cse_/, 'session_')}`;
+    return null;
+}
+/** The most of the asked-for words the reason repeats. */
+export const REASON_WORDS = 60;
+/**
+ * What Claude Code reads when it asked for words here and no card says so: post the action card that sends them here,
+ * or reopen the card they already answered (about 65 tokens, 80 with a link).
+ */
+export function confirmReason(words, link) {
+    const chars = [...(words?.replace(/\s+/g, ' ').trim() ?? '')];
+    const shown = chars.length > REASON_WORDS
+        ? `${chars
+            .slice(0, REASON_WORDS - 1)
+            .join('')
+            .trimEnd()}…`
+        : chars.join('');
+    const asked = shown ? `to type “${shown}” here` : 'to confirm here';
+    const what = shown ? 'those exact words' : 'the words to type';
+    return `You asked them ${asked}, but no open Pending You card says so: post an action card “Confirm in Claude Code on <computer>: <step>” with ${what} as a step command, where Claude Code on <computer>${link ? `, ${link}` : ''}, done what you’ll do (a card they answered: reply_in_thread with reopen).`;
+}

package/dist/stopcheck.js

@@ -2,11 +2,20 @@
 // the person in the chat (a question to them, a step only they can do, a "Your part:" list) and it posted nothing to
 // Pending You in that turn, it asks Claude Code to go on and post it (`{"decision":"block","reason":…}`), once.
 //
-// Pattern matching only, no model, no network: it reads the hook's JSON, the final message, and the tail of the
-// transcript back to the person's last message, never more than READ_CAP bytes. It never loops (stop_hook_active),
+// Since 0.9.0 (guide 2.21) it also catches a final message asking them to type or reply something in this chat
+// ("Reply “yes, erase disk12” here", "confirm here"): an agent that won't act on a card answer for that step must say
+// so on a card, or they never learn where they're needed. Unless a card posted in the turn, or one still open from this
+// folder, asks for the same thing, it asks Claude Code to post the action card that sends them here (confirm.ts).
+//
+// Pattern matching only, no model: it reads the hook's JSON, the final message, and the tail of the transcript back to
+// the person's last message, never more than READ_CAP bytes. Only an ask to type here costs a request (this folder's
+// open cards, as the next-message hook asks for them, given up after 1.5 seconds). It never loops (stop_hook_active),
 // stays quiet for anyone not signed in to this origin, and exits 0 silently on any error.
 import { open } from 'node:fs/promises';
+import { getJson } from "./api.js";
+import { asksToTypeHere, cardFits, confirmReason, sessionLink } from "./confirm.js";
 import { readCredential } from "./credentials.js";
+import { folderForms } from "./pickup.js";
 /** The most of the transcript it reads, from the end. A turn longer than this is let through. */
 export const READ_CAP = 4 * 1024 * 1024;
 const CHUNK = 64 * 1024;
@@ -14,6 +23,12 @@ const CHUNK = 64 * 1024;
 export const STOP_REASON = 'Items for your person are in chat but not in Pending You: post them as cards (ask in both places), or say they don’t need one.';
 /** Tools that put something in front of the person: Pending You's, under any MCP server name. */
 const POSTING_TOOL = /^mcp__.+__(post_request|update_request|reply_in_thread)$/;
+/** How long it waits for this folder's open cards, inside the hook's 3-second deadline (main.ts). */
+const OPEN_TIME_BOX_MS = 1500;
+/** As many of them as Pending You lists. */
+const OPEN_CARDS = 5;
+/** The most of one posting call's words it keeps, to match an ask against. */
+const CARD_TEXT = 20_000;
 /**
  * Text that says the items are already in Pending You, or will be: "you'll get a card to publish it once it's merged"
  * announces a card to come, not a step left in chat.
@@ -87,6 +102,27 @@ export function itemsForPerson(text) {
 export const saysPosted = (text) => SAYS_POSTED.test(plainText(text));
 /** Whether the text says nothing in it needs a card. */
 export const saysNoCard = (text) => SAYS_NO_CARD.test(plainText(text));
+/** Every string a tool call carried (a card's title, summary, steps and their commands…), up to `max` characters. */
+function wordsIn(value, max = CARD_TEXT) {
+    const found = [];
+    let left = max;
+    const walk = (item, depth) => {
+        if (left <= 0 || depth > 8)
+            return;
+        if (typeof item === 'string') {
+            found.push(item.slice(0, left));
+            left -= item.length;
+        }
+        else if (Array.isArray(item))
+            for (const each of item)
+                walk(each, depth + 1);
+        else if (item && typeof item === 'object')
+            for (const each of Object.values(item))
+                walk(each, depth + 1);
+    };
+    walk(value, 0);
+    return found.join('\n');
+}
 /** A message from the person (not a tool's result): where a turn starts. */
 function startsTurn(entry) {
     if (entry.type !== 'user' || entry.isMeta || entry.message?.role !== 'user')
@@ -110,6 +146,7 @@ export async function lastTurn(path, cap = READ_CAP) {
         const texts = [];
         let finalDone = false;
         let posted = false;
+        const cards = [];
         const take = (raw) => {
             if (!raw.trim())
                 return false;
@@ -131,8 +168,13 @@ export async function lastTurn(path, cap = READ_CAP) {
                 if (block?.type === 'tool_use') {
                     finalDone = true;
                     const name = typeof block.name === 'string' ? block.name : '';
-                    const command = typeof block.input?.command === 'string' ? block.input.command : '';
-                    if (POSTING_TOOL.test(name) || /\bpendingyou\b.*\bhold\s+req_/.test(command))
+                    const input = (block.input ?? {});
+                    const command = typeof input.command === 'string' ? input.command : '';
+                    if (POSTING_TOOL.test(name)) {
+                        posted = true;
+                        cards.push(wordsIn(block.input));
+                    }
+                    else if (/\bpendingyou\b.*\bhold\s+req_/.test(command))
                         posted = true;
                 }
                 else if (block?.type === 'text' && !finalDone && typeof block.text === 'string')
@@ -150,20 +192,41 @@ export async function lastTurn(path, cap = READ_CAP) {
             let newline = buffer.lastIndexOf(10);
             while (newline !== -1) {
                 if (take(buffer.subarray(newline + 1).toString('utf8')))
-                    return { text: texts.join('\n'), posted, complete: true, bytesRead };
+                    return { text: texts.join('\n'), posted, cards, complete: true, bytesRead };
                 buffer = buffer.subarray(0, newline);
                 newline = buffer.lastIndexOf(10);
             }
             carry = buffer;
         }
         if (position === 0 && take(carry.toString('utf8')))
-            return { text: texts.join('\n'), posted, complete: true, bytesRead };
-        return { text: texts.join('\n'), posted, complete: position === 0, bytesRead };
+            return { text: texts.join('\n'), posted, cards, complete: true, bytesRead };
+        return { text: texts.join('\n'), posted, cards, complete: position === 0, bytesRead };
     }
     finally {
         await file.close();
     }
 }
+/**
+ * The titles of this folder's cards still waiting on the person (what the next-message hook names), or null when that
+ * can't be told: an error, a slow answer, a server too old to list them.
+ */
+async function openTitles(io, origin, cwd) {
+    try {
+        const query = new URLSearchParams([
+            ...folderForms(cwd, io.home).map((form) => ['cwd', form]),
+            ['limit', '0'],
+            ['open', String(OPEN_CARDS)],
+        ]);
+        const { status, body } = await getJson(io, origin, `/mcp/cli/answers?${query}`, OPEN_TIME_BOX_MS, io.signal, { hook: true });
+        const requests = status === 200 ? body.open?.requests : undefined;
+        if (!Array.isArray(requests))
+            return null;
+        return requests.flatMap((card) => typeof card?.title === 'string' ? [card.title] : []);
+    }
+    catch {
+        return null;
+    }
+}
 export async function stopcheck(io, options) {
     try {
         const input = JSON.parse(await io.readStdin(1000));
@@ -180,7 +243,23 @@ export async function stopcheck(io, options) {
         const text = typeof input.last_assistant_message === 'string' && input.last_assistant_message.trim()
             ? input.last_assistant_message
             : turn.text;
-        if (turn.posted || !text || saysPosted(text) || saysNoCard(text) || !itemsForPerson(text))
+        if (!text)
+            return 0;
+        // Words they must type here (guide 2.21): a card has to say so, one from this turn or one still open.
+        const ask = asksToTypeHere(text);
+        if (ask) {
+            if (saysNoCard(text) || turn.cards.some((card) => cardFits(card, ask.words, 'posted')))
+                return 0;
+            const cwd = typeof input.cwd === 'string' && input.cwd ? input.cwd : io.cwd;
+            const open = await openTitles(io, options.origin, cwd);
+            // Not known (offline, slow, an older server): take the message's word that it's on a card.
+            if (open ? open.some((title) => cardFits(title, ask.words, 'open')) : saysPosted(text))
+                return 0;
+            const reason = confirmReason(ask.words, sessionLink(io.env));
+            io.out(`${JSON.stringify({ decision: 'block', reason })}\n`);
+            return 0;
+        }
+        if (turn.posted || saysPosted(text) || saysNoCard(text) || !itemsForPerson(text))
             return 0;
         io.out(`${JSON.stringify({ decision: 'block', reason: STOP_REASON })}\n`);
         return 0;

package/dist/version.js

@@ -1,2 +1,2 @@
 // The command line's version, as published (package.json). A test keeps them the same.
-export const VERSION = '0.8.0';
+export const VERSION = '0.9.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pendingyou",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Pending You for Claude Code: hear your answers from Pending You in the background, and set Claude Code up in one command.",
   "license": "Apache-2.0",
   "homepage": "https://www.pendingyou.com",
@@ -18,11 +18,17 @@
     "node": ">=20"
   },
   "exports": {
-    ".": "./dist/index.js"
+    ".": "./src/index.ts"
+  },
+  "publishConfig": {
+    "exports": {
+      ".": "./dist/index.js"
+    }
   },
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json && chmod +x dist/cli.js",
+    "prepublishOnly": "pnpm run build && pnpm run test",
     "test": "vitest run",
     "typecheck": "tsc -p tsconfig.json"
   }
-}
+}